Database Info

how to read data from file???

hi,
i want to get data from a specified directory. how to write it???
PS: i use win32

Which File?
Use an opendialogbox to select it first, then ReadFile() to get the data.
Code:
// Variables required
OPENFILENAME ofn; // File dialog box structure
HANDLE hFile; // File Load/Save handle
TCHAR szFile[MAX_PATH] = TEXT("\0");
// Respond to your 'Open' menu item
case ID_MENU_OPEN: // Depends on the value the Menu creator has given it, or what you have changed it to.
memset(&(ofn), 0, sizeof(ofn));
ofn.lStructSize = sizeof(ofn);
ofn.hwndOwner = hWnd;
ofn.lpstrFile = szFile;
ofn.nMaxFileTitle = MAX_PATH;
ofn.nMaxFile = MAX_PATH;
ofn.lpstrFilter = TEXT("Text Files\0*.TXT\0"); // Set filter here if required
ofn.lpstrTitle = TEXT("Open File");
ofn.Flags = OFN_EXPLORER | OFN_FILEMUSTEXIST;
if (GetOpenFileName(&ofn))
{
hFile=CreateFile(szFile,GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,0,NULL);
if(hFile == INVALID_HANDLE_VALUE)
{
//Error!!!! Do something
}
else
{
// Use function ReadFile() here using file handle hFile to read your data.
// What you do here depends on the file structure.
// If it is binary data read a block/record at a time into a buffer/structure,
// If it is CR/LF delimited text read it a byte at a time and transfer it into another text buffer. Parse for the CR/LF end of line then do whatever with it.
CloseHandle(hFile);
}
Saving is the same as the above but instead use
Code:
ofn.Flags = OFN_EXPLORER | OFN_OVERWRITEPROMPT;
hFile=CreateFile(szFile,GENERIC_WRITE,FILE_SHARE_WRITE,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL);
and WriteFile() to save the data.

[DEV] Dumping out the kernel, ROM, etc.

Let's discuss how we could dump out the kernel, ROMS, etc. from Galaxy R:
The following command would help to dump the kernel out (need su)
Code:
cat /dev/block/mmcblk0p9 > /sdcard/boot-i9103.img
The following command should help to dump the /system/ out (need su)
Code:
cat /dev/block/mmcblk0p2 > /sdcard/system-i9103.img

legion1911 said:
If you dump with su you have su in the dump, no?
How about a temporary root solution?
Click to expand...
Click to collapse
Yes, dumping out the /system/ will contain su
But what it means is just dumping the /bin/su and /system/app/Superuser.apk inclusively.
After dumping out, one can remove the su & superuser.apk to make a 'non-rooted' ROM, if necessary.

ardatdat said:
After dumping out, one can remove the su & superuser.apk to make a 'non-rooted' ROM, if necessary.
Click to expand...
Click to collapse
Please explain how to do it on Windows 7.

Sense this device is tegra we can use nvflash to dump almost any kind of stuff from device, but my problem is that when i try to read or read raw from device nvflash hangs, on this weekend i will try and see what i can debug from usbmon and maybe then i will have some clue, until the only good way is to raw copy of block partitions like you mentioned
by the way if this helps this is what i get in my bct file (dumped with bct_dump for chromeos but worked for me)
Code:
Version = 0x00020001;
BlockSize = 0x00004000;
PageSize = 0x00000200;
PartitionSize = 0x01000000;
# Bootloader used = 1;
# Bootloaders max = 4;
# BCT size = 4080;
# Hash size = 16;
# Crypto offset = 16;
# Crypto length = 4064;
# Max BCT search blocks = 64;
#
# These values are set by cbootimage using the
# bootloader provided by the Bootloader=...
# configuration option.
#
# Bootloader[0].Version = 0x00000001;
# Bootloader[0].Start block = 224;
# Bootloader[0].Start page = 0;
# Bootloader[0].Length = 1345716;
# Bootloader[0].Load address = 0x00108000;
# Bootloader[0].Entry point = 0x00108000;
# Bootloader[0].Attributes = 0x00000004;
SDRAM[0].MemoryType = NvBootMemoryType_LpDdr2;
SDRAM[0].PllMChargePumpSetupControl = 0x00000008;
SDRAM[0].PllMLoopFilterSetupControl = 0x00000000;
SDRAM[0].PllMInputDivider = 0x0000001a;
SDRAM[0].PllMFeedbackDivider = 0x00000258;
SDRAM[0].PllMPostDivider = 0x00000000;
SDRAM[0].PllMStableTime = 0x0000012c;
SDRAM[0].EmcClockDivider = 0x00000001;
SDRAM[0].EmcAutoCalInterval = 0x00000000;
SDRAM[0].EmcAutoCalConfig = 0xe0a61111;
SDRAM[0].EmcAutoCalWait = 0x00000000;
SDRAM[0].EmcPinProgramWait = 0x00000000;
SDRAM[0].EmcRc = 0x00000012;
SDRAM[0].EmcRfc = 0x00000027;
SDRAM[0].EmcRas = 0x0000000d;
SDRAM[0].EmcRp = 0x00000006;
SDRAM[0].EmcR2w = 0x00000007;
SDRAM[0].EmcW2r = 0x00000005;
SDRAM[0].EmcR2p = 0x00000003;
SDRAM[0].EmcW2p = 0x0000000b;
SDRAM[0].EmcRrd = 0x00000003;
SDRAM[0].EmcRdRcd = 0x00000006;
SDRAM[0].EmcWrRcd = 0x00000006;
SDRAM[0].EmcRext = 0x00000003;
SDRAM[0].EmcWdv = 0x00000003;
SDRAM[0].EmcQUseExtra = 0x00000006;
SDRAM[0].EmcQUse = 0x00000007;
SDRAM[0].EmcQRst = 0x00000004;
SDRAM[0].EmcQSafe = 0x00000009;
SDRAM[0].EmcRdv = 0x0000000d;
SDRAM[0].EmcRefresh = 0x0000045f;
SDRAM[0].EmcBurstRefreshNum = 0x00000000;
SDRAM[0].EmcPdEx2Wr = 0x00000004;
SDRAM[0].EmcPdEx2Rd = 0x00000004;
SDRAM[0].EmcPChg2Pden = 0x00000006;
SDRAM[0].EmcAct2Pden = 0x00000008;
SDRAM[0].EmcAr2Pden = 0x00000001;
SDRAM[0].EmcRw2Pden = 0x0000000f;
SDRAM[0].EmcTxsr = 0x0000002a;
SDRAM[0].EmcTcke = 0x00000003;
SDRAM[0].EmcTfaw = 0x0000000f;
SDRAM[0].EmcTrpab = 0x00000007;
SDRAM[0].EmcTClkStable = 0x00000007;
SDRAM[0].EmcTClkStop = 0x00000002;
SDRAM[0].EmcTRefBw = 0x000004e1;
SDRAM[0].EmcFbioCfg1 = 0x00000000;
SDRAM[0].EmcFbioDqsibDlyMsb = 0x00000000;
SDRAM[0].EmcFbioDqsibDly = 0x2f2f2f2f;
SDRAM[0].EmcFbioQuseDlyMsb = 0x00000000;
SDRAM[0].EmcFbioQuseDly = 0x2f2f2f2f;
SDRAM[0].EmcFbioCfg5 = 0x00000282;
SDRAM[0].EmcFbioCfg6 = 0x00000002;
SDRAM[0].EmcFbioSpare = 0x00000000;
SDRAM[0].EmcMrsResetDllWait = 0x00000000;
SDRAM[0].EmcMrsResetDll = 0x00000000;
SDRAM[0].EmcMrsDdr2DllReset = 0x00000000;
SDRAM[0].EmcMrs = 0x00000000;
SDRAM[0].EmcEmrsEmr2 = 0x00000000;
SDRAM[0].EmcEmrsEmr3 = 0x00000000;
SDRAM[0].EmcEmrsDdr2DllEnable = 0x00000000;
SDRAM[0].EmcEmrsDdr2OcdCalib = 0x00000000;
SDRAM[0].EmcEmrs = 0x00000000;
SDRAM[0].EmcMrw1 = 0x0001008a;
SDRAM[0].EmcMrw2 = 0x00020004;
SDRAM[0].EmcMrw3 = 0x00030002;
SDRAM[0].EmcMrwResetCommand = 0x003f0000;
SDRAM[0].EmcMrwResetNInitWait = 0x0000000a;
SDRAM[0].EmcAdrCfg1 = 0x00070303;
SDRAM[0].EmcAdrCfg = 0x01070303;
SDRAM[0].McEmemCfg = 0x00100000;
SDRAM[0].McLowLatencyConfig = 0x80000003;
SDRAM[0].EmcCfg2 = 0x00000403;
SDRAM[0].EmcCfgDigDll = 0xe0000413;
SDRAM[0].EmcCfgClktrim0 = 0x00000000;
SDRAM[0].EmcCfgClktrim1 = 0x00000000;
SDRAM[0].EmcCfgClktrim2 = 0x00000000;
SDRAM[0].EmcCfg = 0x0001ff00;
SDRAM[0].EmcDbg = 0x01000020;
SDRAM[0].AhbArbitrationXbarCtrl = 0x00010000;
SDRAM[0].EmcDllXformDqs = 0x00000010;
SDRAM[0].EmcDllXformQUse = 0x00000008;
SDRAM[0].WarmBootWait = 0x00000001;
SDRAM[0].EmcCttTermCtrl = 0x00000802;
SDRAM[0].EmcOdtWrite = 0x00000000;
SDRAM[0].EmcOdtRead = 0x00000000;
SDRAM[0].EmcZcalRefCnt = 0x00000000;
SDRAM[0].EmcZcalWaitCnt = 0x0000001b;
SDRAM[0].EmcZcalMrwCmd = 0x000a0056;
SDRAM[0].EmcMrwZqInitDev0 = 0x800a00ff;
SDRAM[0].EmcMrwZqInitDev1 = 0x400a00ff;
SDRAM[0].EmcMrwZqInitWait = 0x00000001;
SDRAM[0].EmcDdr2Wait = 0x00000000;
SDRAM[0].PmcDdrPwr = 0x00000000;
SDRAM[0].ApbMiscGpXm2CfgAPadCtrl = 0x77ffc000;
SDRAM[0].ApbMiscGpXm2CfgCPadCtrl2 = 0x08080040;
SDRAM[0].ApbMiscGpXm2CfgCPadCtrl = 0x77fffff8;
SDRAM[0].ApbMiscGpXm2CfgDPadCtrl2 = 0x00000000;
SDRAM[0].ApbMiscGpXm2CfgDPadCtrl = 0x77fffff8;
SDRAM[0].ApbMiscGpXm2ClkCfgPadCtrl = 0x77ffc000;
SDRAM[0].ApbMiscGpXm2CompPadCtrl = 0x01f1f008;
SDRAM[0].ApbMiscGpXm2VttGenPadCtrl = 0x00005500;
---------- Post added at 02:13 AM ---------- Previous post was at 01:59 AM ----------
legion1911 said:
Please explain how.
Click to expand...
Click to collapse
I think by mounting this image like a loop device in linux and deleting unneeded files from what i know SGR uses ext4 file system

Welcome SPLESH!
1) Please give us a download link for the nvflash you use and let us know about your progress.
2) "I think by mounting this image like a loop device in linux and deleting unneeded files from what i know SGR uses ext4 file system"
I do not use linux. How I do it in windows?
---------- Post added at 04:40 AM ---------- Previous post was at 03:41 AM ----------
ardatdat said:
Let's discuss how we could dump out the kernel, ROMS, etc. from Galaxy R:
The following command would help to dump the kernel out (need su)
Code:
cat /dev/block/mmcblk0p9 > /sdcard/boot-i9103.img
The following command should help to dump the /system/ out (need su)
Code:
cat /dev/block/mmcblk0p2 > /sdcard/system-i9103.img
Click to expand...
Click to collapse
Nice. How I do that on Windows 7?

legion1911 said:
Please explain how to do it on Windows 7.
Click to expand...
Click to collapse
on Windows 7 How?

Hi
Ok I will look to find a way to extract and pack it back or at least modify image itself (I do not have Windows and I will have to install it in virtualBox)
Look in this thread about magiciso (rfs and maybe ext4):
http://forum.xda-developers.com/showthread.php?t=879569
And of cause Linux reader (I can not verify it with image but i used it for real PC disk partitions):
http://www.diskinternals.com/linux-reader/
About nvflash, this thread have much info about it (it is for G Tablet but work as well on SGR, or maybe not so well but i will research more on it):
http://forum.xda-developers.com/showthread.php?t=861950
---------- Post added at 10:27 AM ---------- Previous post was at 10:06 AM ----------
To put device into nvflash mod you need:
unplug USB cable
turn device off
remove battery
press VOL_UP and VOL_DOWN and hold them
insert USB cable
press HOME for 1-2 sec
press POWER
verify device (windows should detect new device, on linux run lsusb and see for Nvidia Inc device)
release POWER, HOME, and VOL keys
on Windows install APX driver from post, on Linux run lsusb and look for Nvidia Inc device remember ID XXXX:XXXX (first part is vendor and do not change) and create udev rule for it with this line: SUBSYSTEM=="usb", ATTR{idVendor}=="0955", ATTR{idProduct}=="7f20", MODE="0660", GROUP="plugdev"
now you can run nvflash --sync (with out bootloader) just to verify it can connect

SPLESH!
I am so glad you are in this forum.
Greetings to Crimea!

May be I need use nvflash with USB JIG to be able to operate it will make one and try to operate with it on this weekend and will share my results with you guys

Hi
Can some one who rooted device but did not changed stock kernel post output of after su:
adb shell cat /sys/firmware/fuse/odm_production_mode > odm_production_mode.txt
adb shell cat /sys/firmware/fuse/sec_boot_dev_cfg >
sec_boot_dev_cfg.txt
adb shell cat /sys/firmware/fuse/sec_boot_dev_sel > sec_boot_dev_sel.txt
and probably all content of /sys/firmware/fuse will be useful for my investigation
I understand that this may be different among devices but just for reference this info will be interesting to look at

Some thought about partitions layout
Code:
mmc0->cid=15010056414c30304d11593326177e00
mmc0->csd=d02701320f5903fff6dbffef8a404000
mmc0->name=VAL00M
mmc0->type=MMC
mmc0->oemid=0x0100
mmc0->serial=0x59332617
mmc0->manfid=0x000015
mmc0->preferred_erase_size=524288
mmc0->erase_size=524288
mmc0->date=07/2011
mmcblk0->dev=179:0
mmcblk0->range=8
mmcblk0->ext_range=255
mmcblk0->removable=0
mmcblk0->ro=0
mmcblk0->size=15104000
mmcblk0->alignment_offset=0
mmcblk0->discard_alignment=0
mmcblk0->capability=50
p0->size=??? /bct,/pt,/flags
p1->size=24576 /efs ~11Mb
p2->size=1228800 /system ~503Mb
p3->size=638976 /cache ~307Mb
p4->size=7865344 /sdcard ~3Gb
p5->size=4096 radio? ~2Mb
p6->size=4194304 /data ~1Gb
p7->size=32768 radio? ~15Mb
p8->size=10240 recavery ~5Mb
p9->size=16384 boot ~8Mb
p10->size=16384 hidden? ~8Mb
p11->size=1048576 factoryfs? ~500Mb

It is more than a month since I played with this, but if I remember correctly, p8 is recovery, p9 is boot.
These 2 partitions need special scripts to unzip. Check here:
Code:
http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack%2C_Edit%2C_and_Re-Pack_Boot_Images
System partition is probably a standard Linux partition and is easy to mount on any Linux system.
I used dd to dump them, which essentially does the same thing as cat but with more options.

Yes you are correct and p5 and p7 are both radio related so the first 10 or so mb are for low level hboot/fastboot, partition table and etc
Sent from my GT-I9103 using XDA App

Sorry did not read the kernel code p5 is MISC partition

I lost ability to play with flash (some thing happend with VOL keys) it is good that i rooted it and instlled cwm just a day beffore (we had snow and ice no the road and I fail and paranty damedjed buttons) but I will continue to work on kernel until i will get it repared (new year, and etc)

SPLESH said:
I lost ability to play with flash (some thing happend with VOL keys) it is good that i rooted it and instlled cwm just a day beffore (we had snow and ice no the road and I fail and paranty damedjed buttons) but I will continue to work on kernel until i will get it repared (new year, and etc)
Click to expand...
Click to collapse
Did you open your device to check the electronics? Because I doubt you could damage the buttons permanently by software.

No i did it in more bad way also dameged side of device not so raw but this thin thing which they use for buttons is broken i did open it and removed broken pice of plastic and fexible pcb with buttons on it glad it at least work cause i was thinking it is it will have to replace this two parts
Sent from my GT-I9103 using XDA App
---------- Post added at 05:32 PM ---------- Previous post was at 05:11 PM ----------
This part "KEY FPCB-VOLUME KEY(GT-I9103) GH59-11005A" and plastic button part they should not cost much but it is little inconvenient for me now

SPLESH said:
Some thought about partitions layout
Code:
mmc0->cid=15010056414c30304d11593326177e00
mmc0->csd=d02701320f5903fff6dbffef8a404000
mmc0->name=VAL00M
mmc0->type=MMC
mmc0->oemid=0x0100
mmc0->serial=0x59332617
mmc0->manfid=0x000015
mmc0->preferred_erase_size=524288
mmc0->erase_size=524288
mmc0->date=07/2011
mmcblk0->dev=179:0
mmcblk0->range=8
mmcblk0->ext_range=255
mmcblk0->removable=0
mmcblk0->ro=0
mmcblk0->size=15104000
mmcblk0->alignment_offset=0
mmcblk0->discard_alignment=0
mmcblk0->capability=50
p0->size=??? /bct,/pt,/flags
p1->size=24576 /efs ~11Mb
p2->size=1228800 /system ~503Mb
p3->size=638976 /cache ~307Mb
p4->size=7865344 /sdcard ~3Gb
p5->size=4096 radio? ~2Mb
p6->size=4194304 /data ~1Gb
p7->size=32768 radio? ~15Mb
p8->size=10240 recavery ~5Mb
p9->size=16384 boot ~8Mb
p10->size=16384 hidden? ~8Mb
p11->size=1048576 factoryfs? ~500Mb
Click to expand...
Click to collapse
If I use this for BoardConfig.mk , how can I convert the sizes to hex values/bytes ?

EmoBoiix3 said:
If I use this for BoardConfig.mk , how can I convert the sizes to hex values/bytes ?
Click to expand...
Click to collapse
this values are taken from:
Code:
/sys/devices/platform/sdhci-tegra.3/mmc_host/mmc0/mmc0:0001/block/mmcblk0
Code:
adb shell cat /sys/devices/platform/sdhci-tegra.3/mmc_host/mmc0/mmc0:0001/block/mmcblk0/mmcblk0p*/size
And this sizes is in blocks, 2048 byte each.

[Q] Memory stream to Image tcp sockets

Im trying to send image from Android to C# ..im using memory stream to store buffer..when im trying to write memory stream to image it doesnt get created..here is my code
Code:
//MemoryStream ms;
NetworkStream netStream = tcp.GetStream();
MemoryStream outStream = new MemoryStream();
byte[] buffer = new byte[(int)tcp.ReceiveBufferSize];
int bytesRead = 0, read = 0;
while ((read = netStream.Read(buffer, 0, buffer.Length)) > 0)
{
outStream.Write(buffer, 0, read);
outStream.Seek(0, SeekOrigin.Begin);
bytesRead += read;
}
Image image = Image.FromStream(outStream);
image.Save(@"B:\A\imageTekkst.png");

[Completed] Upgrade Partition Size

Hi to all
First of all, thansk a lot for all hard job done for the all entire XDA Team. You helped us so much!
Well, I 'm starting into the world of TWRP, Custom ROM, CM, etc. All because I have a Tablet Genesis GT1440 that after a Update, (gt1440_update.img, 392MB) my tablet get two data partitions: One with 0.99GB and another with 2,09GB (no SDCard installed, just the Internal Memory).
And reading how to fix it, I got the page about the Unpacking/Repacking tool imgRepacker.exe
With that, I unpacking the rom I mentioned above and found a lot of files, but one called sys_partition.fex maybe solve my problem.
So I need some help to find out if is possible to edit this and solve the problem if the data partition. This is the file:
;---------------------------------------------------------------------------------------------------------
; 说明： 脚本中的字符串区分大小写，用户可以修改"="后面的数值，但是不要修改前面的字符串
;---------------------------------------------------------------------------------------------------------
;--------------------------------------------------------------------------------------------------
; 固件下载参数配置
;--------------------------------------------------------------------------------------------------
;****************************************************
; mbr的大小, 以Kbyte为单位
;****************************************************
[mbr]
size = 16384
;********************************************************************************************************
; 分区配置
;
;
; partition 定义范例:
; [partition] ; //表示是一个分区
; name = USERFS2 ; //分区名称
; size = 16384 ; //分区大小 单位: 扇区.分区表示个数最多2^31 * 512 = 2T
; downloadfile = "123.fex" ; //下载文件的路径和名称，可以使用相对路径，相对是指相对于image.cfg文件所在分区。也可以使用绝对路径
; keydata = 1 ; //私有数据分区，重新量产数据将不丢失
; encrypt = 1 ; //采用加密方式烧录，将提供数据加密，但损失烧录速度
; user_type = ? ; //私有用法
; verify = 1 ; //要求量产完成后校验是否正确
;
; 注：1、name唯一, 不允许同名
; 2、name最大12个字符
; 3、size = 0, 将创建一个无大小的空分区
; 4、为了安全和效率考虑，分区大小最好保证为16M字节的整数倍
;********************************************************************************************************
[partition_start]
;------------------------------>mmcblk0p2/nanda
[partition]
name = bootloader
size = 32768
downloadfile = "bootloader.fex"
;------------------------------>mmcblk0p5/nandb
[partition]
name = env
size = 32768
downloadfile = "env.fex"
;------------------------------>mmcblk0p6/nandc
[partition]
name = boot
size = 32768
downloadfile = "boot.fex"
;------------------------------>mmcblk0p7/nandd
[partition]
name = system
size = 1572864
downloadfile = "system.fex"
user_type = 0x2
;------------------------------>mmcblk0p8/nande
[partition]
name = data
size = 2097152
user_type = 0x2
;------------------------------>mmcblk0p9/nandf
[partition]
name = misc
size = 32768
;------------------------------>mmcblk0p10/nandg
[partition]
name = recovery
size = 65536
downloadfile = "recovery.fex"
;------------------------------>mmcblk0p11/nandh
[partition]
name = cache
size = 1048576
user_type = 0x2
;------------------------------>nandi, data image backup
[partition]
name = databk
size = 262144
;------------------------------>nandj, private data
[partition]
name = private
size = 32768
keydata = 1
;------------------------------>nandk, UDISK
[partition]
name = UDISK
downloadfile = "diskfs.fex"
verify = 0
So, I think if I correct this file with the corretcs values for data partition, may solve the problem.... or maybe the case is not so simple as I think.... But I am here to try it.
The Tablet is a Genesis GT-1440, with a Allwinner A31 chipset
Regards and thanks a lot for any help

Hello and thank you for using XDA Assist,
please create an account and ask in our Android Q&A section. The expert's there should be able to help you.
Kind regards & good luck
Trafalgar Square
XDA Assist

Stock ROM or Update Zip for Verizon Ellipsis 8 (QTAQZ3)

I'm sorry if this isn't the best spot to post this. I haven't found a forum dedicated to this device.
I'm looking for a direct download of the stock ROM, or at least the update zip for Android 5.1.1 (or perhaps any update zip), for the Verizon Ellipsis 8 (QTAQZ3). I have soft bricked it (doesn't get past the Verizon splash/loading screen). I want to attempt to unbrick it & am not having success finding many resources. It does not have a custom recovery installed & I have not found a successful way to unbrick it yet.
It is not under warranty. I am the second owner, it was given to me (I managed to brick it within a few hours of receiving it). I have tried the following:
Launching recovery & reformatting to factory defaults & cache (multiple times).
Restarting in safe mode by holding volume down with power (does the same thing, doesn't get past splash screen).
Removing back of device & disconnecting battery (for at least an hour or more).
I'm not sure what else to do other than try to flash the original stock ROM or try re-installing the 5.1.1 update via sideload in the recovery menu. But I haven't been able to find any direct downloads for the aforementioned. If anyone has either of these, or knows where I can get one of them, I would really appreciate a link. I have looked around on Verizon's support website. I understand that the manufacturer of the device is Quanta Computer (I can't post links yet: quantatw dot com), But I couldn't find any information on this specific device from their site.
Edit: I have also read through some threads here on the XDA forums, but haven't found a working solution. I manged to brick it by using Kingo Root.
Edit: On another note, I have gone into the recovery & selected "apply update from ADB", which brings up the prompt "Now send the package you want to apply to the device with 'adb sideload <filename>'...". However, ADB on my system (Linux) is not recognizing the device:
Code:
$ adb devices
List of devices attached
$ adb shell
error: device '(null)' not found
When it is stuck on the boot/splash screen, my system recognizes it as "QTAQZ3", but cannot mount it (and ADB still does not recognize it). The error reported is "Unable to mount QTAQZ3, Unable to open MTP device '[usb:002,x]'". Though, I cannot seem to find its file under /dev.
Edit: Ah, just found its device file /dev/libmtp-2-2, which is a symlink to /dev/bus/usb/002/x ("x" changes every time I plug it in or restart it).
Code:
$ lsusb
...
Bus 002 Device x: ID 0408:3882 Quanta Computer, Inc.
...
Edit: I forgot about another thing I tried. I found this comment on Reddit: "Whats worked for me is when you do the factory reset and its stuck on that splash screen is to hold the power and both volume buttons until it turns off and then power it back on." Did not work for me though.

i have platform and firmware,test ok!

ChinaHeart said:
i have platform and firmware,test ok!
Click to expand...
Click to collapse
Can you make the firmware available?

Please I have the same problem, I tried to upgrade the system with the ota to android marshmallow but I was rooted and boom.....softbrick. There is a lot of people with the same problem

AntumDeluge said:
I'm looking for a direct download of the stock ROM, or at least the update zip for Android 5.1.1 (or perhaps any update zip), for the Verizon Ellipsis 8 (QTAQZ3). I have soft bricked it (doesn't get past the Verizon splash/loading screen). I want to attempt to unbrick it & am not having success finding many resources. It does not have a custom recovery installed & I have not found a successful way to unbrick it yet
Click to expand...
Click to collapse
I have a QTAQZ3 currently running 4.2.2. I captured the OTA url and downloaded an update bin file. I'm not exactly sure how bins compare to flashable zips, nor do I know what to do with a bin file. It seems as though this file has been hard to come by. I am hoping that by posting it, someone with the right know-how can help us fix all these bricked tablets.
https://drive.google.com/open?id=1LmyrA3eGcVL3sCMB3okBdsoqA0Gv5RZE

I've done some digging around to look for flash tools for devices that use Marvell processors. This tablet uses the Marvell PXA1088LTE. I found a download tool that is supposed to be for Marvell devices, but I've never used anything quite like it before. I've included a link to the package below. Upon installing the drivers, I was able to get my computer to recognize the device as a WTPTP device with a PXA1088 processor. The flash tool, however, uses .blf files that I've never seen before. I downloaded some firmware for a device (HiSense X8T) with the same processor as our device. I found that the program MATLAB was the only program I have access to that was able to read .blf files. The .blf for this other device looks like this inside:
Code:
[BLF_Version]
Blf_Version_Number = V2.1.0
[UE_Options]
UE_Boot_Option = 0
[Flash_Properties]
Max_Upload_Split_Size = 0x20000000
Max_FBF_Split_Size = 0x40000000
Flash_Family = eMMC
Spare_Area_Size = 0
Data_Area_Size = 0
FBF_Sector_Size = 4096
[Flash_Options]
ProductionMode = 0
Skip_Blocks_Number =
Erase_All_Flash = 0
Reset_BBT = 0
[TIM_Configuration]
Number_of_Images = 15
Number_of_Keys = 0
Boot_Flash_Signature = 0x4D4D4308
Processor_Type = PXA1920
OEM_UniqueID = 0x4f524312
Issue_Date = 0x20130115
Version = 0x00030400
Trusted = 0
[Reserved_Data]
CUST
1st Custom Value = 0x00000000
End_CUST
End_Reserved_Data
[Extended_Reserved_Data]
Consumer_ID
CID = TBRI
PID = DDR1
End_Consumer_ID
DDR_Initialization
DDR_PID = DDR1
DDROperations
DDR_INIT_ENABLE = 0x00000001
DDR_MEMTEST_ENABLE = 0x00000000
End_DDROperations
Instructions
WRITE = <0xD42828E8,0x00000003>
WRITE = <0xC0100010,0x000D0001> ;DDR_MEM_ADDR_MAP0
WRITE = <0xC0100014,0x200D0001> ;DDR_MEM_ADDR_MAP1
WRITE = <0xC0100020,0x0000A430> ;DDR_SDRAM_CFG0
WRITE = <0xC0100024,0x0000A430> ;DDR_SDRAM_CFG1
WRITE = <0xC0100050,0x900450A1> ;DDR_SDRAM_CTRL1
WRITE = <0xC0100054,0x00000000> ;DDR_SDRAM_CTRL2
WRITE = <0xC0100058,0x20808115> ;DDR_SDRAM_CTRL4
WRITE = <0xC0100060,0x03000000> ;DDR_SDRAM_CTRL7
WRITE = <0xC0100064,0x04040000> ;DDR_SDRAM_CTRL13
WRITE = <0xC0100080,0x4CDA0065> ;DDR_SDRAM_TIMING1
WRITE = <0xC0100084,0x94860345> ;DDR_SDRAM_TIMING2
WRITE = <0xC0100088,0x2038381B> ;DDR_SDRAM_TIMING3
WRITE = <0xC010008C,0x302AFC9C> ;DDR_SDRAM_TIMING4
WRITE = <0xC0100090,0x20110144> ;DDR_SDRAM_TIMING5
WRITE = <0xC0100094,0x0242418F> ;DDR_SDRAM_TIMING6
WRITE = <0xC0100098,0x00008801> ;?DDR_SDRAM_TIMING7
WRITE = <0xC0100100,0x000FF1FC> ;?EXCLUSIVE_MONITOR_CTRL
WRITE = <0xC0100220,0x00004455> ;DDR_PHY_CTRL3
WRITE = <0xC0100230,0x13300AA9> ;DDR_PHY_CTRL7
WRITE = <0xC0100234,0x03300AA0> ;DDR_PHY_CTRL8
WRITE = <0xC0100238,0x000000AA> ;DDR_PHY_CTRL9
WRITE = <0xC010023C,0x0011311C> ;DDR_PHY_CTRL10
WRITE = <0xC0100240,0x00300008> ;DDR_PHY_CTRL11
WRITE = <0xC0100248,0xF0218000> ;DDR_PHY_CTRL13
WRITE = <0xC010024C,0x80000000> ;DDR_PHY_CTRL14
WRITE = <0xC0100300,0x00000000> ;DDR_PHY_DATA_BYTE_SEL
WRITE = <0xC0100304,0x00400003> ;DDR_PHY_DLL_CTRL
WRITE = <0xC0100300,0x00000001> ;DDR_PHY_DATA_BYTE_SEL
WRITE = <0xC0100304,0x00400003> ;DDR_PHY_DLL_CTRL
WRITE = <0xC0100300,0x00000002> ;DDR_PHY_DATA_BYTE_SEL
WRITE = <0xC0100304,0x00400003> ;DDR_PHY_DLL_CTRL
WRITE = <0xC0100300,0x00000003> ;DDR_PHY_DATA_BYTE_SEL
WRITE = <0xC0100304,0x00400003> ;DDR_PHY_DLL_CTRL
WRITE = <0xC010024C,0x20000000> ;DDR_PHY_CTRL14
WRITE = <0xC010024C,0x40000000> ;DDR_PHY_CTRL14
WRITE = <0xC010023C,0x0010311C> ;DDR_PHY_CTRL10
WRITE = <0xC0100380,0x00000100> ;DDR_PHY_WL_SEL
WRITE = <0xC0100384,0x00050002> ;DDR_PHY_WL_CTRL0
WRITE = <0xC0100380,0x00000101> ;DDR_PHY_WL_SEL
WRITE = <0xC0100384,0x00050002> ;DDR_PHY_WL_CTRL0
WRITE = <0xC0100380,0x00000102> ;DDR_PHY_WL_SEL
WRITE = <0xC0100384,0x00050002> ;DDR_PHY_WL_CTRL0
WRITE = <0xC0100380,0x00000103> ;DDR_PHY_WL_SEL
WRITE = <0xC0100384,0x00050002> ;DDR_PHY_WL_CTRL0
WRITE = <0xC0100380,0x00000200> ;DDR_PHY_WL_SEL
WRITE = <0xC0100384,0x00050002> ;DDR_PHY_WL_CTRL0
WRITE = <0xC0100380,0x00000201> ;DDR_PHY_WL_SEL
WRITE = <0xC0100384,0x00050002> ;DDR_PHY_WL_CTRL0
WRITE = <0xC0100380,0x00000202> ;DDR_PHY_WL_SEL
WRITE = <0xC0100384,0x00050002> ;DDR_PHY_WL_CTRL0
WRITE = <0xC0100380,0x00000203> ;DDR_PHY_WL_SEL
WRITE = <0xC0100384,0x00050002> ;DDR_PHY_WL_CTRL0
WRITE = <0xC0100380,0x00000100> ;DDR_PHY_WL_SEL
WRITE = <0xC0100388,0x00000005> ;DDR_PHY_WL_CTRL1
WRITE = <0xC010038C,0x00000002> ;DDR_PHY_WL_CTRL2
WRITE = <0xC0100380,0x00100100> ;DDR_PHY_WL_SEL
WRITE = <0xC0100388,0x00000005> ;DDR_PHY_WL_CTRL1
WRITE = <0xC010038C,0x00000000> ;DDR_PHY_WL_CTRL2
WRITE = <0xC0100380,0x00200100> ;DDR_PHY_WL_SEL
WRITE = <0xC0100388,0x00000005> ;DDR_PHY_WL_CTRL1
WRITE = <0xC010038C,0x00000002> ;DDR_PHY_WL_CTRL2
WRITE = <0xC0100380,0x00000200> ;DDR_PHY_WL_SEL
WRITE = <0xC0100388,0x00000005> ;DDR_PHY_WL_CTRL1
WRITE = <0xC010038C,0x00000002> ;DDR_PHY_WL_CTRL2
WRITE = <0xC0100380,0x00100200> ;DDR_PHY_WL_SEL
WRITE = <0xC0100388,0x00000005> ;DDR_PHY_WL_CTRL1
WRITE = <0xC010038C,0x00000000> ;DDR_PHY_WL_CTRL2
WRITE = <0xC0100380,0x00200200> ;DDR_PHY_WL_SEL
WRITE = <0xC0100388,0x00000005> ;DDR_PHY_WL_CTRL1
WRITE = <0xC010038C,0x00000002> ;DDR_PHY_WL_CTRL2
WRITE = <0xC0100160,0x00000001> ;DDR_USER_INIT_CMD0
WAIT_FOR_BIT_SET = <0xC0100008,0x00000001,0x00001000>
WRITE = <0xC0100164,0x0302003F> ;DDR_USER_INIT_CMD1
WRITE = <0xC0100164,0x03020001> ;DDR_USER_INIT_CMD1
WRITE = <0xC0100164,0x03020002> ;DDR_USER_INIT_CMD1
WRITE = <0xC0100164,0x03020003> ;DDR_USER_INIT_CMD1
WRITE = <0xC0100160,0x03001000> ;DDR_USER_INIT_CMD0
WAIT_FOR_BIT_SET = <0xC0100004,0x00000010,0x00001000>
PP_TABLEHEADER = <0xC01001C8,0xC01001CC,0xC01001C0> ;DDR_TABLEHEADER FOR PRODUCT POINT
PP_WRITE = <0x80000000,0x0002024C,0x00000000> ;Table0 for DCLK resume from stop ([email protected])
PP_WRITE = <0x20000000,0x0000024C,0x00000020> ;Table1 for DCLK resume from stop ([email protected])
PP_WRITE = <0x40000000,0x0000024C,0x00000021>
PP_WRITE = <0x80000000,0x0002024C,0x00000022>
PP_WRITE = <0x20802115,0x00000058,0x00000040> ;DDR 156MHZ table
PP_WRITE = <0x488A0065,0x00000080,0x00000041>
PP_WRITE = <0x42330155,0x00000084,0x00000042>
PP_WRITE = <0x20161612,0x00000088,0x00000043>
PP_WRITE = <0x302A643D,0x0000008C,0x00000044>
PP_WRITE = <0x20070082,0x00000090,0x00000045>
PP_WRITE = <0x00F0E49C,0x00000094,0x00000046>
PP_WRITE = <0x00004455,0x00000220,0x00000047>
PP_WRITE = <0x13300AA9,0x00000230,0x00000048>
PP_WRITE = <0x03300AA0,0x00000234,0x00000049>
PP_WRITE = <0x000000AA,0x00010238,0x0000004A>
PP_WRITE = <0x80000000,0x0000024C,0x0000004B>
PP_WRITE = <0x00000000,0x00000300,0x0000004C>
PP_WRITE = <0x00400003,0x00000304,0x0000004D>
PP_WRITE = <0x00000001,0x00000300,0x0000004E>
PP_WRITE = <0x00400003,0x00000304,0x0000004F>
PP_WRITE = <0x00000002,0x00000300,0x00000050>
PP_WRITE = <0x00400003,0x00000304,0x00000051>
PP_WRITE = <0x00000003,0x00000300,0x00000052>
PP_WRITE = <0x00400003,0x00000304,0x00000053>
PP_WRITE = <0x40000000,0x0000024C,0x00000054>
PP_WRITE = <0x00000002,0x00020068,0x00000055>
PP_WRITE = <0x00000000,0x00000000,0x00000056>
PP_WRITE = <0x20806115,0x00000058,0x00000060> ;DDR 312MHZ table
PP_WRITE = <0x4CD40065,0x00000080,0x00000061>
PP_WRITE = <0x74650295,0x00000084,0x00000062>
PP_WRITE = <0x202C2C1B,0x00000088,0x00000063>
PP_WRITE = <0x302AC47A,0x0000008C,0x00000064>
PP_WRITE = <0x200E0103,0x00000090,0x00000065>
PP_WRITE = <0x01D1C538,0x00000094,0x00000066>
PP_WRITE = <0x00004455,0x00000220,0x00000067>
PP_WRITE = <0x13300AA9,0x00000230,0x00000068>
PP_WRITE = <0x03300AA0,0x00000234,0x00000069>
PP_WRITE = <0x000000AA,0x00010238,0x0000006A>
PP_WRITE = <0x80000000,0x0000024C,0x0000006B>
PP_WRITE = <0x00000000,0x00000300,0x0000006C>
PP_WRITE = <0x00400003,0x00000304,0x0000006D>
PP_WRITE = <0x00000001,0x00000300,0x0000006E>
PP_WRITE = <0x00400003,0x00000304,0x0000006F>
PP_WRITE = <0x00000002,0x00000300,0x00000070>
PP_WRITE = <0x00400003,0x00000304,0x00000071>
PP_WRITE = <0x00000003,0x00000300,0x00000072>
PP_WRITE = <0x00400003,0x00000304,0x00000073>
PP_WRITE = <0x40000000,0x0000024C,0x00000074>
PP_WRITE = <0x00000002,0x00020068,0x00000075>
PP_WRITE = <0x00000000,0x00000000,0x00000076>
PP_WRITE = <0x20808115,0x00000058,0x00000080> ;400MHZ DDR table
PP_WRITE = <0x4CDA0065,0x00000080,0x00000081>
PP_WRITE = <0x94860345,0x00000084,0x00000082>
PP_WRITE = <0x2038381B,0x00000088,0x00000083>
PP_WRITE = <0x302AFC9C,0x0000008C,0x00000084>
PP_WRITE = <0x20110144,0x00000090,0x00000085>
PP_WRITE = <0x0242418F,0x00000094,0x00000086>
PP_WRITE = <0x00004455,0x00000220,0x00000087>
PP_WRITE = <0x13300AA9,0x00000230,0x00000088>
PP_WRITE = <0x03300AA0,0x00000234,0x00000089>
PP_WRITE = <0x000000AA,0x00010238,0x0000008A>
PP_WRITE = <0x00000000,0x00000300,0x0000008B>
PP_WRITE = <0x00000618,0x00000304,0x0000008C>
PP_WRITE = <0x00000001,0x00000300,0x0000008D>
PP_WRITE = <0x00000618,0x00000304,0x0000008E>
PP_WRITE = <0x00000002,0x00000300,0x0000008F>
PP_WRITE = <0x00000618,0x00000304,0x00000090>
PP_WRITE = <0x00000003,0x00000300,0x00000091>
PP_WRITE = <0x00000618,0x00000304,0x00000092>
PP_WRITE = <0x20000000,0x0000024C,0x00000093>
PP_WRITE = <0x40000000,0x0000024C,0x00000094>
PP_WRITE = <0x80000000,0x0000024C,0x00000095>
PP_WRITE = <0x00000002,0x00020068,0x00000096>
PP_WRITE = <0x00000000,0x00000000,0x00000097>
PP_WRITE = <0x03020001,0x00000164,0x000000E0>
PP_WRITE = <0x03020002,0x00000164,0x000000E1>
PP_WRITE = <0x03020003,0x00000164,0x000000E2>
PP_WRITE = <0x00000000,0x00020068,0x000000E3>
PP_WRITE = <0x00000000,0x00000000,0x000000E4>
End_Instructions
End_DDR_Initialization
Image_Maps
NUM_MAPS = 3
1_Image_Map_Info
1_Image_ID = 0x54494D31
1_Image_Type = PRIMARYIMAGE
1_Flash_Address_Lo = 0x0000200000
1_Flash_Address_Hi = 0x00000000
1_Partition = 0x0
1_End_Image_Map_Info
2_Image_Map_Info
2_Image_ID = 0x54494D32
2_Image_Type = RECOVERYIMAGE
2_Flash_Address_Lo = 0x0000280000
2_Flash_Address_Hi = 0x00000000
2_Partition = 0x0
2_End_Image_Map_Info
3_Image_Map_Info
3_Image_ID = 0x54494D33
3_Image_Type = CPIMAGE
3_Flash_Address_Lo = 0x0000300000
3_Flash_Address_Hi = 0x00000000
3_Partition = 0x00000000
3_End_Image_Map_Info
End_Image_Maps
End_Extended_Reserved_Data
[Image_List]
1_Image_Enable = 1
1_Image_Tim_Included = 1
1_Image_Image_ID = 0x54494D48
1_Image_Next_Image_ID = 0x4F424D49
1_Image_Path = ntim_helan_lte.bin
1_Image_Flash_Entry_Address = 0x0000000000
1_Image_Load_Address = 0xD1000000
1_Image_Type = RAW
1_Image_ID_Name = TIMH
1_Image_Erase_Size =
1_Image_Partition_Number = 1
1_Image_Size_To_CRC_in_bytes = 0
1_Image_Hash_Algorithm_ID = SHA-160
1_Image_Image_Size_To_Hash_in_bytes = 0xFFFFFFFF
2_Image_Enable = 1
2_Image_Tim_Included = 1
2_Image_Image_ID = 0x4F424D49
2_Image_Next_Image_ID = 0x50475054
2_Image_Path = obm.bin
2_Image_Flash_Entry_Address = 0x0000020000
2_Image_Load_Address = 0xD1002000
2_Image_Type = RAW
2_Image_ID_Name = OBMI
2_Image_Erase_Size =
2_Image_Partition_Number = 1
2_Image_Size_To_CRC_in_bytes = 0
2_Image_Hash_Algorithm_ID = SHA-160
2_Image_Image_Size_To_Hash_in_bytes = 0xFFFFFFFF
3_Image_Enable = 1
3_Image_Tim_Included = 0
3_Image_Image_ID = 0x50475054
3_Image_Next_Image_ID = 0x52424C49
3_Image_Path = primary_gpt_4g
3_Image_Flash_Entry_Address = 0x0000000000
3_Image_Load_Address = 0xFFFFFFFF
3_Image_Type = RAW
3_Image_ID_Name = PGPT
3_Image_Erase_Size =
3_Image_Partition_Number = 0
3_Image_Size_To_CRC_in_bytes = 0
3_Image_Hash_Algorithm_ID =
3_Image_Image_Size_To_Hash_in_bytes =
4_Image_Enable = 0
4_Image_Tim_Included = 0
4_Image_Image_ID = 0x52424C49
4_Image_Next_Image_ID = 0x4F534C52
4_Image_Path = ReliableData.bin
4_Image_Flash_Entry_Address = 0x0000080000
4_Image_Load_Address = 0xFFFFFFFF
4_Image_Type = RAW
4_Image_ID_Name = RBLI
4_Image_Erase_Size =
4_Image_Partition_Number = 0
4_Image_Size_To_CRC_in_bytes = 0
4_Image_Hash_Algorithm_ID =
4_Image_Image_Size_To_Hash_in_bytes =
5_Image_Enable = 1
5_Image_Tim_Included = 3
5_Image_Image_ID = 0x4F534C52
5_Image_Next_Image_ID = 0x5A494D52
5_Image_Path = u-boot.bin
5_Image_Flash_Entry_Address = 0x0000400000
5_Image_Load_Address = 0x09000000
5_Image_Type = RAW
5_Image_ID_Name = OSLR
5_Image_Erase_Size = 0x00100000
5_Image_Partition_Number = 0
5_Image_Size_To_CRC_in_bytes = 0
5_Image_Hash_Algorithm_ID = SHA-160
5_Image_Image_Size_To_Hash_in_bytes = 0xFFFFFFFF
6_Image_Enable = 1
6_Image_Tim_Included = 0
6_Image_Image_ID = 0x5A494D52
6_Image_Next_Image_ID = 0x4F534C4F
6_Image_Path = recovery.img
6_Image_Flash_Entry_Address = 0x0000500000
6_Image_Load_Address = 0x01400000
6_Image_Type = RAW
6_Image_ID_Name = ZIMR
6_Image_Erase_Size =
6_Image_Partition_Number = 0
6_Image_Size_To_CRC_in_bytes = 0
6_Image_Hash_Algorithm_ID = SHA-160
6_Image_Image_Size_To_Hash_in_bytes = 0xFFFFFFFF
7_Image_Enable = 1
7_Image_Tim_Included = 2
7_Image_Image_ID = 0x4F534C4F
7_Image_Next_Image_ID = 0x5A494D47
7_Image_Path = u-boot.bin
7_Image_Flash_Entry_Address = 0x0000F00000
7_Image_Load_Address = 0x09000000
7_Image_Type = RAW
7_Image_ID_Name = OSLO
7_Image_Erase_Size = 0x00100000
7_Image_Partition_Number = 0
7_Image_Size_To_CRC_in_bytes = 0
7_Image_Hash_Algorithm_ID = SHA-160
7_Image_Image_Size_To_Hash_in_bytes = 0xFFFFFFFF
8_Image_Enable = 1
8_Image_Tim_Included = 0
8_Image_Image_ID = 0x5A494D47
8_Image_Next_Image_ID = 0x53595359
8_Image_Path = boot.img
8_Image_Flash_Entry_Address = 0x0001000000
8_Image_Load_Address = 0x00107FC0
8_Image_Type = RAW
8_Image_ID_Name = ZIMG
8_Image_Erase_Size =
8_Image_Partition_Number = 0
8_Image_Size_To_CRC_in_bytes = 0
8_Image_Hash_Algorithm_ID = SHA-160
8_Image_Image_Size_To_Hash_in_bytes = 0xFFFFFFFF
9_Image_Enable = 1
9_Image_Tim_Included = 0
9_Image_Image_ID = 0x53595359
9_Image_Next_Image_ID = 0x41524249
9_Image_Path = system.img
9_Image_Flash_Entry_Address = 0x0002000000
9_Image_Load_Address = 0xFFFFFFFF
9_Image_Type = SPARSE
9_Image_ID_Name = SYSY
9_Image_Erase_Size =
9_Image_Partition_Number = 0
9_Image_Size_To_CRC_in_bytes = 0
9_Image_Hash_Algorithm_ID =
9_Image_Image_Size_To_Hash_in_bytes =
10_Image_Enable = 1
10_Image_Tim_Included = 4
10_Image_Image_ID = 0x41524249
10_Image_Next_Image_ID = 0x47524249
10_Image_Path = HL_LTG_DL_DKB.bin
10_Image_Flash_Entry_Address = 0x0034A00000
10_Image_Load_Address = 0xFFFFFFFF
10_Image_Type = RAW
10_Image_ID_Name = ARBI
10_Image_Erase_Size =
10_Image_Partition_Number = 0
10_Image_Size_To_CRC_in_bytes = 0
10_Image_Hash_Algorithm_ID = SHA-160
10_Image_Image_Size_To_Hash_in_bytes = 0xFFFFFFFF
11_Image_Enable = 1
11_Image_Tim_Included = 4
11_Image_Image_ID = 0x47524249
11_Image_Next_Image_ID = 0x52464249
11_Image_Path = HL_DL_M09_Y0_AI_SKL_Flash.bin
11_Image_Flash_Entry_Address = 0x0035500000
11_Image_Load_Address = 0xFFFFFFFF
11_Image_Type = RAW
11_Image_ID_Name = GRBI
11_Image_Erase_Size =
11_Image_Partition_Number = 0
11_Image_Size_To_CRC_in_bytes = 0
11_Image_Hash_Algorithm_ID = SHA-160
11_Image_Image_Size_To_Hash_in_bytes = 0xFFFFFFFF
12_Image_Enable = 1
12_Image_Tim_Included = 4
12_Image_Image_ID = 0x52464249
12_Image_Next_Image_ID = 0x4E564D49
12_Image_Path = Skylark_LTG.bin
12_Image_Flash_Entry_Address = 0x00359C0000
12_Image_Load_Address = 0xFFFFFFFF
12_Image_Type = RAW
12_Image_ID_Name = RFBI
12_Image_Erase_Size =
12_Image_Partition_Number = 0
12_Image_Size_To_CRC_in_bytes = 0
12_Image_Hash_Algorithm_ID = SHA-160
12_Image_Image_Size_To_Hash_in_bytes = 0xFFFFFFFF
13_Image_Enable = 1
13_Image_Tim_Included = 0
13_Image_Image_ID = 0x4E564D49
13_Image_Next_Image_ID = 0x55535259
13_Image_Path = nvm.img
13_Image_Flash_Entry_Address = 0x0036A00000
13_Image_Load_Address = 0xFFFFFFFF
13_Image_Type = SPARSE
13_Image_ID_Name = NVMI
13_Image_Erase_Size =
13_Image_Partition_Number = 0
13_Image_Size_To_CRC_in_bytes = 0
13_Image_Hash_Algorithm_ID =
13_Image_Image_Size_To_Hash_in_bytes =
14_Image_Enable = 1
14_Image_Tim_Included = 0
14_Image_Image_ID = 0x55535259
14_Image_Next_Image_ID = 0x53475054
14_Image_Path = userdata_4g.img
14_Image_Flash_Entry_Address = 0x0059A00000
14_Image_Load_Address = 0xFFFFFFFF
14_Image_Type = SPARSE
14_Image_ID_Name = USRY
14_Image_Erase_Size =
14_Image_Partition_Number = 0
14_Image_Size_To_CRC_in_bytes = 0
14_Image_Hash_Algorithm_ID =
14_Image_Image_Size_To_Hash_in_bytes =
15_Image_Enable = 1
15_Image_Tim_Included = 0
15_Image_Image_ID = 0x53475054
15_Image_Next_Image_ID = 0x54494D31
15_Image_Path = secondary_gpt_4g
15_Image_Flash_Entry_Address = 0xFFFFFFFFFF
15_Image_Load_Address = 0xFFFFFFFF
15_Image_Type = RAW
15_Image_ID_Name = SGPT
15_Image_Erase_Size =
15_Image_Partition_Number = 0
15_Image_Size_To_CRC_in_bytes = 0
15_Image_Hash_Algorithm_ID =
15_Image_Image_Size_To_Hash_in_bytes =
I thought we may be able to edit the files and create a flashable file for this program. I initially attempted to edit the .blf file to flash backup images I have gathered from a working QTAQZ3 (running 4.2.2). The flash caused the program to crash with no results. I then attempted to flash the blf file for the HS X8T (likely not advised, but the tablet is already broken, so it was worth a shot). This flash actually responded with program errors and output this log here:
Code:
Getting type of Device
Get Device Type
---
Platform ready status: 0
Getting Version...
---
Platform ready status: 0
Version: 3307
Date: 1152013
Processor: HEL4E
Version: 3307
Date: 01152013
Processor: HELN
Open an BootLoader Device
Get type of device successfully
Enter BootLoader Thread
Enter WTPTPDownload
Begin ParseTim
ParseTim opened TIM file: C:\Users\nehem\Downloads\ONTIM_Marvell_MultiDL 1.3.0.61\temp\FBF_Ntimheader.bin, 54494D48
Number of Images listed in TIM: 2
TIM image ID list:
Begin OpenUsbPort
Original Preamble Mode
Begin DownloadImage:
---
Platform ready status: 0
DownLoading file: C:\Users\nehem\Downloads\ONTIM_Marvell_MultiDL 1.3.0.61\temp\FBF_Ntimheader.bin
---
Platform ready status: 0
Return flag in Dataheader CMD: 4,FDSwitch is 1
*******NOTE:: Fast Download is NOW activated!
uiRemainingBytes is 0....
Last Data
ReadDownloadFileThread return....
Read USB in data command
Download data finished
---
Platform ready status: 0
Begin DownloadImage:
Sending Preamble...
---
Platform ready status: 0
Getting Version...
---
Platform ready status: 0
Version: 3307
Date: 1152013
Processor: HEL4E
---
Platform ready status: 0
DownLoading file: C:\Users\nehem\Downloads\ONTIM_Marvell_MultiDL 1.3.0.61\temp\FBF_h.bin
Return flag in Dataheader CMD: 4,FDSwitch is 1
*******NOTE:: Fast Download is NOW activated!
uiRemainingBytes is 681132032....
ReadDownloadFileThread return....
Last Data
Read USB in data command
Download data finished
---
Platform ready status: 0
Enter Burning flash....
WTPTP Notification: Platform is busy 0x1
WTPTP Notification: Platform is busy ,Notification code is :0x1
WTPTP Error: InvalidSecureBootMethodError : Errorcode is 0x63
GetWtpMessage failed
Abnormal Termination in BootLoader
close BootLoader USB handle
BootLoader Thread Completed!
I'm really hoping that someone with the right knowledge might be able to decipher what's going on here.
Link for flash tool: https://drive.google.com/file/d/1Gb_erExHXMmEzWHl01qRxUdCuX_ggSQj/view?usp=sharing

njmcinty said:
I've done some digging around to look for flash tools for devices that use Marvell processors. This tablet uses the Marvell PXA1088LTE. I found a download tool that is supposed to be for Marvell devices, but I've never used anything quite like it before. I've included a link to the package below. Upon installing the drivers, I was able to get my computer to recognize the device as a WTPTP device with a PXA1088 processor.
Click to expand...
Click to collapse
Good idea/good work on this. I hadn't thought to look for a flash tool for similar devices (though I haven't tried all that hard to unbrick my tablet).
The flash tool, however, uses .blf files that I've never seen before. I downloaded some firmware for a device (HiSense X8T) with the same processor as our device.
Click to expand...
Click to collapse
Can you share the link to this firmware?
I found that the program MATLAB was the only program I have access to that was able to read .blf files. The .blf for this other device looks like this inside:
Code:
Boot_Flash_Signature = 0x4D4D4308
Processor_Type = PXA1920
OEM_UniqueID = 0x4f524312
Issue_Date = 0x20130115
Version = 0x00030400
Click to expand...
Click to collapse
It's likely just a plaintext file - just a coincidence that MATLAB wanted to digest it without complaining (guessing this is on Windows?). Anyway, it looks like it just specifies how/where to load the various images contained in the firmware you downloaded. It is may be possible to hack it to work with different firmware, but I'm worried a bit about the bits that I snipped out from above - if that Boot_Flash_Signature or the UniqueID is generated from something that is flashed on the device, it might be difficult/impossible to hack a file that will play nice with the QTAQZ3.
I initially attempted to edit the .blf file to flash backup images I have gathered from a working QTAQZ3 (running 4.2.2).
Click to expand...
Click to collapse
Do you have those backup files available? Those will be necessary in order to figure out how to hack up the blf file to properly flash the image (if that is indeed possible).
I then attempted to flash the blf file for the HS X8T (likely not advised, but the tablet is already broken, so it was worth a shot). This flash actually responded with program errors and output this log here:
Code:
Enter Burning flash....
WTPTP Notification: Platform is busy 0x1
WTPTP Notification: Platform is busy ,Notification code is :0x1
WTPTP Error: InvalidSecureBootMethodError : Errorcode is 0x63
GetWtpMessage failed
Abnormal Termination in BootLoader
close BootLoader USB handle
BootLoader Thread Completed!
Click to expand...
Click to collapse
This is somewhat promising, in that it looks like it attempted to flash, but that the system was busy. Was your device spinning at the Verizon boot screen, or sitting at the Factory Reset menu that you get when you power on while holding the volume button? If it was actually trying to boot (i.e. sitting at the Verizon screen) then that may be why this returned busy.

I must say, I never expected to hear back from anyone of this post. By now, if anyone was really that attached to their old verizon tablet, they could have bought another off ebay for $30. Nevertheless, it is nice to see there is another person who hasn't COMPLETELY given up hope on their device.
Can you share the link to this firmware?
Click to expand...
Click to collapse
Yes, eventually. It's actually on my old computer at my parent's house. I thought I had it backed-up on my OneDrive, but I do not. I'll be visiting again shortly, so I will grab it then and upload it. I would share the link to the site I originally downloaded it from, but my feverous googling escapade is no longer in my retrievable browser history.
It is may be possible to hack it to work with different firmware, but I'm worried a bit about the bits that I snipped out from above - if that Boot_Flash_Signature or the UniqueID is generated from something that is flashed on the device, it might be difficult/impossible to hack a file that will play nice with the QTAQZ3.
Click to expand...
Click to collapse
Completely valid concerns. I remember there being another device that used a similar hardware set (HP CoolPad or something, found firmware repair videos on YouTube). In the videos, people were using the same flash tool, with very similar files. The blf file from the two devices only had minor differences (eMMc size, RAM... ) if I recall correctly. If interested, I can look into those videos again. I may have made a spreadsheet at some point indicating differences in the two, but I'll have to look for it. To address your concern, I cannot recall if these identifiers were the same or different.
Do you have those backup files available?
Click to expand...
Click to collapse
Same answer as above, I'll grab them next time I am home. I can't recall what method I used to pull them, but I remember it being a pain with this device, so I hope the images I have are valid. If not, With guidance, I may be able to acquire more as I still have the working tablet.
Was your device spinning at the Verizon boot screen, or sitting at the Factory Reset menu that you get when you power on while holding the volume button?
Click to expand...
Click to collapse
Interesting question, more interesting answer: neither. If I recall correctly, to get to the stock recovery on this device, you held power and volume up. To get the device to be recognized as the WTPTP device, I had to either hold the volume down button and plug in the USB OR hold the power and the volume down, then plug in USB. Both of these may have worked, but my memory fails me. The device screen did not light up or change when I entered this mode. There was only a chime on my PC indicating a device was connected, and a listing for WTPTP device in Device Manager.
I'll work on getting the requested files, but until then, it may be helpful for me to review what I've done already. I also found some GitHub pages from that mention these devices or similar ones.
https://github.com/android-Marvell: This may contain helpful tools. I may have tried playing around with this, but I'm not a programmer and barely know what GitHub is lol.
https://github.com/jonthn4411/aabs: This is a fork of another page I found that appears to be gone know. Has information that looks like it might relate to our SoC.
PS: According to this press briefing, it looks like our SoC (PXA1088LTE) is commonly called PXA1920, so if you see any differences, this may be why.

njmcinty said:
I must say, I never expected to hear back from anyone of this post. By now, if anyone was really that attached to their old verizon tablet, they could have bought another off ebay for $30. Nevertheless, it is nice to see there is another person who hasn't COMPLETELY given up hope on their device.
Click to expand...
Click to collapse
I have been periodically checking for new info on this thing since I softbricked it in 2017 - this is the only actual promising thread I've seen the whole time... Unfortunately, I recently moved and can't locate my bricked tablet right now - honestly I may have thrown it away during the move because I've burned so much time trying to fix it. If I don't end up finding it, I'll likely burn $30+ to grab a couple non-bricked ones to play with (they weren't nearly that cheap/readily available when I bricked mine, IIRC). At this point I'm willing to shell out the cash just to claim victory over the stupid thing.
Yes, eventually. It's actually on my old computer at my parent's house. I thought I had it backed-up on my OneDrive, but I do not. I'll be visiting again shortly, so I will grab it then and upload it. I would share the link to the site I originally downloaded it from, but my feverous googling escapade is no longer in my retrievable browser history.
...
Same answer as above, I'll grab them next time I am home. I can't recall what method I used to pull them, but I remember it being a pain with this device, so I hope the images I have are valid. If not, With guidance, I may be able to acquire more as I still have the working tablet.
Click to expand...
Click to collapse
Sounds good - no rush obviously (doubt anybody else cares at this point), but it would be good to have a valid image/descriptor file to try to tear apart.
Completely valid concerns. I remember there being another device that used a similar hardware set (HP CoolPad or something, found firmware repair videos on YouTube). In the videos, people were using the same flash tool, with very similar files. The blf file from the two devices only had minor differences (eMMc size, RAM... ) if I recall correctly. If interested, I can look into those videos again. I may have made a spreadsheet at some point indicating differences in the two, but I'll have to look for it. To address your concern, I cannot recall if these identifiers were the same or different.
Click to expand...
Click to collapse
The videos could certainly be helpful. Let me know if you find those. Even if those fields are somehow generated from something on the device, we might be able to coax the flash tool into divulging the information we need - it has to know where to find the stuff, after all.
Interesting question, more interesting answer: neither. If I recall correctly, to get to the stock recovery on this device, you held power and volume up. To get the device to be recognized as the WTPTP device, I had to either hold the volume down button and plug in the USB OR hold the power and the volume down, then plug in USB. Both of these may have worked, but my memory fails me. The device screen did not light up or change when I entered this mode. There was only a chime on my PC indicating a device was connected, and a listing for WTPTP device in Device Manager.
Click to expand...
Click to collapse
Good to know! The flash failing with "device busy" makes me want to think the device wasn't in the correct state or something, but, depending on the complexity of the executable (and my ability to remember how to live-debug on Windows) we might be able to glean some more information about what's going on by tearing into the flashing program.
I'll work on getting the requested files, but until then, it may be helpful for me to review what I've done already. I also found some GitHub pages from that mention these devices or similar ones.
<URL removed>: This may contain helpful tools. I may have tried playing around with this, but I'm not a programmer and barely know what GitHub is lol.
Click to expand...
Click to collapse
Well, you seem to be more capable than many who dabble with this stuff, so I'd take that as a point of pride, despite not being a programmer I'm quite well acquainted with banging on low-level hardware stuff, so hopefully with a little more research and hackery we can get closer to a solution.
<URL removed>: This is a fork of another page I found that appears to be gone know. Has information that looks like it might relate to our SoC.
PS: According to <URL removed> press briefing, it looks like our SoC (PXA1088LTE) is commonly called PXA1920, so if you see any differences, this may be why.
Click to expand...
Click to collapse
Cool - I'll take a look at those, and maybe get a couple tablets ordered. Even if I can't get a bricked one (odd to think about wanting a bricked tablet), having a working one could very well lead to a way to unbrick them. I wish I'd seen this thread back in January, because I certainly would've kept better track of the tablet if I had
---------- Post added at 05:04 PM ---------- Previous post was at 04:39 PM ----------
If I don't end up finding it, I'll likely burn $30+ to grab a couple non-bricked ones to play with (they weren't nearly that cheap/readily available when I bricked mine, IIRC). At this point I'm willing to shell out the cash just to claim victory over the stupid thing.
Click to expand...
Click to collapse
Just ordered two tablets - one working, one with a boot loop. They were depressingly close in price for the one being damaged and non-working, but whatever. If I defeat the thing it will be worth it.

njmcinty said:
I have a QTAQZ3 currently running 4.2.2. I captured the OTA url and downloaded an update bin file. I'm not exactly sure how bins compare to flashable zips, nor do I know what to do with a bin file. It seems as though this file has been hard to come by. I am hoping that by posting it, someone with the right know-how can help us fix all these bricked tablets.
https://drive.google.com/open?id=1LmyrA3eGcVL3sCMB3okBdsoqA0Gv5RZE
Click to expand...
Click to collapse
Hi there. I'm new. Great post and questions. I too have bricked my tablet and trying to find resolution. I just downloaded your bin file. Thank you so much. Can you provide a site or pdf instruction on how to install on my tablet.

TheJokerscousin said:
Can you provide a site or pdf instruction on how to install on my tablet.
Click to expand...
Click to collapse
Unfortunately, if you look closely at the previous replies, we haven't figured out a way to install the OTA update binary onto a bricked tablet - in fact, I'm not sure if there is one. I've been waiting for the full backup that njmcinty mentioned, but they haven't gotten back about that yet. I do have a functional tablet available, along with 2 bricked ones to test on. I haven't taken the time yet to try to back up my functional one as I believe the process to do so could lead to it being bricked as well...

bxlentpartyon said:
Unfortunately, if you look closely at the previous replies, we haven't figured out a way to install the OTA update binary onto a bricked tablet - in fact, I'm not sure if there is one. I've been waiting for the full backup that njmcinty mentioned, but they haven't gotten back about that yet. I do have a functional tablet available, along with 2 bricked ones to test on. I haven't taken the time yet to try to back up my functional one as I believe the process to do so could lead to it being bricked as well...
Click to expand...
Click to collapse
Thank you. I apologize but The thread was long and I just signed up. If I come across anything I'll post. Thanks again.

Thank you @TheJokerscousin! This was the bump I needed to get these files uploaded. Sorry for the delay, I grabbed them and just never got around to uploading them! I'll include the link below. If there are any other files necessary, there's a chance I missed something, but I can add it to the upload. Sounds like we may have company as far as people interested in fixing these tablets. I'm going to try and look through my earlier notes to see if I can pick up where I left off months ago....
14.92 GB folder on MEGA
20 files
mega.nz

Thanks for uploading this! I'm downloading it now, hopefully it will prove useful.
FYI, I hadn't looked at this stuff in a while, but I did hack around a bit on Friday and I have a couple ideas (or starts at ideas, at least) to try to get a backup or OTA update flashed to the device.
I'm busy today, but I'll try and come back and list the stuff I did try, and what progress I make (if any) at some point later this week.

I may try an organize some of those files a little more cleanly. When I grabbed them, I just started dragging and dropping. The mess may be a little hard to navigate. One thing I am still looking for is a firmware I have for a device (HS-X8T). I should have it soon, and I'll add it to the drop. If I recall correctly, that Lenovo A788T device, who's firmware I included in the dump, uses the same processor as well.

No worries on the organization - I can tell what's what for the most part. I played with this a lot yesterday, and was able to get the phone tablet recognized on a Windows machine that I cobbled together, but I couldn't get the Marvell flash program to detect the phone tablet.
The Windows machine I was using totally sucks, so it was painful to try to troubleshoot the issue further. I'm gonna set up a better one this weekend and hopefully learn a little bit more.
Thanks again for providing the files. Maybe with another hundred or so hours of effort we'll be able to save a few people $30, haha.

bxlentpartyon said:
No worries on the organization - I can tell what's what for the most part. I played with this a lot yesterday, and was able to get the phone tablet recognized on a Windows machine that I cobbled together, but I couldn't get the Marvell flash program to detect the phone tablet.
The Windows machine I was using totally sucks, so it was painful to try to troubleshoot the issue further. I'm gonna set up a better one this weekend and hopefully learn a little bit more.
Thanks again for providing the files. Maybe with another hundred or so hours of effort we'll be able to save a few people $30, haha.
Click to expand...
Click to collapse
Any progress? I'm a bit out of my depth but obviously have the same issue. It's not a disaster if this never gets resolved as mentioned but it's always alluring when something is broken that needs fixed like this.

UmpquaRiver said:
Any progress? I'm a bit out of my depth but obviously have the same issue. It's not a disaster if this never gets resolved as mentioned but it's always alluring when something is broken that needs fixed like this.
Click to expand...
Click to collapse
I had played with this quite a bit a couple weeks ago, but I sort of hit a wall. I was able to get the Marvell flash tool that you provided to recognize my tablet and attempt to flash it, but I ended up hitting the exact same error that you were seeing (not super surprising).
After doing some investigation, I think that the error occurs because the flash tool sees that the previous boot had failed, so it considers the tablet to be in an invalid state for flashing. I gathered this from a Marvell document written about a similar SOC to the one used in the tablets in question.
Anyway, at this point, I think this is going to require some more significant hackery to get working. We either need to somehow trick the tool into thinking that the tablet is in a valid state (which may not even work), or we need to somehow get the tablet to write a valid boot state to its NVRAM, which would hopefully achieve the same effect. I'm writing this off the top of my head, so my wording/terminology might not be dead on. The point is, tablets stuck in a boot loop don't appear to want to flash with this tool, at least not without banging on them to some degree.
I haven't given up on this, but I also haven't had any time to work on it recently. I've got some ideas on how to move forward, but they involve tearing apart the flash tool binary and trying to get an idea of how it works, which is apparently fairly difficult on Windows. I'm pretty skilled at this sort of thing on Linux, but there seem to be very few freely available tools for this kind of stuff on Windows, and many of them are clunky, at best... I'm going to try to spend some time on this again sometime soon.

bxlentpartyon said:
I had played with this quite a bit a couple weeks ago, but I sort of hit a wall. I was able to get the Marvell flash tool that you provided to recognize my tablet and attempt to flash it, but I ended up hitting the exact same error that you were seeing (not super surprising).
After doing some investigation, I think that the error occurs because the flash tool sees that the previous boot had failed, so it considers the tablet to be in an invalid state for flashing. I gathered this from a Marvell document written about a similar SOC to the one used in the tablets in question.
Anyway, at this point, I think this is going to require some more significant hackery to get working. We either need to somehow trick the tool into thinking that the tablet is in a valid state (which may not even work), or we need to somehow get the tablet to write a valid boot state to its NVRAM, which would hopefully achieve the same effect. I'm writing this off the top of my head, so my wording/terminology might not be dead on. The point is, tablets stuck in a boot loop don't appear to want to flash with this tool, at least not without banging on them to some degree.
I haven't given up on this, but I also haven't had any time to work on it recently. I've got some ideas on how to move forward, but they involve tearing apart the flash tool binary and trying to get an idea of how it works, which is apparently fairly difficult on Windows. I'm pretty skilled at this sort of thing on Linux, but there seem to be very few freely available tools for this kind of stuff on Windows, and many of them are clunky, at best... I'm going to try to spend some time on this again sometime soon.
Click to expand...
Click to collapse
Any progress on this tablet?
I have the QTAZ3 and it's boot looped

Hello? Sorry plz, i not very good speak eng.. But, Have you made any progress in your search? It's just that there was also a problem that the above tablet simply does not pull version 5.1. So I was redirected here, from the 4PDA site. So I need at least a firmware version 4.4.4. Is there such a..?