Hello,
i hope you may help me.
I try to flash my domino to remove all the Orange stuff with a stock firmware.
So, as you understand the flash did not work, and now impossible to start or reflash the modem.
It's a Domino "S" with the LCD screen.
The only thing i 've found, is to maintain the "connect" button and (without battery), plug the modem.
Windows 7 or XP with Huawei drivers, display in the device manager :
Code:
Modems: HUAWEI Mobile Connect – 3G Modem VID:12D1 PID:1003
Ports: HUAWEI Mobile Connect – 3G PC UI Interface (COM4) VID:12D1 PID:1003
I've read that PID:1003 is Download mode, but it's normaly :modem PID 1446, port :142D
I try to reflash it with E5832sUpdate_956.11.17.05.309.exe
the result is
Code:
COM4
Connected
Download (Offline)
Unkown
956.11.17.05.309
FAILED TO UPDATE…
So if i use REVSKILLS:
Code:
[U]MENU SETUP[/U]
Serial Com Port →
[B]COM4 - HUAWEI Mobile Connect – 3G PC UI Interface (COM4)[/B] ←
COM3 – HUAWEI Mobile Connect – 3G Modem
COM3 - \Device\QCUSB_COM3_1
COM4 - \Device\QCUSB_COM4_2
I've some answers from the modem:
Code:
[U]MENU DIAG[/U]
DIAG Commands, OC – STATUS REPORT →
0D 14 37 36 32 35 41 2D 31 33 35 35 31 31 35
30 2D 53 4E 43 41 41
7625A-13551150-SNCAA
DIAG Commands, 22 – DISPLAY EMU →
7E 03 00 06
~___
DIAG Commands, 3A -DOWNLOAD MODE →
3A
:
Then in the BL MENU
Code:
BL
BOOTLDR:Hello
7E 03 00 04
~___
DWNMODE: No Operation
7E 02
~_
DWNMODE: Poweroff Phone :
7E 02
~_ [B][COLOR="Red"] (AND IT POWER OFF)[/COLOR][/B]
DWNMODE: SwitchDwnMode
3A
:
And finally:
Code:
[U]Show MEM Partitions in DWNMODE[/U]
Name : EBI Memory - ebi.bin
------------------------------
Base : 00000000 - Length : 07FFFFFC - Info : 2
Name : MDSP RAM A region - mdsp_rama.bin
------------------------------
Base : B1000000 - Length : 00008000 - Info : 1
Name : MDSP RAM B region - mdsp_ramb.bin
------------------------------
Base : B1200000 - Length : 00008000 - Info : 1
Name : MDSP RAM C region - mdsp_ramc.bin
------------------------------
Base : B1400000 - Length : 0000C000 - Info : 1
Name : MDSP Register region - mdsp_regs.bin
------------------------------
Base : B1C00000 - Length : 00000028 - Info : 1
Name : ADSP RAM A region - adsp_rama.bin
------------------------------
Base : AC000000 - Length : 00080000 - Info : 1
Name : ADSP RAM B region - adsp_ramb.bin
------------------------------
Base : AC200000 - Length : 00080000 - Info : 1
Name : ADSP RAM C region - adsp_ramc.bin
------------------------------
Base : AC400000 - Length : 00080000 - Info : 1
Name : ADSP RAM I region - adsp_rami.bin
------------------------------
Base : AC800000 - Length : 00080000 - Info : 1
Name : CMM Script - load.cmm
------------------------------
Base : 0015D8D0 - Length : 0000030C - Info : 2
I'm beyond my limits now, so that why i try to find some help to know if it's definitly bricked or if there is any hope to revival.
Thanks.
Related
Hi,
I am working on un-bricking my Optimus One (P500) via JTAG, and I need some additional information.
Here is what I did so far:
- created an LPT to JTAG adapter, called the wiggler
- soldered wires to the JTAG pins on the phone's board as shown here
- downloaded openOCD 0.5 and used this configuration file for the wiggler adapter
- started the giveio driver that is in the drivers/ directory of openOCD
- ran the command "openocd --f wiggler.config.file.cfg" and got the following output:
Code:
Open On-Chip Debugger 0.5.0 (2011-08-09-23:21)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.berlios.de/doc/doxygen/bugs.html
Warn : Adapter driver 'parport' did not declare which transports it allows; assuming legacy JTAG-only
Info : only one transport option; autoselect 'jtag'
parport port = 0x378
trst_and_srst srst_pulls_trst srst_gates_jtag trst_push_pull srst_open_drain
dcc downloads are enabled
fast memory access is enabled
6000 kHz
Info : clock speed 500 kHz
Error: JTAG scan chain interrogation failed: all zeroes
Error: Check JTAG interface, timings, target power, etc.
Error: Trying to use configured scan chain anyway...
Error: arm9.cpu: IR capture error; saw 0x00 not 0x01
Warn : Bypassing JTAG setup events due to errors
Info : Embedded ICE version 0
Error: unknown EmbeddedICE version (comms ctrl: 0x00000000)
Info : arm9: hardware has 2 breakpoint/watchpoint units
- ran "telnet localhost 4444" and tried issuing debugging commands via jtag
In general I was following the steps described in this wiki. What I saw is that they have certain binary files for their phone which I wasn't able to find for Optimus:
- the IPL and SPL bootolader image files (hboot.img)
- radio image files (radio.img)
- full recovery images
Does anyone know where can we get the same files for Optimus phones? I imagine they can be read off a working phone. Anyone knows how to do this?
Additionally, was anyone able to configure openOCD to work with the MSM7227 chip in this phone? I can't seem to get it to detect the ARM cpu inside it.
Finally, here are some photos of my LPT <-> wiggler <-> JTAG setup.
Suggestions, help, pats on the back appreciated.
Nice! I haven't seen much in the way of hardware work on our phones. I'd be interested in any progress that you make on this. I wish that I could offer more than the pat on the back, but my experience with JTAG is minimal. In any case, good luck!
Sent from my LG-P500 using XDA App
Forgive for my English... I have connected phone to jtag as me to fill in bootloader?
photo my connected i.imgur.com/vUdUV.jpg
myk777 said:
Forgive for my English... I have connected phone to jtag as me to fill in bootloader?
photo my connected i.imgur.com/vUdUV.jpg
Click to expand...
Click to collapse
my openocd.cfg
---------------------------------------------------
interface parport
parport_port 0x378
parport_cable wiggler
jtag_khz 6000
reset_config trst_and_srst srst_pulls_trst
#dream information (or something near it)
set _CHIPNAME lolololo
set _ENDIAN little
set _CPUTAPID 0x12345678
jtag newtap lololo cpu -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id $_CPUTAPID
------------------------------------------------------------
some updates
In this message I will try to summarize what we have so far...
[1]
myk777 was able to establish an LTP <-> JTAG connection via the wiggler. Here are the connections he made:
i.imgur.com/vUdUV.jpg
[2]
He also identified the to be ARM1136 with the tap ID 0x203c00e1.
OpenOCD 5.0 contains the configuration file for ARM1136 in the following location:
openocd-0.5.0/target/imx31.cfg
The full documentation for ARM1136 is available here:
google DDI0211K_arm1136_r1p5_trm.pdf
What remains to be done:
A. Configure openocd to use the wiggler and the imx31 to target the ARM1136 chip
B. Try to execute the initial bootloader code (using openocd debugger)
C. Find the binary dumps of the bootloader code for this phone, and try to rewrite it
For A I have the following suggestion:
- set the CPUTAPID=0x203c00e1
- launch openocd with something like this:
openocd -f wiggler.config.file.cfg -f target/imx31.cfg
Has failed flash memory. Has given on repair to service.
Hi guys!
This thread is the closest to my problem with Samsung Galaxy Mini S5570 model. I was on forum with this phone but there I couldn't find any "deeper" thread (most of them ends with "use RiffBox").
So, I have built Clone Wiggler, solder down wires to the JTAG pads and establish connection with bricked phone. Here is what I got from the OpenOCD after start:
Code:
Warn : Adapter driver 'parport' did not declare which transports it allows; assuming legacy JTAG-only
Info : only one transport option; autoselect 'jtag'
adapter speed: 500 kHz
Info : clock speed 500 kHz
Info : JTAG tap: MSM7227.cpu tap/device found: 0x203c10e1 (mfg: 0x070, part: 0x03c1, ver: 0x2)
Warn : gdb services need one or more targets defined
Here is OpenOCD config file:
Code:
interface parport
parport_cable wiggler
adapter_khz 500
#debug_level 3
# CPU settings
set _CHIPNAME MSM7227
set _CPUTAPID 0x203c10e1
#set _ENDIAN little
jtag newtap $_CHIPNAME cpu -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id $_CPUTAPID
And output from "jtag init" and "scan_chain" after telnet localhost 4444:
Code:
telnet localhost 4444
> jtag init
JTAG tap: MSM7227.cpu tap/device found: 0x203c10e1 (mfg: 0x070, part: 0x03c1, ver: 0x2)
> scan_chain
TapName Enabled IdCode Expected IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
0 MSM7227.cpu Y 0x203c10e1 0x203c10e1 4 0x01 0x0f
S5570 has MSM7227 Qualcomm chip and 4Gb OneNand KAT007012C - BRTT flash. I'm aware that there is no luck with OneNAND and OpenOCD, but I still have the hope and strong will
My OpenOCD version is latest 0.6.1
Any reply is more than welcome and thanks in advance.
I have read that MSM7227 has several cores that operate separately. One core is arm9 (modem processor) and the second is arm11 (applications) ... so configuration file is changed and with this OpenOCD config, JTAG is connected to the arm9 modem processor:
Code:
interface parport
parport_cable wiggler
adapter_khz 300
reset_config trst_and_srst srst_pulls_trst
#debug_level 3
# CPU settings
set _CPUTAPID 0x203c10e1
set _TARGETNAME arm9.cpu
set _ENDIAN little
# create jtag
jtag newtap arm9 cpu -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id $_CPUTAPID
# create target
target create arm9 arm926ejs -endian $_ENDIAN -chain-position $_TARGETNAME
Here is output from the OpenOCD:
Code:
Open On-Chip Debugger 0.6.1 (2012-11-04-19:22)
Licensed under GNU GPL v2
For bug reports, read
Warn : Adapter driver 'parport' did not declare which transports it allows; assuming legacy JTAG-only
Info : only one transport option; autoselect 'jtag'
adapter speed: 300 kHz
trst_and_srst srst_pulls_trst srst_gates_jtag trst_push_pull srst_open_drain
arm9
Info : clock speed 250 kHz
Info : JTAG tap: arm9.cpu tap/device found: 0x203c10e1 (mfg: 0x070, part: 0x03c1, ver: 0x2)
Info : Embedded ICE version 6
Info : arm9: hardware has 2 breakpoint/watchpoint units
After power is attached to the phone I have to press few times power button (not sure about that - screen just flashes) and then press Power + Volume down + Home buttons. Screen is still black but the phone is nicely recognized by the OpenOCD. The next step is "telnet localhost 4444". Every few seconds GDB was printing some lines so I typed in "reset" and "halt". Here are few commands to show the output:
Code:
> halt
Jazelle debug entry -- BROKEN!
invalid mode value encountered 0
ThumbEE -- incomplete support
cpsr contains invalid mode value - communication failure
Polling target failed, GDB will be halted. Polling again in 100ms
target was in unknown state when halt was requested
target state: halted
target halted in ARM state due to debug-request, current mode: Abort
cpsr: 0x200000d7 pc: 0x003679e0
MMU: disabled, D-Cache: disabled, I-Cache: disabled
Polling succeeded again
> arm9 curstate
halted
> arm9 mdb 2000 100
0x000007d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000007e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x000007f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x00000800 00 00 a0 e1 00 00 a0 e1 00 00 a0 e1 00 00 a0 e1 ................
0x00000810 00 00 a0 e1 00 00 a0 e1 00 00 a0 e1 00 00 a0 e1 ................
0x00000820 02 00 00 ea 18 28 6f 01 00 00 00 00 3c 45 26 00 .....(o.....<E&.
0x00000830 01 70 a0 e1
> arm reg
System and User mode registers
r0: fffffffb r1: 002fff30 r2: 00000f80 r3: 000000ff
r4: ffffff00 r5: 000000ff r6: 003788cc r7: 0038fabc
r8: 00390320 r9: 00000000 r10: 002fffb0 r11: 00000040
r12: 00390320 sp_usr: ffffffe0 lr_usr: e1a0a002 pc: 003679e0
cpsr: 200000d7
FIQ mode shadow registers
r8_fiq: 000000db r9_fiq: 15c43000 r10_fiq: 00000070 r11_fiq: 00000000
r12_fiq: ffff000c sp_fiq: 00000000 lr_fiq: f000b4bc spsr_fiq: 00000010
Supervisor mode shadow registers
sp_svc: 00000000 lr_svc: 00017118 spsr_svc: 000000d7
Abort mode shadow registers
sp_abt: 002fff1c lr_abt: 0046c140 spsr_abt: 000000d3
IRQ mode shadow registers
sp_irq: 40000030 lr_irq: 009ee8dd spsr_irq: 00000010
Undefined instruction mode shadow registers
sp_und: fffffffc lr_und: ffff0008 spsr_und: 000000db
Well, I hope that Clone wiggler actually communicate with my hard bricked phone. What is the next step and how to unbrick the phone? Please guys give me some hint to move on because I can barely find any quality info about unbricking procedure for S5570. I'm stuck at this point.
In theory bootloader should be loaded to the memory and then written to the NAND (actually OpenNAND). Or is it possible to load a program and run it from OpenOCD to enable communication with Odin?
Thanks in advance and any feedback is more than welcome.
dbunic said:
Hi guys!
This thread is the closest to my problem with Samsung Galaxy Mini S5570 model. I was on forum with this phone but there I couldn't find any "deeper" thread (most of them ends with "use RiffBox").
So, I have built Clone Wiggler, solder down wires to the JTAG pads and establish connection with bricked phone. Here is what I got from the OpenOCD after start:
Code:
Warn : Adapter driver 'parport' did not declare which transports it allows; assuming legacy JTAG-only
Info : only one transport option; autoselect 'jtag'
adapter speed: 500 kHz
Info : clock speed 500 kHz
Info : JTAG tap: MSM7227.cpu tap/device found: 0x203c10e1 (mfg: 0x070, part: 0x03c1, ver: 0x2)
Warn : gdb services need one or more targets defined
Here is OpenOCD config file:
Code:
interface parport
parport_cable wiggler
adapter_khz 500
#debug_level 3
# CPU settings
set _CHIPNAME MSM7227
set _CPUTAPID 0x203c10e1
#set _ENDIAN little
jtag newtap $_CHIPNAME cpu -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id $_CPUTAPID
And output from "jtag init" and "scan_chain" after telnet localhost 4444:
Code:
telnet localhost 4444
> jtag init
JTAG tap: MSM7227.cpu tap/device found: 0x203c10e1 (mfg: 0x070, part: 0x03c1, ver: 0x2)
> scan_chain
TapName Enabled IdCode Expected IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
0 MSM7227.cpu Y 0x203c10e1 0x203c10e1 4 0x01 0x0f
S5570 has MSM7227 Qualcomm chip and 4Gb OneNand KAT007012C - BRTT flash. I'm aware that there is no luck with OneNAND and OpenOCD, but I still have the hope and strong will
My OpenOCD version is latest 0.6.1
Any reply is more than welcome and thanks in advance.
Click to expand...
Click to collapse
Hello there!
Do you finished with succes?I am planning to try recover same phone but with h-jtag.
Any help welcome
szakiz said:
Hello there!
Do you finished with succes?I am planning to try recover same phone but with h-jtag.
Any help welcome
Click to expand...
Click to collapse
Unfortunately no, phone was fixed with riffbox. Thread was inactive for a while and I didn't have success with inspecting/fixing boot loader via Jtag interface. Hope you will have more luck. Cheers!
my phone model- CENTRIC CM2221
android -6.0
problem- no service
i check imei blank and baseband unknown .
how to solve ?
please provide me stock rom or good solution ..
Phone Info Log .........
1. Power Off Phone , Remove battery , Insert back
2. Insert USB cable. In some cases require hold BootKey
Wait for phone...
Phone found! [ 16 ]
Sync...
Inital Boot Ok!
BB_CPU_PID : 6737
BB_CPU_NME : [MediaTek] MT6737M|MT6737_S00
BB_CPU_EXT : 0xCB00 , 0x8A00 , 0x0000
Processing BROM stage
Settings for BROM configured!
SecCfgVal : 0x00000000
BromVer : 0x00FF
BLVersion : 0x0001
PreLoader : Active [ Boot with PL ]
BootLdrSS : NORMAL with PRELOADER
Processing DA stage
DA Select done, will use MTK_AllInOne_DA_v5.1624.16.07
Sending and initialize DA ...
Running DA ver.4.2 on BBID : 0x93
NAND Flash : NOT INSTALLED
eMMC Flash : 510001154D333238E8020042AF2EBAF4
Initialize Memory ...
DRAM already initialized by Preloader
DAgent sent , init HW now
eMMC FlashIC initialized
[eMMC] : FLASH_VEN : 0x15 , OEM : 0100
[eMMC] : FLASH_INF : [SAMSUNG] , BM328
[eMMC] : FLASH_CID : 150100513832334D420002E8F4BA73AF
[eMMC] : FLASH_BRT : 0x00400000 , 0x00400000 , 0x00400000
[eMMC] : FLASH_LEN : 0x00000003A3E00000
[eMMC] : FLASH_UCP : 14910 MiB [eMMC 16 GiB]
DEV RID : 0xEF0B331D1BA71095953C8F7CFAA875FB
INT RAM : 0x00020000
EXT RAM : 0x80000000 [2 GiB]
BOOT TYPE : EMMC_FLASH_BOOT
SOC VERIFY : C1
Boot Ok!
You cm2 to Repaire baseband
Sent from my iPhone using Tapatalk Pro
abuk91 said:
You cm2 to Repaire baseband
Sent from my iPhone using Tapatalk Pro
Click to expand...
Click to collapse
bro allready try but not done .....need flash file
no solution????????????????????????????????????????????????????????????
I have the same problem
phone accent neon no service imei not found
I'm looking for rom file for this model
What could be the problem ..
Operation : Identify [ v2.18 ]
Mode : FLASH
1. Make sure device is powered off. Power off, if need. Wait 20 seconds after
2. Insert USB cable in phone
Waiting for device connection ...
PTFN : MediaTek USB Port (COM7)
MODE : BOOTROM
PORT : 7
Waiting BOOT ack ...
BROM : Skip ACK verify
BROM : Init BROM
BROM init passed!
CHIP : MT6580 , SBID : 0x8A00 , HWVR : 0xCA00 , SWVR : 0x0000
TYPE : LEGACY MTK
BROM : MEID : 84E1311723E5F72DDF767B7B831BD757
BROM : SecLevel : 0x00000000
BROM : SecMode : PLAIN [+PRL]
BROM : BROM|BL : 0x05|0xFE
BROM : BOOTROM
MODE : 0_base : BASE_v2044 | Manual : Enabled
AGENT : Look for suitable BootChain in DA ...
AGENT : MTK_AllInOne_DA_SP.bin
AGENT : Found MT6580
AGENT : MTK_DOWNLOAD_AGENT
BROM : Sending 1st DA ...
BROM : DA sent
BROM :Transfer control to DA ...
DA : AGENT started!
NAND : DEVICE NOT FOUND
NAND : 000000000000000000000000
eMMC : OK
eMMC : 45000170414934456E0101344F2524D7
DAInf: 4 : 2 : 156
DA : EXT_RAM NOT initialized!
eMMC : OK
eMMC : 70010045453449413401016ED724254F
NAND : DEVICE NOT FOUND
NAND : 000000000000000000000000
DRAM : 0x0178
EMI : DEV : MT6752
EMI : SRC : preloader_k80hd_bsp_fwv_512m.bin
EMI : CNT : 0003
EMI : [00] : ID : 700100454534454134 : VEN : KINGSTON | DEV : EE4EA4 : RAM : [ 512.00 MB ]
EMI : [01] : ID : C80111344D45594D41 : VEN : UNKNOWN | DEV : 4MEYMA : RAM : [ 512.00 MB ]
EMI : [02] : ID : 700100454534494134 : VEN : KINGSTON | DEV : EE4IA4 : RAM : [ 512.00 MB ]
EMI : Init EMI from PRELOADER
INIT : 0xBC : DRAM [ 0x00000000 : [ 0 B ] ]
DRAM : DRAM: 0x20000000 [ 512.00 MB ]
DA : DRAM ready!
DA : BOOT to 2nd DA ...
DA : Receiving HW info
EMMC: 70010045453449413401016ED724254F
EMMC: VEN : KINGSTON | OEM : 01 | DEV : EE4IA4
EMMC:
BOOT1 : 0x00200000 [ 2.00 MB ]
BOOT2 : 0x00200000 [ 2.00 MB ]
RPMB : 0x00080000 [ 512.00 KB ]
USER : 0xE2000000 [ 3.53 GB ]
SRAM: 0x00020000 [ 128.00 KB ]
DRAM: 0x20000000 [ 512.00 MB ]
CHIP : MT6580 , SBID : 0x8A00 , HWVR : 0xCA00 , SWVR : 0x0000 , EVOL : 0x0000
RNID : C936D9FF3A84D90E7B2010FA5212EA26
STATUS : BLANK FLASH
BSTYLE : EMMC FLASH BOOT
DA : USB : FULL-SPEED
DA : USB : Change Port Speed
PTFN : MediaTek DA USB VCOM (Android) (COM9)
MODE : PRELOADER PORT
PORT : 9
Boot done!
Patch Level : O11019
Display ID : O11019 release-keys
Ver. CodeName : REL
Ver. Release : 8.1.0
Sec. Patch : 2019-09-05
Build Time : 23.08.2019
Product Model : Kicka_4_Plus
Product Brand : MobiWire
Product Name : Kicka_4_Plus
Product Device : Kicka_4_Plus
Product Manfct : MobiWire
Product Info : k80hd_bsp_fwv_512m
Board Platform : mt6580
Product Board : VP402_Mobiwire_Kicka4Plus
USERDATA : FILESYSTEM : F2FS with FDE ( Full Disk Encryption ***)
Done!
Elapsed: 00:00:30
Operation : HW Test [ v1.58 ]
1. Power Off Phone , Remove battery , Insert back
2. Insert USB cable. In some cases require hold BootKey
Wait for phone...
Phone found! [ 1 ]
Sync...
Inital Boot Ok!
BB_CPU_PID : 6580
BB_CPU_NME : [MediaTek] MT6580_S00
BB_CPU_EXT : 0xCA00 , 0x8A00 , 0x0000
Processing BROM stage
Settings for BROM configured!
SecCfgVal : 0x00000000
BromVer : 0x00FF
BLVersion : 0x0001
PreLoader : Active [ Boot with PL ]
BootLdrSS : NORMAL with PRELOADER
Processing DA stage
DA Select done, will use MTK_AllInOne_DA_v3.3001.2018-04-25.11:26_437806
Sending and initialize DA ...
Running DA ver.4.2 on BBID : 0x9C
NAND Flash : NOT INSTALLED
eMMC Flash : 70010045453449413401016ED724254F
Initialize Memory ...
DRAM already initialized by Preloader
DAgent sent , init HW now
eMMC FlashIC initialized
[eMMC] : FLASH_VEN : 0x70 , OEM : 0100
[eMMC] : FLASH_INF : [KINGSTON] , 4AI4E
[eMMC] : FLASH_CID : 70010045453449413401016ED724254F
[eMMC] : FLASH_BRT : 0x00200000 , 0x00200000 , 0x00080000
[eMMC] : FLASH_LEN : 0x00000000E2000000
[eMMC] : FLASH_UCP : 3616 MiB [eMMC 4 GiB]
DEV RID : 0x4EA014B2FFD936C90ED9843AFA10207B
INT RAM : 0x00020000
EXT RAM : 0x20000000 [512 MiB]
BOOT TYPE : EMMC_FLASH_BOOT
SOC VERIFY : C1
Boot Ok!
Processing Miscellaneous test
MSC : BatteryLevel : 3009 mV
[Processing] FlashMemory Read-Write test
[eMMC] : [KINGSTON] , 4AI4E , 0xE2000000 , 3616 MiB
[eMMC] : CID : 70010045453449413401016ED724254F
[eMMC] : MODE : SQ-WR
[PASSED] : eMMC RW Check #1 Ok!
[eMMC] : MODE : RA-WR
[PASSED] : eMMC RW Check #2 Ok!
[eMMC RO CHECK] : eMMC Ok! READ-WRITE Passed!
[Processing] RAM Read-Write test
[DRAM] : 0x20000000 , 512 MiB
[DRAM] : ADDRESS BUS test
[PASSED] : Bus Count : 0x1C
[DRAM] : DATA BUS test
[PASSED] : Bus Count : 0x1F
[DRAM] : PATTERN test
[PASSED] : PATTERN Ok
[DRAM] : INCDEC test
[PASSED] : INCDEC Ok
All Done!
Done!
Elapsed: 00:01:40
Reconnect Power/Cable!
Found modem : E5577s-932
Model : Huawei AuthVer 4 modem (New)
IMEI : 866852025411353
Serial NR. : X8BDW16A13000936
Firmware : 21.328.62.00.1133
Dashboard version : WEBUI_17.100.19.00.1133_MRE5
Web UI version : WEBUI_17.100.19.00.1133_MRE5
SIM Lock status : unlocked
Wrong codes entered : 0 (unlock attempts left : 10)
===================================================================
AT^NVWREX=0,0,16, 02 03 04 03 02 03 03 02 03 02 03 02 03 02 03 00
ERROR
try to change the firmware and webui for old ver then change it by dc unlocker
by read device then code
at^cimei="your imei"
So long story short, I bricked my A226b and after a week of trying different things I noticed the product code was different when I was using Android Utilities. This could be why (my other post) I'm getting errors.
Looking around, the closest I can find to my problem is "build.prop" where the device I.D has changed after flash
I'm stuck in BROM and I can't get to DM or ADB, I'm searching for the answer but I still don't understand how to achieve changing the device I.D / Product I.D back so SP flash tool sees it as a correct model or deactivated this check etc.
I'm hoping I'm close to finding solution, any ideas?
Thank you
Decmanager said:
So long story short, I bricked my A226b and after a week of trying different things I noticed the product code was different when I was using Android Utilities. This could be why (my other post) I'm getting errors.
Looking around, the closest I can find to my problem is "build.prop" where the device I.D has changed after flash
I'm stuck in BROM and I can't get to DM or ADB, I'm searching for the answer but I still don't understand how to achieve changing the device I.D / Product I.D back so SP flash tool sees it as a correct model or deactivated this check etc.
I'm hoping I'm close to finding solution, any ideas?
Thank you
Click to expand...
Click to collapse
If your device is in BROM mode, and you have the right firmware files, SPFT, don´t check the device model to flash it, only it is based on the scatter file. Maybe you can upload some screenshots from the message you are receiving. Note that to really be sure your device is entering to BROM mode, you have to check in device manager, that it is in preloader mode, and using other tool, device will stay in BROM mode. Can you describe what you have with?
I'm bricked in brom, I use auth bypass, then Android Utilities / A226b dead boot repair and when it reads it, it shows product code of A12 and hangs back to brom. I feel like I've flashed it to be a12 some how and when I try flash the correct files it's giving me an error.
*(in my other post are the details of why I'm doing it and some logs / I'm not sure how I bricked it)
Waiting for mtk usb device... ok
BootMode : BootRom[COM21]
DriverDesc : MediaTek USB Port
DriverPath : usb\vid_0e8d&pid_0003\6&39447387&0&2
DriverSRV : wdm_usb
DriverVersion : 3.0.1504.0
DriverDate : 1-22-2015
DriverCFG : oem25.inf
DriverOEM : MediaTek Inc.
● BBChip ID MT6833
● BBChip Inf 989:8A00:CA00:0
● Chip PID Dimensity 700
● Chip UID Palmer
● Chip Ver CHIP_VER_E1
BRom::SEC:{0xe5}[SBC:ON:SLA:OFFAA:ON]
BRom stage Re-configuration
● BR_MEID:0x76206C45E7FF29381C34C136A484886F
Disabling watchdog timer0...
BRom::WinUSB:evHnd{0xefaf700}
BRom::WinUSB:evHnd{0xefb0218}
BRom::WinUSB:evHnd{0xefb07e0}
===== Bypass Authentication =====
Dumping Dram data(0xa47a0500)...
Re-connecting to BootROM...
Sending Download Agent(A037F)...
Booting Download Agent at(0x200000)...
Successfully received DA sync cahr
Start setup da environment...
Setup da device enviroment...
Successfully received 1st DA sync signal
Initialize Dram(0x1000)...
Dram initialized
Boot and enter 2nd DA...
Boot 2nd Da done! Getting Ram Info
● Sram 448.00KB
● Dram 4.00GB
Boot and enter 2nd SEC DA...
===== Power On HACC =====
Boot 2nd SEC DA done! Getting HW Info
● Storage eMMC
● BOOT1 4.00MB
● BOOT2 4.00MB
● RPMB 16.00MB
● GP1 00000000
● GP2 00000000
● GP3 00000000
● GP4 00000000
● USR 58.24GB
● MLC 00000001
● SLC 00000001
● EOL 00000001
● LCYCLE 00000000
● CID 13014E47314A395238101B685D0A29D1
● MFRID 0x13
● Vendor Micron
● Card BGA BGA (Discrete embedded)
● OEMID 0x4e
● Product G1J9R8
● Revision 1.0
● Card SN 0x1b685d0a
● MFDate 2/2022
● EMCP MT29VZZZAD8GQFSL_046W_9R8
● Capacity 0xe91000000:58.27GB
● RNID 07C80DE18DA944D652A025AC302451BA
Switching to usb high-speed...
===== wait for DA high speed port =====
Waiting for mtk da device... ok
BootMode : MTK DA VCOM[COM22]
DriverDesc : MediaTek DA USB VCOM (Android)
DriverPath : usb\vid_0e8d&pid_2001\6&39447387&0&2
DriverSRV : wdm_usb
DriverVersion : 3.0.1504.0
DriverDate : 1-22-2015
DriverCFG : oem25.inf
DriverOEM : MediaTek Inc.
● USBSpeed high-speed
Gathering partitions info...
===== wait for DA S/W detection report =====
===== Download boot_section to device =====
BOOT-A/B region(s) successfully updated!
===== Download user_section to device =====
(P/S)-GPT header(s) and entries(s) successfully updated!
Rebooting device... Done
Waiting for samsung-dm usb device...
**AND THEN HANGS**
It's showing up as : ● Product - G1J9R8
Decmanager said:
Waiting for mtk usb device... ok
BootMode : BootRom[COM21]
DriverDesc : MediaTek USB Port
DriverPath : usb\vid_0e8d&pid_0003\6&39447387&0&2
DriverSRV : wdm_usb
DriverVersion : 3.0.1504.0
DriverDate : 1-22-2015
DriverCFG : oem25.inf
DriverOEM : MediaTek Inc.
● BBChip ID MT6833
● BBChip Inf 989:8A00:CA00:0
● Chip PID Dimensity 700
● Chip UID Palmer
● Chip Ver CHIP_VER_E1
BRom::SEC:{0xe5}[SBC:ON:SLA:OFFAA:ON]
BRom stage Re-configuration
● BR_MEID:0x76206C45E7FF29381C34C136A484886F
Disabling watchdog timer0...
BRom::WinUSB:evHnd{0xefaf700}
BRom::WinUSB:evHnd{0xefb0218}
BRom::WinUSB:evHnd{0xefb07e0}
===== Bypass Authentication =====
Dumping Dram data(0xa47a0500)...
Re-connecting to BootROM...
Sending Download Agent(A037F)...
Booting Download Agent at(0x200000)...
Successfully received DA sync cahr
Start setup da environment...
Setup da device enviroment...
Successfully received 1st DA sync signal
Initialize Dram(0x1000)...
Dram initialized
Boot and enter 2nd DA...
Boot 2nd Da done! Getting Ram Info
● Sram 448.00KB
● Dram 4.00GB
Boot and enter 2nd SEC DA...
===== Power On HACC =====
Boot 2nd SEC DA done! Getting HW Info
● Storage eMMC
● BOOT1 4.00MB
● BOOT2 4.00MB
● RPMB 16.00MB
● GP1 00000000
● GP2 00000000
● GP3 00000000
● GP4 00000000
● USR 58.24GB
● MLC 00000001
● SLC 00000001
● EOL 00000001
● LCYCLE 00000000
● CID 13014E47314A395238101B685D0A29D1
● MFRID 0x13
● Vendor Micron
● Card BGA BGA (Discrete embedded)
● OEMID 0x4e
● Product G1J9R8
● Revision 1.0
● Card SN 0x1b685d0a
● MFDate 2/2022
● EMCP MT29VZZZAD8GQFSL_046W_9R8
● Capacity 0xe91000000:58.27GB
● RNID 07C80DE18DA944D652A025AC302451BA
Switching to usb high-speed...
===== wait for DA high speed port =====
Waiting for mtk da device... ok
BootMode : MTK DA VCOM[COM22]
DriverDesc : MediaTek DA USB VCOM (Android)
DriverPath : usb\vid_0e8d&pid_2001\6&39447387&0&2
DriverSRV : wdm_usb
DriverVersion : 3.0.1504.0
DriverDate : 1-22-2015
DriverCFG : oem25.inf
DriverOEM : MediaTek Inc.
● USBSpeed high-speed
Gathering partitions info...
===== wait for DA S/W detection report =====
===== Download boot_section to device =====
BOOT-A/B region(s) successfully updated!
===== Download user_section to device =====
(P/S)-GPT header(s) and entries(s) successfully updated!
Rebooting device... Done
Waiting for samsung-dm usb device...
**AND THEN HANGS**
It's showing up as : ● Product - G1J9R8
Click to expand...
Click to collapse
I saw you had "verified boot enabled" error, in the other post. You can try this https://www.hovatek.com/forum/thread-39260.html, but, excluding some files for the flash round, you can bypass that error, I have to see the files in SPFT, to can remember which (I also had the same issue with other device).
G1J9R8 it´s just the eMMc RAM product, not your device, the error may happen with UFI boxes.
You won´t have issues flashing any partition, through mtk-client.
SubwayChamp said:
I saw you had "verified boot enabled" error, in the other post. You can try this https://www.hovatek.com/forum/thread-39260.html, but, excluding some files for the flash round, you can bypass that error, I have to see the files in SPFT, to can remember which (I also had the same issue with other device).
G1J9R8 it´s just the eMMc RAM product, not your device, the error may happen with UFI boxes.
You won´t have issues flashing any partition, through mtk-client.
Click to expand...
Click to collapse
OK I setup and ready to flash with MTK client, can you point me to the simplest method to flash my MT6833 or what ever it is I need. I am also actively searching for info but if you have something please post. Thank you lots.
Decmanager said:
OK I setup and ready to flash with MTK client, can you point me to the simplest method to flash my MT6833 or what ever it is I need. I am also actively searching for info but if you have something please post. Thank you lots.
Click to expand...
Click to collapse
Simple, unlock bootloader through mtk-client (don´t erase metadata), then flash all the partitions available in the firmware.
SubwayChamp said:
Simple, unlock bootloader through mtk-client (don´t erase metadata), then flash all the partitions available in the firmware.
Click to expand...
Click to collapse
Couldn't find good solution to unlock bootloader, the phone stuck in Brom.