Database Info

[DEV] Dumping out the kernel, ROM, etc.

Let's discuss how we could dump out the kernel, ROMS, etc. from Galaxy R:
The following command would help to dump the kernel out (need su)
Code:
cat /dev/block/mmcblk0p9 > /sdcard/boot-i9103.img
The following command should help to dump the /system/ out (need su)
Code:
cat /dev/block/mmcblk0p2 > /sdcard/system-i9103.img

legion1911 said:
If you dump with su you have su in the dump, no?
How about a temporary root solution?
Click to expand...
Click to collapse
Yes, dumping out the /system/ will contain su
But what it means is just dumping the /bin/su and /system/app/Superuser.apk inclusively.
After dumping out, one can remove the su & superuser.apk to make a 'non-rooted' ROM, if necessary.

ardatdat said:
After dumping out, one can remove the su & superuser.apk to make a 'non-rooted' ROM, if necessary.
Click to expand...
Click to collapse
Please explain how to do it on Windows 7.

Sense this device is tegra we can use nvflash to dump almost any kind of stuff from device, but my problem is that when i try to read or read raw from device nvflash hangs, on this weekend i will try and see what i can debug from usbmon and maybe then i will have some clue, until the only good way is to raw copy of block partitions like you mentioned
by the way if this helps this is what i get in my bct file (dumped with bct_dump for chromeos but worked for me)
Code:
Version = 0x00020001;
BlockSize = 0x00004000;
PageSize = 0x00000200;
PartitionSize = 0x01000000;
# Bootloader used = 1;
# Bootloaders max = 4;
# BCT size = 4080;
# Hash size = 16;
# Crypto offset = 16;
# Crypto length = 4064;
# Max BCT search blocks = 64;
#
# These values are set by cbootimage using the
# bootloader provided by the Bootloader=...
# configuration option.
#
# Bootloader[0].Version = 0x00000001;
# Bootloader[0].Start block = 224;
# Bootloader[0].Start page = 0;
# Bootloader[0].Length = 1345716;
# Bootloader[0].Load address = 0x00108000;
# Bootloader[0].Entry point = 0x00108000;
# Bootloader[0].Attributes = 0x00000004;
SDRAM[0].MemoryType = NvBootMemoryType_LpDdr2;
SDRAM[0].PllMChargePumpSetupControl = 0x00000008;
SDRAM[0].PllMLoopFilterSetupControl = 0x00000000;
SDRAM[0].PllMInputDivider = 0x0000001a;
SDRAM[0].PllMFeedbackDivider = 0x00000258;
SDRAM[0].PllMPostDivider = 0x00000000;
SDRAM[0].PllMStableTime = 0x0000012c;
SDRAM[0].EmcClockDivider = 0x00000001;
SDRAM[0].EmcAutoCalInterval = 0x00000000;
SDRAM[0].EmcAutoCalConfig = 0xe0a61111;
SDRAM[0].EmcAutoCalWait = 0x00000000;
SDRAM[0].EmcPinProgramWait = 0x00000000;
SDRAM[0].EmcRc = 0x00000012;
SDRAM[0].EmcRfc = 0x00000027;
SDRAM[0].EmcRas = 0x0000000d;
SDRAM[0].EmcRp = 0x00000006;
SDRAM[0].EmcR2w = 0x00000007;
SDRAM[0].EmcW2r = 0x00000005;
SDRAM[0].EmcR2p = 0x00000003;
SDRAM[0].EmcW2p = 0x0000000b;
SDRAM[0].EmcRrd = 0x00000003;
SDRAM[0].EmcRdRcd = 0x00000006;
SDRAM[0].EmcWrRcd = 0x00000006;
SDRAM[0].EmcRext = 0x00000003;
SDRAM[0].EmcWdv = 0x00000003;
SDRAM[0].EmcQUseExtra = 0x00000006;
SDRAM[0].EmcQUse = 0x00000007;
SDRAM[0].EmcQRst = 0x00000004;
SDRAM[0].EmcQSafe = 0x00000009;
SDRAM[0].EmcRdv = 0x0000000d;
SDRAM[0].EmcRefresh = 0x0000045f;
SDRAM[0].EmcBurstRefreshNum = 0x00000000;
SDRAM[0].EmcPdEx2Wr = 0x00000004;
SDRAM[0].EmcPdEx2Rd = 0x00000004;
SDRAM[0].EmcPChg2Pden = 0x00000006;
SDRAM[0].EmcAct2Pden = 0x00000008;
SDRAM[0].EmcAr2Pden = 0x00000001;
SDRAM[0].EmcRw2Pden = 0x0000000f;
SDRAM[0].EmcTxsr = 0x0000002a;
SDRAM[0].EmcTcke = 0x00000003;
SDRAM[0].EmcTfaw = 0x0000000f;
SDRAM[0].EmcTrpab = 0x00000007;
SDRAM[0].EmcTClkStable = 0x00000007;
SDRAM[0].EmcTClkStop = 0x00000002;
SDRAM[0].EmcTRefBw = 0x000004e1;
SDRAM[0].EmcFbioCfg1 = 0x00000000;
SDRAM[0].EmcFbioDqsibDlyMsb = 0x00000000;
SDRAM[0].EmcFbioDqsibDly = 0x2f2f2f2f;
SDRAM[0].EmcFbioQuseDlyMsb = 0x00000000;
SDRAM[0].EmcFbioQuseDly = 0x2f2f2f2f;
SDRAM[0].EmcFbioCfg5 = 0x00000282;
SDRAM[0].EmcFbioCfg6 = 0x00000002;
SDRAM[0].EmcFbioSpare = 0x00000000;
SDRAM[0].EmcMrsResetDllWait = 0x00000000;
SDRAM[0].EmcMrsResetDll = 0x00000000;
SDRAM[0].EmcMrsDdr2DllReset = 0x00000000;
SDRAM[0].EmcMrs = 0x00000000;
SDRAM[0].EmcEmrsEmr2 = 0x00000000;
SDRAM[0].EmcEmrsEmr3 = 0x00000000;
SDRAM[0].EmcEmrsDdr2DllEnable = 0x00000000;
SDRAM[0].EmcEmrsDdr2OcdCalib = 0x00000000;
SDRAM[0].EmcEmrs = 0x00000000;
SDRAM[0].EmcMrw1 = 0x0001008a;
SDRAM[0].EmcMrw2 = 0x00020004;
SDRAM[0].EmcMrw3 = 0x00030002;
SDRAM[0].EmcMrwResetCommand = 0x003f0000;
SDRAM[0].EmcMrwResetNInitWait = 0x0000000a;
SDRAM[0].EmcAdrCfg1 = 0x00070303;
SDRAM[0].EmcAdrCfg = 0x01070303;
SDRAM[0].McEmemCfg = 0x00100000;
SDRAM[0].McLowLatencyConfig = 0x80000003;
SDRAM[0].EmcCfg2 = 0x00000403;
SDRAM[0].EmcCfgDigDll = 0xe0000413;
SDRAM[0].EmcCfgClktrim0 = 0x00000000;
SDRAM[0].EmcCfgClktrim1 = 0x00000000;
SDRAM[0].EmcCfgClktrim2 = 0x00000000;
SDRAM[0].EmcCfg = 0x0001ff00;
SDRAM[0].EmcDbg = 0x01000020;
SDRAM[0].AhbArbitrationXbarCtrl = 0x00010000;
SDRAM[0].EmcDllXformDqs = 0x00000010;
SDRAM[0].EmcDllXformQUse = 0x00000008;
SDRAM[0].WarmBootWait = 0x00000001;
SDRAM[0].EmcCttTermCtrl = 0x00000802;
SDRAM[0].EmcOdtWrite = 0x00000000;
SDRAM[0].EmcOdtRead = 0x00000000;
SDRAM[0].EmcZcalRefCnt = 0x00000000;
SDRAM[0].EmcZcalWaitCnt = 0x0000001b;
SDRAM[0].EmcZcalMrwCmd = 0x000a0056;
SDRAM[0].EmcMrwZqInitDev0 = 0x800a00ff;
SDRAM[0].EmcMrwZqInitDev1 = 0x400a00ff;
SDRAM[0].EmcMrwZqInitWait = 0x00000001;
SDRAM[0].EmcDdr2Wait = 0x00000000;
SDRAM[0].PmcDdrPwr = 0x00000000;
SDRAM[0].ApbMiscGpXm2CfgAPadCtrl = 0x77ffc000;
SDRAM[0].ApbMiscGpXm2CfgCPadCtrl2 = 0x08080040;
SDRAM[0].ApbMiscGpXm2CfgCPadCtrl = 0x77fffff8;
SDRAM[0].ApbMiscGpXm2CfgDPadCtrl2 = 0x00000000;
SDRAM[0].ApbMiscGpXm2CfgDPadCtrl = 0x77fffff8;
SDRAM[0].ApbMiscGpXm2ClkCfgPadCtrl = 0x77ffc000;
SDRAM[0].ApbMiscGpXm2CompPadCtrl = 0x01f1f008;
SDRAM[0].ApbMiscGpXm2VttGenPadCtrl = 0x00005500;
---------- Post added at 02:13 AM ---------- Previous post was at 01:59 AM ----------
legion1911 said:
Please explain how.
Click to expand...
Click to collapse
I think by mounting this image like a loop device in linux and deleting unneeded files from what i know SGR uses ext4 file system

Welcome SPLESH!
1) Please give us a download link for the nvflash you use and let us know about your progress.
2) "I think by mounting this image like a loop device in linux and deleting unneeded files from what i know SGR uses ext4 file system"
I do not use linux. How I do it in windows?
---------- Post added at 04:40 AM ---------- Previous post was at 03:41 AM ----------
ardatdat said:
Let's discuss how we could dump out the kernel, ROMS, etc. from Galaxy R:
The following command would help to dump the kernel out (need su)
Code:
cat /dev/block/mmcblk0p9 > /sdcard/boot-i9103.img
The following command should help to dump the /system/ out (need su)
Code:
cat /dev/block/mmcblk0p2 > /sdcard/system-i9103.img
Click to expand...
Click to collapse
Nice. How I do that on Windows 7?

legion1911 said:
Please explain how to do it on Windows 7.
Click to expand...
Click to collapse
on Windows 7 How?

Hi
Ok I will look to find a way to extract and pack it back or at least modify image itself (I do not have Windows and I will have to install it in virtualBox)
Look in this thread about magiciso (rfs and maybe ext4):
http://forum.xda-developers.com/showthread.php?t=879569
And of cause Linux reader (I can not verify it with image but i used it for real PC disk partitions):
http://www.diskinternals.com/linux-reader/
About nvflash, this thread have much info about it (it is for G Tablet but work as well on SGR, or maybe not so well but i will research more on it):
http://forum.xda-developers.com/showthread.php?t=861950
---------- Post added at 10:27 AM ---------- Previous post was at 10:06 AM ----------
To put device into nvflash mod you need:
unplug USB cable
turn device off
remove battery
press VOL_UP and VOL_DOWN and hold them
insert USB cable
press HOME for 1-2 sec
press POWER
verify device (windows should detect new device, on linux run lsusb and see for Nvidia Inc device)
release POWER, HOME, and VOL keys
on Windows install APX driver from post, on Linux run lsusb and look for Nvidia Inc device remember ID XXXX:XXXX (first part is vendor and do not change) and create udev rule for it with this line: SUBSYSTEM=="usb", ATTR{idVendor}=="0955", ATTR{idProduct}=="7f20", MODE="0660", GROUP="plugdev"
now you can run nvflash --sync (with out bootloader) just to verify it can connect

SPLESH!
I am so glad you are in this forum.
Greetings to Crimea!

May be I need use nvflash with USB JIG to be able to operate it will make one and try to operate with it on this weekend and will share my results with you guys

Hi
Can some one who rooted device but did not changed stock kernel post output of after su:
adb shell cat /sys/firmware/fuse/odm_production_mode > odm_production_mode.txt
adb shell cat /sys/firmware/fuse/sec_boot_dev_cfg >
sec_boot_dev_cfg.txt
adb shell cat /sys/firmware/fuse/sec_boot_dev_sel > sec_boot_dev_sel.txt
and probably all content of /sys/firmware/fuse will be useful for my investigation
I understand that this may be different among devices but just for reference this info will be interesting to look at

Some thought about partitions layout
Code:
mmc0->cid=15010056414c30304d11593326177e00
mmc0->csd=d02701320f5903fff6dbffef8a404000
mmc0->name=VAL00M
mmc0->type=MMC
mmc0->oemid=0x0100
mmc0->serial=0x59332617
mmc0->manfid=0x000015
mmc0->preferred_erase_size=524288
mmc0->erase_size=524288
mmc0->date=07/2011
mmcblk0->dev=179:0
mmcblk0->range=8
mmcblk0->ext_range=255
mmcblk0->removable=0
mmcblk0->ro=0
mmcblk0->size=15104000
mmcblk0->alignment_offset=0
mmcblk0->discard_alignment=0
mmcblk0->capability=50
p0->size=??? /bct,/pt,/flags
p1->size=24576 /efs ~11Mb
p2->size=1228800 /system ~503Mb
p3->size=638976 /cache ~307Mb
p4->size=7865344 /sdcard ~3Gb
p5->size=4096 radio? ~2Mb
p6->size=4194304 /data ~1Gb
p7->size=32768 radio? ~15Mb
p8->size=10240 recavery ~5Mb
p9->size=16384 boot ~8Mb
p10->size=16384 hidden? ~8Mb
p11->size=1048576 factoryfs? ~500Mb

It is more than a month since I played with this, but if I remember correctly, p8 is recovery, p9 is boot.
These 2 partitions need special scripts to unzip. Check here:
Code:
http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack%2C_Edit%2C_and_Re-Pack_Boot_Images
System partition is probably a standard Linux partition and is easy to mount on any Linux system.
I used dd to dump them, which essentially does the same thing as cat but with more options.

Yes you are correct and p5 and p7 are both radio related so the first 10 or so mb are for low level hboot/fastboot, partition table and etc
Sent from my GT-I9103 using XDA App

Sorry did not read the kernel code p5 is MISC partition

I lost ability to play with flash (some thing happend with VOL keys) it is good that i rooted it and instlled cwm just a day beffore (we had snow and ice no the road and I fail and paranty damedjed buttons) but I will continue to work on kernel until i will get it repared (new year, and etc)

SPLESH said:
I lost ability to play with flash (some thing happend with VOL keys) it is good that i rooted it and instlled cwm just a day beffore (we had snow and ice no the road and I fail and paranty damedjed buttons) but I will continue to work on kernel until i will get it repared (new year, and etc)
Click to expand...
Click to collapse
Did you open your device to check the electronics? Because I doubt you could damage the buttons permanently by software.

No i did it in more bad way also dameged side of device not so raw but this thin thing which they use for buttons is broken i did open it and removed broken pice of plastic and fexible pcb with buttons on it glad it at least work cause i was thinking it is it will have to replace this two parts
Sent from my GT-I9103 using XDA App
---------- Post added at 05:32 PM ---------- Previous post was at 05:11 PM ----------
This part "KEY FPCB-VOLUME KEY(GT-I9103) GH59-11005A" and plastic button part they should not cost much but it is little inconvenient for me now

SPLESH said:
Some thought about partitions layout
Code:
mmc0->cid=15010056414c30304d11593326177e00
mmc0->csd=d02701320f5903fff6dbffef8a404000
mmc0->name=VAL00M
mmc0->type=MMC
mmc0->oemid=0x0100
mmc0->serial=0x59332617
mmc0->manfid=0x000015
mmc0->preferred_erase_size=524288
mmc0->erase_size=524288
mmc0->date=07/2011
mmcblk0->dev=179:0
mmcblk0->range=8
mmcblk0->ext_range=255
mmcblk0->removable=0
mmcblk0->ro=0
mmcblk0->size=15104000
mmcblk0->alignment_offset=0
mmcblk0->discard_alignment=0
mmcblk0->capability=50
p0->size=??? /bct,/pt,/flags
p1->size=24576 /efs ~11Mb
p2->size=1228800 /system ~503Mb
p3->size=638976 /cache ~307Mb
p4->size=7865344 /sdcard ~3Gb
p5->size=4096 radio? ~2Mb
p6->size=4194304 /data ~1Gb
p7->size=32768 radio? ~15Mb
p8->size=10240 recavery ~5Mb
p9->size=16384 boot ~8Mb
p10->size=16384 hidden? ~8Mb
p11->size=1048576 factoryfs? ~500Mb
Click to expand...
Click to collapse
If I use this for BoardConfig.mk , how can I convert the sizes to hex values/bytes ?

EmoBoiix3 said:
If I use this for BoardConfig.mk , how can I convert the sizes to hex values/bytes ?
Click to expand...
Click to collapse
this values are taken from:
Code:
/sys/devices/platform/sdhci-tegra.3/mmc_host/mmc0/mmc0:0001/block/mmcblk0
Code:
adb shell cat /sys/devices/platform/sdhci-tegra.3/mmc_host/mmc0/mmc0:0001/block/mmcblk0/mmcblk0p*/size
And this sizes is in blocks, 2048 byte each.

somthing intresting help unbrick

[PWRAP] pwrap_init_preloader
[PWRAP] pwrap_init
[PWRAP] _pwrap_init_sidly [Read Test] pass,SIDLY=0 rdata=5AA5
[PWRAP] _pwrap_init_sidly [Read Test] pass,SIDLY=1 rdata=5AA5
[PWRAP] _pwrap_init_sidly [Read Test] pass,SIDLY=2 rdata=5AA5
[PWRAP] _pwrap_init_sidly [Read Test] pass,SIDLY=3 rdata=5AA5
[PMIC_WRAP]wrap_init pass,the return value=0.
pl pmic init start
pl pmic efuse start
pl pmic efuse BUCK trim
[0x1C8]=0xF802
[0x1CA]=0x807F
[0x20E]=0xE0
[0x260]=0xF0
[0x286]=0xF0
pl pmic efuse end
pl pmic en rst [0x126]=0x13
[0xE]=0x1
[0x540]=0xA0
Battery exist
[0xE]=0x1
[0x540]=0xA0
pl vm read [0x290]=0x50
pl vm set [0x290]=0x52
pl vm check [0x290]=0x52
pl pmic init done
[PLFM] Init I2C: OK(0)
[PLFM] Init PWRAP: OK(0)
[PLFM] Init PMIC: OK(0)
[PLFM] chip[CA00]
[I2C][PL] [i2c0 write] i2c transaction complate
[BLDR] Build Time: 20140218-141828
==== Dump RGU Reg ========
RGU MODE: 75
RGU LENGTH: FFE0
RGU STA: 40000000
RGU INTERVAL: FFF
RGU SWSYSRST: 0
==== Dump RGU Reg End ====
RGU: g_rgu_satus:2
mtk_wdt_mode_config mode value=35, tmp:22000030
PL RGU RST: ??
SW reset with bypass power key flag
Find bypass powerkey flag
mtk_wdt_mode_config mode value=70, tmp:22000071
kpd register for pmic set!
mt_usb_calibraion: input_reg = 0x0
mt_usb_calibraion: term_vref = 0x0, clkref = 0x0, vrt_vref = 0x0,
[RTC] bbpu = 0x5, con = 0x426
[RTC] irqsta = 0x0, pdn1 = 0x0, pdn2 = 0x201, spar0 = 0x40, spar1 = 0x800
[RTC] new_spare0 = 0x0, new_spare1 = 0x1, new_spare2 = 0x1, new_spare3 = 0x1
[RTC] bbpu = 0x5, con = 0x424
SW reset with bypass power key flag
SW reset with bypass power key flag
[PLFM] WDT reboot bypass power key!
p1 pmic read INT_RSV(bit7)[0x138][0x80]
[RTC] rtc_bbpu_power_on done
[SD0] Bus Width: 1
[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(0) DDR(0) DIV(193) DS(0) RS(0)
[SD0] Switch to High-Speed mode!
[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(2) DDR(1) DIV(96) DS(0) RS(0)
[SD0] Bus Width: 8
[SD0] Size: 3696 MB, Max.Speed: 52000 kHz, blklen(512), nblks(7569408), ro(0)
[SD0] Initialized
[SD0] SET_CLK(52000kHz): SCLK(50000kHz) MODE(2) DDR(1) DIV(0) DS(0) RS(0)
msdc_ett_offline_to_pl: size<2> m_id<0x90>
msdc <0> <HYNIX > <H4G1d>
msdc <1> <xxxxxx> <H4G1d>
msdc failed to find
*******EMMC_INFO*******
eMMC partition size(1 block = 512Bytes):
BOOT1:<4096> blocks
BOOT2:<4096> blocks
RPMB :<4096> blocks
GP1 :<0> blocks
GP2 :<0> blocks
GP3 :<0> blocks
GP4 :<0> blocks
USER :<7569408> blocks
*******EMMC_INFO*******
fw id len:1
found:1,i:1
[EMI] DDR2
[EMI] eMMC/NAND ID = 90,1,4A,48,34,47,31,64,4
[EMI] MDL number = 1
[MEM] 1066 MHZ
rank 0 coarse = 15
rank 0 fine = 48
10:| 0 0 1 1 1 0
opt_dle value:8
rank 1 coarse = 15
rank 1 fine = 48
10:| 0 0 1 1 1 0
opt_dle value:8
byte:0, (DQS,DQ)=(8,8)
byte:1, (DQS,DQ)=(8,A)
byte:2, (DQS,DQ)=(8,8)
byte:3, (DQS,DQ)=(8,A)
[EMI] DRAMC calibration passed
[EMI] DQSINCTL:50000
[MEM] complex R/W mem test pass
[PLFM] Init Boot Device: OK(0)
[ROM_INFO] 'v2','0x2700000','0x20000','0x46C0000','0x2C00'
[SEC_K] SML KEY AC = 0
[SEC_K] SBC_PUBK Found
[SEC] AES Legacy : 0
[SEC] SECCFG AC : 1
[SEC] read '0x2700000'
0x41,0x4E,0x44,0x5F,0x53,0x45,0x43,0x43,
[LIB] SecLib.a '20121226-155014'
[LIB] CFG read size '0x4000' '0x1860'
[LIB] Name = SOMC
[LIB] Config = 0x11, 0x11
0x31,0x41,0x35,0x35
0x6F679858
[LIB] HW DEC
0x49494949
[LIB] SEC CFG 'v3' exists
[LIB] Status = 0x43434343
[LIB] ty = 0 , ld = 0
[PART] Image with part header
[PART] name : LK
[PART] addr : FFFFFFFFh
[PART] size : 316772
[PART] magic: 58881688h
[PART] load "UBOOT" from 0x0000000003960200 (dev) to 0x81E00000 (mem) [SUCCESS]
[PART] load speed: 9374KB/s, 316772 bytes, 33ms
[LIB] HW DEC
[SECRO] secroimg '0x41414141'
[SECRO] secroimg '0x35353535'
[SECRO] factory mode enabled
[AUTHEN] rsa.N length = 1024 bytes
[AUTHEN] rsa.E length = 20 bytes
[LIB] Verify 'UBOOT'
0x43434343
[LIB] part load '0x3960000'
[AUTHEN] 0x53,0x53,0x53,0x53
[AUTHEN] verify signature ... pass
[LIB] Verify 'LOGO'
0x43434343
[LIB] part load '0x4D40000'
[AUTHEN] 0x53,0x53,0x53,0x53
[AUTHEN] verify signature ... failed, error is 7
[SECLIB_IMG_VERIFY] Signature Fail.
[LIB] Fail (0x0)
<ASSERT> sec_boot.c:line 181 0
[PLFM] preloader fatal error...
[PLFM] emergency download mode(timeout: 30s).
mtk_arch_reset at pre-loader!
this is console with serial interface
i will post picture with pin layaut

how to unbrick?

botioni said:
[PWRAP] pwrap_init_preloader
[PWRAP] pwrap_init
[PWRAP] _pwrap_init_sidly [Read Test] pass,SIDLY=0 rdata=5AA5
[PWRAP] _pwrap_init_sidly [Read Test] pass,SIDLY=1 rdata=5AA5
[PWRAP] _pwrap_init_sidly [Read Test] pass,SIDLY=2 rdata=5AA5
[PWRAP] _pwrap_init_sidly [Read Test] pass,SIDLY=3 rdata=5AA5
[PMIC_WRAP]wrap_init pass,the return value=0.
pl pmic init start
pl pmic efuse start
pl pmic efuse BUCK trim
[0x1C8]=0xF802
[0x1CA]=0x807F
[0x20E]=0xE0
[0x260]=0xF0
[0x286]=0xF0
pl pmic efuse end
pl pmic en rst [0x126]=0x13
[0xE]=0x1
[0x540]=0xA0
Battery exist
[0xE]=0x1
[0x540]=0xA0
pl vm read [0x290]=0x50
pl vm set [0x290]=0x52
pl vm check [0x290]=0x52
pl pmic init done
[PLFM] Init I2C: OK(0)
[PLFM] Init PWRAP: OK(0)
[PLFM] Init PMIC: OK(0)
[PLFM] chip[CA00]
[I2C][PL] [i2c0 write] i2c transaction complate
[BLDR] Build Time: 20140218-141828
==== Dump RGU Reg ========
RGU MODE: 75
RGU LENGTH: FFE0
RGU STA: 40000000
RGU INTERVAL: FFF
RGU SWSYSRST: 0
==== Dump RGU Reg End ====
RGU: g_rgu_satus:2
mtk_wdt_mode_config mode value=35, tmp:22000030
PL RGU RST: ??
SW reset with bypass power key flag
Find bypass powerkey flag
mtk_wdt_mode_config mode value=70, tmp:22000071
kpd register for pmic set!
mt_usb_calibraion: input_reg = 0x0
mt_usb_calibraion: term_vref = 0x0, clkref = 0x0, vrt_vref = 0x0,
[RTC] bbpu = 0x5, con = 0x426
[RTC] irqsta = 0x0, pdn1 = 0x0, pdn2 = 0x201, spar0 = 0x40, spar1 = 0x800
[RTC] new_spare0 = 0x0, new_spare1 = 0x1, new_spare2 = 0x1, new_spare3 = 0x1
[RTC] bbpu = 0x5, con = 0x424
SW reset with bypass power key flag
SW reset with bypass power key flag
[PLFM] WDT reboot bypass power key!
p1 pmic read INT_RSV(bit7)[0x138][0x80]
[RTC] rtc_bbpu_power_on done
[SD0] Bus Width: 1
[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(0) DDR(0) DIV(193) DS(0) RS(0)
[SD0] Switch to High-Speed mode!
[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(2) DDR(1) DIV(96) DS(0) RS(0)
[SD0] Bus Width: 8
[SD0] Size: 3696 MB, Max.Speed: 52000 kHz, blklen(512), nblks(7569408), ro(0)
[SD0] Initialized
[SD0] SET_CLK(52000kHz): SCLK(50000kHz) MODE(2) DDR(1) DIV(0) DS(0) RS(0)
msdc_ett_offline_to_pl: size<2> m_id<0x90>
msdc <0> <HYNIX > <H4G1d>
msdc <1> <xxxxxx> <H4G1d>
msdc failed to find
*******EMMC_INFO*******
eMMC partition size(1 block = 512Bytes):
BOOT1:<4096> blocks
BOOT2:<4096> blocks
RPMB :<4096> blocks
GP1 :<0> blocks
GP2 :<0> blocks
GP3 :<0> blocks
GP4 :<0> blocks
USER :<7569408> blocks
*******EMMC_INFO*******
fw id len:1
found:1,i:1
[EMI] DDR2
[EMI] eMMC/NAND ID = 90,1,4A,48,34,47,31,64,4
[EMI] MDL number = 1
[MEM] 1066 MHZ
rank 0 coarse = 15
rank 0 fine = 48
10:| 0 0 1 1 1 0
opt_dle value:8
rank 1 coarse = 15
rank 1 fine = 48
10:| 0 0 1 1 1 0
opt_dle value:8
byte:0, (DQS,DQ)=(8,8)
byte:1, (DQS,DQ)=(8,A)
byte:2, (DQS,DQ)=(8,8)
byte:3, (DQS,DQ)=(8,A)
[EMI] DRAMC calibration passed
[EMI] DQSINCTL:50000
[MEM] complex R/W mem test pass
[PLFM] Init Boot Device: OK(0)
[ROM_INFO] 'v2','0x2700000','0x20000','0x46C0000','0x2C00'
[SEC_K] SML KEY AC = 0
[SEC_K] SBC_PUBK Found
[SEC] AES Legacy : 0
[SEC] SECCFG AC : 1
[SEC] read '0x2700000'
0x41,0x4E,0x44,0x5F,0x53,0x45,0x43,0x43,
[LIB] SecLib.a '20121226-155014'
[LIB] CFG read size '0x4000' '0x1860'
[LIB] Name = SOMC
[LIB] Config = 0x11, 0x11
0x31,0x41,0x35,0x35
0x6F679858
[LIB] HW DEC
0x49494949
[LIB] SEC CFG 'v3' exists
[LIB] Status = 0x43434343
[LIB] ty = 0 , ld = 0
[PART] Image with part header
[PART] name : LK
[PART] addr : FFFFFFFFh
[PART] size : 316772
[PART] magic: 58881688h
[PART] load "UBOOT" from 0x0000000003960200 (dev) to 0x81E00000 (mem) [SUCCESS]
[PART] load speed: 9374KB/s, 316772 bytes, 33ms
[LIB] HW DEC
[SECRO] secroimg '0x41414141'
[SECRO] secroimg '0x35353535'
[SECRO] factory mode enabled
[AUTHEN] rsa.N length = 1024 bytes
[AUTHEN] rsa.E length = 20 bytes
[LIB] Verify 'UBOOT'
0x43434343
[LIB] part load '0x3960000'
[AUTHEN] 0x53,0x53,0x53,0x53
[AUTHEN] verify signature ... pass
[LIB] Verify 'LOGO'
0x43434343
[LIB] part load '0x4D40000'
[AUTHEN] 0x53,0x53,0x53,0x53
[AUTHEN] verify signature ... failed, error is 7
[SECLIB_IMG_VERIFY] Signature Fail.
[LIB] Fail (0x0)
<ASSERT> sec_boot.c:line 181 0
[PLFM] preloader fatal error...
[PLFM] emergency download mode(timeout: 30s).
mtk_arch_reset at pre-loader!
this is console with serial interface
i will post picture with pin layaut
Click to expand...
Click to collapse
how did you check this out?

theonecallednick said:
how did you check this out?
Click to expand...
Click to collapse
I found uart pin on mainboard for debuging .
with serial usb cable pl2303

This is the red light only and unknown hardware found (the unknown hardware is in fact mtk usb vcom driver buth sony version ) if you try sp flash tool for mtk then it comunicates with de phone buth it needs some authentication file.

Help..
I am also having same problem..I falshed wrong rom..
It just shows red led and does not detects by PC...
Were you able to solve the problem..if yes..please help..

botioni said:
[PWRAP] pwrap_init_preloader
[PWRAP] pwrap_init
[PWRAP] _pwrap_init_sidly [Read Test] pass,SIDLY=0 rdata=5AA5
.........................
this is console with serial interface
i will post picture with pin layaut
Click to expand...
Click to collapse
Samuel Wankhede said:
I am also having same problem..I falshed wrong rom..
It just shows red led and does not detects by PC...
Were you able to solve the problem..if yes..please help..
Click to expand...
Click to collapse
Try the guide given in thread linked below
http://forum.xda-developers.com/showpost.php?p=57614511&postcount=13

Please share uart pinout
Baudrate should be 115200??
Thanks

uart
please share the uart pinout , thanks

[Completed] [Q] touch screen inverted

my tablets a20 allwinner board `: s780I-v10
my touch has just got inverted .when i touch right side screen it goes left..i flashed the stock rom but still the problem exists..anyone look at the script file( attachments ) at tells me what to do...are touch screen drivers missing or not? confused
already converted from script.bin to script.fex
please help
or take look at this
[ctp_para]
ctp_used = 1
ctp_twi_id = 2
ctp_screen_max_x = 800
ctp_screen_max_y = 480
ctp_firm = 2
ctp_int_port = portH21<6><default><default><default>
ctp_wakeup = portB13<1><default><default><1>
[ctp_cfg_para]
ctp_cfg_used = 0
[ctp_list_para]
ctp_det_used = 1
ft5x_ts = 1
gt82x = 0
gslX680 = 1
gt9xx_ts = 0
gt910 = 0
gt811 = 1
gt818 = 0
ilitek_aimvF = 1
zet6221 = 1

Hi,
I can't find anything relevant on XDA for your device and issue. You will need to ask for help here,
> Android Development and Hacking > Android Q&A, Help & Troubleshooting
Good luck!

mkbootimg created boot.img creation discrepenacy

Hi,
I have noticed a discrepancy which I am unable to understand and appreciate if someone can provide a clarification in case they have noticed the same issue. I tried to split (using unmkbootimg) boot.img (from Xiaomi Mi MAX update ROMs) and merged it back (using mkbootimg) and found that the newly made boot.img was smaller by 1354 bytes. Appreciate your reply if I am missing anything.
% ls -l boot.img ../boot.img
-rw-rw-r-- 1 skanduru skanduru 12924234 Jan 1 2009 ../boot.img
-rw-rw-r-- 1 skanduru skanduru 12922880 Jan 15 01:07 boot_new.img
% cat output.txt
# kernel written to 'kernel' (10172221 bytes)
# ramdisk written to 'ramdisk.cpio.gz' (2746601 bytes)
# To rebuild this boot image, you can use the command:
mkbootimg --base 0 --pagesize 2048 --kernel_offset 0x80008000 --ramdisk_offset 0x81000000 --second_offset 0x80f00000 --tags_offset 0x80000100 --cmdline
'console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=qcom msm_rtb.filter=0x237 ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci
lpm_levels.sleep_disabled=1 earlyprintk ramoops_memreserve=4M' --kernel kernel --ramdisk ramdisk.cpio.gz -o boot_new.img
A bindiff of the two images shows that the original boot.img has some stuff (1354 bytes) appended at the bottom which makes the difference. The net result is the boot_new.img doesn't boot up. Just wondering if someone has seen this issue.

boot image to try
The link to boot.img image to try out mkbootimg issue. We can see that @C53000, the original boot.img has extra stuff (1374 bytes).
Image can be downloaded from (Couldn't update it in the previous query)
s000 DOT tinyupload DOT com/?file_id=42124441031490820660

skanduru said:
The link to boot.img image to try out mkbootimg issue. We can see that @C53000, the original boot.img has extra stuff (1374 bytes).
Image can be downloaded from (Couldn't update it in the previous query)
s000 DOT tinyupload DOT com/?file_id=42124441031490820660
Click to expand...
Click to collapse
Could be an issue with Xiaomi image as it doesn't specify second_bootloader size, but appends it. Tried this change and it works. Not sure if it might be the case for potentially other manufacturer's boot.img. Posting it if it could be of some use.
--- a/mkbootimg/unmkbootimg.c
+++ b/mkbootimg/unmkbootimg.c
@@ -80,6 +80,30 @@ int usage(void)
return 1;
}
+int maybe_fix_second_image_size(boot_img_hdr *hdr, void *file_data)
+{
+ int offset = ((hdr->kernel_size + hdr->ramdisk_size
+ + 2*hdr->page_size - 1) / hdr->page_size) * hdr->page_size;
+ char *second_image = ((char *)file_data + offset);
+ u_int16_t *s = (u_int16_t *) second_image;
+ int is_second_image_true = 0;
+
+ if (s[0]) {
+ /*
+ * Second_image does exist ! Calculate the size and fix the
+ * size in hdr.
+ */
+ int size = 0;
+ while (s[0]) {
+ size += 2;
+ s++;
+ }
+ hdr->second_size = size;
+ is_second_image_true = 1;
+ }
+ return is_second_image_true;
+}
+
int main(int argc, char **argv)
{
void *file_data = 0;
@@ -160,7 +184,13 @@ int main(int argc, char **argv)
hdr->ramdisk_size);
}
- if(hdr->second_size != 0) {
+ /*
+ * Even though the second_size is 0, some vendors may place secondary
+ * image there, for ex. Xiaomi. In such a case do calculate the size
+ * based on termination with a null.
+ * XXX: Temp fix.
+ */
+ if(hdr->second_size != 0 || maybe_fix_second_image_size(hdr, file_data)) {
offset = ((hdr->kernel_size + hdr->ramdisk_size
+ 2*hdr->page_size - 1) / hdr->page_size) * hdr->page_size;
if (save_file(second_fn, &((char *)file_data)[offset],

How To Open tumbdata3 file?

I have tumbdata3 file. How can I recover or extract images in it?

xeeks said:
I have tumbdata3 file. How can I recover or extract images in it?
Click to expand...
Click to collapse
You probably mean ".THUMBDATA3-xxxx" which provides the "android thumbnail index".
If you want to extract single images as jpg files, I have bad news for you - its not possible.

How about with this code?
#!s/usr/bin/python
"""extract files from Android thumbdata3 file"""
f=open('thumbdata3.dat','rb')
tdata = f.read()
f.close()
ss = '\xff\xd8'
se = '\xff\xd9'
count = 0
start = 0
while True:
x1 = tdata.find(ss,start)
if x1 < 0:
break
x2 = tdata.find(se,x1)
jpg = tdata[x1:x2+1]
count += 1
fname = 'extracted%d03.jpg' % (count)
fw = open(fname,'wb')
fw.write(jpg)
fw.close()
start = x2+2

LS.xD said:
You probably mean ".THUMBDATA3-xxxx" which provides the "android thumbnail index".
If you want to extract single images as jpg files, I have bad news for you - its not possible.
Click to expand...
Click to collapse
Is there anyway to view it?

xeeks said:
How about with this code?
#!s/usr/bin/python
"""extract files from Android thumbdata3 file"""
f=open('thumbdata3.dat','rb')
tdata = f.read()
f.close()
ss = '\xff\xd8'
se = '\xff\xd9'
count = 0
start = 0
while True:
x1 = tdata.find(ss,start)
if x1 < 0:
break
x2 = tdata.find(se,x1)
jpg = tdata[x1:x2+1]
count += 1
fname = 'extracted%d03.jpg' % (count)
fw = open(fname,'wb')
fw.write(jpg)
fw.close()
start = x2+2
Click to expand...
Click to collapse
Where did you find it?

LS.xD said:
Where did you find it?
Click to expand...
Click to collapse
Google Search. My question is does it work?