Related
Hello. To whoever who has blew up the IMEI's on their Moto G by command "fastboot erase all". Please note i have not yet found the solution but am working on it. I need help. Here is the status:
1. PDS partition does not determine IMEI!
As you know PDS is actually at /dev/block/mmcblk0p26 or /dev/block/platform/msm_sdc.1/by-name/pds. When the phone boot it mounts this partition at /pds. After blowng up my IMEI, this partition was still mounting at /pds and had data untouched in it. So this partition is really not important. Also i read on another thread, people with backup also cud not restore their IMEI.
2.When giving command "fastboot erase all", the following partitions are erased, potential IMEI storage locations:
a. hob (located at /dev/block/platform/msm_sdcc.1/by-name/hob)
b. dhob (located at /dev/block/platform/msm_sdcc.1/by-name/dhob)
c. fsc (located at /dev/block/platform/msm_sdcc.1/by-name/fsc)
There are other partitions erased as well such as fsg,modemst1, modemst2 etc. But these partitions are restored when we flash stock ROM. So they can be took out of picture.
3. What i need help with
Now i tried to determine the file system of hob,dhob,pds and fsc but was unable to find it. Tried to format these with "make_ext4fs", no luck. Now i need some one who has rooted Moto G with intact IMEI who can extract and send these partitions so that i can test accordingly.
I am sorry there is no solution here till now, but i am trying my best to convert this "tablet" back into phone.
Thanks.
UPDATE
skyguy126 has worked really hard on this thing and is near achieving the result. Any help is greatly needed. Thanks. Please check his posts to get you up to date.
Click to expand...
Click to collapse
DISCLAIMER
Changing or messing up with IMEI may be banned in your area or country of residence. Please check with your local regulations before attempting to modify the IMEI and related information of your phone. I take no responsibility whatsoever for your attempts to change any such information. This thread does not support in anyway to deliberately modify the identity of the phone. But we do to try and recover any lost information. Thanks.
Click to expand...
Click to collapse
Filesystem info:
/dev/block/platform/msm_sdc.1/by-name/pds = ext3
/dev/block/platform/msm_sdcc.1/by-name/hob = unknown, not mounted
/dev/block/platform/msm_sdcc.1/by-name/dhob = unknown, not mounted
/dev/block/platform/msm_sdcc.1/by-name/fsc = unknown, not mountedIt's possible those partitions are mounted and unmounted during bootup.
I did try mounting them: http://forum.xda-developers.com/showthread.php?t=1012622
More partition tools here: http://forum.xda-developers.com/showthread.php?t=520582
lost101 said:
Filesystem info:
/dev/block/platform/msm_sdc.1/by-name/pds = ext3
/dev/block/platform/msm_sdcc.1/by-name/hob = unknown, not mounted
/dev/block/platform/msm_sdcc.1/by-name/dhob = unknown, not mounted
/dev/block/platform/msm_sdcc.1/by-name/fsc = unknown, not mountedIt's possible those partitions are mounted and unmounted during bootup.
I did try mounting them: http://forum.xda-developers.com/showthread.php?t=1012622
More partition tools here: http://forum.xda-developers.com/showthread.php?t=520582
Click to expand...
Click to collapse
Ok lost101, thats great info.. So right now there is no way to read those hob,dhob and fsc partitions. Another dead end possibly. I tried with parted also, they are unreadable.
UPDATE I managed to format hob to ext2. Possibly its filesystem?(Need confirmation). Though dhob could not be formatted. Reason: "Too small 524"
Unsure if it's at all helpful, but here are the file-sizes of the partitions.
I'm also interested to know where the bootloader is stored. When flashing motoboot.img the command is: fastboot motoboot motoboot.img - so specifying the destination as a partition called 'motoboot.' But it would appear this partition is only available in fastboot mode, unless it's merely a pointer for /dev/block/platform/msm_sdcc.1/by-name/sbl1.
EDIT: Obviously not 'sbl1' since motoboot.img is almost 2mb.
lost101 said:
Unsure if it's at all helpful, but here are the file-sizes of the partitions.
I'm also interested to know where the bootloader is stored. When flashing motoboot.img the command is: fastboot motoboot motoboot.img - so specifying the destination as a partition called 'motoboot.' But it would appear this partition is only available in fastboot mode, unless it's merely a pointer for /dev/block/platform/msm_sdcc.1/by-name/sbl1.
EDIT: Obviously not 'sbl1' since motoboot.img is almost 2mb.
Click to expand...
Click to collapse
Yes i tried to erase moto boot: permission denied. Meanwhile i was taking a look on all init files in /etc. There's this file init.mmi.rc. It mounts /fsg and /persist, but sets permission to 0660 exactly to partitions we are pursuing i.e (hob,dhob). Following is the specific command:
exec /system/bin/chown -L root:radio /dev/block/platform/msm_sdcc.1/by-name/hob
exec /system/bin/chown -L root:radio /dev/block/platform/msm_sdcc.1/by-name/dhob
Its defining permission for root and "radio". And why does radio need to access hob and dhob? For IMEI?(Just a guess).
Also maybe radio then sets the baseband accordingly after reading hob and dhob. Because all those with 0 IMEI's have baseband version with 00y,01y at the end instead of 00R or 01P. Why is that? Even after flashing 01P baseband, it was still showing 01y. What does 01y signify? Please look into it if u have time. I am continously working. Hope we reach somewhere.
Another weird thing is that Via fast boot imei is correctly showed then when phone boots is 0
Confirm about baseband. Tried everything still 00y
I tried also flashing pds from a working moto g with no luck
@TeamMex has stated that the Bootloader (BL) is stored in a partition "untouchable by user." It would appear there is no way to make an .img dump (and flash it back via fastboot or other means) as a way to downgrade BL version. Currently the only way to flash to that partition is in BL mode - unless some other tools exist? I have not explored 'BP Tools' and 'QCOM' options on BL screen.
I would assume the same may not be true for IMEI, since that information (partition) is accessible at all times.
lost101 said:
@TeamMex has stated that the Bootloader (BL) is stored in a partition "untouchable by user." It would appear there is no way to make an .img dump (and flash it back via fastboot or other means) as a way to downgrade BL version. Currently the only way to flash to that partition is in BL mode - unless some other tools exist? I have not explored 'BP Tools' and 'QCOM' options on BL screen.
I would assume the same may not be true for IMEI, since that information (partition) is accessible at all times.
Click to expand...
Click to collapse
Some info relatd with Imei have part in PDS if you cant mount pds baseband are unrecognized and not (IMEI, not baseband, not signal, not serial number,not mac adress, etc...) You can think of it as that is a bridge connecting the software to the hardware, to recognize the serial, imei etc.
You can make backup of pds using TWRP
PS: All custom rom (Not stock ) have a fake PDS
PS2: OP
Bad bad bad , have you erased the rom (the one with the sensitive information from your phone)
You never make a fastboot erase all :| NEVER
now you can't obtain anymore your imei [Maybe if you send your phone to motorola they can repair it.)
Edit:
More info
/dev/block/platform/msm_sdcc.1/by-name/hob = unknown, not mounted <-- RAM related
/dev/block/platform/msm_sdcc.1/by-name/dhob = unknown, not mounted <-- not idea
/dev/block/platform/msm_sdcc.1/by-name/fsc = unknown, not mounted <-- not idea too
cheer.s
I have suggested the 'IMEI Backup Script' include other partitions: http://forum.xda-developers.com/showthread.php?p=56454537
@TeamMex, do you think with all those partitions backed up, someone could recover from 'fastboot erase all'?
lost101 said:
I have suggested the 'IMEI Backup Script' include other partitions: http://forum.xda-developers.com/showthread.php?p=56454537
@TeamMex, do you think with all those partitions backed up, someone could recover from 'fastboot erase all'?
Click to expand...
Click to collapse
Nope, he can't recover it.
you can't recover information only touchable via fastboot.
you can recover that info only if you have a some issues related with the PDS making a new rom
but if you make erase all you can't recover it.
Belive me I'm try to recover that info on moto G of friend.
TeamMex said:
Nope, he can't recover it.
you can't recover information only touchable via fastboot.
you can recover that info only if you have a some issues related with the PDS making a new rom
but if you make erase all you can't recover it.
Belive me I'm try to recover that info on moto G of friend.
Click to expand...
Click to collapse
Bummer. I guess that's the end of the story.
Return To Manufacturer (RTM) is the only solution for: fastboot erase all.
surfino said:
Another weird thing is that Via fast boot imei is correctly showed then when phone boots is 0
Confirm about baseband. Tried everything still 00y
I tried also flashing pds from a working moto g with no luck
Click to expand...
Click to collapse
Hello surfino. As i said earlier PDS is not important. That doesnt help with IMEI 0 problem. You can move on from that. But one thing. Did you "fastboot erase all" your Moto G? Because my IMEI is not displayed in fastboot. You can help by figuring out way to read hob and dhob partitions. They are most suspected to contain IMEI data. HOB and DHOB are at /dev/block/platform/msm_sdcc.1/by-name/hob and /dev/block/platform/msm_sdcc.1/by-name/dhob.
Thankyou.
lost101 said:
@TeamMex has stated that the Bootloader (BL) is stored in a partition "untouchable by user." It would appear there is no way to make an .img dump (and flash it back via fastboot or other means) as a way to downgrade BL version. Currently the only way to flash to that partition is in BL mode - unless some other tools exist? I have not explored 'BP Tools' and 'QCOM' options on BL screen.
I would assume the same may not be true for IMEI, since that information (partition) is accessible at all times.
Click to expand...
Click to collapse
I used BP Tools with QC Diag Driver and read NV partitions. Too bad. I tried to write NV #550 supposedly IMEI field, but to no avail. It seems Moto G does not support writing IMEI like that. Tried same with DFS. It gave BAD_PARAMETER error, meaning NV partition does not support inserting IMEI with that method.
TeamMex said:
Some info relatd with Imei have part in PDS if you cant mount pds baseband are unrecognized and not (IMEI, not baseband, not signal, not serial number,not mac adress, etc...) You can think of it as that is a bridge connecting the software to the hardware, to recognize the serial, imei etc.
You can make backup of pds using TWRP
PS: All custom rom (Not stock ) have a fake PDS
PS2: OP
Bad bad bad , have you erased the rom (the one with the sensitive information from your phone)
You never make a fastboot erase all :| NEVER
now you can't obtain anymore your imei [Maybe if you send your phone to motorola they can repair it.)
Edit:
More info
/dev/block/platform/msm_sdcc.1/by-name/hob = unknown, not mounted <-- RAM related
/dev/block/platform/msm_sdcc.1/by-name/dhob = unknown, not mounted <-- not idea
/dev/block/platform/msm_sdcc.1/by-name/fsc = unknown, not mounted <-- not idea too
cheer.s
Click to expand...
Click to collapse
Yes bro, i "fastboot erase all" 'd my Moto G. I learnt it the hard way. But i dont think hob and dhob are ram related because as i said earlier radio is chown'ing it in init file. And regarding corrupting PDS partition, my wifi bluetooth and gps are working fine even after formatting PDS completely. Though my WIFI stopped working when i formatted /persist.
PS: i took it to Motorola center. They said to replace the SOC completely! That sucks. And i gotta pay like half the amount i bought it for.
lost101 said:
Bummer. I guess that's the end of the story.
Return To Manufacturer (RTM) is the only solution for: fastboot erase all.
Click to expand...
Click to collapse
So guess thats it. Looks i have to buy a new phone then. I dont understand why Motorola would put such sensitive information to such easy access. Thats really bad on their part. Plus they have not simplfied the IMEI recovery process like samsung has. Anyways, thanks for your help man!
rootr said:
So guess thats it. Looks i have to buy a new phone then. I dont understand why Motorola would put such sensitive information to such easy access. Thats really bad on their part. Plus they have not simplfied the IMEI recovery process like samsung has. Anyways, thanks for your help man!
Click to expand...
Click to collapse
You have to remember Motorola don't talk about Fastboot on their site, or even make Firmware Images available to the public. The Motorola Firmware Images linked to on XDA are provided by a third party. Fastboot is intended for use by engineers only. Sorry for your loss.
rootr said:
Yes bro, i "fastboot erase all" 'd my Moto G. I learnt it the hard way. But i dont think hob and dhob are ram related because as i said earlier radio is chown'ing it in init file. And regarding corrupting PDS partition, my wifi bluetooth and gps are working fine even after formatting PDS completely. Though my WIFI stopped working when i formatted /persist.
PS: i took it to Motorola center. They said to replace the SOC completely! That sucks. And i gotta pay like half the amount i bought it for.
Click to expand...
Click to collapse
hob are symlinked partition only xD
Yes I did fastboot erase all
And with fastboot getvar imei it currently display my imei. That's what I don't understand
Would doing a JTAG dump help at all, since it dumps the entire nand chip? Just a suggestion...
Someone with an intact imei could try this.
---------- Post added at 02:01 AM ---------- Previous post was at 01:35 AM ----------
surfino said:
Yes I did fastboot erase all
And with fastboot getvar imei it currently display my imei. That's what I don't understand
Click to expand...
Click to collapse
If it correctly showed imei, reflash stock frimware from fastboot. This might restore it!
So, this is the tale:
- Tried to go back to stock (I had CM), but I failed hard.
- Went back to CM, no signal, WTF.
- Did a "fastboot getvar all", doesnt show IMEI
- Boot to CM, of course, *#06# shows an empty IMEI
- Said to myself, you ****ed up pal.
- Read thousand posts, tried almost everything.
- I give up, I have a ****ing tablet.
- Then I read this pal in the forum with similar case, he said "I flashed stock rom without sim card on"
- I thro, why the hell not? this **** is dead anyway.
- I download "exactly" the same stock rom for my phone, before I flashed a different version.
- **** works, my IMEI is back and I cant believe it.
Since then (1 week) has been working as normal.
The BLU VIVO XL4 has arived.
Sorry this guide is not for very new users, it relies on certain amount of prior knowledge.
**NOTE**
Unlocking Bootloader WILL set warranty flag to "NO"
Make the read-back backup, BEFORE unlocking, so there is a possibility to restore warranty to "yes"
Getting SPFlash Tool to work on BLU VIVO XL4
I used sp flash tool version 5.18.28
Needs custom DA file and Auth file. Both have been found from a near clone device.
Open flash tool select the DA file and Auth file from the link below.
add the scatter file from archive. There is a preloader file in the archive also. This is needed for spflash tool to open the Auth file.
Stock Rom and Auth file
Then follow the guide found on youtube.
Not planning to go into too much detail about the actual pulling of the firmware, as there is already
a fantastic guide with step-by-step photos and also a video.
Just the basics
Pull stock rom with spflash tool once just from the "boot region" to get the preloader file.
Process that file with the Wwr_MTK tool to get partition table information.
And one more time pull as one large binary file from the "user region" then split it into
individual images using the tool called "Wwr_MTK" it can be found on other site(Hovatek). I cannot put a
link as it is against forum rules (no advertising other forums)
But there is a youtube video that describes the process. And gives link for download of the tool.
**NOTE-1**
The Wwr_MTK tool did not have the correct chip (mt6762 In fact the "family class" for the chip is mt6765) as an option. Because of this you will need to add it to the tool before using it. Open the downloaded zip.( I used "WwR_MTK_2.40_Eng" ). Open "Template.ini" with text editing software, in the section labeled "CPU" add "MT6765 2" , keep same format as the rest of the file. Save the changes and close Template.ini.
Now when you run the tool, you will be able to create the scatter file as you split the rom into files.
**NOTE-2**
The tool connects to internet and downloads fresh the files and scripts when you start it. There is a 30 second ad screen displayed. If you block internet to the tool, then the add screen turns into 2 minute wait screen. I am not suggesting that you hack the tool to by-pass it, just letting you know what to expect.
IT IS HIGHLY RECOMMENDED TO MAKE YOUR OWN FULL BACKUP BEFORE PERFORMING THESE STEPS
AFTER YOU HAVE MADE FULL BACKUPS
Now to start modifying
DOWNLOAD
UNLOCK BOOTLOADER
unlocking bootloader is no more complicated then then enabling OEM unlock toggle in dev options menu.
Then performing Command in terminal. Just like so many android devices.
Unlock Bootloader
1. Enable Developer options on phone:
open settings--> "about device"--> click build number 5-7 times--> go back one screen in settings
-->select more "more settings" --> scroll to bottom "Develpoer options" --> enable "usb debugging"
2. Open cmd or power shell terminal
3. reboot phone to bootloader with the following commands
Code:
adb reboot bootloader
4.Once the phone has finished loading into fastboot mode type this command
Code:
fastboot oem unlock
I also did --MIGHT be an optional step
Code:
fastboot flashing unlock
Do not think both were needed.
After each command when phone was rebooted,
it took extra time to open. But did not show the normal recovery screen while
it did the factory reset. But a reset did happen both times,
as I had the setup wizard each time.
Even after unlocking bootloader, doing a "fastboot boot *xyz.img" (boot or recovery test images)
Phone would only cycle to off then do a full reboot. Doing "fastboot flash boot boot.img" does flash the boot.
And "fastboot flash recovery recovery.img" does flash the recovery.
TWRP
1. Download TWRP From Link above
2. Enable Developer options on phone:
open settings--> "about device"--> click build number 5-7 times--> go back one screen in settings
-->select "more settings" --> scroll to bottom "Develpoer options" --> enable "usb debugging"
3. Open cmd or power shell terminal
4. reboot phone to bootloader with the following commands
Code:
adb reboot bootloader
5. Now give the command to flash twrp, assuming you downloaded the file to default download folder
Code:
fastboot flash recovery %userprofile%\downloads\TWRP-3_2_3-1020-OMFG-mod_b6-device-name-vivo-wipe-misc.img
5. Reboot to twrp. Needed to boot directly to twrp, or stock recovery will be re-flashed by phone.
Code:
fastboot oem reboot-recovery
Once inside twrp It is asking for password to unlock (decrypt)***automatic decrypt not work on this device as of YET***
this is supposed to be same password used to unlock phone.
Because this twrp does not work with encryption, every time you reboot you will have to select language, if changed from default.
To get recovery to be functional, you need to make phone patched for both "DM-Verity" and "Force-encryption"
I do this with
"Universal Disabler"
https://forum.xda-developers.com/android/software/universal-dm-verity-forceencrypt-t3817389
There is similar utiliy built into this Recovery image.
to use the built in option , Select ADVANCED, Then RM Forceencrypt
This will flash the lazypatcher with options set to remove encryption both in boot.img and /vender/*fstab : remove dm-verity.
--OR-- manually do the following steps
Steps
1. Download Zip from Link above.
2. Open TWRP
3. Open Wipe menu
4. Select format /data
5. Key in "YES" and swipe
6. Return to Home Page of TWRP
7. Choose reboot menu then recovery
8. Recovery should now have access to Internal memory (temp for now)
9. Use abd push to put the zip file downloaded above to internal memory
Code:
adb push %userprofile%\downloads\Disable_Dm-Verity_ForceEncrypt_12.16.2018.zip /sdcard/
10. Select install menu , and install the Disable_Dm-Verity_ForceEncrypt_12.16.2018.zip
Do not rename the file. It installs and makes the patch base on the file name.
If you want to have root also, then flash Magisk at this point.
Now the dm-verity and force encryption are off. You can flash gsi custom rom, if you desire. At the moment, I have only been able to boot the phone with working cell data and calls on the PHH-Phusion --vanilla builds. Do not know why the gapps versions do not allow rill to function.
As of the writing of this I have put up V4 of the TWRP port. This version uses the correct mount points for this phone, not the ones from the source of the port. Also corrected the device name in default.prop, to match device name. Build fingerprint has been left as is. Fixed the micro sdcard name and OTG names. Added mipe to the "misc" /"para" partition to escape a factory reset recovery loop that [uu]could[/u] happen under certain situations.
And my prefered ported recovery from LRTeam TWRP-3_2_3-1020-OMFG-mod_b6-device-name-vivo-wipe-misc.img.
DOWNLOADS
Files
1. Sp Flash tool (v 5.18.28 or newer) https://androidmtk.com/smart-phone-flash-tool
2. stock XL4 ROM, DA file, TWRP all in shared folder https://androidfilehost.com/?w=files&flid=287088
3. stock Xi+ ROM, TWRP in shared folder https://androidfilehost.com/?w=files&flid=287703
4. Unviversal DM-Patch disable tool thread
5. Youtube Guide Video to use backup image splitter tool "WWR_MTK" https://www.youtube.com/watch?v=GMAytZ56hac
Kernel sources have been published 12-12-2018, by BLU
I have them synced to GitHub while I make test builds.
https://github.com/mrmazakblu/BLU-VIVO-XL4-kernel
Default defconfig should be arch/arm64/config/k62mv1_64_bsp_defconfig. Based off of build description in "getprop"
Built kernel has not been able to be booted yet.
TWRP is first ported and provided thanks to @Voinea12
.
placeholder not really welcomed here on XDA
just pm a moderator or report this thread when you`re ready to upload something, until then, thread closed
After seeing that the Blu vivo xl4 requires an "auth file" in order to flash with spflash tool, I asked BLU to supply the file.
They responded with a big fat NO.
.......
.......
THE NEXT DAY THE FILE WAS POSTED ON A DIFFERENT THREAD.
SO THERE HELP WAS NO LONGER NEEDED.
Just made successfull readback on preloader. and currently reading full rom.
will post link when done.
here is auth file and DA file I used.
pulled firmware is here.
there are more images in complete firmware, but the ones included should be enough , as long as you NEVER do format all from spflash tool.
STOCK ROM
So far all attempts to load twrp have failed.
Also just tried to flash boot.img with the built kernel. When rebooted, phone just stayed on black screen. No back-light , nothing.
Just a repeating connect disconnect sound from pc. Long pressing power and trying to get into the bootloader menu failed.
Was able to Que up sp flash tool and keep holding the volume down button , on the next time it cycled on off preloader was caught and i was able to flash back the correct boot.img.
Working version is available now
Thread was opened.
mrmazak said:
So far all attempts to load twrp have failed.
Also just tried to flash boot.img with the built kernel. When rebooted, phone just stayed on black screen. No back-light , nothing.
Just a repeating connect disconnect sound from pc. Long pressing power and trying to get into the bootloader menu failed.
Was able to Que up sp flash tool and keep holding the volume down button , on the next time it cycled on off preloader was caught and i was able to flash back the correct boot.img.
Click to expand...
Click to collapse
My streak with SP Flash is still a losing one, the auth file works for my phone as well (Blu Vivo XI+), I just used the preloader.img that was in the update.zip and ran it through the WwR MTK Tool and got the preloader.bin to go with the auth file as you indicated you had done, that was one hurdle that your post helped me solve, but for some reason when I start reading the full rom I get about 6-10 MB into it and then it disconnects from my phone and stops. Not sure if its driver related or what, which drivers did you use for the readback?
psychofad said:
My streak with SP Flash is still a losing one, the auth file works for my phone as well (Blu Vivo XI+), I just used the preloader.img that was in the update.zip and ran it through the WwR MTK Tool and got the preloader.bin to go with the auth file as you indicated you had done, that was one hurdle that your post helped me solve, but for some reason when I start reading the full rom I get about 6-10 MB into it and then it disconnects from my phone and stops. Not sure if its driver related or what, which drivers did you use for the readback?
Click to expand...
Click to collapse
To be honest I have not installed driver specific for this. I have vcomm drivers installed, same from couple years ago.
Is the readback stopping because you set wrong hex address length in the readback tab?
mrmazak said:
To be honest I have not installed driver specific for this. I have vcomm drivers installed, same from couple years ago.
Is the readback stopping because you set wrong hex address length in the readback tab?
Click to expand...
Click to collapse
No, I got the readback of the EMMC_USER just fine and ran it through the WwR MTK tool and it gave me the hex address to use for the full rom readback, t then told me
Code:
The file size is smaller than the start position of the LK (uboot). To determine the type of processor and memory, it is necessary to read the full firmware in the SP Flash Tool, specify the parameters for reading: Start address: 0x0, Lenght: 0x1D1EC00000.
So I entered those two addresses as EMMC_USER readback. If my phone is off and I just connect it to the usb without holding any keys it gives me another error.....and I'm an idiot. just figured it out as I was looking at logs, apparently I must have changed the usb speed in sp flash which changes it's pid causing it to try and read from another port. It's downloading now
Thanks to @hanuma there is now a material themed twrp port.
The V2 version loads. But has no adb or mtp access
https://forum.xda-developers.com/showpost.php?p=78498431&postcount=95
https://mega.nz/#F!225EzQwT!t8hvGvmFoNYNvXev-Li1fQ
******EDIT*****
Most of the following problems did not repeat in same way when I tried to repeat the install process.
Main issue was with simcard. But exact process to get installed and working is still not known.
-- install after already having rooted, encryption removed stock, seems to work.
-- fresh full stock rom, full encryption, then gsi seems to not work sim card.
PHH-treble gsi images do boot this device. I do not have a bug list as yet.
working:WITH encryption removed:
1. wifi
2. camera
3. fingerprint- unlock
4. music
5. video
NOT working :WITH encyyption removed:
1. cell signal
2. cell data
3. phone
4. sms
---------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------
working:WITH encryption enabled
1. phone
2. sms
NOT working:WITH encryption enabled
1.. everything else
EDIT
Much of the force closing problems were from a corrupted external sdcard. When I removed the card , the force close messages did not come.
Getting 4G data connection was not stable. after a full reset and rom re-install I was not able to get data connection, and only able to have connection to make calls when set to 3G connection only.
some bugs in vendor I assume will need some help solving this.
EDIT 2
Finally got around to trying again. his time I started with vanilla version of phh-treble gsi.
4G data and sms, calls in out all work. Camera , video both work.
WiFi tethering did not work.
Setup that worked :
force encryption removed with universal dm-verity patcher, ( bothboot.img and vendor partitions both edited).
magisk patched boot
Would this work on Blu Vivo XI since same chipset?
sinkoo1979 said:
Would this work on Blu Vivo XI since same chipset?
Click to expand...
Click to collapse
It should. I have been working with few users with Xi+ it works for them. And another user of Xi provided a twrp port, but no details on if this read-back worked. It must have, I suppose it must have.
Please do try to do the readback for your self, and share the files. will help with twrp if I can
Guide has been revised.
The original guide suggests to format /data and patch device to remove force encryption. This works fine for stock rom, and modifying stock rom. But I have found that removing encryption will not allow the phone to work as a phone when flashed with GSI. The down side is, at the moment, there is no twrp that is working to read the encrypted /data.
mrmazak said:
Guide has been revised.
The original guide suggests to format /data and patch device to remove force encryption. This works fine for stock rom, and modifying stock rom. But I have found that removing encryption will not allow the phone to work as a phone when flashed with GSI. The down side is, at the moment, there is no twrp that is working to read the encrypted /data.
Click to expand...
Click to collapse
Can any of this be done without a computer
Decaphyz said:
Can any of this be done without a computer
Click to expand...
Click to collapse
No, you need fastboot(PC preogram) to unlock bootloader and either sp flash tool or fastboot to flash recovery.
mrmazak said:
No, need you fastboot(PC preogram) to unlock bootloader and either sp flash tool or fastboot to flash recovery.
Click to expand...
Click to collapse
Oof
mrmazak said:
Thanks to @hanuma there is now a material themed twrp port.
The V2 version loads. But has no adb or mtp access
https://forum.xda-developers.com/showpost.php?p=78498431&postcount=95
https://mega.nz/#F!225EzQwT!t8hvGvmFoNYNvXev-Li1fQ
Click to expand...
Click to collapse
I just did this, and it worked the first time. I got into the phone and set it up. But it was super laggy after a while. So I decided to reset the phone like how you would normally do to fix a problem, and now... it’s making me boot into the recovery each and every time I try and boot into the system... i installed the gsi rom "PixelExperience for AOnly" at max lees site
IndifferentBear said:
I just did this, and it worked the first time. I got into the phone and set it up. But it was super laggy after a while. So I decided to reset the phone like how you would normally do to fix a problem, and now... it’s making me boot into the recovery each and every time I try and boot into the system... i installed the gsi rom "PixelExperience for AOnly" at max lees site
Click to expand...
Click to collapse
dont panic. this is minor bug. Easiest way to solve is to flash stock recovery. and do factory reset from there.
You can install image from twrp or fastboot, even spflashtool.
It is from the flag that is set into para(misc) partition.
You can clear it manually with terminal also, or even use one of the othe rtwrp images I shared. One with "misc" in the file name.
If you use one of those recoveries and do reset will also clear that reboot condition
mrmazak said:
dont panic. this is minor bug. Easiest way to solve is to flash stock recovery. and do factory reset from there.
You can install image from twrp or fastboot, even spflashtool.
It is from the flag that is set into para(misc) partition.
You can clear it manually with terminal also, or even use one of the othe rtwrp images I shared. One with "misc" in the file name.
If you use one of those recoveries and do reset will also clear that reboot condition
Click to expand...
Click to collapse
thanks dude! can you give me the command to run in terminal to do it? ill try that first, then ill try flashing stock recovery!
---------- Post added at 02:47 AM ---------- Previous post was at 02:44 AM ----------
mrmazak said:
dont panic. this is minor bug. Easiest way to solve is to flash stock recovery. and do factory reset from there.
You can install image from twrp or fastboot, even spflashtool.
It is from the flag that is set into para(misc) partition.
You can clear it manually with terminal also, or even use one of the othe rtwrp images I shared. One with "misc" in the file name.
If you use one of those recoveries and do reset will also clear that reboot condition
Click to expand...
Click to collapse
but i was required to wipe the sys, data, cache, and dalvik/art to have a clean install.
---------- Post added at 03:33 AM ---------- Previous post was at 02:47 AM ----------
mrmazak said:
dont panic. this is minor bug. Easiest way to solve is to flash stock recovery. and do factory reset from there.
You can install image from twrp or fastboot, even spflashtool.
It is from the flag that is set into para(misc) partition.
You can clear it manually with terminal also, or even use one of the othe rtwrp images I shared. One with "misc" in the file name.
If you use one of those recoveries and do reset will also clear that reboot condition
Click to expand...
Click to collapse
YO! Oaky so basic laly when i flashed that misc recovery IT BOOTED!!!!! thank you soo much dude, your the best!
This is Generic guide for Unbricking or Downgrading Huawei devices with Kirin 960 CPU. Most probably very similar steps can be done for Kirin 970, but i don't have device to test. At the end i did attach my files, that i used for CMR-W09.
This WILL WORK even if you have Black Screen with permanent Fastboot - this is common issue for those, who tried to downgrade from EMUI 9 to EMUI 8. Yes, this is also unbrickable!
Have Fun!
1. Prerequisites
- Linux installed on your PC/laptop or as Virtual Machine, with fastboot tool on it
- Board Software for your device – you can find on easy-firmware.com (about $15 for pass and reach collection) or gem-flash.com (has cheap $3 pass but less firmwares in collection)
HiKey_IDT linux tool – can be found there https://github.com/96boards-hikey/tools-images-hikey960/
- Knowledge about test point location to interrupt CPU loading routine – ask google or look on this forum
http://forum.gsmhosting.com/vbb/f1022/huawei-test-point-gallery-2291781/index17.html
- Opened device – you need access to motherboard
2. Booting device in force update mode
Small intro. Hisilicon Kirin CPUs has special mode, when they are interrupting normal boot process and opening COM port on USB to accept commands. You have chance to load your own binaries directly to device RAM before boot process will continue (still, this images has to be signed by Huawei private key)
- Disconnect battery connector from motherboard
- Short test point to ground (any big metal shield on board will work for that)
- Having test point shorted – connect USB cable. Run “lsusb” command – you should see device “USB SER” in devices
- Open folder with Board Software. Find xml file with model name in name, for ex. “CMR-W09-BD_1.0.0.19_Download.xml”. In that xml file – check section for “bootloaderimage” – you will find paths and memory addresses for all needed boot stages. Keep that open.
- Find all three boot img files – copy them to Linux machine. Note: For me, this three files didn’t work. But I found files with same names in other folder of Board Software – and that did a trick. You have to experiment a little bit.
- Go to folder, where you have HiKey_IDT tools downloaded. Copy three boot files from Board Software to same folder as hikey_idt. Edit “config” file – you should specify correct address and file name – according to Board Software
- Check “dmesg” command output – look for GSM Modem connected messages – you will see port name attached – like ttyUSB0
- Run next command “./hikey_idt -c config -p /dev/ttyUSB0”. You should see information about loaded all boot stages, with “Finish downloading” message after each. If you did everything fine – in 5-15 seconds you will have your device ready for downgrade/unbrick/killing_your_cat
- To verify that everything is fine – run “fastboot devices” command. If it will show device with proper serial number in output – you are fine to continue
3. Fixing your device
On that step – you have special fastboot booted, that has no security/validation on it. You can unbrick your device, or kill it. Do all steps carefully.
- Flash proper partition table information. You can take it from OTA package (from inside of UPDATE.APP) – normally, it has name HISIUFS_GPT. Run “fastboot flash ptable HISIUFS_GPT.img”
- Flash other partitions one by one. Skip files CRC.img, SHA256RSA.img, CURVER.img, VERLIST.img, PACKAGE_TYPE.img and HISIUFS_GPT.img (it was already flashed on previous step). To flash this files, run “fastboot flash” with partition name and image file name after it – for ex. “fastboot flash recovery_vendor RECOVERY_VENDOR.img”. Note: Partition names should be written in lowercase. You can see partition names in Huawei Update Extractor, as extracted image files sometimes has shortened names.
- Run few more commands to cleanup things around:
Code:
fastboot erase misc
fastboot erase modemnvm_factory
fastboot erase bootfail_info
fastboot erase dfx
fastboot erase rrecord
fastboot erase patch
- Flash few more files – from Board Software:
Code:
fastboot flash splash2 splash2.img
fastboot erase userdata
fastboot flash userdata userdata.img
fastboot erase version
fastboot flash version version.img
fastboot flash reserved4 gpu_test_data_all_v2.bin (may be different for other devices – look into XML file from Board Software package for any “reserved” partitions)
- Remove USB cable, connect battery back and boot your device. Most probably your device will boot now! Or at least it will try
4. Final steps
- Make factory reset from stock recovery!
- Make 3-button flash of same or newer firmware just after restoring device!
- Make backup of your NVME and OEMINFO! Use next commands for that:
Code:
dd if=/dev/block/platform/hi_mci.0/by-name/oeminfo of=/storage/emulated/0/oeminfo.img
dd if=/dev/block/bootdevice/by-name/nvme of=/storage/emulated/0/nvme.bak
Above commands are for adb shell with root. If you will do that under TWRP – you can use “of=/sdcard” in dd commands
Note: If your device is in bootloop, but runs recovery/eRecovery fine. If recovery is showing error during factory reset – maybe, you have screwed your nvme during previous upgrades/downgrades. In that case – make NVME backup using TWRP, take nvme.img from Board software package. Using any HEX editor – open both files, and copy all variable values from your backup to nvme.img from Board – manually. After doing that – repeat all steps from beginning until getting forced fastboot mode, and flash this image with “fastboot flash nvme”
P.S. In above links you may find lovely-prepared files for CMR-W09 tablet with region C432 for recovering to b161 firmware (includes recovery.sh script to flash everything in one command) - it can be used to get $4 unlock code with DC Unlocker.
HiKey_IDT => https://drive.google.com/open?id=1EdNfHVc8japoVSe2k4iTWdyp5JyPa1LR
Recovery Files for CMR-W09 C432 B161 => https://drive.google.com/open?id=1YgwwwFITjbJ8vIepcCt0O5w_RRJcKV8F
Board Software for CMR-W09 => https://drive.google.com/open?id=1w3mfVt8ObsViiv5ov3cUAog-M8hHMaSF
Testpoint location on Mediapad 10.8 (should be same on both Pro and non-Pro)
Reserved
Damn! I sent my tablet to a repair center two days ago...
Thank you for this great guide!
crckmc said:
Damn! I sent my tablet to a repair center two days ago...
Thank you for this great guide!
Click to expand...
Click to collapse
Nah, i'm not looking for fast ways! Decided that i can do it by my own ))) Btw, service center will not even try to repair your tablet - they will replace whole logic board or whole tablet.
For me It gives errors, I used my own device board fw.
Which device do you use? Did you boot it with testpoint?
If it is any of M5/M5 Pro (even if it is 8.4") - you can use files that i attached - hikey_idt is preconfigured. For other kirin960 devices that may need different boot files from own board
goodwin_c said:
Which device do you use? Did you boot it with testpoint?
If it is any of M5/M5 Pro (even if it is 8.4") - you can use files that i attached - hikey_idt is preconfigured. For other kirin960 devices that may need different boot files from own board
Click to expand...
Click to collapse
Booted with testpoint, and I used the Huawei P10 (It's a kirin960) and used my own boot files from the board fw. From what I know, I did a wrong downgrade, I did not know about the xloader thing going on, I had B386 installed, and tried do downgrade to B369a, different xloaders both of them. Now the screen is black, can't get into fastboot this way, I used DC-Phoenix too, managed to get somehow into fastboot, but these flashing errors still happened saying partition lenght get error, my logicboard may be already damaged tho.
yoghurt13 said:
Booted with testpoint, and I used the Huawei P10 (It's a kirin960) and used my own boot files from the board fw. From what I know, I did a wrong downgrade, I did not know about the xloader thing going on, I had B386 installed, and tried do downgrade to B369a, different xloaders both of them. Now the screen is black, can't get into fastboot this way, I used DC-Phoenix too, managed to get somehow into fastboot, but these flashing errors still happened saying partition lenght get error, my logicboard may be already damaged tho.
Click to expand...
Click to collapse
But the first - try hikey_idt with my files (it is preconfigured in attached archive). If it will be still throwing errors (i had same errors with wrong boot files) - take own files from your board. But not from "bootloaderimg" or "fastbootimage" folders - i got success with files from "update_nv_bootloader_block" folder of my board software package.
Next step - after you will boot board with hikey_idt and willl have fastboot loaded (screen will be still black - this is normal) - you will have to write partition table to device eMMC. For that - extract HISIUFS_GPT.img from UPDATE.APP and flash it as "ptable" - run "fastboot flash ptable HISIUFS_GPT.img". If that will go without errors - you can flash other images one by one.
What linux should i have? It's not possible under windows?
lukastob said:
What linux should i have? It's not possible under windows?
Click to expand...
Click to collapse
Any distro that you like - will work for you. If you are newbie - you can take Ubuntu for ex. Also, virtual machine with linux will be totally fine - just you should check everytime that USB is passed from host to VM. And no - i don't know about alternative tool for hikey_idt under WIndows, and service version of IDT - is bad-bad-bad. So, Linux is your choice.
Good jobs man ))) thanks from all users for testpoint
Well I managed to get into the special fastboot, and I could flash a few thing, but at least 5 images fail the verification, including Xloader, It's strage, as the Xloader still tries to verify things.
yoghurt13 said:
Well I managed to get into the special fastboot, and I could flash a few thing, but at least 5 images fail the verification, including Xloader, It's strage, as the Xloader still tries to verify things.
Click to expand...
Click to collapse
Try to flash xloader from OTA, not from board. From UPDATE.APP. Did you flash ptable in that mode?
goodwin_c said:
Try to flash xloader from OTA, not from board. From UPDATE.APP. Did you flash ptable in that mode?
Click to expand...
Click to collapse
I was doing that, I tried the ota xloader, and I tried the board sec_xloader too, they did not work, both of them has verification errors. Flashing DTS, fastboot, trustfirmware gives this error FAILED (remote: 'image verification error'). And yes, I flashed the Ptable too.
yoghurt13 said:
I was doing that, I tried the ota xloader, and I tried the board sec_xloader too, they did not work, both of them has verification errors. Flashing DTS, fastboot, trustfirmware gives this error FAILED (remote: 'image verification error'). And yes, I flashed the Ptable too.
Click to expand...
Click to collapse
from which folder did you take boot files for hikey_idt? maybe, you could try to take older board firmware? Or try to flash files from "fastbootimage" folder of your board.
goodwin_c said:
from which folder did you take boot files for hikey_idt? maybe, you could try to take older board firmware? Or try to flash files from "fastbootimage" folder of your board.
Click to expand...
Click to collapse
I literally have only 1 board firmware version the VTR-AL00, and I tried those stuff already, only your hikey-idt preconfigured got it into fastboot, after that I tried to flash my own board fw stuff onto it. So this whole thing might not work in my case.
yoghurt13 said:
I literally have only 1 board firmware version the VTR-AL00, and I tried those stuff already, only your hikey-idt preconfigured got it into fastboot, after that I tried to flash my own board fw stuff onto it. So this whole thing might not work in my case.
Click to expand...
Click to collapse
Can you share somewhere files from your board? i'll look into it.
goodwin_c said:
Can you share somewhere files from your board? i'll look into it.
Click to expand...
Click to collapse
Yeah, I'll upload the thing, I'll PM you the link.
Okay, I somehow managed to get it to work, found the perfect rom for the reset, BUT, the thing is, I lost my IMEI number from the phone, is there any way to reset it?
Amazing, thank you for this
---------- Post added at 10:02 PM ---------- Previous post was at 10:00 PM ----------
yoghurt13 said:
Yeah, I'll upload the thing, I'll PM you the link.
Click to expand...
Click to collapse
I think because of the relocked bootloader
This thread is meant as a guide to provide a higher level picture of what to do when your Idol 3 is bricked. This is not a step by step guide, some systems knowledge is expected.
Several hours ago all I had was a boot logo. Now I have Sailfish thanks to developers like vknecht and many other members who posted guides here and other forums.
Let's begin.
Requirements:
USB cable.
Sahara & Firehose Test software.
Appropriate TWRP image.
6045I Stock OS + Correct modem firmware. The OS and firmware comes in zips, unzip and replace and rezip as needed. My model was the 6045I so that was unnecessary.
Optional:
Your custom OS you wish to install. In my case it was LineageOS 14.1 and SailfishOS published by vknecht.
Stage 1:
The very first thing you need to do is to get the device to boot into /recovery partition which will hold the twrp.img. Doing this provides enough functionality to interact with your phone to unbrick it. To do this you need to:
Put the device into Download mode. It is done by connecting it via USB to PC (while it is off), pressing all 3 buttons - Power, Volume Up and Volume Down.
When screen prompts let go and hold Volume Up
The screen turns off. If the Qualcomm driver loaded successfully (in my case it automatically did), open Sahara & Firehose Test program.
All you need to do here is select your device from the dropdown > Click Detect (detects the driver) > NPRG > Get GPT > Info.
Now you need to scroll down and find the /recovery partition. Point the path to where your TWRP image is stored. The version of TWRP is important. For example, if you tried to install some custom boot chain that is not compatible with your OS you won't be able to get to /recovery. In my experience if you have the twrp-3.1.1-idol3.img and the twrp-3.0.0-1.img (from the hybrid boot loader thread) this was sufficient for my situation. Think logically which one you need to be able to load.
Checkmark the box.
Write the image (make sure to click No)
When you reboot your phone if you hold Volume Up you will have access to TWRP.
Stage 2:
Before you start modding anything just get it to load stock. Use the stock image from the thread link above, in my case it worked. However getting it to load will be a pain, depending on the situation. In my case I encountered /data partition errors. All errors regarding the /data partition are solved the same way - you delete it somehow. You are flashing an OS and your device is already a brick, data loss is acceptable. In my case I couldn't even mount /data (encryption issue) so I had to reformat it via the TWRP menu, make it first EXT2, then EXT4. Errors are irrelevant here, as long as EXT4 format succeeded you are good to go.
Stage 3:
Now use the standard procedure for flashing your target .zip via TWRP. In my case I deleted everything, /system (it was a brick anyway, just making sure it was clean), /data, /cache, Cache & Dalvik pretty much everything that made sense in my situation from the TWRP Wipe menu. I did this because at this stage you might encounter the infamous ERROR 7. There are different causes for it, but to know exactly why you got it open the updater-script file inside your extracted stock-rom.zip (META-INF\com\google\android was my location) via Notepad. This should tell you more about why you had the error.
Then flash the .zip. It worked for me.
Stage 4:
Once booted into the stock OS you are good to go. I don't know if you can get the OTA updates with that image, but I was upgrading to a more recent release of LineageOS so I didn't test long.
Earlier I mentioned you might need different TWRP images. This was the case for me here. After using the 3.0.0 recovery image I could boot into the OS but had difficulties booting into TWRP so I just flashed the 3.1.1 using the above methods and continued.
Once you are in TWRP you can use the standard procedures in other threads for flashing your custom OS. I was flashing LineageOS only as an intermediate step to go to Sailfish so I didn't flash GApps.
At this stage you might encounter ERROR 7 again, but for a different reason; If you deleted /data and you still had this issue it might be because of this. Basically it means you did not swap the radios like I told you to. You can either overwrite the script like suggested in this thread (it will cost you 4G) or you can go back and redo it.
Stage 5:
Boot into your custom OS. I think you get the method from here.
In short to go from brick to custom OS you need to get TWRP. If you can somehow boot into that, you can always fix the phone, and thanks to Sahara & FireHose Test program you should always be able to flash the /recovery partition as long as you find the right TWRP image.
Hope I helped someone, I was bashing my head for 3 days with this garbage Mobile Q Upgrade stuck at 20% issue some people have seen before.
Do you know where I can download the Sahara & Firehose Test software? Thanks.
pug_ster said:
Do you know where I can download the Sahara & Firehose Test software? Thanks.
Click to expand...
Click to collapse
The original thread was here: https://forum.xda-developers.com/idol-3/development/tool-sahara-firehose-test-alcatel-t3454855
Looks like the file is taken down now, I still have a copy however:
https://mega.nz/#F!xBRXRIrT!TlYCGpJ-63L1BxjRhuaYrw
printf() said:
The original thread was here: https://forum.xda-developers.com/idol-3/development/tool-sahara-firehose-test-alcatel-t3454855
Looks like the file is taken down now, I still have a copy however:
https://mega.nz/#F!xBRXRIrT!TlYCGpJ-63L1BxjRhuaYrw
Click to expand...
Click to collapse
Password: decker.su
can i get modem files? this download link is no longer available
This phone can only fastboot, but without authorization to pc, I tried turning to recovery/normal start, it does nothing but blinks(screen light turns on and off). I can't factory reset nor can I get the firmware to factory reset. any help would be greatly appreciated!!
You probably have wiped a partition ( especially that where adbd is located ): re-flash phone's Stock ROM.
that emmc is weared-out and therefore either the emmc controller or kernel decided to provide block device ro (before it finally dies on wear-leveling)
use a drilling machine through emmc chip to destroy user data
jwoegerbauer said:
You probably have wiped a partition ( especially that where adbd is located ): re-flash phone's Stock ROM.
Click to expand...
Click to collapse
How am I supposed to do so? I don't have the stock rom...
seems it's Mediatek SoC you can just dump stock ROM off the phone itself.
It's now easy to bypass MediaTek's SP Flash Tool authentication
A group of developers has created a Python utility to bypass the authentication routine of MediaTek SP Flash Tool. Check it out now!
www.xda-developers.com
I personally prefer mtkclient cmd line for linux (python) it's maybe not that easy to setup but it's easy in usage. it even provides a simple gui. for readback ROM device needs to be powered off and usb disconnected (as usual for Mediatek devices). plug in usb cable when PC is ready for preloader mode, then "rl": Read all partitions from flash to a directory
Code:
python3 mtk rl /path/to/outdir
Note: Android partitions are mounted ro it's unlikely ROM itself is damaged (if not forcefully modified). "only" userdata + cache partitions are writeable to Android, formatting userdata partition is "same" as factory reset.