Database Info

I killed recovery in my phone. Please help!

Hello guys!
Recently I've acted like an idiot and now I am asking for help.
I have a new smartphone - Gionee gn8001 (Marathon M5 Plus). It is a new model, I've bought it in China. I rooted it via Kingroot. But, as every phone in China this one does not have gapps integrated into it's ROM. That's why I wanted to install any custom recovery into it. I have not found a firmware or recovery scecifically for this phone so I decided to try and flash recovery from another model using the same CPU (MTK6753). I've downloaded recovery from Elephone P8000, which is very close to mine. Then I've flashed it into my phone using MTK MobileUncle Tool. After that I cannot enter into the recovery at all. The phone is still working but recovery just reboots and that's all.
I have several questions...
1)How SPFlash tool should work when I cannot extract a battery from the phone? The phone starts then I connect it to USB, SPFlash tool cannot work. This is why i have not extracted my own recovery from it. To avoid this in future, I want to know how this should be done?
2)Any suggestions except "wait till someone will make a recovery for this phone model"?
3)After I rooted the phone, it's OTA upgrade program recommended a full restore. I've downloaded the file, it's 1.5Gb of data, I think it is a full OS image. And it looks like one. BUT it's scatter file is not a full one, it's very brief:
preloader 0x0
pgpt 0x0
proinfo 0x80000
nvram 0x380000
protect1 0x880000
protect2 0x1280000
lk 0x1c80000
para 0x1d00000
boot 0x1d80000
recovery 0x2d80000
logo 0x3d80000
expdb 0x4580000
seccfg 0x4f80000
oemkeystore 0x5000000
secro 0x5200000
keystore 0x5800000
tee1 0x6000000
tee2 0x6500000
frp 0x6a00000
nvdata 0x6b00000
metadata 0x8b00000
system 0xb000000
cache 0xcb000000
userdata 0xe4000000
flashinfo 0xFFFF0084
sgpt 0xFFFF0004
I understand that this is an image to be installed from stock recovery. The question is - can I somehow tell is there a stock recovery itself in this image? And if it is there - can I somehow extract it and flash it into my phone to return at least stock recovery back?
Thanks for answers!

Flashing TWRP on Ulefone Power doesn't work

Hello.
I have tried flashing the recovery partition on my Ulefone Power in 2 ways.
Boot to ROM.
Go to options -> “About phone”, click the compilation number several times to become a developer.
Enable OEM unlock.
Boot to fastboot.
“fastboot devices” in admin CMD shows my phone.
“fastboot flashing unlock”; pressed volume up to agree; successful
“fastboot flash recovery image.img”; successful
After that, when I reboot my phone to recovery or even ROM it goes into a loop of booting. I see Ulefone logo for several seconds, then it disappears for another few and the cycle is repeated.
I've also tried to flash it from the official Ulefone tutorial. But when it comes to connecting my device I get an error:
Code:
PMT changed for the ROM; it must be downloaded
From what I read, I first have to format the whole partition, flash TWRP and only then flash ROM from TWRP. So that's what I did.
Reinstalled ROM just in case.
Used SP_Flash_Tool_Win_v5.1620 to format the partitions with option "Format whole flash without bootloader". Successful.
Used SP_Flash_Tool_Win_v5.1620 to flash TWRP choosing its scatter file. Successful.
After that, I can boot neither to recovery nor to ROM. In order for the phone to work I have to flash the ROM again with SP_Flash_Tool_Win_v5.1620.
Oh, and I tried 3 different .img files for TWRP, 2 of which I downloaded from the official tutorial and one TWRP 3.0.2-1 from NeedRom.com.
Any idea what I'm doing wrong? I can live with flashing TWRP with either of these 2 methods.

I have also tried to root my phone with apps KingRoot and KingoRoot to install something like Flashify and flash recovery from ROM. But these apps failed to root my phone.
And finally, I've tried booting the recovery from fastboot with:
Code:
fastboot boot recovery.img
...but I got the following error:
Code:
C:\Users\mrjigsaw\Desktop\Smartphone\ulefone Power_Android 6.0_20160517>fastboot boot recovery.img
downloading 'boot.img'...
OKAY [ 0.799s]
booting...
FAILED (remote: invalid kernel address: not lie in memory)
finished. total time: 0.820s
Fortunately this error appears on whole 2 pages in Google...
Any ideas what to do next? I'm stuck.

hey. Just received my Ulefone Power today as well.
Tried various TWRP for the Power from here: http://www.needrom.com/category/ulefone/power-ulefone/
but neither did work.
Since i don't own a windows machine i also tried to simply boot the recovery via fast boot but i get the same error message.
Hope someone is willing to help us
EDIT:
from the scatter file: - partition_index: SYS9
partition_name: recovery
file_name: recovery.img
is_download: true
type: NORMAL_ROM
linear_start_addr: 0x2d80000
physical_start_addr: 0x2d80000
partition_size: 0x1000000
region: EMMC_USER
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: UPDATE
reserve: 0x00
so maybe
Code:
fastboot -b 0x2d80000 boot recovery.img
? Will try later in the evening
Cheers

nope... i just hope i don't need all the windows madness to do it...

I managed to finally flash TWRP. I solved it by... using different image...
Please note that I used 4 images before finally 5th worked, so it wasn't such an obvious solution.
I couldn't find the link in my history but after some googling I think this was the image I used:
aplush.xyz/2016/05/ulefone-power-twrp-3-download.html
Please try this one and if it doesn't work, try another one from Aplush (I'm sure that I downloaded it from Aplush).
Good luck!

was successful as well last night using this recovery:
http://www.needrom.com/download/twrp-3-0-0-5/comment-page-3/#comment-273477
however i could not fastboot boot it, so i dived into the cold and flashed it hoping for the best

mrjigsaw said:
I have also tried to root my phone with apps KingRoot and KingoRoot to install something like Flashify and flash recovery from ROM. But these apps failed to root my phone.
And finally, I've tried booting the recovery from fastboot with:
Code:
fastboot boot recovery.img
...but I got the following error:
Code:
C:\Users\mrjigsaw\Desktop\Smartphone\ulefone Power_Android 6.0_20160517>fastboot boot recovery.img
downloading 'boot.img'...
OKAY [ 0.799s]
booting...
FAILED (remote: invalid kernel address: not lie in memory)
finished. total time: 0.820s
Fortunately this error appears on whole 2 pages in Google...
Any ideas what to do next? I'm stuck.
Click to expand...
Click to collapse
did you get it fixed?

The Story of my lost and recovery IMEI = 0 into GOOD

FIRST AT ALL, BE SURE WHAT YOU DO, I AM NOT RESPONSIBLE FOR ANY DAMAGE, ETC... AT YOUR OWN RISK, THIS IS MY EXPERIENCE, IT CAN BUT IT MUST NOT WORK ON YOUR PHONE, YOU HAVE BEEN WARNED BERFORE DOING ANY ACTION​
Guys, this is a story of a 3 year odyssey to get my IMEI on this phone back and at the end, YES!!! it works again. 100% full signal came back.
Now let's get into in....
First, tools you need to recovery your IMEI again.
- phone must be unlocked
- phone must be root
- phone should be on original stock 5.1
- TWRP Recovery ROM (use twrp-3.0.2-0-xt1032)
- from PlayStore download "Partitions Backup"
- from PlayStore download "Root Browser"
- XPOSED Framework and XPOSED Installer
- IMEI CHANGER (XPOSED MODULE)
- .IMG (use attached)
The story:
A friend of mine bought 2013 a Moto G (1st Gen) and wanted to root by himself. Root doesen't work, so he kept up. He decided to put an other rom on his phone, what he doesen't know, he erased all with command everything before (DICKHEAD): Fastboot erase all and Fastboot erase recovery <-- KILLER
From this moment.. after rebooting his phone the was no signal anymore. Serveral ROM and MODEMS tried out. Nothing just WIFI works. He gave the phone to me. 3 years later i wanted to re-awake this wonderful phone back to life.
Now, here comes the steps, you should do, to re-gain your phone...
01. choose and use a stock 5.1 rom of your country and flash it by fastboot command as always...
02. after rom installation and after reboot, install TWRP recovery rom with fastboot
03. reboot into recovery and install root in TWRP (use: UPDATE-SuperSU-v2.46)
04. reboot and download from PlayStore "Partitions Backup" and "Root Browser" and "IMEI Changer"
05. download XPOSED Framework (zip) and XPOSED Installer (apk)
06. reboot into TWRP install XPOSED Framework
07. reboot and install the XPOSED Installer APK with Root Browser and install IMEI Changer Module in XPOSED
08. reboot system, go into IMEI Changer and change your IMEI (under the back cover of your phone)
09. reboot and type in phone *#06#, you should see right now your IMEI, but the signal is already lost right? Okay, let's go ahead...
10. now return into Root Browser and see if there is a folder on your SDCARD "PartitionsBackups", if not, start the App and return
11. copy all three .img (attached) into it, start the App "Partitions Backup" again. Navigate to 3 dotted menu and and check "Restore a Partition"
12. navigate with "Root Browser" to the folder "PartitionsBackups" on SDCARD and use the first one, if successful, restore also the both other partitions. Forget the dd commands in terminal or cmd (doesent work), use the APP on top.
13. if it's done, reboot and pray... GOOD LUCK
14. Congrats, your signal should be back.
15. use Partitions Backup to backup all your partitions (as .img) and store them elsewhere.
16. set IMEI Changer as inactive and reboot, check with *#06#, otherwise let it active
17. !!! GIVE ME A THANKS, IF YOU ARE HAPPY WITH THIS !!!​

NOTE!
YOUR IMEI WILL NOT SHOWN IN FASTBOOT!
(bootloader) version: 0.5
(bootloader) version-bootloader: 411A
(bootloader) product: falcon
(bootloader) secure: yes
(bootloader) hwrev: 0x83C0
(bootloader) radio: 0x1
(bootloader) emmc: 16GB Toshiba REV=06 PRV=01 TYPE=17
(bootloader) ram: 1024MB Hynix S4 SDRAM DIE=4Gb
(bootloader) cpu: MSM8226 CS
(bootloader) serialno: TA8900FI4F
(bootloader) cid: 0x0007
(bootloader) channelid: 0x00
(bootloader) uid: 28F911020F000000000000000000
(bootloader) unlocked: yes
(bootloader) iswarrantyvoid: yes
(bootloader) mot_sst: 3
(bootloader) max-download-size: 536870912
(bootloader) reason: Reboot mode set to fastboot
(bootloader) imei:
(bootloader) meid:
(bootloader) date:
(bootloader) sku:
(bootloader) iccid:
(bootloader) cust_md5:
(bootloader) max-sparse-size: 268435456
(bootloader) current-time: "Wed Aug 19 23:46:25 UTC 2015"
(bootloader) ro.build.fingerprint[0]: motorola/falcon_retde/falcon_umts:
(bootloader) ro.build.fingerprint[1]: 5.1/LPB23.13-56/56:user/release-ke
(bootloader) ro.build.fingerprint[2]: ys
(bootloader) ro.build.version.full[0]: Blur_Version.221.21.56.falcon_umt
(bootloader) ro.build.version.full[1]: s.Retail.en.DE
(bootloader) ro.build.version.qcom[0]: AU_LINUX_ANDROID_LNX.LA.3.5.1_RB1
(bootloader) ro.build.version.qcom[1]: .04.04.02.048.045
(bootloader) version-baseband: MSM8626BP_1032.3116.98.00y EMEA_CUST
(bootloader) kernel.version[0]: Linux version 3.4.42-g89906d6 ([email protected]
(bootloader) kernel.version[1]: ilclbld34) (gcc version 4.8 (GCC) ) #1 S
(bootloader) kernel.version[2]: MP PREEMPT Mon Aug 17 19:06:25 CDT 2015
(bootloader) sdi.git: git=MBM-NG-V41.1A-0-gdc5aeaf
(bootloader) sbl1.git: git=MBM-NG-V41.1A-0-g199f3c5
(bootloader) rpm.git: git=MBM-NG-V41.1A-0-g8b7736e
(bootloader) tz.git: git=MBM-NG-V41.1A-0-g99c1a7c
(bootloader) aboot.git: git=MBM-NG-V41.1A-0-g80481ae
(bootloader) qe: qe 1/1
(bootloader) ro.carrier: unknown
all: listed above
finished. total time: 0.104s

Reserved #2

Reserved #3

Can it work on Moto E dual sim 2014 indian version
Jerome-X said:
FIRST AT ALL, BE SURE WHAT YOU DO, I AM NOT RESPONSIBLE FOR ANY DAMAGE, ETC... AT YOUR OWN RISK, THIS IS MY EXPERIENCE, IT CAN BUT IT MUST NOT WORK ON YOUR PHONE, YOU HAVE BEEN WARNED BERFORE DOING ANY ACTION​
Guys, this is a story of a 3 year odyssey to get my IMEI on this phone back and at the end, YES!!! it works again. 100% full signal came back.
Now let's get into in....
First, tools you need to recovery your IMEI again.
- phone must be unlocked
- phone must be root
- phone should be on original stock 5.1
- TWRP Recovery ROM (use twrp-3.0.2-0-xt1032)
- from PlayStore download "Partitions Backup"
- from PlayStore download "Root Browser"
- XPOSED Framework and XPOSED Installer
- IMEI CHANGER (XPOSED MODULE)
- .IMG (use attached)
The story:
A friend of mine bought 2013 a Moto G (1st Gen) and wanted to root by himself. Root doesen't work, so he kept up. He decided to put an other rom on his phone, what he doesen't know, he erased all with command everything before (DICKHEAD): Fastboot erase all and Fastboot erase recovery <-- KILLER
From this moment.. after rebooting his phone the was no signal anymore. Serveral ROM and MODEMS tried out. Nothing just WIFI works. He gave the phone to me. 3 years later i wanted to re-awake this wonderful phone back to life.
Now, here comes the steps, you should do, to re-gain your phone...
01. choose and use a stock 5.1 rom of your country and flash it by fastboot command as always...
02. after rom installation and after reboot, install TWRP recovery rom with fastboot
03. reboot into recovery and install root in TWRP (use: UPDATE-SuperSU-v2.46)
04. reboot and download from PlayStore "Partitions Backup" and "Root Browser" and "IMEI Changer"
05. download XPOSED Framework (zip) and XPOSED Installer (apk)
06. reboot into TWRP install XPOSED Framework
07. reboot and install the XPOSED Installer APK with Root Browser and install IMEI Changer Module in XPOSED
08. reboot system, go into IMEI Changer and change your IMEI (under the back cover of your phone)
09. reboot and type in phone *#06#, you should see right now your IMEI, but the signal is already lost right? Okay, let's go ahead...
10. now return into Root Browser and see if there is a folder on your SDCARD "PartitionsBackups", if not, start the App and return
11. copy all three .img (attached) into it, start the App "Partitions Backup" again. Navigate to 3 dotted menu and and check "Restore a Partition"
12. navigate with "Root Browser" to the folder "PartitionsBackups" on SDCARD and use the first one, if successful, restore also the both other partitions. Forget the dd commands in terminal or cmd (doesent work), use the APP on top.
13. if it's done, reboot and pray... GOOD LUCK
14. Congrats, your signal should be back.
15. use Partitions Backup to backup all your partitions (as .img) and store them elsewhere.
16. set IMEI Changer as inactive and reboot, check with *#06#, otherwise let it active
17. !!! GIVE ME A THANKS, IF YOU ARE HAPPY WITH THIS !!!​
Click to expand...
Click to collapse
Bro, I also lost my imei number for moto e, it shows imei: 0, but in fastboot getvarall, it shows imei number.I think the img file you have attached will be different for moto e. I am ready to do anything, please guide. Thanks and regards

Im not an expert, but this method seems dangerous. The partitions you have attached are unique to your device, and flashing them on another device could cause serious permanent problems. I would suggest you remove these instructions until it is known what is contained within the hob, dhob and fsc partitions, unless someone can correct me.

Its up to the user to doing any action. This is my story, and my very own solution here, i wrote.
Gesendet von meinem SM-A310F mit Tapatalk

Professor Gibbins said:
Im not an expert, but this method seems dangerous. The partitions you have attached are unique to your device, and flashing them on another device could cause serious permanent problems. I would suggest you remove these instructions until it is known what is contained within the hob, dhob and fsc partitions, unless someone can correct me.
Click to expand...
Click to collapse
What problems? Even if they are the same IMEI still there is little chance that 2 users to be in the same country same network and same city. Anyway there are a lot of people who used the command and are screwed so it's great tutorial to revive the device
Sent from Samsung Galaxy S7

Jerome-X said:
Its up to the user to doing any action. This is my story, and my very own solution here, i wrote.
Click to expand...
Click to collapse
Exactly, this could mean that an inexperienced user might follow these instructions without understanding the implications. And when you say this is your very own solution, it's literal. This solution only applies to your specific device.
Eurofighter_ty said:
What problems? Even if they are the same IMEI still there is little chance that 2 users to be in the same country same network and same city. Anyway there are a lot of people who used the command and are screwed so it's great tutorial to revive the device
Click to expand...
Click to collapse
The IMEI duplication was only an example. There could be many other irreversible issues that the user doesn't even immediately realise.
Essentially, these partitions should never be overwritten without first taking a backup.

Yes of course, u re right
Gesendet von meinem SM-A310F mit Tapatalk

Haha, I'm not fussed with being right - just wanting to point out/give my opinion on the possible risks.
By all means keep your tutorial, but could I suggest adding a step where the 3 partitions are backed up before they are overwritten, just in case they need those partitions in the future.

Thank you so much for this really useful guide, I was hopeless and finally after 3 years was able to make my phone work.

[SOLVED] [TWRP] Restore data of a damaged and encrypted Nexus5 (to a new Nexus5)

update: SOLVED - thread can be closed
Hi!
My phone got physically damaged while it was at a shop getting its display changed.
My setting was (as I reconstructed from my last backup):
TWRP 2.8.7.1 (or maybe 3.0.0.0)
Cyanogenmod cm-13.0-20160214-NIGHTLY-hammerhead-recovery (or maybe higher)
encrypted
I am trying to access the phone information and had it examined from a data recovery expert.
This is all the data I got on a USB:
data.emmc.win
system.ext4.win
system.ext4.win.md5
system.info
I don't know if the information stored in those file containers is still encrypted as I provided the data recovery expert with my encryption key.
My idea was to get a new Nexus5, install TWRP and try to restore the partitions. I would then have been able to use the new phone as a 1:1 replacement of the old one.
Unfortunately it didn't work (out of the box).
Maybe this would work? [TUTORIAL] Create Flashable Zip From CWM/TWRP Backup (MTK)
My other idea is to access the different files directly, but that failed too (I renamed system.ext4.win to system.ext4 and unzipped it with 7-Zip on Windows10). When opening the unzipped folder every files content is: "50 RHT.security.selinux=ubject_r:system_file:s0"
So, I do really need help.
Do you have any ideas?

fivel_ said:
Hi!
My phone got physically damaged while it was at a shop getting its display changed.
My setting was (as I reconstructed from my last backup):
TWRP 2.8.7.1 (or maybe 3.0.0.0)
Cyanogenmod cm-13.0-20160214-NIGHTLY-hammerhead-recovery (or maybe higher)
encrypted
I am trying to access the phone information and had it examined from a data recovery expert.
This is all the data I got on a USB:
data.emmc.win
system.ext4.win
system.ext4.win.md5
system.info
I don't know if the information stored in those file containers is still encrypted as I provided the data recovery expert with my encryption key.
My idea was to get a new Nexus5, install TWRP and try to restore the partitions. I would then have been able to use the new phone as a 1:1 replacement of the old one.
Unfortunately it didn't work (out of the box).
Maybe this would work? [TUTORIAL] Create Flashable Zip From CWM/TWRP Backup (MTK)
My other idea is to access the different files directly, but that failed too (I renamed system.ext4.win to system.ext4 and unzipped it with 7-Zip on Windows10). When opening the unzipped folder every files content is: "50 RHT.security.selinux=ubject_r:system_file:s0"
So, I do really need help.
Do you have any ideas?
Click to expand...
Click to collapse
These are partition dumps (at least I think they are, maybe they are empty and just appeared on the USB flash drive out of thin air), not zip files.
In theory you should be able to flash them to another phone (using dd) and be ready to go, however the N5 might use the quallcomm hardware key storage method in which case the only way to access your data seems to be decrypting it on the device. What part of your device is damaged? Maybe you can still access the recovery via adb and then decrypt it even iff your screen is destroyed.

Thanks a lot!
My old phone is rendered unusable without any chance of using it again.
So I bought an used Nexus5 and am looking for ways to recreate the partitions etc exactly the same way they were on the old phone.
I stored the files
data.emmc.win
system.ext4.win
system.ext4.win.md5
system.info
on the new Nexus5 and accessed the folder via TWRP and told it to use it as recovery/restore from backup. Unfortunately this didn't work (at the first time).
Whats next??

fivel_ said:
Thanks a lot!
My old phone is rendered unusable without any chance of using it again.
So I bought an used Nexus5 and am looking for ways to recreate the partitions etc exactly the same way they were on the old phone.
I stored the files
data.emmc.win
system.ext4.win
system.ext4.win.md5
system.info
on the new Nexus5 and accessed the folder via TWRP and told it to use it as recovery/restore from backup. Unfortunately this didn't work (at the first time).
Whats next??
Click to expand...
Click to collapse
@nailyk helped me a lot this github thread Issue 863. Thanks!

hi @fivel_
How goes your experiments? Where you able to restore the dump of the broken device?
Does the broken device start into fastboot mode?

hi @nailyk!
I think what I have from my old phone is the image of the two major partititions - system and data (I don’t know where the others like boot or recovery are - maybe they are sub-partititions or something like that in the big data partition (13GiB)?).
edit: the partitions of a regular nexus5 can be seen here:
guide-repartition-nexus5
i think a regular „fastboot flash parition“ would not work. But I don’t know what can work and I do not exactly know where and what to search. so I am still left in the dark - did not know that there was so much to know regarding phone storage and partition.
ps: my old broken phone was not able to be recognized from windows. I will try again after making sure it is completeley charged.

If you have the same rom on your new device, that on the old one, and the data dump isn't broken, fastboot flash userdata -S 512M <your dump> should work.

okay, so the correct would be to
1. restore new phone from backup (in order to get the old rom on the new phone)
2. flash userdata.
right?

ok, I managed to connect to the old device via fastboot:
Is it maybe not as dead after all? The screen is not working, sadly
what can I do next?
Code:
C:\Users\fivel\Documents\Android\platform-tools-latest-windows\platform-tools>fastboot getvar all
(bootloader) version-hardware: rev_11
(bootloader) version-baseband: M8974A-2.0.50.2.28
(bootloader) version-bootloader: HHZ11k
(bootloader) version-cdma: N/A
(bootloader) variant: hammerhead D821(E) 16GB
(bootloader) serialno: 065f8e4100746380
(bootloader) carrier: None
(bootloader) secure-boot: yes
(bootloader) unlocked: yes
(bootloader) product: hammerhead
(bootloader) partition-size:aboot: 80000
(bootloader) partition-type:aboot: emmc
(bootloader) partition-size:boot: 1600000
(bootloader) partition-type:boot: emmc
(bootloader) partition-size:recovery: 1600000
(bootloader) partition-type:recovery: emmc
(bootloader) partition-size:system: 40000000
(bootloader) partition-type:system: ext4
(bootloader) partition-size:userdata: 3321fa800
(bootloader) partition-type:userdata: ext4
(bootloader) partition-size:cache: 2bc00000
(bootloader) partition-type:cache: ext4
(bootloader) partition-size:persist: 1000000
(bootloader) partition-type:persist: ext4
all:
finished. total time: 0.211s
And I managed to go to recovery-mode, blindly, and get ADB working. Does the result look damaged?
Code:
~ # ls
boot res
cache root
charger sbin
data sdcard
default.prop seapp_contexts
dev selinux_version
etc sepolicy
file_contexts service_contexts
firmware sideload
fstab.hammerhead supersu
init sys
init.rc system
init.recovery.hammerhead.rc tmp
init.recovery.usb.rc twres
license ueventd.hammerhead.rc
persist ueventd.rc
proc usb-otg
property_contexts vendor
recovery

fivel_ said:
ok, I managed to connect to the old device via fastboot:
Is it maybe not as dead after all? The screen is not working, sadly
what can I do next?
Code:
C:\Users\fivel\Documents\Android\platform-tools-latest-windows\platform-tools>fastboot getvar all
(bootloader) version-hardware: rev_11
(bootloader) version-baseband: M8974A-2.0.50.2.28
(bootloader) version-bootloader: HHZ11k
(bootloader) version-cdma: N/A
(bootloader) variant: hammerhead D821(E) 16GB
(bootloader) serialno: 065f8e4100746380
(bootloader) carrier: None
(bootloader) secure-boot: yes
(bootloader) unlocked: yes
(bootloader) product: hammerhead
(bootloader) partition-size:aboot: 80000
(bootloader) partition-type:aboot: emmc
(bootloader) partition-size:boot: 1600000
(bootloader) partition-type:boot: emmc
(bootloader) partition-size:recovery: 1600000
(bootloader) partition-type:recovery: emmc
(bootloader) partition-size:system: 40000000
(bootloader) partition-type:system: ext4
(bootloader) partition-size:userdata: 3321fa800
(bootloader) partition-type:userdata: ext4
(bootloader) partition-size:cache: 2bc00000
(bootloader) partition-type:cache: ext4
(bootloader) partition-size:persist: 1000000
(bootloader) partition-type:persist: ext4
all:
finished. total time: 0.211s
And I managed to go to recovery-mode, blindly, and get ADB working. Does the result look damaged?
Code:
~ # ls
boot res
cache root
charger sbin
data sdcard
default.prop seapp_contexts
dev selinux_version
etc sepolicy
file_contexts service_contexts
firmware sideload
fstab.hammerhead supersu
init sys
init.rc system
init.recovery.hammerhead.rc tmp
init.recovery.usb.rc twres
license ueventd.hammerhead.rc
persist ueventd.rc
proc usb-otg
property_contexts vendor
recovery
Click to expand...
Click to collapse
Perfect. You are where I would bring you
For the next time: download your twrp, go into fastbootmode and fastboot boot twrp.img
It will download and boot into twrp.
Then you should be able to decrypt with twrp decrypt <your password>
Maybe <your password> need to be typed in hexa.
fivel_ said:
okay, so the correct would be to
1. restore new phone from backup (in order to get the old rom on the new phone)
2. flash userdata.
right?
Click to expand...
Click to collapse
Exactly, use the same rom, flash your userdata reboot.
Now you have two way to get your data back. Good luck

nailyk said:
Perfect. You are where I would bring you
Click to expand...
Click to collapse
Great thanks!!
For the next time: download your twrp, go into fastbootmode and fastboot boot twrp.img
Click to expand...
Click to collapse
ok, done!
Code:
C:\Users\fivel\Documents\Android\platform-tools-latest-windows\platform-tools>fastboot boot twrp.img
downloading 'boot.img'...
OKAY [ 0.748s]
booting...
OKAY [ 0.114s]
finished. total time: 0.868s
It will download and boot into twrp.
Then you should be able to decrypt with twrp decrypt <your password>
Maybe <your password> need to be typed in hexa.
Click to expand...
Click to collapse
ok, how do I perform this command?
twrp decrypt - in ADB, in Fastboot, else?

ok, one more step:
1. i got to adb in recovery mode again.
2. i startet a shell via adb shell
3. decrypt:
~ # twrp decrypt ********
Attempting to decrypt data partition via command line.
Data successfully decrypted, new block device: '/dev/block/dm-0'
Click to expand...
Click to collapse
and now?
edit:
now I performed,
4. adb pull /dev/block/dm-0 /data.img
and it is running... we will see what is inside

so, now I have the data.img on my pc.
do I first need it to transfer to the new phone, or can I just type:
fastboot flash userdata -S 512M data.img
thanks a lot for all your help @nailyk!

fivel_ said:
ok, one more step:
1. i got to adb in recovery mode again.
2. i startet a shell via adb shell
3. decrypt:
and now?
edit:
now I performed,
4. adb pull /dev/block/dm-0 /data.img
and it is running... we will see what is inside
Click to expand...
Click to collapse
o0 Data successfully decrypted
So the data.img you catch is the full filesystem without encryption
you can mount loop it in any linux
fivel_ said:
so, now I have the data.img on my pc.
do I first need it to transfer to the new phone, or can I just type:
fastboot flash userdata -S 512M data.img
Click to expand...
Click to collapse
yes this will put your data (unencrypted it seems) into your old device
thanks a lot for all your help @nailyk!
Click to expand...
Click to collapse
No pbm Glad you solve it.

hi!
I had not got the time to apply your advice to my phone... today I did.
when I type: fastboot flash userdata -S 512M e:mypathtolocation/data.img
i get: Invalid sparse file format at header magi
I guess this is a small error, as I was able to open the image and it looks like the userdata.
the folders inside the image are: adb, anr, app, app-asec, app-lib, app-private, backup, bootchart, dalvik-cache, data, dontpanic, drm, local, lost+found, media, etc.
What do I do now? @nailyk your help and advice is always appreciated!

fivel_ said:
hi!
I had not got the time to apply your advice to my phone... today I did.
when I type: fastboot flash userdata -S 512M e:mypathtolocation/data.img
i get: Invalid sparse file format at header magi
I guess this is a small error, as I was able to open the image and it looks like the userdata.
the folders inside the image are: adb, anr, app, app-asec, app-lib, app-private, backup, bootchart, dalvik-cache, data, dontpanic, drm, local, lost+found, media, etc.
What do I do now? @nailyk your help and advice is always appreciated!
Click to expand...
Click to collapse
Reboot ?
Also if your new dump isn't encrypted anymore you can mount loop it into any linux distro. If you don't have one, look for FWUL into my signature.
Glad your problem is now solved

thanks again, I have recovered ALL the lost data

Glad it worked
When there is a shell, there is a way
P.S.: please change title of first post to mark it as solved. Then asks Moderators for closing.

360 N6 Lite (QIKU): help is needed: 1)to root the device 2)to cope with AVB

Device: 360 N6 Lite by QIKU, Snapdragon 630
Device is running stock ROM based on android 8.1, no mods, no tweaks, just a stock android. I've never ever messed with any system files/partitions.
Stock ROM was re-flashed a few days ago after this thread was posted - to satisfy request of some person who thought I had ROM tampered with.
I can re-flash ROM as many times as would be needed, upon request if anybody is really keen to help.
Addtional info about my device:
1. fastboot has limited functionality: it cannot flash any partiton. Therefore, if I have to flash certain partition, like booot/recovery/system I only can do it with QFIL flashing software.
2. I can patch stock boot.img by Magisk alright. However, after I flash patched boot phone goes to Red State (or bootloop if phone is connected to PC), so Magisk is not an option here. Or I'm just so stupid I do not see how to benefit from Magisk. Log of Magisk patching the stock boot is attached here.
I thought I might have a chance with superSU though.
3. bootloader is unlocked if I can trust the info below:
(bootloader) unlocked:yes
(bootloader) off-mode-charge:0
(bootloader) charger-screen-enabled:0
(bootloader) battery-soc-ok:yes
(bootloader) battery-voltage:3975
(bootloader) version-baseband:
(bootloader) version-bootloader:
(bootloader) variant:SDM EMMC
(bootloader) partition-type:cache:ext4
(bootloader) partition-size:cache: 0x1F400000
(bootloader) partition-type:userdata:ext4
(bootloader) partition-size:userdata: 0x5EBBFBE00
(bootloader) partition-type:system:ext4
(bootloader) partition-size:system: 0xE0000000
(bootloader) secure:yes
(bootloader) serialno:********
(bootloader) product:QK1713-A01
(bootloader) max-download-size:536870912
(bootloader) kernel:uefi
(bootloader) Verity mode: true
(bootloader) Device unlocked: true
(bootloader) Device critical unlocked: true
(bootloader) Charger screen enabled: false
Phone is apparently not rooted as shown on attached pics. However, when I run <adb shell> command, it appears as if there is a root already installed as I see # prompt, not $.
This phone really makes me crazy. I cannot flash custom recovery, I cannot flash any partition using fastboot, I cannot flash any zip-package and I cannot figure out how to properly install SU-binary.
Any help is much appreciated!

In the thread linked to above one can see BusyBox is installed on phone. BusyBox by default comes with the SU-binary. Check this.

jwoegerbauer said:
Check this.
Click to expand...
Click to collapse
Sure. Could you please share details what exactly to be checked: files/locations/permissions/what?
Just in case:
1|QK1713:/ # ls /system/bin/su
ls: /system/bin/su: No such file or directory
1|QK1713:/ # ls /system/xbin/su
ls: /system/xbin/su: No such file or directory
1|QK1713:/ #
QK1713:/ # find /system -name "su"
QK1713:/ #
QK1713:/ # find /data -name "su"
QK1713:/ #
QK1713:/ # find /system -name "busy*"
/system/bin/busybox
QK1713:/ #

Regarding AVB: the goal is to deactivate AVB 1.0 in order to be able to flash custom recovery (TWRP).
In Magisk log it is said 'Boot image is signed with AVB 1.0'
As mentioned here: AVB 1.0 there is no VBMETA partitions on devices with AVB 1.0. This is almost correct statement re my device. To be more precise: there is such a partition, list of partitions is attached. But VBMETA is filled with all zeroes. File mmcblk0p57 (dd-ed from device) is also attached, it consists of zeroes
Also, VBMETA partition is not supposed to be flashed when flashing stock ROM. Here's what is there in rawprogram0.xml:
Code:
<program SECTOR_SIZE_IN_BYTES="512" file_sector_offset="0" filename="" label="vbmeta" ...
<program SECTOR_SIZE_IN_BYTES="512" file_sector_offset="0" filename="" label="vbmetabak" ...
So, I conclude it should be useless for me to try anything like:
Code:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
Question is: is there any way how to deactivate AVB 1.0 so that I could flash boot.img patched by Magisk? Image of stock boot is attached herewith.
Or, almost the same question: what needs to be done with stock boot in order for my device does not reject custom recovery?

Does your QFil tool allow you to add additional options when flashing an image?
I know you don't believe that your phone uses vbmeta, but we can't rule it out unless you can flash it properly.
I still find it really hard to believe that they removed the ability to flash from fastboot. It makes me think it is more likely that the syntax of the command is different. That's just my gut feeling and of course I may be wrong.
Do you know if your device uses A/B partitioning?
What happens if you use TWRP and try:
fastboot boot recovery.img

Bondyuk said:
Does your QFil tool allow you to add additional options when flashing an image?
Click to expand...
Click to collapse
QFIL - Qualcomm Flash Image Loader. It can flash any partition I want to but it does not support command line parameters: it is ran as a separate program, not from command line if it is what you mean.
Bondyuk said:
I know you don't believe that your phone uses vbmeta, but we can't rule it out unless you can flash it properly.
Click to expand...
Click to collapse
Well, as I mentioned: VBMETA is filled with all zeroes. Do you think all zeroes can effectively prevent me from using customized images?
Bondyuk said:
Do you know if your device uses A/B partitioning?
Click to expand...
Click to collapse
It certainly does not.
Bondyuk said:
What happens if you use TWRP and try:
Click to expand...
Click to collapse
I cannot use TWRP because TWRP is a customized (changed) recovery. My ugly device does NOT allow using amended partition. It relates to both boot and recovery.

vp1117 said:
Device: 360 N6 Lite by QIKU, Snapdragon 630
Device is running stock ROM based on android 8.1, no mods, no tweaks, just a stock android. I've never ever messed with any system files/partitions.
Addtional info about my device:
1. fastboot has limited functionality: it cannot flash any partiton, therefore the only way I can flash anything is by QFIL
2. I can patch stock boot.img by Magisk alright. However, when I flash patched boot phone goes to Red State (or bootloop if phone is connected to PC), so Magisk is not an option here. Or I'm just so stupid I do not see how to benefit from Magisk. I hope I might have a chance with superSU though.
Log of Magisk patching the stock boot is attached here.
3. bootloader is unlocked:
(bootloader) unlocked:yes
(bootloader) off-mode-charge:0
(bootloader) charger-screen-enabled:0
(bootloader) battery-soc-ok:yes
(bootloader) battery-voltage:3975
(bootloader) version-baseband:
(bootloader) version-bootloader:
(bootloader) variant:SDM EMMC
(bootloader) partition-type:cache:ext4
(bootloader) partition-size:cache: 0x1F400000
(bootloader) partition-type:userdata:ext4
(bootloader) partition-size:userdata: 0x5EBBFBE00
(bootloader) partition-type:system:ext4
(bootloader) partition-size:system: 0xE0000000
(bootloader) secure:yes
(bootloader) serialno:********
(bootloader) product:QK1713-A01
(bootloader) max-download-size:536870912
(bootloader) kernel:uefi
(bootloader) Verity mode: true
(bootloader) Device unlocked: true
(bootloader) Device critical unlocked: true
(bootloader) Charger screen enabled: false
Phone is apparently not rooted as shown on attached pics. However, when I run <adb shell> command, it appears as if there is a root already installed: https://forum.xda-developers.com/t/i-need-help-rooting-my-zte-quest-5.4276715/post-85018813
This phone really bothers me. I cannot flash custom recovery, I cannot flash any partition using fastboot and I cannot figure out how to properly install SU-binary.
Any help is much appreciated!
Click to expand...
Click to collapse
What's your android version I see that you're using SuperSU just to let u know SuperSU only works on Android Nougat and below this means if you're running android Oreo and above SuperSU will no longer work for Android Oreo and above I recommend u to use magisk

Austinredstoner said:
What's your android version I see that you're using SuperSU just to let u know SuperSU only works on Android Nougat and below this means if you're running android Oreo and above SuperSU will no longer work for Android Oreo and above I recommend u to use magisk
Click to expand...
Click to collapse
I'm not using superSU. I only wanted to explore if it would be possible to use superSU on my device.
Stock ROM is based on Oreo.
I cannot use Magisk.

vp1117 said:
I'm not using superSU. I only wanted to explore if it would be possible to use superSU on my device.
Stock ROM is based on Oreo.
I cannot use Magisk.
Click to expand...
Click to collapse
Why can't u use magisk did u flash magisk.zip file in via twrp recovery or some other recovery like orangefox

vp1117 said:
I'm not using superSU. I only wanted to explore if it would be possible to use superSU on my device.
Click to expand...
Click to collapse
What do you really want to have: SuperSU or SU ( read: Switch User )? SuperSU is a Superuser access management tool ( authored by Chainfire ), whereas SU is a binary ( ported from Linux distros ) that allows to perform actions on Android with Superuser privileges similar to the Administrator privileges on Windows OS.

jwoegerbauer said:
What do you really want to have: SuperSU or SU ( read: Switch User )? SuperSU is a Superuser access management tool, whereas SU is a binary that allows to perform actions on Android with Superuser privileges similar to the Administrator privileges on Windows OS.
Click to expand...
Click to collapse
Thank you. You are right: probably, I'm not clear in stating of my goal. I need to be able to run file managers like Root Explorer with root privileges, i.e. to access and amend files in system areas.

Austinredstoner said:
Why can't u use magisk did u flash magisk.zip file in via twrp recovery or some other recovery like orangefox
Click to expand...
Click to collapse
Because I cannot use any custom recoveries.
All I can do with Magisk is to patch stock boo.img and try to flash it to the phone. Just to get Red State as a result.
It all was written in my 1st post in this thread...

vp1117 said:
Sure. Could you please share details what exactly to be checked: files/locations/permissions/what?
Just in case:
1|QK1713:/ # ls /system/bin/su
ls: /system/bin/su: No such file or directory
1|QK1713:/ # ls /system/xbin/su
ls: /system/xbin/su: No such file or directory
1|QK1713:/ #
QK1713:/ # find /system -name "su"
QK1713:/ #
QK1713:/ # find /data -name "su"
QK1713:/ #
QK1713:/ # find /system -name "busy*"
/system/bin/busybox
QK1713:/ #
Click to expand...
Click to collapse
This screenshot of Android's terminal window shows that phone's Android must be somehow rooted because of # is shown instead of $ in front of each line
Run either on computer
Code:
adb devices
adb shell "mount -t auto -o rw,remount /system"
or in Android terminal
Code:
mount -t auto -o rw,remount /system
Is it giving you a 'not permitted' error - or similar?

jwoegerbauer said:
This screenshot of Android's terminal window shows that phone's Android must be somehow rooted because of # is shown instead of $ in front of each line
Run either on computer
Code:
adb devices
adb shell "mount -t auto -o rw,remount /system"
or in Android terminal
Code:
mount -t auto -o rw,remount /system
Is it giving you a 'not permitted' error - or similar?
Click to expand...
Click to collapse
From PC's command prompt:
Z:\android\adb>adb devices
List of devices attached
b839ca58 device
Z:\android\adb>adb shell "mount -t auto -o rw,remount /system"
Z:\android\adb>
At the same time, from android terminal application:

@vp1117
The screenshot shows that Android Terminal app is launched as normal user, not as superuser as former screenshots provided here by you show it.
I have come to the conclusion that your phone is no longer in its state of delivery, as initially claimed by you: there are simply too many things that do not fit together.
Hence my recommendation: Do a Factory Reset, then re-flash phone's Stock ROM to get rid off of all mods you applied so far, wipe phone's Cache partition, and afterwards restart your attempts to root it from the scratch - of course having the appropriate knowledge how to do it.
My last 2 cents here:
To re-flash phone's Stock ROM you use YGDP tool
DL: https://droidfilehost.com/download/download-ygdp-tool-version/

Have done it.
For ROM re-flashing I used QIKU vendor's utility, not YGDP. Screenhots of re-flashing are attached.
Next, the only thing I did was to install Material Terminal and Root Explorer applications.
Here are results of same commands executing:
And Root Explorer denying device having been tooted:

... and here's info about my attempts to find su and busybox on freshly re-flashed device:

Once you run "adb shell" and you get greeted with a # prompt then you can perform commands in "adb shell" without having to run su. BTW: This is because of in your phone's Android properties ro.secure by default is set to 0.
Be happy!
You can try to add the su applet ( what is missing in your pre-installed no-root version of BusyBox ) to Android at your own - what requires both the phone's bootloader got unlocked and the Android's SELinux got disabled before:
Code:
adb devices
adb shell "mkdir -p /data/local/tmp"
adb push <location-of-su-applet-on-pc-here> /data/local/tmp
adb shell
chmod 0777 /data/local/tmp/su
chown root:root /data/local/tmp/su
chcon /data/local/tmp/su u:object_r:su_exec:s0
mount -t auto -o rw,remount /system
mv -f /data/local/tmp/su /system/bin/su
mount -t auto -o ro,remount /system
exit
adb reboot
The matching su applet you fetch from SuperSU.zip.

jwoegerbauer said:
Once you run "adb shell" and you get greeted with a # prompt then you can perform commands in "adb shell" without having to run su. BTW: This is because of in your phone's Android properties ro.secure by default is set to 0.
Click to expand...
Click to collapse
Thank you for guiding me.
There is a lot of information in your last post that I have to digest and understand being at zero-knowledge level.
Let me start with this:
ro.secure - is it defined in default.prop stored in boot.img?

@vp1117
It's the file build.prop located in /system directory what is the file of interest, not the "default.prop" file.
Build.prop contains all those final settings / commands that make an Android device run smoothly.
I'm pretty sure build.prop on your phone contains the lines
ro.secure=0
ro.debuggable=1
persist.service.adb.enable=1
FYI: If ro.secure=0 then adbd runs as root.
BTW:
I no longer participate this thread: It just doesn't make sense to me anymore.