NVIDIA Shield Unlock Bootloader FAILED <Remote: <> - Shield Tablet Q&A, Help & Troubleshooting

Good afternoon-
I recently picked up a NVIDIA Shield from a friend of mine because it would not turn back on for him. It is currently stuck at the NVIDIA Boot screen. I can access the Bootloader and I can access stock recovery. However, when I attempted to use Fastboot to unlocked the bootloader I receive the below...
(bootloader) Showing Options on Display.
(bootloader) Use device keys for selection.
(bootloader) erasing userdata...
(bootloader) erasing userdata done
(bootloader) erasing cache...
(bootloader) erasing cache done
(bootloader) unlocking...
FAILED (remote: ()
finished. total time: 3.872s
I am using "Fastboot OEM Unlock" and it does prompt me on the Shield to unlock, but once I select unlock it bounces right back to the bootloader and fails. I tried wiping data and factory reset via stock recovery, but when I do I receive an E: Failed to Mount /Cache (Invalid Argument). It will not let me read/write any of my user data files at all. It seems as if they are corrupt, but I am not quite sure.
I am looking for a way to get this thing back up and running. I am perfectly fine with losing all data on it. Is there a stock kernal that I can flash with a locked bootloader? I fear the issue is with the bootloader or corrupted EMMC. I am open to any and all suggestions!

Make sure that your USB cable is plugged into a USB 2.0 port directly connected to your motherboard as sometimes USB 3.0 ports can cause problems and front panel USB connections can be unreliable.
from: https://forum.xda-developers.com/showthread.php?t=2399737

In case it is interesting, (if someone get managed) it should be possible to boot into twrp recovery with locked bootloader.
- Linux only - (I have not tested and can not confirm if this works. maybe i have a thinking blunder)
first we need a u-boot from another unlocked (similar) device (not sure about size?)
Code:
dd if=/dev/mmcblk0boot0 of=u-boot-dtb-tegra.bin bs=1048576 count=1
second we can boot this u-boot without flashing
Code:
tegra-uboot-flasher exec u-boot-dtb-tegra.bin
third we can boot twrp from fastboot
Code:
fastboot boot twrp-3.3.1-0-shieldtablet.img
Pre-requisites
you need to create your own cbootimage-config
https://github.com/NVIDIA/cbootimage-configs/tree/master/tegra124/nvidia
Adding Board Support
====================
If that doesn't work out, you may create the required configuration files
using the following process:
1)
Extract the BCT from the existing device. Various methods exist to do this:
1a)
Recent versions of tegrarcm now have the capability to read the BCT from the
device without requiring any HW-specific binaries, nor code already installed
on the device:
tegrarcm --bct board.bct readbct
1b)
If you have access to Linux running on the device already, then you can use
dump the memory device directly:
For devices which boot from eMMC:
dd if=/dev/mmcblk0boot0 of=bct.bin bs=65536 count=1
For devices which boot from SPI:
dd if=/dev/mtd0ro of=bct.bin bs=65536 count=1
1c)
If you have a working nvflash for your device, then this can also extract the
BCT:
nvflash --bl fastboot.bin --getbct --bct board.bct
If that doesn't work, you could try reading the content of the BCT partition
or the start of the raw device, then extracting the BCT:
nvflash --bl fastboot.bin --read 2 board.bct
or:
nvflash --bl fastboot.bin --rawdeviceread 0 128 board.bct
Note that some of the above commands extract many more bytes of data that is
strictly required. However, this avoids updating these instructions for each
new chip; Tegra20's BCT is just under 4KiB, Tegra30's around 6KiB, etc.
2)
Convert the BCT to a cbootimage configuration file:
bct_dump board.bct > board.bct.cfg
This will de-compile the extracted BCT binary into a text configuration file
suitable for later use by cbootimage.
To follow the same structure as the rest of the configuration files in this
project, it's then best to split up board.bct.cfg into separate board.bct.cfg
(DevType, DeviceParam, and SDRAM lines), and board.img.cfg (all other header
parameters). Use the existing configuration files as a guide.
Once you have performed these steps, you will have configuration files
suitable for your personal use. We don't accept contributions to this project
that were derived in this fashion. We encourage you to contact the vendor
and request them to submit their own configuration files.
Click to expand...
Click to collapse
tegra-uboot-flasher
https://github.com/NVIDIA/tegra-uboot-flasher-scripts
Introduction
============
This project provides scripts and data that provide a simple way of using
tegrarcm and U-Boot to write U-Boot (or an alternative image) to the boot
flash of a Tegra device.
The flash images handled by this tool include just the bootloader and any
other data necessary for the bootloader to execute (i.e. the BCT). Creating or
flashing a root filesystem, either on the Tegra device's built-in flash, or on
external storage media, is a separate step unrelated to this tool.
Pre-requisites
==============
This document assumes that the instructions in README-developer.txt have
already been followed. Those instructions generate various files that the
flashing process uses. These include host-based utilities such as tegrarcm,
U-Boot binaries that run on the Tegra target device, and the flash images to
write to the Tegra device.
If you are using a distribution package of this tool, the development steps
have likely already been followed, and you need only follow the instructions
in this file.
If you are working with the source code to this tool, you almost certainly
need to follow the instructions in README-developer.txt first.
Board Configurations
====================
Every Tegra board design has a name. Examples are Harmony or Cardhu.
Each board may exist in a number of different configurations; perhaps the
RAM size or speed varies, or a different type of boot flash is supported.
Each of these configurations is also given a name. tegra-uboot-flasher's
user-interface uses these configuration names exclusively. Examples are
harmony, cardhu-a02-1gb, cardhu-a04-1gb.
You may find a list of valid values for configname by executing:
tegra-uboot-flasher list-configs
Simple Usage - Flashing
=======================
To flash a board, connect a USB cable from your host PC to the Tegra device,
place that board into USB recovery mode, and execute the following as root
on the host machine:
tegra-uboot-flasher flash CONFIG
This will download code and data to the Tegra device and execute a flashing
routine. Once this is complete, the system will reboot into the freshly
flashed boot image, and the system will proceed to boot normally. Depending
on the board and U-Boot support, the flashing process may be observed via the
debug serial port, or on a built-in LCD panel.
Simple Usage - Testing U-Boot
=============================
If you simply want to download an unmodified U-Boot to the Tegra device and
execute it, execute the following as root on the host machine:
tegra-uboot-flasher exec CONFIG
This can be useful for quickly testing changes to U-Boot without writing it
to flash every time. This mode of operation is a very simple wrapper around
tegrarcm, which eliminates the need to remember which BCT to use for each
board configuration.
Advanced Options
================
A number of command-line options exist to control tegra-uboot-flasher's
behaviour. For example, you may specify an alternate image to be written
to boot flash, load configuration data from an alternate location, save
the temporary files created during execution for later analysis, etc.
Execute tegra-uboot-flasher with the --help option to see a description
of these options.
Click to expand...
Click to collapse

Related

Nandroid v2.0 - Full NAND backup and restore tool (tried and tested!)

* What is Nandroid Backup v2.0?
Nandroid Backup is a set of tools and a script that will enable anyone who has root on their G1 and has the engineering/dev spl bootloader [1] (or has a dev phone) + a recovery image with busybox and adbd running as root [2] to make full system backups. These can then be restored using the fastboot [3] commandline tool and your phone in SPL/bootloader mode (hold camera + power). This allows you to create regular backups of your entire phones NAND flash so that you can restore a backup when something breaks. Its backup method works on a level that allows you to completely break, wipe or corrupt any or all partitions and still restore the phone to a working state within a few minutes. This works great for those who use their G1 for normal activities but also want to test their ideas which might break the phone, or when not having an extra G1 to keep purely as a development phone.
* Requirements for use
- Android G1 phone in recovery mode with busybox installed, including appropriate symlinks to at least tar and md5sum, as well as 'adb shell' support running as root. I recommend using JesusFreke US RC30 or UK RC8 v1.2 recovery image. You can flash the RC30 v1.2 recovery.img on your G1 if you don't want to bother constructing your own image. Of course you are free to use your own recovery image and it will work if you set it up correctly.
- dump_image-arm and mkyaffs2image|mkyaffs2image-$ARCH compiled in the current dir, as well as root on a linux/mac (POSIX) machine for constructing system and data images. root is required because the uid, gid and file permissions need to be preserved while extracting and creating the yaffs2 images. You are free to run the script as a normal user and then run the appropriate commands yourself as root; the commands are printed when you run the script as a regular user.
If you don't trust the provided binaries, you are free to compile them yourself. The source for the tools are included. For dump_image, edit nandtools/android-imagetools/Makefile so that you use the proper cross compiling gcc. For mkyaffs2img, just running make in tartools/yaffs2/utils/ should give you a binary. You are on your own in getting stuff compiled, but it should be easy to figure out from the Makefile.
* How to use this (the easy part)
Just boot your phone in recovery mode with the correct recovery.img (one that has adb shell as root + busybox installed with symlinks to tar, md5sum etc) and connect it to your pc/laptop/server. Then run the nandroid.sh script. If something is wrong or missing, it will tell you.
* What about restore?
If you have the dev phone or have root on the G1 and flashed the engineering/dev bootloader, then you can power on your phone while holding camera to get into the bootloader/SPL. It should then show some androids on skateboards (if not, you don't have the engineering/dev bootloader). Plug in your USB cable and push back until it says FASTBOOT instead of Serial0. Now you can fire up fastboot flash {partition} {file.img}.
Fastboot itself is part of the android SDK. If you download and compile your own mydroid build, it should sit in mydroid/out/host/linux-x86/bin/fastboot Perhaps in a future version I'll include a restore script, but for now I don't see the need.
One tip, if you are in fastboot mode on your phone and 'fastboot devices' doesn't show anything, try as root. You might need to edit your udev setup to allow your user to access the phone's usb device (which is different from the one you're in when in recovery or normal boot).
* Where's the source?
Sources are included. They are copies of the Android sources with various changes mostly made by Brainaid.
Everything in the zip is also also available through subversion:
svn co http://svn.infernix.net/nandroid/
Note that I DO NOT recommend checking out the latest revision unless you know damn well what you are doing. No guarantees if you play with fire. At the very least do diff against the latest released version.
* Credits
Bash script hacked together by infernix.
dump_image adapted from flash_image and extended by Brainaid.
Original mtdutils source and mkyaffs2image source by Google.
[1] http://forum.xda-developers.com/showthread.php?t=455860
[2] http://forum.xda-developers.com/showthread.php?t=443713
[3] http://www.gotontheinter.net/fastboot
DOWNLOAD HERE or:
wget http://dx.infernix.net/nandroid-2.0.zip
Originally Posted by trmacdonal
How to Restore your phone on a Windows PC using a Nandroid backup
I am going to assume you already have a Nandroid backup created on your SD card using JF 1.31's recovery Alt-B feature. The backup will create a folder called nandroid on your SD.
What you need:
The Android SDK:
Fastboot Windows Binary in this post:http://forum.xda-developers.com/showpost.php?p=3083753&postcount=1
From your Nandroid backup you need three files:
data.img
system.img
boot.img
Steps to restore your phone
1) Put the files Adb and AdbWinApi.dll from the tools folder in the Android SDK into C:\WINDOWS\System32 folder on your PC. Substitute the correct drive letter if windows is not installed on you C: drive
2) Put the Windows Fastboot.exe into the C:\WINDOWS\System32 folder on your PC
3) Create a folder on the C: drive of your PC called android. The path should be C:\Android.
4) Copy the Nandroid backup files data.img, system.img, and boot.img from your SD card to the folder called Android you created by mounting your SD card as removable disk.
5) Unplug the USB cord and power off your phone
6) Power up your phone by holding CAMERA+POWER, you should see three androids on skateboards. If you don't see this go install the Engineering boot loader
7) Plug the USB cord back into your phone and press back. The screen on your phone should say fastboot.
8) Make sure your pc is using the correct driver. Open the device manager on your pc. It is helpfull to have all other USB storage devices besides your phone unplugged for this part. Look for a USB Mass Storage device in the list of the USB devices. Right click on it and update the driver. Pick the option to browse for a driver on your pc. The driver is located in the Android SDK your downloaded in the folder called usb_driver. If this is done right you will now see a device called HTC Dream
9) Press start, go to run and type cmd (If you are on Vista just type cmd in the search box and hit enter). The command prompt will pop up.
10) Type cd C:\android
then enter the following commands:
fastboot flash system system.img
it will say Sending, then writing and say OKAY if it was successful
then type
fastboot flash userdata data.img
wait for the second OKAY and type
fastboot flash boot boot.img
wait for the second OKAY and type
fastboot reboot
Your phone should now be restored exactly as you had it when it was backed up.
This sounds great! I just recently used the other script to make a backup, but this sounds like it's been a bit more polished
I attempted to compile the yaffs2 utils under OS X 10.5 and I encountered a problem during linking:
ln -s ../yaffs_ecc.c yaffs_ecc.c
gcc -c -I/usr/include -I.. -O2 -Wall -DCONFIG_YAFFS_UTIL -Wshadow -Wpointer-arith -Wwrite-strings -Wstrict-prototypes -Wmissing-declarations -Wmissing-prototypes -Wredundant-decls -Wnested-externs -Winline -static yaffs_ecc.c -o yaffs_ecc.o
gcc -c -I/usr/include -I.. -O2 -Wall -DCONFIG_YAFFS_UTIL -Wshadow -Wpointer-arith -Wwrite-strings -Wstrict-prototypes -Wmissing-declarations -Wmissing-prototypes -Wredundant-decls -Wnested-externs -Winline -static mkyaffsimage.c -o mkyaffsimage.o
mkyaffsimage.c:120: warning: ‘yaffs_CalcNameSum’ defined but not used
gcc -o mkyaffsimage yaffs_ecc.o mkyaffsimage.o
ld: absolute addressing (perhaps -mdynamic-no-pic) used in _process_directory from mkyaffsimage.o not allowed in slidable image
collect2: ld returned 1 exit status
make: *** [mkyaffsimage] Error 1
Any thoughts? I'm heading off to google to figure out what a 'slidable image' is.
-jwb
No idea, and I don't have access to a mac. You could change the makefile and skip compiling of mkyaffsimage, you only need mkyaffs2image, but you'll probably get similar errors.
infernix said:
No idea, and I don't have access to a mac. You could change the makefile and skip compiling of mkyaffsimage, you only need mkyaffs2image, but you'll probably get similar errors.
Click to expand...
Click to collapse
Google seems to imply its a common issue, possibly solved in a later XCode rev.. We'll see how that pans out.
mkyaffs2image on mac
It built just fine for me when I did the whole mydroid build. It's in out/host/darwin-x86/bin.
Is there some way to mount the yaffs2 image, though? Does one need to do the kernel patch etc on a linux box and then use loop?
Wow this a awesome. Thanks for all the hard work everyone.
you are are ridiculous.....ly good!
so you telling me if we have root and jf's modified rc30 v1.2 and be brick our phone, there's another quarter in your pocket after you die (game over) and you can start a whole new game?
hbguy
hbguy said:
so you telling me if we have root and jf's modified rc30 v1.2 and be brick our phone, there's another quarter in your pocket after you die (game over) and you can start a whole new game?
Click to expand...
Click to collapse
If you have flashed the engineering bootloader (the androids on skateboards appear when powering on your phone while holding camera button), yes.
haha very nice ::borat voice::
P.S. For the borat fans out there, he is making a new movie, insider info baby
hbguy!
Error messages but still makes backups?
I got the following when I ran nandroid.sh on my mac. Are the error messages safe to disregard -- it seems like it worked:
Code:
nandroid v2.0
mounting system and data read-only on device
error: device not found
error: device not found
start adb portforward on port 4531
error: device not found
checking free space on cache
error: device not found
./nandroid.sh: line 152: [: -le: unary operator expected
pushing tools to /cache: dump_image-arm... error: device not found
done
Getting md5sum on device for boot...error: device not found
done ()
Dumping boot from device over tcp to backup_2008-12-19//boot.img...
error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for boot.img
Getting md5sum on device for recovery...error: device not found
done ()
Dumping recovery from device over tcp to backup_2008-12-19//recovery.img...
error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for recovery.img
Getting md5sum on device for misc...error: device not found
done ()
Dumping misc from device over tcp to backup_2008-12-19//misc.img...
error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for misc.img
Getting md5sum on device for tar for system...error: device not found
done ()
Dumping tar file for system backup_2008-12-19//system.tar...error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for system.tar
To convert system.tar to system.img, run the following commands as root:
mkdir /tmp/-system-tmp
tar x -C /tmp/-system-tmp -f backup_2008-12-19//system.tar
/Users/brock/Inbox/nandroid-2.0/mkyaffs2image /tmp/-system-tmp/system backup_2008-12-19//system.img
Make sure that /tmp/-system-tmp doesn't exist befor you extract, or use different paths.
Remember to remove the tmp dirs when you are done.
Getting md5sum on device for tar for data...error: device not found
done ()
Dumping tar file for data backup_2008-12-19//data.tar...error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for data.tar
To convert data.tar to data.img, run the following commands as root:
mkdir /tmp/-data-tmp
tar x -C /tmp/-data-tmp -f backup_2008-12-19//data.tar
/Users/brock/Inbox/nandroid-2.0/mkyaffs2image /tmp/-data-tmp/data backup_2008-12-19//data.img
Make sure that /tmp/-data-tmp doesn't exist befor you extract, or use different paths.
Remember to remove the tmp dirs when you are done.
Getting md5sum on device for tar for cache...error: device not found
done ()
Dumping tar file for cache backup_2008-12-19//cache.tar...error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for cache.tar
To convert cache.tar to cache.img, run the following commands as root:
mkdir /tmp/-cache-tmp
tar x -C /tmp/-cache-tmp -f backup_2008-12-19//cache.tar
/Users/brock/Inbox/nandroid-2.0/mkyaffs2image /tmp/-cache-tmp/cache backup_2008-12-19//cache.img
Make sure that /tmp/-cache-tmp doesn't exist befor you extract, or use different paths.
Remember to remove the tmp dirs when you are done.
removing tools from /cache: dump_image-arm... error: device not found
done
unmounting system and data on device
error: device not found
error: device not found
Backup successful.
brocktice said:
I got the following when I ran nandroid.sh on my mac. Are the error messages safe to disregard -- it seems like it worked:
Code:
nandroid v2.0
mounting system and data read-only on device
error: device not found
[/QUOTE]
This didn't work at all.
What I don't really get is that it continues at all, if the device isn't connected it should not even start.
It's a bit hard to tell because I don't have a mac here. Please run the following commands on your mac and post them:
[code]which adb
adb devices
BLAH=foo
echo "without $BLAH"
echo "with ${BLAH}"
I'll look at this soon, should have access to a mac sometime in the next few weeks
Click to expand...
Click to collapse
brocktice said:
I got the following when I ran nandroid.sh on my mac. Are the error messages safe to disregard -- it seems like it worked:
Code:
nandroid v2.0
mounting system and data read-only on device
error: device not found
error: device not found
start adb portforward on port 4531
error: device not found
checking free space on cache
error: device not found
./nandroid.sh: line 152: [: -le: unary operator expected
pushing tools to /cache: dump_image-arm... error: device not found
done
Getting md5sum on device for boot...error: device not found
done ()
Dumping boot from device over tcp to backup_2008-12-19//boot.img...
error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for boot.img
Getting md5sum on device for recovery...error: device not found
done ()
Dumping recovery from device over tcp to backup_2008-12-19//recovery.img...
error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for recovery.img
Getting md5sum on device for misc...error: device not found
done ()
Dumping misc from device over tcp to backup_2008-12-19//misc.img...
error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for misc.img
Getting md5sum on device for tar for system...error: device not found
done ()
Dumping tar file for system backup_2008-12-19//system.tar...error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for system.tar
To convert system.tar to system.img, run the following commands as root:
mkdir /tmp/-system-tmp
tar x -C /tmp/-system-tmp -f backup_2008-12-19//system.tar
/Users/brock/Inbox/nandroid-2.0/mkyaffs2image /tmp/-system-tmp/system backup_2008-12-19//system.img
Make sure that /tmp/-system-tmp doesn't exist befor you extract, or use different paths.
Remember to remove the tmp dirs when you are done.
Getting md5sum on device for tar for data...error: device not found
done ()
Dumping tar file for data backup_2008-12-19//data.tar...error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for data.tar
To convert data.tar to data.img, run the following commands as root:
mkdir /tmp/-data-tmp
tar x -C /tmp/-data-tmp -f backup_2008-12-19//data.tar
/Users/brock/Inbox/nandroid-2.0/mkyaffs2image /tmp/-data-tmp/data backup_2008-12-19//data.img
Make sure that /tmp/-data-tmp doesn't exist befor you extract, or use different paths.
Remember to remove the tmp dirs when you are done.
Getting md5sum on device for tar for cache...error: device not found
done ()
Dumping tar file for cache backup_2008-12-19//cache.tar...error: device not found
done
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
md5sum verified for cache.tar
To convert cache.tar to cache.img, run the following commands as root:
mkdir /tmp/-cache-tmp
tar x -C /tmp/-cache-tmp -f backup_2008-12-19//cache.tar
/Users/brock/Inbox/nandroid-2.0/mkyaffs2image /tmp/-cache-tmp/cache backup_2008-12-19//cache.img
Make sure that /tmp/-cache-tmp doesn't exist befor you extract, or use different paths.
Remember to remove the tmp dirs when you are done.
removing tools from /cache: dump_image-arm... error: device not found
done
unmounting system and data on device
error: device not found
error: device not found
Backup successful.
Click to expand...
Click to collapse
I had this problem too but disconnecting and reconnecting the usb cable fixed it.
SplasPood said:
I had this problem too but disconnecting and reconnecting the usb cable fixed it.
Click to expand...
Click to collapse
Well the script is supposed to check for a device and stop when theres a problem.
also if this can happen at all then other things might go wrong on mac too. I think mac requires bash variables to be called like #{VAR} and doesn't handle $VAR for some reason.
update on mac issues
OK, it seems it was all a problem on my end -- didn't have the correct set-up. I now have the appropriate recovery image (thought I did, but I guess I didn't) and it seems to work, except for this:
Code:
Comparing md5sum...parseopts.c:76: setup_check: fopen '--status': No such file or directory
The images and such now have non-zero filesize, though. That's an improvement over before.
yeah i've gotten some more reports. will make it mac OS X compatible soonish
I can't seem to figure out how to get this to work. If someone who knows linux can IM me, that'd be great. (or is there a way to do this on XP?)
AIM:adventninja
Thanks in advance
Does this also back up radio and htc secure nand partitions?
tranks
backed up successfully.
for those who get errors in the script.
i assume you have installed modiffied recovery image + jesusfreke's rc30v2 and
before running the script check this.
this steps involves having linux i dont know how its done in windows maybe its the same i dont know.
1: disconnect usb cable
2: check that you have adb program in your path, eg: /usr/bin/adb
if you dont know what adb is, adb is a program to comunicate with phone via usb (its not the same as transfering files between pc and g1),
adb program is found in android-sdk-linux_x86-1.0_r2, unpack it, and copy adb to your path, just google and find latest android sdk.
once you downloaded sdk unpacked it and copied the executable file adb to /usr/bin go to next step.
3: boot the phone into recovery mode ( power up the phone and holding "power + home" keys and a triangle will appear on its screen.
4: in your pc open konsole, su root, and plug your USB G1
5: type adb devices
if the response to this command is "HTC G1 bla bla.. found.", then you are ready to execute the script, it will no give errors and you will backup its contents.
if you dont see HTC G1 words, then its likely your phone was detected as "USB MASS STORAGE", and we dont want that. we need that its detected as a "HTC DIRECT ACCESS DEVICE".
a: control +c
b: killall adb (this is important)
c: unplug USB, plug it in another port,
d: go to step 5
hope it helps.
infernix said:
* What is Nandroid Backup v2.0?
Nandroid Backup is a set of tools and a script that will enable anyone who has root on their G1 and has the engineering/dev spl bootloader [1] (or has a dev phone) + a recovery image with busybox and adbd running as root [2] to make full system backups. These can then be restored using the fastboot [3] commandline tool and your phone in SPL/bootloader mode (hold camera + power). This allows you to create regular backups of your entire phones NAND flash so that you can restore a backup when something breaks. Its backup method works on a level that allows you to completely break, wipe or corrupt any or all partitions and still restore the phone to a working state within a few minutes. This works great for those who use their G1 for normal activities but also want to test their ideas which might break the phone, or when not having an extra G1 to keep purely as a development phone.
* Requirements for use
- Android G1 phone in recovery mode with busybox installed, including appropriate symlinks to at least tar and md5sum, as well as 'adb shell' support running as root. I recommend using JesusFreke US RC30 or UK RC8 v1.2 recovery image. You can flash the RC30 v1.2 recovery.img on your G1 if you don't want to bother constructing your own image. Of course you are free to use your own recovery image and it will work if you set it up correctly.
- dump_image-arm and mkyaffs2image|mkyaffs2image-$ARCH compiled in the current dir, as well as root on a linux/mac (POSIX) machine for constructing system and data images. root is required because the uid, gid and file permissions need to be preserved while extracting and creating the yaffs2 images. You are free to run the script as a normal user and then run the appropriate commands yourself as root; the commands are printed when you run the script as a regular user.
If you don't trust the provided binaries, you are free to compile them yourself. The source for the tools are included. For dump_image, edit nandtools/android-imagetools/Makefile so that you use the proper cross compiling gcc. For mkyaffs2img, just running make in tartools/yaffs2/utils/ should give you a binary. You are on your own in getting stuff compiled, but it should be easy to figure out from the Makefile.
* How to use this (the easy part)
Just boot your phone in recovery mode with the correct recovery.img (one that has adb shell as root + busybox installed with symlinks to tar, md5sum etc) and connect it to your pc/laptop/server. Then run the nandroid.sh script. If something is wrong or missing, it will tell you.
* What about restore?
If you have the dev phone or have root on the G1 and flashed the engineering/dev bootloader, then you can power on your phone while holding camera to get into the bootloader/SPL. It should then show some androids on skateboards (if not, you don't have the engineering/dev bootloader). Plug in your USB cable and push back until it says FASTBOOT instead of Serial0. Now you can fire up fastboot flash {partition} {file.img}.
Fastboot itself is part of the android SDK. If you download and compile your own mydroid build, it should sit in mydroid/out/host/linux-x86/bin/fastboot Perhaps in a future version I'll include a restore script, but for now I don't see the need.
One tip, if you are in fastboot mode on your phone and 'fastboot devices' doesn't show anything, try as root. You might need to edit your udev setup to allow your user to access the phone's usb device (which is different from the one you're in when in recovery or normal boot).
* Where's the source?
Sources are included. They are copies of the Android sources with various changes mostly made by Brainaid.
Everything in the zip is also also available through subversion:
svn co http://svn.infernix.net/nandroid/
Note that I DO NOT recommend checking out the latest revision unless you know damn well what you are doing. No guarantees if you play with fire. At the very least do diff against the latest released version.
* Credits
Bash script hacked together by infernix.
dump_image adapted from flash_image and extended by Brainaid.
Original mtdutils source and mkyaffs2image source by Google.
[1] http://forum.xda-developers.com/showthread.php?t=455860
[2] http://forum.xda-developers.com/showthread.php?t=443713
[3] http://www.gotontheinter.net/fastboot
DOWNLOAD HERE or:
wget http://dx.infernix.net/nandroid-2.0.zip
Click to expand...
Click to collapse
hey infernix, did you happen to get a mac version of this together? thanks!

[Q] NVFlash

So I never used it before, since I thought it would be fairly straightforward. But nope, it turns out more complicated. First I wanted to backup the device, yet when I downloaded the zip file, I only see scripts. How the hell do you run them. Do I replace the files in the original folder and run the download.bat? Videos online show it formatting and installing prime when you run download.bat. After backing up I wanted to dual boot Ubuntu, yet those instructions aren't much more clear. Again do I replace those files in the zip with the original nvflash folder? How do I run the script once I put them in there? The Nvflash.exe doesnt help. And he says to put recovery.img, boot.img, and system.img in the /image folder (for prime), yet I have no idea where those are. NVFlash hasnt been explained well. I see videos online showing how to use it for basic root, but when it comes to anything else, everyone is silent.
Here:
www.androidroot.mobi/2011/06/13/nvflash-on-asus-transformer/
There is a link to the prime rom 1.4 needed too.
1- download nvflash
2-download the primerom 1.4
3-extract both zips
4- in the extracted primerom folder, copy system.img, boot.img, recovery.img
5-paste them in your nvfash folder
6-connect your tablet to ur pc n enter APX mode
7-double click on download.bat(yes it looks like a script)
8-sit and relax and your tablet will boot with thw prime rom.
9-now, boot into recovery (POWER+ DWN) THEN UP. wipe everything and install the rom of your choice.
Sent from my Transformer TF101 using Tapatalk
dude2k5 said:
So I never used it before, since I thought it would be fairly straightforward. But nope, it turns out more complicated. First I wanted to backup the device, yet when I downloaded the zip file, I only see scripts. How the hell do you run them. Do I replace the files in the original folder and run the download.bat? Videos online show it formatting and installing prime when you run download.bat. After backing up I wanted to dual boot Ubuntu, yet those instructions aren't much more clear. Again do I replace those files in the zip with the original nvflash folder? How do I run the script once I put them in there? The Nvflash.exe doesnt help. And he says to put recovery.img, boot.img, and system.img in the /image folder (for prime), yet I have no idea where those are. NVFlash hasnt been explained well. I see videos online showing how to use it for basic root, but when it comes to anything else, everyone is silent.
Click to expand...
Click to collapse
It's not easy to explain something that has so many uses and so little documentation. Try to find anything over at nvidia where this thing comes from and let us know how that goes:
Here is all I've gotten and it is just by typing in (either in linux or Win) this:
Code:
nvflash --help
Nvflash started
nvflash action [options]
action (one or more) =
--help (or -h)
displays this page
--cmdhelp cmd(or -ch)
displays command help
--resume (or -r)
send the following commands to an already-running bootloader
--quiet (or -q)
surpress excessive console output
--wait (or -w)
waits for a device connection (currently a USB cable)
--create
full initialization of the target device using the config file
--download N filename
download partition filename to N
--setboot N
sets the boot partition to partition N
--format_partition N
formats contents of partition N
--read N filename
reads back partition N into filename
--getpartitiontable filename
reads back the partition table into filename
--getbit filename
reads back BIT into filename
--getbct
reads back the BCT from mass storage
--odm C Data
ODM custom 32bit command 'C' with associated 32bit data
--go
continues normal execution of the downloaded bootloader
options =
--configfile filename
indicates the configuration file used with the following commands:
--create, --format_all
--bct filename
indicates the file containing the BCT
--sbk 0x00000000 00000000 00000000 00000000
indicates the secure boot key for the target device
--bl filename
downloads and runs the bootloader specified by filename
--odmdata N
sets 32bit customer data into a field in the BCT, either hex or
decimal
--diskimgopt N
sets 32bit data required for disk image convertion tool
--format_all
formats all existing partitions on the target device using the config file,
including partitions and the bct
--setbootdevtype S
sets the boot device type fuse value for the device name.
allowed device name string mentioned below:
emmc, nand_x8, nand_x16, nor, spi
--setbootdevconfig N
sets the boot device config fuse value either hex or decimal
--verifypart N
verifies data for partition id = N specified. N=-1
indicates all partitions
Intended to be used with --create command only.
--setbct
updates the chip specific settings of the BCT in mass storage to
the bct supplied,used with --create, should not be with --read,and
--format(delete)_all,format(delete)_partition,--download, and--read
--sync
issues force sync commad
--rawdeviceread S N filename
reads back N sectors starting from sector S into filename
--rawdevicewrite S N filename
writes back N sectors from filename to device starting from sector S
--updatebct <bctsection>
bctsection should refer to the section of the bct we are updating.
Curently we suport updates for following sections
<SDRAM> updates SdramParams and NumSdramSets fields
<DEVPARAM> updates DevParams, DevType and NumParamSets
<BOOTDEVINFO> updates BlockSizeLog2, PageSizeLog2 and PartitionSize
And this crazy nvflash utility has been the most useful small program I've had for the transformer and I think will remain that way. Some of the commands (e.g. when you insert the SBK or Secure Boot Key) seem like magic, and I've no idea where people have come up with these things. Other pieces of it are pretty clear like using --read {filename} to put a partition .img file on the PC as a backup of that numbered partition.
Sorry: I'm still learning this as well, and will be well . forever.

[Q] Flashing stock via fastboot error message

Hi, I want to (re-)flash the stock 4.1.2 rom on my Photon Q, because I recently run into some problems of the phone sending messages to the number 8737 even after I had removed the stock sms app.
This should be the right rsd file:
Code:
asanti_c_sprint-user-4.1.2-9.8.2Q-122_XT897_FFW-5-6-release-keys-cid9.xml.zip (MD5: 88f43a03d313bbcc262db78f15ac957c)
I'm on linux and I don't have any Windows system I could install and run RSDLite on. So I decided to take the fastboot way: I unzipped the above file and tried flashing the rom manually. But I always run in to the following error output:
Code:
# fastboot flash cdrom cdrom
(bootloader) Variable not supported!
target reported max download size of 31457280 bytes
Invalid sparse file format at header magi
error: write_sparse_skip_chunk: don't care size 22923264 is not a multiple of the block size 4096
fastboot: ../libsparse/sparse.c:143: write_all_blocks: Assertion `pad >= 0' failed.
Note that "fastboot devices" lists the Photon Q as "T069503UAP fastboot". The same or a similar error messages applies to "fastboot flash system system.img" etc. I use fastboot from the Fedora 20 "android-tools" package (version 20130123git98d0789-2).
Any ideas what's the problem here? Solution?
Thanks in advance!
It's dangerous to try and fastboot the items yourself. Would be better to borrow a Windows PC or something to use RSD (virtual machines are also NOT recommended for this).
But perhaps you should just try to fastboot the other partitions. Not sure 'cdrom' is needed. Either way, I strongly, STRONGLY advise against doing what you are doing.
Okay, thanks for your advice!
The same or similar error messages appear when flashing the other partitions (as already mentioned in the first post). Unfortunately, it's really hard to find somebody with a Windows system, at the moment. I thought RSDLite uses fastboot internally anyway.
I'm not sure if the FXZ images can be flashed as they are, via fastboot.
I believe they should be converted to the standard ext4 format via the simg2img.py pytoon script, before being usable.
I repeat I'm not sure, but I believe that hardly motorola's own format is handled correctly by the fastboot command.
Whatever, for your convenience, I attach the mentioned converter script.
Aside fastboot, can be used for a variety of other purposes, the ext4 images can be mounted straight in Linux via loopback device or extracted in windows with a bunch of tools, personally I use Ftk Imager.
Thanks, that tool is great! After conversion, I was indeed able to mount the system partition as follows:
Code:
# mount -o ro,loop system_converted.img /some/mnt/path
But it doesn't help with the other files (cdrom, boot.img, recovery.img), because they seem to have a different format. However, the system partition was all I wanted. Now, instead of reflashing, I'm going to compare the system partition's files (especially in the "app" folder) and see what might have caused my problem.
tuxor1337 said:
But it doesn't help with the other files (cdrom, boot.img, recovery.img),
Click to expand...
Click to collapse
The boot, recovery and similar partitions aren't written on top of a filesystem like /system or /data.
they are written as they are on top of the physical media.
you can safely flash them in any way: fastboot, restore by recovery and so on.
unlike the filesystem based partitions, they are always in the same format.
If you need to edit the boot or recovery content you need a special script to unpack and repack them, many android kitchens have it
I was just wondering whether flashing on Linux will work when using "moto fastboot" like this one: http://forum.xda-developers.com/showthread.php?t=1138092
I don't really need this functionality anymore. But out of curiosity: What do you think?
My photon has a broken USB connector, so I can't test it in first person.
Btw, I believe that testing is the only way to understand what is flashable and what not, obviously taking handy a good full nandroid backup.

[MOD] [root] [CHUWI] [Vi7]

This is a guide on rooting the new Chuwi Vi7 Phablet as a result of spending lots of hours on this proyect with the hope that others find it useful.
This is work in progress, do not attempt it if you are not ready to flash back the original rom in case you soft brick your Chuwi
PREREQUISITES:
A) For LINUX users:generally install the android-tools package so you have the adb command available.
In Manjaro linux and Arch Linux just do
Code:
sudo pacman -Sy android-tools
In Ubuntu probably
Code:
apt-get update && apt-get install android-tools
A) windows users would need to (presumibly; not tested)
For WINDOWS users:
install the intel drivers for android and user the attached adb.exe with dm-verity support
Most ADB.EXE do not have dm-verity. Try installing Java (prerequisite to install Android Studio) and installed Android Studio (download full package, but only install SDK part).
The file reported to work fine is android-studio-bundle-141.2117773-windows.exe
The ADB version is 1,011,200 bytes with date of 02/14/2015 07:12 PM.
1) (Recommended) Apply the over the air update; you know you have it when you can see the Google Playstore installed.
2) Connect your Chuwi Vi7 to your PC with a microusb cable
First we need the ability to write to the system partition so in order to do this, run these commands:
Code:
adb root
adb disable-verity
adb reboot
wait 30 seconds now we are going to do a backup of SYSTEM and DATA just in case
(if you are in Windows remove the ./ before system_068 and data_069)
This will take some minutes
Code:
adb boot recovery
Wait a few seconds until you are in the stock recovery
Code:
adb root
adb pull /dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID068 ./system_068
adb pull /dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID069 ./data_069
adb reboot
3) unzip the attached file and transfer all the individual files contained to the Chuwi´s /data/local/tmp folder
Code:
adb root
# Now we are going to push the whole folder contained in the archive we just extracted
adb push RootChuwiVi7 /data/local/tmp/
4) Now from a terminal run this command:
Code:
adb shell /system/bin/sh -x /data/local/tmp/vi7root
alternatively run
Code:
./rootnow
and that´s it!
Now open Root Verifier (it´s an app) to check if your Chuwi is rooted...
If you like my work dont forget to press the THANKS button and/or donate
TIPS: If you do not get prompted to allow root access by superSU, do adb root from the command line
If you need to flash the phablet here you can download the rom and flashing tool:
https://mega.nz/#!QVFCGDCa!oz4jXrxdsE6pJ4rVt4AlbUHN-VY9NwTF7SNfeir0mSk
Password: jopasaps
You need to install the intel drivers and the flash drivers and run Flash E2, load all the rom files, click on custom order, tick all the boxes, select generic usb, click on NEXT, turn off the phablet, then click on USB1 and very very quickly plug the phablet to your PC while holding VOLUME- you will see some activity in the screen and within 1 minute it will be ready.
If it is ready within 5 seconds then you did not load all the files. Depending on why your phablet is soft bricked it may be enough to flash only some of the files.
KNOWN ISSUES: Open Source superuser by koush does not work as the su binary needs recompiling. We are therefore using SuperSU by chain, I suggest you don't update SuperSU in the Play Store.
TROUBLESHOOTING: the command adb reboot ptest_clear is reported to work with soft bricked devices (put here as a courtesy, not needed in principle)
UPDATE: Download this file to update your SYSTEM partition to the latest version of the firmware, including some debloating and with English as default language. This update is done from recovery, through an adb push command
Thanks for this! I'm trying but can't get it to work. Running the script generates errors and I've boiled it down to doing the permissions -- I can't mount /system as RW no matter what syntax I've tried. I'm in the ADB shell and running under SU (#). Also tried mounting explicit as /dev/block/dm-0 but it still only comes back as "mount: Read-only file system".
Try again from the beginning, you will be able to mount read/write system now...
ALSO VERY IMPORTANT, download the new attachment and use instead ...
Thanks, I tried to disable verity before and it didn't work. I'll try again this time.
---------- Post added at 11:14 AM ---------- Previous post was at 11:11 AM ----------
Can you by any chance post your ADB.exe which has support for disable-verity command?
My adb is simple to install...
1) Install Manjaro linux
2) Run: pacman -Sy android-tools
and... that´s it! you get adb and fastboot
and no need to install android drivers
the sequence then I use to be able to write to the system partition on the Chuwi Vi7 is:
adb root
adb disable-verity (that needs to be done only once)
adb remount
Let me know whether it works in windows ...
TheAndroidGeek said:
Thanks, I tried to disable verity before and it didn't work. I'll try again this time.
---------- Post added at 11:14 AM ---------- Previous post was at 11:11 AM ----------
Can you by any chance post your ADB.exe which has support for disable-verity command?
Click to expand...
Click to collapse
casacristo said:
My adb is simple to install...
1) Install Manjaro linux
2) Run: pacman -Sy android-tools
and... that´s it! you get adb and fastboot
and no need to install android drivers
the sequence then I use to be able to write to the system partition on the Chuwi Vi7 is:
adb root
adb disable-verity (that needs to be done only once)
adb remount
Let me know whether it works in windows ...
Click to expand...
Click to collapse
For WINDOWS users:
I had various flavors of ADB.EXE and none of them had the dm-verity. Finally installed Java (prerequisite to install Android Studio) and installed Android Studio (download full package, but only install SDK part).
The file I used as android-studio-bundle-141.2117773-windows.exe
The ADB version is 1,011,200 bytes with date of 02/14/2015 07:12 PM.
Now rooted... but not sure what to do with this very low spec tablet I have so many other tablets (Onda, Teclast, Acer, etc).
Thanks casacristo!
Yeoh Master Shifu Arturo, its been awhile, how are you, only today notice your thread here, sorry for a little OT...
i own the first variance of x3(c3130), damn intel for making it so hard to root... :laugh:
Code:
[[email protected] ~]$ adb root
[COLOR="blue"]adbd cannot run as root in production builds[/COLOR]
[[email protected] ~]$ adb disable-verity
[COLOR="blue"]error: closed[/COLOR]
i was trying a different approach, root via recovery & i wonder if you have tried the FlsTool, can't figured out the correct commands to repack back ported custom recoveries...
Code:
[URL="https://github.com/android-ia/vendor_intel_build/blob/master/FlsTool/FlsTool"]FlsTool[/URL]
FlsTool v.1.21
This tool can do several different operations of FLS files.
Use the 'Action' option to select to required operation.
Actions:
-p [ --pack ] Packing multiple FLS files into one
-i [ --inject ] Inject NVM, Certificates or Security into FLS file
-x [ --extract ] Extract all image parts from the FLS file(s)
--extract-fls Extract embedded files from the FLS file(s)
--extract-prg Extract PRG file
-b [ --to-bin ] Convert a single Hex file to binary file
--hex-to-fls Create an Fls from a Prg file
--sign Formerly known as FlsSign
--to-fls2 [ arg ] Force output file format to Fls2
--to-fls3 [ arg ] Force output file format to Fls3
-d [ --dump ] Dump the meta data of an FLS file.
--sec-pack Dump all SecPack data of an FLS file.
HexToFls options:
--prg arg Choose a PRG file to create the Fls from
--psi arg Add a PSI to the Fls file (replaces if '-r' option)
--ebl arg Add an EBL to the Fls file (replaces if '-r' option)
--meta arg Inject any meta file to the Fls file (Equal to --version or -v in HexToFls)
--xml arg Add an XML file to the Fls file (replaces if '-r' option)
--zip arg Add a ZIP file to the Fls file (replaces if '-r' option)
--script arg Add a Script file to the Fls file (replaces if '-r' option)
--tag arg Specifies the memory region tag to insert the input file (replaces if '-r' option)
Inject options:
-n [ --nvm-path ] arg Path to the NVM input files
Generic Options:
-o [ --output ] arg Output path
-r [ --replace ] [ arg ] Defaults to replace when trying to add a section which is already existing
-v [ --verbose ] [ arg ] Set verbosity
--prompt [ arg ] Prompt before quitting
--version Show the version of this tool
-h [ --help ] Show command line help
Please specify an input file
@jasonx3
try this file:
https://mega.co.nz/#!UMVwTQIR!w04Pidyd2TRDLyWnqMfCL_qxXRtJmapD0UFmp0hQnx4
it is a full rom with root and gapps, with a script that flashes it (provided
you have a root shell)
@Vadim Shved
Can you be more specific?
I use link2sd without problems to convert apps to system apps.
do this:
adb root
adb remount
what is the output?
Hello Yuweng, good to see you, yes it has been a while... I don´t change hardware very frequently nowadays and not always I feel I can make a substantial contribution to the community
I have not used FlsTool but I have something to offer you....
Download this file:
https://mega.co.nz/#!UMVwTQIR!w04Pidyd2TRDLyWnqMfCL_qxXRtJmapD0UFmp0hQnx4
It is a complete dd copy of my system partition with a script that will verify the md5sum is correct and flash it.
I think this should work fine if you can be root though a recovery.
This system image has already root, busybox, google updates integrated
yuweng said:
Yeoh Master Shifu Arturo, its been awhile, how are you, only today notice your thread here, sorry for a little OT...
i own the first variance of x3(c3130), damn intel for making it so hard to root... :laugh:
Code:
[[email protected] ~]$ adb root
[COLOR="blue"]adbd cannot run as root in production builds[/COLOR]
[[email protected] ~]$ adb disable-verity
[COLOR="blue"]error: closed[/COLOR]
i was trying a different approach, root via recovery & i wonder if you have tried the FlsTool, can't figured out the correct commands to repack back ported custom recoveries...
Code:
[URL="https://github.com/android-ia/vendor_intel_build/blob/master/FlsTool/FlsTool"]FlsTool[/URL]
FlsTool v.1.21
This tool can do several different operations of FLS files.
Use the 'Action' option to select to required operation.
Actions:
-p [ --pack ] Packing multiple FLS files into one
-i [ --inject ] Inject NVM, Certificates or Security into FLS file
-x [ --extract ] Extract all image parts from the FLS file(s)
--extract-fls Extract embedded files from the FLS file(s)
--extract-prg Extract PRG file
-b [ --to-bin ] Convert a single Hex file to binary file
--hex-to-fls Create an Fls from a Prg file
--sign Formerly known as FlsSign
--to-fls2 [ arg ] Force output file format to Fls2
--to-fls3 [ arg ] Force output file format to Fls3
-d [ --dump ] Dump the meta data of an FLS file.
--sec-pack Dump all SecPack data of an FLS file.
HexToFls options:
--prg arg Choose a PRG file to create the Fls from
--psi arg Add a PSI to the Fls file (replaces if '-r' option)
--ebl arg Add an EBL to the Fls file (replaces if '-r' option)
--meta arg Inject any meta file to the Fls file (Equal to --version or -v in HexToFls)
--xml arg Add an XML file to the Fls file (replaces if '-r' option)
--zip arg Add a ZIP file to the Fls file (replaces if '-r' option)
--script arg Add a Script file to the Fls file (replaces if '-r' option)
--tag arg Specifies the memory region tag to insert the input file (replaces if '-r' option)
Inject options:
-n [ --nvm-path ] arg Path to the NVM input files
Generic Options:
-o [ --output ] arg Output path
-r [ --replace ] [ arg ] Defaults to replace when trying to add a section which is already existing
-v [ --verbose ] [ arg ] Set verbosity
--prompt [ arg ] Prompt before quitting
--version Show the version of this tool
-h [ --help ] Show command line help
Please specify an input file
Click to expand...
Click to collapse
Mine is a dual-sim c3130, ro.secure=1, ro.adb.secure=1, no adb while at stock 3e recovery, fastboot flash recovery twrp-recovery.img doesn't work, non of the existing exploit rooting software works, in fact, nothing works on this piece of sh#t but its so cheap... :laugh:
Got mine for less than a month, its a rebrand of Teclast X70, only last week the oem release the firmware, thats where i found out about FlsTool, its actually also available on Windows, i'll leave the linux copy here for everyone to explore...
Thanks! and by all means let us know if you succeed...
yuweng said:
Mine is a dual-sim c3130, ro.secure=1, ro.adb.secure=1, no adb while at stock 3e recovery, fastboot flash recovery twrp-recovery.img doesn't work, non of the existing exploit rooting software works, in fact, nothing works on this piece of sh#t but its so cheap... :laugh:
Got mine for less than a month, its a rebrand of Teclast X70, only last week the oem release the firmware, thats where i found out about FlsTool, its actually also available on Windows, i'll leave the linux copy here for everyone to explore...
Click to expand...
Click to collapse
casacristo said:
@Vadim Shved
Can you be more specific?
I use link2sd without problems to convert apps to system apps.
do this:
adb root
adb remount
what is the output?
Click to expand...
Click to collapse
I did everything from your tutorial. Root checker says that root is present. BUT! I cant do opearations with system partiotion. I tried to: 1)adb root 2)adb remount. After that in command promt I see that remount succeeded. Root checker say that root is present... But I still cant do anything. System partiotion cant be r/w
Edit: Sorry, but I thing that it is a problem of some apps that are not ready for android 5.1.x
Is there original rom available anywhere with tools to flash it? (got my vi7 in a state where it show only first "chuwi" logo, no "intel" logo - just black screen (but PC for example sees ADB interface; unfortunately "no permission"). I'm hoping that's only software problem.
Edit: CRANE_EVB firmware (seems to be some vi7 compatible device, not vi7 itself) finally worked. Required that I force (in devices manager) "intel usb driver for android devices" to be used for my detected chuwi vi7 "adb interface", then "adb.exe reboot ptest_clear" and it starts, no more black screen, no more "PTEST VER 1.41" problem etc.
Anyway still looking for original vi7 rom (not that crane_evb thing).
Anyone dare to flash TWRP pack with FlsTool, it should just brick the recovery only, if it doesn't work :fingers-crossed: then just flash back stock 3e recovery...
WARNING : Might brick your Vi7 but then again, you have the Firmware uploaded by OP to unbrick it... :laugh:
You might need to unlock the bootloader too...
Code:
adb reboot fastboot
fastboot oem unlock confirm
Updates - 01-Sept-2015
Huge Thanks to best98 for carrying out numerous of tests... :good:
Conclusion : No point to further develop custom recoveries, after unlocking bootloader, vi7 will refuse to boot unless you press Vol+ for 3 seconds then only it will boot up normally, no one would wanna do that...
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
best98 said:
Hi
So, I tried to flash stock 3e recovery..
Code:
"Warning: Chip mismatch. HW is [Sofia_3G_R] SW expects [Sofia_3G]
Device synchronized.
Using: Faster CRC, Writing all blocks , Skip data CRC , Skip protocol CRC
Start downloading item 'CUST:recovery.fls'' from file 'C:\Android\Chuwi_V7\stock-3e-recovery.fls''.
Checksum OK (0x0000)
Process time was 656 msec.
Total time was 1359 msec.
Channel 1 is succesfully closed."
Still boots with the green/red/black screen..
Did the fastboot eom lock
Code:
PS C:\> fastboot oem lock
...
(bootloader) Please confirm the device state action using the UI.
(bootloader) got key event 1
(bootloader) EV_DOWN received
(bootloader) got key event 2
(bootloader) EV_POWER received
(bootloader) Userdata erase required, this can take a while...
OKAY [ 11.506s]
finished. total time: 11.511s
Now, got the bootloop.. -> flashing the whole firmware : boots ok.
adb reboot fastboot
fastboot oem unlock
Code:
PS C:\> fastboot oem unlock
...
(bootloader) Please confirm the device state action using the UI.
(bootloader) got key event 1
(bootloader) EV_DOWN received
(bootloader) got key event 2
(bootloader) EV_POWER received
(bootloader) Userdata erase required, this can take a while...
OKAY [ 11.299s]
finished. total time: 11.300s
Black/green/red screen..
fastboot format cache + fastboot format data = same Black/green/red screen..
I hit 'Vol+' it goes forward.. shows Intel logo and boots..
Pierrick
Click to expand...
Click to collapse
fastboot oem unlock confirm
gets
< waiting for device >
and nothing else happens
yuweng said:
Anyone dare to flash TWRP pack with FlsTool, it should just brick the recovery only, if it doesn't work :fingers-crossed: then just flash back stock 3e recovery...
WARNING : Might brick your Vi7 but then again, you have the Firmware uploaded by OP to unbrick it... :laugh:
You might need to unlock the bootloader too...
Code:
adb reboot fastboot
fastboot oem unlock confirm
Click to expand...
Click to collapse
Is it possible to overclock this device? 900mhz.... it sucks.
Hmm.. I could try.. nothing to loose, but can't get the communication to work.
I unlocked the bootloader throug the Developer Option menu. Is it enough ?
yuweng said:
Anyone dare to flash TWRP pack with FlsTool, it should just brick the recovery only, if it doesn't work :fingers-crossed: then just flash back stock 3e recovery...
WARNING : Might brick your Vi7 but then again, you have the Firmware uploaded by OP to unbrick it... :laugh:
You might need to unlock the bootloader too...
Code:
adb reboot fastboot
fastboot oem unlock confirm
Click to expand...
Click to collapse
Thank You so much for participating in Development... :good:
Fyi, OP can't test b'cos he drop & break his vi7 while i'm having a different variance of x3...
First you need to unlock the bootloader & if you didn't then it will brick your vi7 but then again, you guys have the firmware to unbrick it...
Steps
If you're using Windows then download fastboot from here, if you're using linux then follow tips from OP
To reboot to fastboot => adb reboot fastboot -> There is no intel Droidboot, only green distorted screen but fastboot command works
To unlock bootloader -> fastboot oem unlock then follow PC on-screen for instructions & for formatting data & cache partition too. Mine have to issue the command fastboot oem unlock confirm
After this to reboot -> fastboot reboot
At PC, setup intel USB driver -> right click -> Run As Administrator
Start FlsTool -> Switch off your vi7 -> wait awhile -> Click at Next -> Click Start USB1 -> Plugin your vi7 & it'll download
After boot up Android -> adb reboot recovery & if TWRP doesn't boot then unplug USB, press & hold Power for 10 seconds & it power off then follow the same procedure to reinstall back stock 3e recovery
For more info, refer to the FlsTool attach pdf file for details
Additional info
At the Russian forum mentioned you'll need to check the option Manual (no auto start) while on my x3 with default Auto Start works fine...
Hi
Not changing the bootloader butusing a mix of the OP script and Chinese tablet -Intel Root- script worked.
One of the big deal was to have the ADB compatibility with "disable-verity" which is the last release.
Now, I will try to focus on TWRP.. but FLS with COM to USB mapping makes it a little bit complicated !
Pierrick
OK.. just tried this, and now, I have a green screen ..
Rolling back the 3e recovery worked but the result is still showing me, black/green and red lines.
Right now, tablet does not boot anymore, except those lines in green/black and red.. where no text is written - looks like locked inl in fastboot.
Willing to hear from you to get back the control of the tablet
Here are the settings I used - thumbnail !
BTW - attaching adb.exe that handles the disable-verity
yuweng said:
Thank You so much for participating in Development... :good:
Fyi, OP can't test b'cos he drop & break his vi7 while i'm having a different variance of x3...
First you need to unlock the bootloader & if you didn't then it will brick your vi7 but then again, you guys have the firmware to unbrick it...
Steps
If you're using Windows then download fastboot from here, if you're using linux then follow tips from OP
To reboot to fastboot => adb reboot fastboot -> There is no intel Droidboot, only green distorted screen but fastboot command works
To unlock bootloader -> fastboot oem unlock then follow PC on-screen for instructions & for formatting data & cache partition too. Mine have to issue the command fastboot oem unlock confirm
After this to reboot -> fastboot reboot
At PC, setup intel USB driver -> right click -> Run As Administrator
Start FlsTool -> Switch off your vi7 -> wait awhile -> Click at Next -> Click Start USB1 -> Plugin your vi7 & it'll download
After boot up Android -> adb reboot recovery & if TWRP doesn't boot then unplug USB, press & hold Power for 10 seconds & it power off then follow the same procedure to reinstall back stock 3e recovery
For more info, refer to the FlsTool attach pdf file for details
Additional info
At the Russian forum mentioned you'll need to check the option Manual (no auto start) while on my x3 with default Auto Start works fine...
Click to expand...
Click to collapse

GUIDE: Visible Midnight (Wingtech WTVIS01) Backup, Restore, Root, Bootloader-unlock and making partition's read-write.

So I've became the lucky owner of two of these devices, and after hosing one and having to rebuild from scratch I want to provide some helpful information on rooting, backing up the device and general info that may or may-not be needed! So let's start this party off right!
These commands posted are for the Linux terminal, add python if using windows or play with the command line of mtkclient to figure things out, I can't assume what everyone OS's are.......
1. get yourself mtkclient from here : https://github.com/bkerler/mtkclient
follow all the steps regarding setup regardless if on Linux or Windoze!
2. BACK-UP the Full device using mtkclient, doing so will save yourself a lot of aggravation that I endured during my endeavors! This will do a Full back-up of the device by partition and place in a single file for making restore painless.
Power OFF the phone
Issue the mtkclient command via Terminal
Code:
mtk rf flash.bin
HOLD VOL+ & VOL- and plug-in the USB-C, if done correctly the phone will go into brom.
Once done backing up ( Total Time is around 60 minutes or less ) we're going to issue the last command, this resets mtkclient safely)
Code:
mtk reset
2a. Restoring you're Device
Now we're going to issue THREE mtk commands, the first is, assuming you're working in the same directory you back-up the file to.
Code:
mtk wf flash.bin
Without un-plugging, issue the next to wipe all data for a full reset.
Code:
mtk e metadata,userdata,md_udc
followed by reset
Code:
mtk reset
In the extreme case I suffered, you need to let the phone die completely if unable to enter brom the normal way, once dead follow the process as if you just turned it off.
This situation came about while I began to figure out how to get twrp working on the device.
Total size of this back-up will be around 32GB, so store in a safe place.. Also, DO NOT SHARE THIS IMAGE WITH ANYONE!!!! It contains all of the phone's sensitive info (IMEI)
Now let's talk rooting with or without bootloader-unlocked.
The good new's about this device is we can use mtkclient to bypass unlocking the bootloader for flashing a rooted boot.img patched by Magisk, the bad new's is that the phone will default to boot_b and not the boot the root boot.img so unlocking the bootloader is a must.
adb install app-release.apk that is attached, this Magisk that is designed for mtk devices and frankly has worked the best for me, once installed we're going to back-up the stock boot with the following commands using mtkclient.
Code:
mtk r boot_a boot.img
mtk reset
this will be placed in you mtkclient directory and will need transferred to the storage for patching by the Magisk app. once done we will transfer the file back to our mtkclient directory.
boot once again back into brom and issue the command
Code:
mtk w boot_a magisk_patched.img
mtk reset
keep in mind that each patched boot.img will be named different so this is not a copy and paste thing currently.
however, if you want to install an already patched version of the boot.img you can download the attached boot.img, place into your mtkclient directory and issue this command
Code:
mtk w boot_a magisk_patched-23001_nx6U2.img
mtk reset
For bootloader-unlocking, just follow the read-me file for more in-depth instructions, however this will get you going regarding the unlock.
boot back into brom and issue the following commands, if done correctly the bootloader is now unlocked. However this is needed for simple root, just flash the attached boot.img
Code:
mtk da seccfg unlock
mtk e metadata,userdata,md_udc
mtk w vbmeta vbmeta.img.empty
mtk reset
This particular guide is addressing Super.img read-writable, focusing on making all partitions write-able for the reason updating the phone with GSI Images or just needing access to add / remove files on the phone.
I found this post most helpful regarding super.img, as i had issue at first understanding boot-loops at first. https://forum.xda-developers.com/t/...s-rw-in-super-partition.4120963/post-87112415
This is assuming you are now comfy with brom, familiar with using mtk and also on Linux.
I've already done all the work need for converting hex to dec, and is a start copy of my note's and the steps I took to get things working. I'll attach the file as well for off-line use if needed as well.
First we need to back-up the super.img from the brom using the following command with-in the mtkclient directory. make a copy of this before we begin and keep in a safe place!!!
Code:
mtk r super super.img
once done we will use this tool to break down the image's into readable partition's using linux.
[TOOL][WIN,LIN,AND,DARW] Super image tools | extract or make partitions RW in super partition
Disclaimer: Super image tools was made for testing and educational purposes, ME is not responsible for what you do on/with your device using our tools, you must agree that you using our tools on your own risk, I am not responsible for anything...
forum.xda-developers.com
once you have your super.img placed into the new extracted directory, we're going to issue a command using terminal from said directory.
Code:
./superunpack.x64 super.img
next we're going to create THREE folders call system, vendor, product. ( Vendor & Product is optional if editing system only )
So lets start with system as most will only likely be editing that for rw access, so let's get down to it.
Code:
e2fsck -f system_a.ext4
resize2fs system_a.ext4 2G
e2fsck -y -E unshare_blocks system_a.ext4
e2fsck -fy system_a.ext4
sudo mount -t ext4 -o,rw system_a.ext4 system
now you're ready for system edits, once done we need to unmount the system using this command
Code:
sudo umount system
next we need to fix the system and resize it so we can add it back into the super.img following these commands.
Code:
e2fsck -fy system_a.ext4
resize2fs system_a.ext4 353376
once done we can use DD the system back into super,img, keep in mind this takes a very long time as it need to read the block and search for the offset that we're using.
Code:
dd if='system_a.ext4' of='super.img' bs=1 seek=2315255808 count=1447428096 conv=notrunc
once done we need to move the new super.img to our mtkclient folder, and flash using
Code:
mtk w super super.img
mtk reset
if done correctly it will boot with read / write access to the system partition.
again I've attached my notes that also include Vendor & Product to keep this thread to a minimum! however i will include partition sized and dd instruction here for vendor, product & system for short hand viewing on-line.
SYSTEM
e2fsck -fy system_a.ext4
resize2fs system_a.ext4 353376
dd if='system_a.ext4' of='super.img' bs=1 seek=2315255808 count=1447428096 conv=notrunc
PRODUCT
e2fsck -fy product_a.ext4
resize2fs product_a.ext4 461253
dd if='product_a.ext4' of='super.img' bs=1 seek=1048576 count=1889292288 conv=notrunc
VENDOR
e2fsck -fy vendor_a.ext4
resize2fs vendor_a.ext4 103509
dd if='vendor_a.ext4' of='super.img' bs=1 seek=1890582528 count=423972864 conv=notrunc
Last but not least, if anything this the most important part regarding Development.
Attached is the Project config make file, I've not currently tried to build this as I'm still digging into this device. However it is a nice Find as it has the build condition as well as the driver info.
some might recall this as a /proc/config.gz file but again we have no kernel source but clearly it's not impossible to build having all the info, but it's a long road.

Categories

Resources