Database Info

Boot from SD Card

On page 67 of the Service Manual, it mentions "Turn the device power off and insert Diagnostic SD card. Press and hold Capture button, then press Power button to enter Diagnostic mode."
I'm thinking that the camera + power button will make the G1 boot off the SD Card.. this may be a way to run a hacked rev 30 on a locked rev 30 phone...
I will try some stuff tonight...
-Nikropht

that does seem interesting... im going to try to flash JF's img after in finishes downloading... i'll post results... along with my attempt to flash a signed rc29 update... cross your fingers i dont brick the damned phone

The Artemis device had this so-called "Diagnostic SD" mentioned. Im asuming therefore we could dossibly create one and flash our device with whatever firmware, akin to the "Pandora Battery" for PSP.
Worth exploring, but difficult to pull of without bricking... If it is possibly to flash a signed RC30 at any point using the current SD method, then at least we know we cannot brick the phone

the SPL bootloader (engineering and original) look for NBH files on the SD card.
DREADIAG.nbh
and
DREAIMG.nbh
As you can see, their purpose is clear. One is for booting diagnostics and the other is for flashing the firmware.

^^^so are you saying flashing DREAIMG.nbh is possible with this method?

damien667 said:
the SPL bootloader (engineering and original) look for NBH files on the SD card.
DREADIAG.nbh
and
DREAIMG.nbh
As you can see, their purpose is clear. One is for booting diagnostics and the other is for flashing the firmware.
Click to expand...
Click to collapse
So could we create a dreadiag.nbh from RC29?

Yes indeedy. However, we don't know the format of said nbh files. We're working on it still.

richbayliss said:
The Artemis device had this so-called "Diagnostic SD" mentioned. Im asuming therefore we could dossibly create one and flash our device with whatever firmware, akin to the "Pandora Battery" for PSP.
Worth exploring, but difficult to pull of without bricking... If it is possibly to flash a signed RC30 at any point using the current SD method, then at least we know we cannot brick the phone
Click to expand...
Click to collapse
its possible to flash update.zip so we won't brick the phone... the issue is that each update checks for something on the one previously installed... like mentioned in one of my other posts its a endless loop... we can change whatit looks for but then loose the signature...

Can we not use the info here
http://wiki.xda-developers.com/index.php?pagename=Hermes_NBH
To go the other way!?

richbayliss said:
Can we not use the info here
http://wiki.xda-developers.com/index.php?pagename=Hermes_NBH
To go the other way!?
Click to expand...
Click to collapse
ok... HAs anyone tried to extract DREAIMG.NBH just to see how its formated or structured??? If so we could compare it to the data listed for the hermes nbh format just to compare differences(if any) to see how closely they match... just a thought

If I could get a copy of the file I would give it a whirl... but cannot find it anywhere.

Guys,
NBH files are a proprietary format. They are like the update.zip, but different. We don't know how, as this is embedded into the SPL code that is all in binary format at the time (it's not been disassembled). No one except HTC and/or T-Mo will have these original files anyway. This means we're going to have to build one from scratch with reverse engineering of the spl (at least that's what it looks like as of now). That being said, there is no NBH file that is "found" on any file system of the G1. The NBH file contains files within itself that are flashed onto the NAND flash of the phone, like update.zip. The difference is that NBH files are not signed (that we know of yet), and the format in which they have to be assembled.

richbayliss said:
If I could get a copy of the file I would give it a whirl... but cannot find it anywhere.
Click to expand...
Click to collapse
I cant find it either.... its out there though... too many people have posted their experiments with it... if any has it or know where it is is located please post... thank...

DREAIMG.nbh is nowhere. People are just creating empty files with that filename to see what the bootloader will do.

damien667 said:
DREAIMG.nbh is nowhere. People are just creating empty files with that filename to see what the bootloader will do.
Click to expand...
Click to collapse
Yup. Well to be correct there are probably true DREAIMG.NBH files somewhere out there (at a htc repair center most likely), but they have not yet made their way into the hands of the hacking community.

True.
I would rick messing if there was an update.zip of the OTA RC30 as is now. So I could rescue myself.
Looking at the WinMo phones, they have NBH for a few devices, and it is common for all of them to put the OS partition at header 0x0400, even on the latest Diamond device. So I would risk trying a file with this IF I knew I wouldnt be bricking for life.

richbayliss said:
True.
I would rick messing if there was an update.zip of the OTA RC30 as is now. So I could rescue myself.
Looking at the WinMo phones, they have NBH for a few devices, and it is common for all of them to put the OS partition at header 0x0400, even on the latest Diamond device. So I would risk trying a file with this IF I knew I wouldnt be bricking for life.
Click to expand...
Click to collapse
there is an official rc30 update.zip out... however it does not seem to alter the os... i re-flahed my rc30 with it and i didnt have to re log into google and nothing was missing... all of my text messages were even intact

When you flash with update.zip, it does not affect the data partition (where all your settings and installed apps are located). It only changes radio, system, and boot partitions.

formar of DREAIMG.nbh:
0x200 bytes header,
then N images one by one(radio, hboot, recovery, boot, splash, sysfs, userfs)
header:
000: 48 00 00 00 54 00 00 00 43 00 00 00 49 00 00 00 │H...T...C...I...
010: 4D 00 00 00 41 00 00 00 47 00 00 00 45 00 00 00 │M...A...G...E...
020: 44 52 45 41 31 30 30 30 30 00 00 00 00 00 00 00 │DREA10000.......
030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 │................
seems like simple "magic"
+0x40: 32 DD's - IMHO type descriptor's (type of each image, 00 if not used)
+0xC0: 32 DD's - offset of images
+0x140: 32 DD's - size of each image
+0x1C0: version?
1C0: 31 31 31 31 31 31 31 31 00 00 00 00 00 00 00 00 │11111111........
1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 │................
1E0: 30 2E 30 35 2E 30 2E 30 00 00 00 00 00 00 00 00 │0.05.0.0........
1F0: 47 65 6E 65 72 69 63 00 00 00 00 00 00 00 00 00 │Generic.........

Booting from the SD card is probably how you enter the manufacturers test mode RE: FACTORY_TEST Run as a manufacturer test application, running as the root user. "android.permission.FACTORY_TEST"
http://code.google.com/android/reference/android/Manifest.permission.html

[Q] Stuck on TWRP

I recently installed TWRP 2.5. I had backed up my system with it and everything was working fine. I recently went back to restore and it said I was successful. When I rebooted the tablet the TWRP comes up. now every time I reboot is the same. TWRP 2.5 starts. No matter what rom I try to install it reboots to the recovery.

Did you try usong the bootloader?
Sent from my GT-I9300 using xda app-developers app

danielbr14 said:
Did you try usong the bootloader?
Sent from my GT-I9300 using xda app-developers app
Click to expand...
Click to collapse
No, I'm not familiar with that program. I am kinda at a disadvantage because the tablet only boots to the TWRP recovery . Not allowing me to use a usb connection. The only thing I can do is remove the external sd card and copy files to it. Use the TWRP recovery to try to install, but then the tablet just boots back to the recovery.

The bootloader is like the bios of your computer it is what you need to unlock to install custom roms . you need to hold down the power button and when the tablet vibrates press the volume down than press the volume down button to navigate . choose the android logo and press the volume up button. Tell me if that helps.
Btw i didnt got notified when you replied me so it took me some time sorry
Sent from my GT-I9300 using xda app-developers app

danielbr14 said:
The bootloader is like the bios of your computer it is what you need to unlock to install custom roms . you need to hold down the power button and when the tablet vibrates press the volume down than press the volume down button to navigate . choose the android logo and press the volume up button. Tell me if that helps.
Btw i didnt got notified when you replied me so it took me some time sorry
Sent from my GT-I9300 using xda app-developers app
Click to expand...
Click to collapse
No, the bootloader is not working. Tried power / volume down / etc. but only the TWRP comes up.

Did you do a clean install.. It's sounds like your stuck on a bootloop???
X10a-Freedom

zorprime01 said:
Did you do a clean install.. It's sounds like your stuck on a bootloop???
X10a-Freedom
Click to expand...
Click to collapse
Don't think I know how to do that. I have tried installing different roms, and the recovery says successful, but when rebooting the tablet, The TWRP recovery comes up again.

A full install is when you drlete the dalcik and cache and the preform the installition if that doesnt help try to do a full internal storge wipe and then install the rom .
But dont forget to move all of your importent data to your sd card so you wont loose it
Sent from my GT-I9300 using xda app-developers app

danielbr14 said:
A full install is when you drlete the dalcik and cache and the preform the installition if that doesnt help try to do a full internal storge wipe and then install the rom .
But dont forget to move all of your importent data to your sd card so you wont loose it
Sent from my GT-I9300 using xda app-developers app
Click to expand...
Click to collapse
I always delete the caches. I have done the full storage wipe through the TWRP. then tried to instal roms, including the latest op system from asus.
Getting the same results as above. Even tried to re-install The TWRP recovery again.

Try getting adb shell access to your recovery (on Windows, you may need to install some drivers first).

_that said:
Try getting adb shell access to your recovery (on Windows, you may need to install some drivers first).
Click to expand...
Click to collapse
Not quite sure of that procedure, could you provide a good link on how to do it? Don't you need to plug the tablet into your computer and be recognized? I have the drivers for the tablet installed but because I can only boot into the TWRP recovery, My computer wont recognize it.

cnh56 said:
Not quite sure of that procedure, could you provide a good link on how to do it? Don't you need to plug the tablet into your computer and be recognized? I have the drivers for the tablet installed but because I can only boot into the TWRP recovery, My computer wont recognize it.
Click to expand...
Click to collapse
With the correct drivers, the computer should recognize the recovery's adb interface and you should be able to use "adb shell" to get a command prompt from your recovery. I can't help you with the drivers, but apparently this one should work: http://forum.xda-developers.com/showpost.php?p=41458912&postcount=2472 . You will also need to get adb binaries for your PC from somewhere.
Alternative: Try using the internal command terminal in TWRP - it's not very powerful but maybe it is enough and then you don't need to mess with the computer or drivers at all. Run the following command:
Code:
ls -l /dev/block/mmc*
and tell me if you see mmcblk0, mmcblk0p1, mmcblk0p2, mmcblk0p3, etc. up to mmcblk0p8 (and some more).

_that said:
With the correct drivers, the computer should recognize the recovery's adb interface and you should be able to use "adb shell" to get a command prompt from your recovery. I can't help you with the drivers, but apparently this one should work: http://forum.xda-developers.com/showpost.php?p=41458912&postcount=2472 . You will also need to get adb binaries for your PC from somewhere.
Alternative: Try using the internal command terminal in TWRP - it's not very powerful but maybe it is enough and then you don't need to mess with the computer or drivers at all. Run the following command:
Code:
ls -l /dev/block/mmc*
and tell me if you see mmcblk0, mmcblk0p1, mmcblk0p2, mmcblk0p3, etc. up to mmcblk0p8 (and some more).
Click to expand...
Click to collapse
Yes, I ran that internal command in TWRP and got these
/dev/block/mmcblk0
/dev/block/mmcblk0boot0
/dev/block/mmcblk0boot1,
/dev/block/mmcblk0p1
/dev/block/mmcblk0p10
/dev/block/mmcblk0p2
/dev/block/mmcblk0p3
/dev/block/mmcblk0p4
/dev/block/mmcblk0p5
/dev/block/mmcblk0p6
/dev/block/mmcblk0p7
/dev/block/mmcblk0p8
/dev/block/mmcblk0p9
/dev/block/mmcblk1
/dev/block/mmcblk1p1
What does that mean?

cnh56 said:
What does that mean?
Click to expand...
Click to collapse
That means your recovery can still see all the partitions of the internal storage, which is good, so we can proceed with the next command:
Code:
hexdump -C -n 512 /dev/block/mmcblk0p3
Ignore the hexadecimal numbers and read the text in the right column, if any. Does it look like this?
Code:
00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000200
or like this:
Code:
00000000 62 6f 6f 74 2d 72 65 63 6f 76 65 72 79 00 00 00 |boot-recovery...|
00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000040 72 65 63 6f 76 65 72 79 0a 2d 2d 77 69 70 65 5f |recovery.--wipe_|
00000050 64 61 74 61 0a 00 00 00 00 00 00 00 00 00 00 00 |data............|
00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000200
or differently?

_that said:
That means your recovery can still see all the partitions of the internal storage, which is good, so we can proceed with the next command:
Code:
hexdump -C -n 512 /dev/block/mmcblk0p3
Ignore the hexadecimal numbers and read the text in the right column, if any. Does it look like this?
Code:
00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000200
or like this:
Code:
00000000 62 6f 6f 74 2d 72 65 63 6f 76 65 72 79 00 00 00 |boot-recovery...|
00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000040 72 65 63 6f 76 65 72 79 0a 2d 2d 77 69 70 65 5f |recovery.--wipe_|
00000050 64 61 74 61 0a 00 00 00 00 00 00 00 00 00 00 00 |data............|
00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000200
or differently?
Click to expand...
Click to collapse
It looks like the first set of codes

cnh56 said:
It looks like the first set of codes
Click to expand...
Click to collapse
OK, no forced reboot to recovery, so your ROM is unhappy with something.
Which ROM did you try to install last?

_that said:
OK, no forced reboot to recovery, so your ROM is unhappy with something.
Which ROM did you try to install last?
Click to expand...
Click to collapse
Stock rom from asus. "US_epad-user-10.6.1.14.8.zip" I renamed it "Asus Update" Loded it into my ext.card and used TWRP to install it. After a while it says it was successful. I wiped the cache's and rebooted. Same ole...TWRP came up again.

cnh56 said:
Stock rom from asus. "US_epad-user-10.6.1.14.8.zip" I renamed it "Asus Update" Loded it into my ext.card and used TWRP to install it. After a while it says it was successful. I wiped the cache's and rebooted. Same ole...TWRP came up again.
Click to expand...
Click to collapse
If you don't have any important data on your device, try formatting the data partition. This will wipe all of your internal storage - apps, app data and /sdcard.

_that said:
If you don't have any important data on your device, try formatting the data partition. This will wipe all of your internal storage - apps, app data and /sdcard.
Click to expand...
Click to collapse
I did as instructed. Same result... Back to TWRP. Dammit!!! :crying:

When you reboot your device, do you see the boot animation before TWRP starts? Or does it go directly from the white ASUS logo to the blue curtains of TWRP?

TUTORIAL: Remove *TAMPERED* & *RELOCKED* flag / HBoot w/o unlock_code.bin

FOR ALL K2 VARIANTS (K2_CL, K2_UL, K2_U, K2_PLC_CL)​
Advantages
- No more hassle with htcdev, tokens, or unlock codes
- No more submitting your phones personal info to htc
- The ability to get back to 100% stock without any visual traces or records of having been S-Off or unlocking your bootloader.
PLEASE PAY CLOSE ATTENTION TO THIS TUTORIAL AS I WILL SHOW YOU HOW TO CHANGE THE FLAG FOR LOCK, RELOCK, UNLOCK, AND TAMPERED!!
I INSIST THAT YOU READ ALL OF THIS BEFORE YOU TAKE FURTHER ACTION - IF YOU FAIL TO FOLLOW INSTRUCTIONS THE ONLY ONE TO BLAME IS YOURSELF. AFTER YOU HAVE READ THIS TUTORIAL AND COME TO UNDERSTAND THIS PROCEDURE THEN BY ALL MEANS GO AHEAD AND CARRY OUT THE NECESSARY STEPS TO ACCOMPLISH WHATEVER GOALS YOU MAY CURRENTLY HAVE AT THIS TIME.​
- This tutorial may be easier on the eyes if viewed by the actual web browser vice an app or phone device.
Many thanks to @old.splatterhand for being generous and providing me some files which allowed me to confirm this tutorial for all K2 variants.
Confirmed Working - Credits
Myself - K2_CL
@russellvone - K2_CL
Lordvincent 90 - K2_CL
@DrBassman - K2_CL
REQUIREMENTS FOR THIS TUTORIAL FOR THE PURPOSE OF LEARNING AND APPLYING IT
- This tutorial will be based on an already UNLOCKED Bootloader with TAMPERED flag
- Must be S-OFF
- Must be rooted
- Proper ADB and Fastboot files
- Hex editor (HxD)
- Knowledge of Hex and DD (aka - Data Destroyer)
If you do not know what DD is then please read the following which I extracted from WIKI for the simplicity of this tutorial - Otherwise, skip this and move along.
dd is a command on Unix and Unix-like operating systems whose primary purpose is to convert and copy a file.
On Unix, device drivers for hardware (such as hard disks) and special device files (such as /dev/zero and /dev/random) appear in the file system just like normal files; dd can also read and/or write from/to these files, provided that function is implemented in their respective driver. As a result, dd can be used for tasks such as backing up the boot sector of a hard drive, and obtaining fixed amount of random data. The dd program can also perform conversions on the data as it is copied, including byte order swapping and conversion to and from the ASCII and EBCDIC text encodings.
The name dd may be an allusion to the DD statement found in IBM's Job Control Language (JCL), where the initialism stands for "Data Description." The command's syntax resembles the JCL statement more than it does other Unix commands, so the syntax may have been a joke. Another explanation for the command's name is that "cc" (for "convert and copy", as in the command's description) was already taken by the C compiler.
The dd command is specified by IEEE Std 1003.1-2008, which is part of the Single UNIX Specification.
The command line syntax of dd differs from many other Unix programs, in that it uses the syntax option=value for its command line options, rather than the more-standard --option value or -option=value formats. By default, dd reads from STDIN and writes to STDOUT, but these can be changed by using the if (input file) and of (output file) options.
Usage varies across different operating systems. Also, certain features of dd will depend on the computer system capabilities, such as dd's ability to implement an option for direct memory access. Sending a SIGINFO signal (or a USR1 signal on Linux) to a running dd process makes it print I/O statistics to standard error once and then continue copying (note that signals may terminate the process on OS*X). dd can read standard input from the keyboard. When end-of-file (EOF) is reached, dd will exit. Signals and EOF are determined by the software. For example, Unix tools ported to Windows vary as to the EOF: Cygwin uses (the usual Unix EOF) and MKS Toolkit uses (the usual Windows EOF).
In spirit with the Unix philosophy, dd does one thing (and may be considered to do it "well" ). Unlike a sophisticated and highly abstracted utility, dd has no algorithm other than in the low-level decisions of the user concerning how to vary the run options. Often, the options are changed for each run of dd in a multi-step process to solve a computer problem.
The GNU variant of dd as supplied with coreutils on Linux does not describe the format of the messages displayed on standard output on completion. However, these are described by other implementations, e.g. that with BSD.
Each of the "Records in" and "Records out" lines shows the number of complete blocks transferred + the number of partial blocks, e.g. because the physical medium ended before a complete block was read, or a physical error prevented reading the complete block.
A block is a unit measuring the number of bytes that are read, written, or converted at one time. Command line options can specify a different block size for input/reading (ibs) compared to output/writing (obs), though the block size (bs) option will override both ibs and obs. The default value for both input and output block sizes is 512 bytes (the traditional block size of disks, and POSIX-mandated size of "a block"). The count option for copying is measured in blocks, as are both the skip count for reading and seek count for writing. Conversion operations are also affected by the "conversion block size" (cbs).
For some uses of the dd command, block size may have an effect on performance. For example, when recovering data from a hard disk, a small block size will generally cause the most bytes to be recovered. Issuing many small reads is an overhead and may be non-beneficial to execution performance. For greater speed during copy operations, a larger block size may be used. However, because the amount of bytes to copy is given by bs×count, it is impossible to copy a prime number of bytes in one go without going with one of two bad choices, bs=N count=1 (memory use) or bs=1 count=N (read request overhead). Alternative programs (see below) permit specifying bytes rather than blocks.
Click to expand...
Click to collapse
Let's get started shall we - the following commands highlighted in RED are your commands to execute:
- Go ahead and plug your device in to your PC with a USB cable.
- Open up CMD and change its directory to the location of your proper ADB and Fastboot files
- Establish a proper connection with your device. It should look something like this:
Code:
C:\Users\*******\Desktop\Android_tweak_software\HTC_fastboot_files>[COLOR="Red"][B]adb devices[/B][/COLOR]
List of devices attached
HT3********* device
C:\Users\*******\Desktop\Android_tweak_software\HTC_fastboot_files>
- If connection is established then direct to your devices' adb shell:
Code:
C:\Users\*******\Desktop\Android_tweak_software\HTC_fastboot_files>[COLOR="Red"][B]adb shell[/B][/COLOR]
[email protected]:/ #
- Go ahead and gain superuser rights to your devices' adb shell:
Code:
C:\Users\*******\Desktop\Android_tweak_software\HTC_fastboot_files>adb shell
[email protected]:/ # [COLOR="Red"][B]su[/B][/COLOR]
su
[email protected]:/ #
- Now we need to copy a partition (mmcblk0p7) to your sdcard using DD. Insure you do not make a typo:
Code:
C:\Users\*******\Desktop\Android_tweak_software\HTC_fastboot_files>adb shell
[email protected]:/ # su
su
[email protected]:/ # [COLOR="Red"][B]dd if=/dev/block/mmcblk0p7 of=/sdcard/mmcblk0p7.img[/B][/COLOR]
dd if=/dev/block/mmcblk0p7 of=/sdcard/mmcblk0p7.img
31155+0 records in
31155+0 records out
15951360 bytes transferred in 2.259 secs (7061248 bytes/sec)
[email protected]:/ #
- Now we need to pull this image (mmcblk0p7) to our pc:
Code:
C:\Users\*******\Desktop\Android_tweak_software\HTC_fastboot_files>adb shell
[email protected]:/ # su
su
[email protected]:/ # dd if=/dev/block/mmcblk0p7 of=/sdcard/mmcblk0p7.img
dd if=/dev/block/mmcblk0p7 of=/sdcard/mmcblk0p7.img
31155+0 records in
31155+0 records out
15951360 bytes transferred in 2.259 secs (7061248 bytes/sec)
[email protected]:/ # [COLOR="Red"][B]exit[/B][/COLOR]
exit
[email protected]:/ # [COLOR="Red"][B]exit[/B][/COLOR]
exit
C:\Users\*******\Desktop\Android_tweak_software\HTC_fastboot_files>[COLOR="Red"][B]adb pull /sdc
ard/mmcblk0p7.img[/B][/COLOR]
2523 KB/s (15951360 bytes in 6.172s)
C:\Users\*******\Desktop\Android_tweak_software\HTC_fastboot_files>
- Go ahead and repeat these steps for (mmcblk0p3).
- At this time go ahead and open up your hex editor (HxD) and at the top right change from hex in the drop down bar to dec - you will do this (if necessary) for all images pertaining to this tutorial.
- Drag\drop (mmcblk0p3.img) in to the hex editor (HxD).
- Now hit ctrl+F or go to the Search tab, then click on Find.
- Search for HTCU. You will see the following:
Code:
Offset(d) 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15
000033728 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000033744 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000033760 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000033776 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[COLOR="Red"][B]000033792[/B] 00 00 00 00 [B]48 54 43 55[/B] 01 00 00 00 00 00 00 00 ....[B]HTCU[/B]........[/COLOR]
000033808 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000033824 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000033840 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000033856 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
- Drag\drop (mmcblk0p7.img) in to the hex editor (HxD).
- Now hit ctrl+G or go to the Search tab, then click on Goto....
- Search for DEC OFFSET 4265984.
- You will see something like this:
Code:
Offset(d) 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15
04265920 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
04265936 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
04265952 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
04265968 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[COLOR="Red"][B]04265984[/B] [B]68 25 32 C6 02[/B] 00 00 00 00 00 00 00 00 00 00 00 [B]h%2Æ.[/B]...........[/COLOR]
04266000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
04266016 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
04266032 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
04266048 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
- Now that we have what we needed loaded and prepped we want to see what needs adjustment regarding lock, unlock, relock, and tampered.
- These two partitions are already stamped with the bootloader being unlocked as well as being tampered so finding what we are looking for makes it easy as seen above.
- mmcblk0p3 is the partition which determines if our device is locked, unlocked, or relocked.
- mmcblk0p7 is the partition which determines if our device is tampered with or not.
- Let's look at mmcblk0p3. We see in red, HTCU, which we already know means Unlocked, because as I mentioned in the beginning, this tutorial is based on an already unlocked bootloader and tampered device.
Code:
[COLOR="Red"][B]000033792[/B] 00 00 00 00 [B]48 54 43 55[/B] 01 00 00 00 00 00 00 00 ....[B]HTCU[/B]........[/COLOR]
- We want to lock or relock our device. To relock is, "HTCL". To Lock is, "00 00 00 00".
- Our goal is creating a dd command which will implement these changes for us to our partition already on our device.
- To lock:
Code:
echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p3 bs=1 seek=33796
- To relock:
Code:
echo -ne "HTCL" | dd of=/dev/block/mmcblk0p3 bs=1 seek=33796
- To unlock:
Code:
echo -ne "HTCU" | dd of=/dev/block/mmcblk0p3 bs=1 seek=33796
- The command for seek is what determines the decimal search of that partition when implementing the echo command from start to finish, from left to right as it writes it out. This is why earlier I told you to change it from hex to dec in your hex editor. If you look at seek=33796 and go back to your hex editor you will notice the dec offset says 33792 then underneath that it says 33808.
Code:
Offset(d) 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15
000033792 00 00 00 00 48 54 43 55 01 00 00 00 00 00 00 00 ....HTCU........
000033808 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
- To determine the exact decimal location where the dd command will start writing to you must first look at the top of your hex editor where it shows '00 01 02 03 04 05, etc'. You will take the offset for 33792 and look at where HTCU begins then scroll to the top which in this case it aligns to '04', so we add 04 to the offset of 33792 which gives us a total of 33796. This becomes our seek (our starting point).
- Now that we have established this concept with mmcblk0p3.img, lets go and take a look at mmcblk0p7.img.
- We already know our device has been tampered with. If you search for tamper or tampered you will find results and these results eventually bring you to where we already are as mentioned above and if following along then what you are currently looking at on your pc.
- This one is really simple. Either your device is tampered or it is not. In this case we notice '02' which signifies the setup for being tampered.
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00411800 68 25 32 C6 02 00 00 00 00 00 00 00 00 00 00 00 h%2Æ............
- Let's go ahead and change it to '00' with the following dd command:
Code:
echo -ne '\x00' | dd of=/dev/block/mmcblk0p7 bs=1 seek=4265988
- To restore back to tampered you will just replace 00 with 02.
(FOR K2_PLC_CL USERS, REPLACE 00 WITH 04, INSTEAD OF 02 - Credit goes to @DOrtego for notifying me of this)
- Now to show you how to execute these commands. I will only use one command for this example since it will be the same for all of them. The following in RED will be your commands to execute. A lot of these will be due to insuring you are set up prior to executing the dd command itself, so if you are already good to go then just seek for the dd command and follow along:
Code:
C:\Users\*******\Desktop\Android_tweak_software\HTC_fastboot_files>[COLOR="Red"][B]adb devices[/B][/COLOR]
List of devices attached
HT********** device
C:\Users\*******\Desktop\Android_tweak_software\HTC_fastboot_files>[COLOR="Red"][B]adb shell[/B][/COLOR]
[email protected]:/ # [COLOR="Red"][B]su[/B][/COLOR]
su
[email protected]:/ # [COLOR="Red"][B]echo -ne '\x00' | dd of=/dev/block/mmcblk0p7 bs=1 seek=4265988[/B][/COLOR]
ock/mmcblk0p7 bs=1 seek=4265988 <
1+0 records in
1+0 records out
1 bytes transferred in 0.012 secs (83 bytes/sec)
[email protected]:/ # [COLOR="Red"][B]exit[/B][/COLOR]
exit
[email protected]:/ # [COLOR="Red"][B]exit[/B][/COLOR]
exit
C:\Users\*******\Desktop\Android_tweak_software\HTC_fastboot_files>
I will also show you how to go back to S-ON, but you BETTER make sure you have your stock HBoot.img flashed, Stock Boot.img flashed, etc OR YOU WILL BRICK YOUR DEVICE INDEFINITELY!!!
YOU MUST FIRST BE IN FASTBOOT - THERE WILL BE NO USING ADB NOR A TERMINAL EMULATOR FOR THIS STEP
To go from radio S-OFF to radio S-ON enter the following :
Code:
[B]fastboot oem writesecureflag 3[/B]
To go from HBoot S-Off to HBoot S-On just flash a stock HBoot to remove the modified version.
Code:
[B]adb reboot bootloader[/B]
// booting in to bootloader
[B]fastboot devices[/B]
// establishing connection between device and PC
[B]fastboot oem rebootRUU[/B]
// booting in to RUU
[B]fastboot flash zip filename.zip[/B]
// .zip with stock HBoot image
[B]fastboot reboot-bootloader[/B]
// confirm mod S-Off HBoot now reads new S-On from stock HBoot
[B]fastboot reboot[/B]
// boot OS
So, there you have it everyone! Enjoy, and profit!
--- Happy Hunting!

Other users, what I did to confirm this was by pulling mmcblk0p3 and mmcblk0p7 for both versions and compared the results with a hex editor to determine these steps are valid for the K2_CL variant. Enjoy.
EDIT: Confirmed for ALL K2 variants
Sent from my C525c using XDA Premium 4 mobile app

And yes, I used my device as a guinea pig so of course it works
Sent from my C525c using XDA Premium 4 mobile app

Modding.MyMind said:
And yes, I used my device as a guinea pig so of course it works
Sent from my C525c using XDA Premium 4 mobile app
Click to expand...
Click to collapse
What if we wish to put *tampered* back?
Lol

Hmmm, I would have to look at that as I did not consider that as an option. However, having 'tampered' being displayed leaves traces so why would you want to lol.
Sent from my C525c using XDA Premium 4 mobile app

Complete joke, very well done sir.
Awesome find!

Yea, I knew it was ha! And thanks. Would like to see if this works for the other variants as well but I do not have what I need from them so either they will need to figure it out or become very brave with trying my steps lol.
Sent from my C525c using XDA Premium 4 mobile app

+sorry for the off topic+
but I decided to do a complete factory restore of my phone and accept an ota update to see if I could get to that clockworkmod like screen in stock recovery.
and it let me
first attempt it just installed the update without letting me into the clockworkmod like..........
so I simply deleted a system app accepted the next update, allowed to boot into recovery,
then once it got to the hated /!\ Red triangle, I just held volume+ then pressed power and it let me see the reason for the fail.
thought you would like to play with it

Awesome! Thanks.
Sent from my C525c using XDA Premium 4 mobile app

Maybe @old.splatterhand could look in to this with the K2_U and K2_UL variants .
And possibly add this finding to his index *cough**cough* haha
Sent from my C525c using XDA Premium 4 mobile app

Modding.MyMind said:
Awesome! Thanks.
Sent from my C525c using XDA Premium 4 mobile app
Click to expand...
Click to collapse
alrighty, just got into it again, used an app called quick boot and booted into recovery, again it would not let me in to CWM-like until it showed red triangle then had to hold volume+ then power, tried to apply a different zip (crossbreeder)
aborted,
I'm gonna do some playing myself!

I have added it to my Index, but i have to add much more, when its time.

@Modding.MyMind
confirmed working......
thanks again sir, very proud of your hard work!

Yea, will be uploading pictures soon enough so people can see it on my phone. Unfortunately, I won't be able to get a pic where it shows *tampered* because I already removed it lol (but hey, if it isn't there that is evidence in itself). But I can atleast provide pics where it shows locked (not relocked) and unlocked with S-Off.
I got other projects I am looking into as well. Hopefully, they too will be just as satisfying as this.
Sent from my C525c using XDA Premium 4 mobile app

Modding.MyMind said:
I got other projects I am looking into as well. Hopefully, they too will be just as satisfying as this.
Sent from my C525c using XDA Premium 4 mobile app
Click to expand...
Click to collapse
Just helped a fellow with the handle
Lordvincent 90
over on AndroidForums
sent him this way so he could use your find so he could his phone in for hardware repair.......
with out any traces of s-off!!!!
#already_awesome
oh yeah.... I'm on edge waiting for more!
very impressed with what you've brought so early in the game.
I'm rooting for ya \ /*_*\ /

russellvone said:
Just helped a fellow with the handle
Lordvincent 90
over on AndroidForums
sent him this way so he could use your find so he could his phone in for hardware repair.......
with out any traces of s-off!!!!
#already_awesome
oh yeah.... I'm on edge waiting for more!
very impressed with what you've brought so early in the game.
I'm rooting for ya \ /*_*\ /
Click to expand...
Click to collapse
I have added him to the OP under credits
Glad this served him well and soon others when it calls for it
Sent from my C525c using XDA Premium 4 mobile app

Reserved....
Sent from my C525c using XDA Premium 4 mobile app

russellvone said:
very impressed with what you've brought so early in the game.
Click to expand...
Click to collapse
Newbie on XDA forums, but as for androids... Especially K2_CL... Pretty much got the experience needed to get by and to grow. I focus most on mods, hence my name. Something about modding gets me pumped haha.
That's my Bio and I'm sticking to it.
Sent from my C525c using XDA Premium 4 mobile app

Modding.MyMind said:
Newbie on XDA forums, but as for androids... Especially K2_CL... Pretty much got the experience needed to get by and to grow. I focus most on mods, hence my name. Something about modding gets me pumped haha.
That's my Bio and I'm sticking to it.
Sent from my C525c using XDA Premium 4 mobile app
Click to expand...
Click to collapse
THAT'S WHAT I'M SCREAMING!
:beer: «--one for you
:beer: «--one for me
cheers!
#EDIT#
for some reason my beers look like smiley faces on tapatalk?¿

Pictures uploaded in OP. Take additional note that in both pictures you do not see *tampered* nor do you see *relocked*. Enjoy.
Sent from my C525c using XDA Premium 4 mobile app

[NB1-Collision] [Alternate method] How to unlock the bootloader of Nokia 5 and 6

Like the alternate Nokia 8.1 Bootloader Unlock method before, here's what you need:
- TWRP accessibility with proper bootloader downgrading. You must use Chinese 7to TWRP I posted last year (In Nokia 6 Root Guide) to achieve this (either 3.1.1 or 3.2.1 are OK), so downgrading the bootloader back to Nougat is necessary.
If your phone still stay at Android 7 or 8, great, you're welcome to NB1-Collision method.
As I've introduced in Nokia 8.1 forum:
Since it uses the unlock key from Nokia 8 and I tricked the phone as Nokia 8, I called the unlock method "NB1-Collision".
Click to expand...
Click to collapse
The identification to verify if the unlock key valid is located at deviceinfo partition, and here are the offsets:
SN: 0x00000010
IMEI1: 0x00002010
Still, editing the IMEI1 here will not change the actual IMEI stored at NVRAM, so you can't use this to do anything illegal.
If you know the point, you can unlock your phone without reading this guide. In case you don't, let me tell you how.
Part 0: Obtain an official unlock key for Nokia 8, and you must know it's IMEI1 and SN
Same as before, I will not provide mine, please do it yourself.
Part 1: Boot to TWRP
Skip this part if you can boot to TWRP already. Just boot to TWRP and do Part 2.
To make sure the phone will definitely boot to TWRP with proper signature, you can flash TWRP to boot partition directly:
Code:
fastboot oem dm-verity (md5)
fastboot flash aboot /path/to/D1C-0-331A-emmc_appsboot_service.mbn
fastboot reboot-bootloader
fastboot oem dm-verity (md5)
fastboot flash boot /path/to/7to-twrp.img
The extraction password of the service bootloader zip is "WLBGFIH123", in case you want to know.
Then reboot to the TWRP:
Code:
fastboot reboot
OK, now you've entered the TWRP.
Part 2: Dump the deviceinfo partition and hack it
If you're familiar with adb commands, here's how:
Code:
adb shell dd if=/dev/block/bootdevice/by-name/deviceinfo of=/tmp/deviceinfo.img
adb pull /tmp/deviceinfo.img
The rest of the procedure are straight forward. Use a Hex Editor to edit the deviceinfo partition:
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 46 49 48 45 32 50 5F 42 00 00 00 00 01 00 00 00 FIHE2P_B........
00000010 4E 42 31 47 41 44 32 37 38 30 30 31 32 33 34 35 NB1GAD2780012345
00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00002000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002010 31 32 33 34 35 36 37 38 39 30 31 32 33 34 37 00 123456789012347.
00002020 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 00 xxxxxxxxxxxxxxx.
And save it as deviceinfo_mod.img.
Push it back to your phone, along with new version of emmc_appsboot, either service or retail are OK - you can extract it from recent OTA packages.
Code:
adb push /path/to/deviceinfo_mod.img /tmp/d1
adb push /path/to/D1C-0-562H-emmc_appsboot.mbn /tmp/d2
adb shell dd if=/tmp/d1 of=/dev/block/bootdevice/by-name/deviceinfo
adb shell dd if=/tmp/d2 of=/dev/block/bootdevice/by-name/aboot
adb reboot bootloader
Part 3: Unlock the bootloader
Code:
fastboot flash unlock /path/to/unlock.key
fastboot flashing unlock_critical
Your phone will reboot immediately. Don't stop right here, execute following command straight forward:
Code:
fastboot oem alive
When fastboot responsed OKAY, please proceed:
Code:
fastboot flash unlock /path/to/unlock.key
fastboot oem unlock-go
All done. Your phone has unlocked bootloader.
Part 4: Restore original deviceinfo and reinstall stock firmware with OST LA
Code:
fastboot flash deviceinfo /path/to/deviceinfo.img
I needn't to mention how to flash stock firmware with OST LA or NOST.
FYC, firmware can be downloaded from https://fih-firmware.hikaricalyx.com/hmd_en.html#d1c .
Good luck then!
Specially thanks to HMD Global for releasing official Nokia 8 bootloader unlock, otherwise it would be impossible.

I was think about this method before you release. But noone provide me the unlock.key, so I cancel to research this method. But thank for your effort

Elvaa said:
I was think about this method before you release. But noone provide me the unlock.key, so I cancel to research this method. But thank for your effort
Click to expand...
Click to collapse
You can ask for an existing unlock key requested, before the_laser got banned here as alternate method.
But you also need to know it's IMEI1 and SN.
So, you can't flash new emmc_appsboot after you hacked deviceinfo partition.

You can upload the file: deviceinfo.img edited to NB1 and we just need to save the stock deviceinfo.img of the device. And flash directly your deviceinfo.img.
That would be faster

App Unlockbootloader.apk :
Messages Error: Device not support.
???

taicracker said:
You can upload the file: deviceinfo.img edited to NB1 and we just need to save the stock deviceinfo.img of the device. And flash directly your deviceinfo.img.
That would be faster
Click to expand...
Click to collapse
You can't simply do this. As I mentioned before, deviceinfo partition contains unique and critical credentials for your phone, and it will not accept the credentials from other devices.
Also, deviceinfo partition contains your IMEI, and disclose IMEI here is strictly forbidden.

The Unlock.key
Can you Explain me Little About The Unlock Key Please

Việt nam
Until now, it is possible to root nokia 6 ta 1021 android 8.1.0
hikari_calyx said:
You can't simply do this. As I mentioned before, deviceinfo partition contains unique and critical credentials for your phone, and it will not accept the credentials from other devices.
Also, deviceinfo partition contains your IMEI, and disclose IMEI here is strictly forbidden.
Click to expand...
Click to collapse

[GUIDE] How to install Android 10 internal update for Nokia 5.1 Plus

WARNING: This package is never meant for non-experienced members!
Chinese translation of this guide is on the way. (本教程的中文版仍在编写中)
Code:
#include <std_disclaimer.h>
/*
* Your warranty is now void. *
* I am not responsible for bricked devices, dead SD cards,
* thermonuclear war, or you getting fired because the alarm app failed.
Please do some research if you have any concerns about features included in this ROM before flashing it! YOU are choosing to make these modifications, and if you point the finger at me for messing up your device, I will laugh at you.
*/
We changed the flashing procedure this time, so it will:
- Prevent noobs without any experiences
- Avoid installing many dumb security updates
Target: PDA-311A-0-00WW-B02
Now it's available for public.
Please download and install this to your phone via ADB sideload of 874 command: https://android.googleapis.com/pack.../ace851ea59294177f677018648d6c0614317510e.zip
To Chinese Nokia X5 owners: Please convert your phone to Global Nokia 5.1 Plus before flashing, and don't forget to change SKUID to 600WW.
What's the requirement for flashing?
- Nokia 5.1 Plus X5 with Global Android one firmware installed (any version)
- Rooted phone (either MTK-SU or regular root method are OK)
Or:
- The Bootloader is Unlocked
Here's how (if rooted):
Due to the spelling error of the script, the correct one is attached below.
Please replace it to the one inside package, if you want to use "Click_Me_To_Flash.cmd"..
Click to expand...
Click to collapse
- Download the package and extract it. You'll get 17 img files, and 6 other files.
- Create one directory called "pda-3110" on your phone's internal storage. THIS IS CASE SENSITIVE, so don't use uppercase "PDA".
- Copy all the img files to the pda-3110 directory.
- Execute this under command prompt:
Code:
adb shell
- Check what's your current slot:
Code:
getprop ro.boot.slot_suffix
Take a note whether the slot is "_a" or "_b".
- Grant root permission:
Code:
su
If necessary, grant root permission on the phone. If grant successful, you'll see the dollar ($) symbol will become into hash (#) symbol.
If your phone is rooted with MTK-SU, you must do this:
- Open Magisk Manager and install Magisk on another slot.
After installation complete, stay at installation complete screen and don't reboot.
- Now execute following commands.
If current slot is "_a", then execute these:
Code:
dd if=/storage/emulated/0/pda-3110/boot.img of=/dev/block/bootdevice/by-name/boot_b
dd if=/storage/emulated/0/pda-3110/cam_vpu1.img of=/dev/block/bootdevice/by-name/cam_vpu1_b
dd if=/storage/emulated/0/pda-3110/cam_vpu2.img of=/dev/block/bootdevice/by-name/cam_vpu2_b
dd if=/storage/emulated/0/pda-3110/cam_vpu3.img of=/dev/block/bootdevice/by-name/cam_vpu3_b
dd if=/storage/emulated/0/pda-3110/cda.img of=/dev/block/bootdevice/by-name/cda_b
dd if=/storage/emulated/0/pda-3110/lk.img of=/dev/block/bootdevice/by-name/lk_b
dd if=/storage/emulated/0/pda-3110/logo.img of=/dev/block/bootdevice/by-name/logo_b
dd if=/storage/emulated/0/pda-3110/md1img.img of=/dev/block/bootdevice/by-name/md1img_b
dd if=/storage/emulated/0/pda-3110/odmdtbo.img of=/dev/block/bootdevice/by-name/odmdtbo_b
dd if=/storage/emulated/0/pda-3110/preloader.img of=/dev/block/bootdevice/by-name/preloader_b
dd if=/storage/emulated/0/pda-3110/scp.img of=/dev/block/bootdevice/by-name/scp_b
dd if=/storage/emulated/0/pda-3110/spmfw.img of=/dev/block/bootdevice/by-name/spmfw_b
dd if=/storage/emulated/0/pda-3110/sspm.img of=/dev/block/bootdevice/by-name/sspm_b
dd if=/storage/emulated/0/pda-3110/system.img of=/dev/block/bootdevice/by-name/system_b
dd if=/storage/emulated/0/pda-3110/systeminfo.img of=/dev/block/bootdevice/by-name/systeminfo_b
dd if=/storage/emulated/0/pda-3110/tee.img of=/dev/block/bootdevice/by-name/tee_b
dd if=/storage/emulated/0/pda-3110/vendor.img of=/dev/block/bootdevice/by-name/vendor_b
If current slot is "_b":
Code:
dd if=/storage/emulated/0/pda-3110/boot.img of=/dev/block/bootdevice/by-name/boot_a
dd if=/storage/emulated/0/pda-3110/cam_vpu1.img of=/dev/block/bootdevice/by-name/cam_vpu1_a
dd if=/storage/emulated/0/pda-3110/cam_vpu2.img of=/dev/block/bootdevice/by-name/cam_vpu2_a
dd if=/storage/emulated/0/pda-3110/cam_vpu3.img of=/dev/block/bootdevice/by-name/cam_vpu3_a
dd if=/storage/emulated/0/pda-3110/cda.img of=/dev/block/bootdevice/by-name/cda_a
dd if=/storage/emulated/0/pda-3110/lk.img of=/dev/block/bootdevice/by-name/lk_a
dd if=/storage/emulated/0/pda-3110/logo.img of=/dev/block/bootdevice/by-name/logo_a
dd if=/storage/emulated/0/pda-3110/md1img.img of=/dev/block/bootdevice/by-name/md1img_a
dd if=/storage/emulated/0/pda-3110/odmdtbo.img of=/dev/block/bootdevice/by-name/odmdtbo_a
dd if=/storage/emulated/0/pda-3110/preloader.img of=/dev/block/bootdevice/by-name/preloader_a
dd if=/storage/emulated/0/pda-3110/scp.img of=/dev/block/bootdevice/by-name/scp_a
dd if=/storage/emulated/0/pda-3110/spmfw.img of=/dev/block/bootdevice/by-name/spmfw_a
dd if=/storage/emulated/0/pda-3110/sspm.img of=/dev/block/bootdevice/by-name/sspm_a
dd if=/storage/emulated/0/pda-3110/system.img of=/dev/block/bootdevice/by-name/system_a
dd if=/storage/emulated/0/pda-3110/systeminfo.img of=/dev/block/bootdevice/by-name/systeminfo_a
dd if=/storage/emulated/0/pda-3110/tee.img of=/dev/block/bootdevice/by-name/tee_a
dd if=/storage/emulated/0/pda-3110/vendor.img of=/dev/block/bootdevice/by-name/vendor_a
- Now back to Magisk Manager.
If your phone is rooted with MTK-SU:
Tap Reboot on installation complete screen now, and enjoy Android 10.
If your phone is rooted with regular method (which is, latest Magisk installed properly):
- Open Magisk Manager and install Magisk on another slot.
After installation complete, reboot immediately. Then you should be able to enjoy Android 10 with rooted state.
And here's how (if bootloader unlocked and prefer flashing via fastboot):
- Download the package and extract it. You'll get 17 img files, and 6 other files.
- Use some hex editor (e.g. HxD) to open preloader.img file, and remove the content from 0x0-0x7FF, save it.
Because fastboot will flash preloader.img file you inputted to the offset 0x7FF of actual fastboot partitions, so we must remove header from preloader.img dump, otherwise it will kill the phone.
- After removing header, file size should be 284,672 bytes (278 KiB).
Content range for reference:
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 45 4D 4D 43 5F 42 4F 4F 54 00 00 00 01 00 00 00 EMMC_BOOT.......
00000010 00 02 00 00 FF FF FF FF FF FF FF FF FF FF FF FF ....ÿÿÿÿÿÿÿÿÿÿÿÿ
00000020 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000007E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000007F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000800 4D 4D 4D 01 38 00 00 00 46 49 4C 45 5F 49 4E 46 MMM.8...FILE_INF
00000810 4F 00 00 00 01 00 00 00 01 00 05 05 10 0F 20 00 O............. .
And here's after removed:
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 4D 4D 4D 01 38 00 00 00 46 49 4C 45 5F 49 4E 46 MMM.8...FILE_INF
00000010 4F 00 00 00 01 00 00 00 01 00 05 05 10 0F 20 00 O............. .
00000020 44 4E 04 00 00 00 08 00 F0 00 00 00 6C 06 00 00 DN......ð...l...
00000030 F0 00 00 00 01 00 60 C2 4D 4D 4D 01 0C 00 01 00 ð.....`ÂMMM.....
00000040 01 00 00 00 4D 4D 4D 01 64 00 07 00 90 00 00 00 ....MMM.d.......
00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
- Use img2simg to convert system.img and vendor.img into sparse images.
If you're Windows user, please find img2simg binaries yourself.
This is known available by default on Ubuntu and Debian (sudo apt install img2simg).
Code:
img2simg system.img system.simg
img2simg vendor.img vendor.simg
- Check current slot:
Code:
fastboot getvar current-slot
In this case, the current slot is a.
- Flash these partitions (including modified preloader) to the slot you currently have (slot a in this case):
Code:
fastboot flash boot_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/boot.img
fastboot flash cam_vpu1_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/cam_vpu1.img
fastboot flash cam_vpu2_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/cam_vpu2.img
fastboot flash cam_vpu3_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/cam_vpu3.img
fastboot flash cda_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/cda.img
fastboot flash lk_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/lk.img
fastboot flash logo_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/logo.img
fastboot flash md1img_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/md1img.img
fastboot flash odmdtbo_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/odmdtbo.img
fastboot flash preloader_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/preloader_header_removed.img
fastboot flash scp_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/scp.img
fastboot flash spmfw_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/spmfw.img
fastboot flash sspm_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/sspm.img
fastboot flash system_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/system.simg
fastboot flash systeminfo_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/systeminfo.img
fastboot flash tee_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/tee.img
fastboot flash vendor_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/vendor.simg
fastboot -w reboot
- After reboot, enjoy Android 10.
Download link:
AFH: https://www.androidfilehost.com/?fid=4349826312261767469
SHA256 Checksum: f000263c677ff7f0963a34ece67ecaa2ceb16089e3aa1887dddbbe20d46d590c

FAQ​
Q1: Why you don't just leak OTA packages like before?
A1: This time I don't want to make my life harder in the future.
Q2: When Android 10 will be pushed to my country?
A2: I don't know. I even don't know when HMD Chinese localization team will be back. So no hope for localized Android 10 for Nokia X5 now.
Q3: How can I rollback to Android 9 if not satisfied?
A3: If not bootloader unlocked, switch the slot back to A under fastboot mode, then flash the phone with SP Flash Tool (Download only). Always backup the whole emmc to for the worst case.
If unlocked, use NFT featured on Nokia 7.2 forum: https://forum.xda-developers.com/nokia-7-2/development/tool-nft-1-0-1-nokia-flash-tool-to-t4003267
Q4: How can I unlock the bootloader?
A4: It's paid method and how to request cannot be disclosed here, or it will violate the rules of XDA.
Q5: My phone is bricked!
A5: I'm not responsible at all. We tested it on Nokia X5 sold in China already.
Q6: Can I use GCam?
A6: No. Nokia 5.1 Plus X5 doesn't support Camera2API at all, so no GCam.
Q7: What does HCTSW stand for?
A7: Hikari Calyx Tech SoftWare.

Reserved #2

Can I roll back to android 9 if I change my active partition to a if installed android 10 on b ??

bx2_nero said:
Can I roll back to android 9 if I change my active partition to a if installed android 10 on b ??
Click to expand...
Click to collapse
Probably yes, but you need to perform factory reset under stock recovery before switching slot.

Any reported bug by your tester?

bx2_nero said:
Any reported bug by your tester?
Click to expand...
Click to collapse
CTS probably cannot be passed which expected.
After that, didn't see any bug so far.

One known issue:
- This Android 10 build seems cannot be rooted with regular procedure of Magisk Manager.

hikari_calyx said:
One known issue:
- This Android 10 build seems cannot be rooted with regular procedure of Magisk Manager.
Click to expand...
Click to collapse
That means no payment app will work because of SafetyNet and no magisk so no bypassing that.

hikari_calyx said:
One known issue:
- This Android 10 build seems cannot be rooted with regular procedure of Magisk Manager.
Click to expand...
Click to collapse
In MTK-SU thread it says that any update after March 20 will block temp root , so I think April security patch fixed the MTK-SU method and it is included in the Android 10 build.

Tips to users who want to downgrade the phone:
- You must perform a regular factory reset on settings (Don't do factory reset on recovery or you will get stuck at FRP lock that requires you to install further updates)
After reset done, don't connect the phone to Internet and just reboot to fastboot mode.
- Switch the slot to A under fastboot mode right after factory reset.
Code:
fastboot --set-active=a
- Use SP Flash Tool to flash any Android 9 firmware on following website:
https://fih-firmware.hikaricalyx.com/hmd_en.html#pda
Any PDA-2***-0-00WW-B** (excluding PDA-209B-0-00WW-B06) are OK. I recommend PDA-214A-0-00WW-B01.
- Skip wifi connection at first boot, or you'll be asked to install latest updates and MTK-SU will be blocked.
- root the phone and follow the guide on topic.
I strongly recommend you, don't login Google account until everything is done.

Three Bugs noticed So far in Android™ 10 beta
1◆ Swiping left (The back button should appear on left) toggles back button on Right side
2◆Accent color: Color changes for text and not. bar but not in settings
3◆A white bar appearing above when using apps

To subscribers of this topic:
PDA-311A-0-00WW-B01 minor patch released!
What's new? I don't know - I don't have access to their changelog at all.
But, to install it, you must have PDA-3110-0-00WW-B01 installed and install the package via external SD card. ADB Sideload is unavailable.
https://www.androidfilehost.com/?fid=4349826312261794057

Cannot run su in adb
i have acquired root in phone with mtksu and suboot with magisk , but getting permission denied output when trying to run su in cmd. Shouldi I run mtksu through cmd? I tried doing that but I was getting cannot find su command.

xdriv3r said:
i have acquired root in phone with mtksu and suboot with magisk , but getting permission denied output when trying to run su in cmd. Shouldi I run mtksu through cmd? I tried doing that but I was getting cannot find su command.
Click to expand...
Click to collapse
Make sure that you have acquired root access buy using any root checker , then change the installation to inactive slot in magisk and wait on the same screen after it is successful, it will prompt to reboot..don't reboot open cmd and flash A10 beta , 'su' command should give a prompt on your phone to allow root access in adb , allow that then only you will be able to use the dd commands.
Dm me if you need further assistance.

bx2_nero said:
Make sure that you have acquired root access buy using any root checker , then change the installation to inactive slot in magisk and wait on the same screen after it is successful, it will prompt to reboot..don't reboot open cmd and flash A10 beta , 'su' command should give a prompt on your phone to allow root access in adb , allow that then only you will be able to use the dd commands.
Dm me if you need further assistance.
Click to expand...
Click to collapse
Successfully flashed Android 10 Beta. Thank you all so much.

Is it possible to factory reset the device?

xdriv3r said:
Is it possible to factory reset the device?
Click to expand...
Click to collapse
After the installation of A10 beta ... absolutely....and it will make it more stable.

bx2_nero said:
After the installation of A10 beta ... absolutely....and it will make it more stable.
Click to expand...
Click to collapse
I'll factory reset from the Android settings?

xdriv3r said:
I'll factory reset from the Android settings?
Click to expand...
Click to collapse
Yes you can.