Database Info

[ROM] ZTE Grand X View 2 (K81) Root and Stock firmware

Stock firmware
Rogers B05 Firmware
https://www.androidfilehost.com/?fid=1395089523397891291
Separate Firehose download
https://www.androidfilehost.com/?fid=1395089523397891292
ZTE Kernel source mirror (We are codenamed Helen)
https://www.androidfilehost.com/?fid=1395089523397891289
Here is a step by step guide on how to flash the stock rom with QFIL and by extension any image.
Download and install the Qualcomm drivers from here
Download the firmware from above
Extract the firmware to a folder that you can easily access them from like your desktop
Download and install QPST from here
Open the QFIL application (Find it in your start menu)
In the "Select Build Type" field select Flat Build
In the "Select Programmer" field navigate to the folder you extracted the firmware and support files to and select the prog_emmc_firehose_8909.mbn file
Select the "Load XML" button and navigate to the folder you extracted the firmware and support files to and select the rawprogram0.xml and then the patch0.xml when prompted.
Plug in your tablet
Run the following adb command "adb reboot edl" (Now the screen should be blank but the led light should be red)
If the text at the top of the QFIL application says "No Port Available" click the "Select Port..." option and pick your device. If your device isn't showing up there you didn't install the drivers properly.
Click the Download Button to begin flashing your device
So the above explains how to flash everything if you want to flash just boot or recovery use the tool in the 2nd post it is a lot easier

Warning
This is a dangerous tool. It can render your device permanently unusable. If you use it, your warranty will likely be void. You accept all responsibility for the consequences.
Acknowledgments
Special thanks to @tdm for taking the firehose I got and creating the k81tool with it!
Note Well
The first rule of intelligent tinkering is to save all the parts.
Always backup your partitions before writing new contents, so that you can get back to where you started.
Never write both boot and recovery in one session. Always make sure that you can boot into the other partition in case something fails.
Preparation
Download magisks patched boot.img from here.
Download k81tool from here.
Setup your computer.
Setup for Windows
Download zadig.
Boot your device in EDL mode (see below).
Windows will want to install the Qualcomm USB driver. We won't be using it so cancel.
Run zadig. Find device 05c6:9008 and install the WinUSB driver for it.
Reboot your device and rerun steps to go back to EDL mode
Booting in EDL mode
Code:
adb reboot edl
Usage
Code:
k81tool.exe <read|write> <boot|recovery> <filename>
Example:
Code:
k81tool.exe read boot stock-boot.img
Code:
k81tool.exe write boot patched_boot.img
Multiple Operations
This is a "one-shot" tool. After performing an operation, it will reset the device with a 5 second countdown. If you wish to perform multiple operations (eg. backup, flash), simply re-enter EDL mode.
Common Problems
Device was not found
First enter EDL mode, then run the tool.
Device is visible in device manager but cannot be found by the tool.
Connect directly to the PC, not through a hub.
Windows says bad file descriptor
The WinUSB driver is not installed.
Once you flash the patched_boot.img all you need to do is install the magisks manager and you will have root enjoy!
Proof of root:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

Place Holder for TWRP

bad links??
Hi
First, thank-you, thank-you, thank-you x 100. I've been looking for a method to root this device from the day I got it as an add on to my cell plan. Not sure if I am missing something but when I click on the androidfilehost links I get taken to a home page but there is no file to download for all three links. Initially I thought I might have to register so I did that but the links still just take you to the Home advert page Could you update the links when you get a chance - thanks !!
edit - I have a couple of questions -As you have been the first to root the device there are obviously no custom firmware builds available so we stick with stock, correct? We will be able to remove the bloatware on stock because it's rooted though, correct? I also use tasker and the AutoApps suite for automation and I need root for some of my tasks so this is a huge step in the right direction. Lastly in order to root the device do we need to do follow all steps in the first post and then complete the steps in the second post? Or is the second post just a different way to do what was done in post 1? I'm excited to root this so thanks for fixing those links! Thanks again for all your work.

ryanoc75 said:
Hi
First, thank-you, thank-you, thank-you x 100. I've been looking for a method to root this device from the day I got it as an add on to my cell plan. Not sure if I am missing something but when I click on the androidfilehost links I get taken to a home page but there is no file to download for all three links. Initially I thought I might have to register so I did that but the links still just take you to the Home advert page Could you update the links when you get a chance - thanks !!
Click to expand...
Click to collapse
Sorry about that somehow the links broke, I have updated them so now they are proper.

Hey guys. Having a little trouble. I keep on running into "Failed: unknown error" when I try to flash the patched boot.img that was provided. I managed to read the stock boot image with no problems, but writing just runs into this error.
Thoughts?
I am using the Bell variant so I hope that isn't the source of it

Post Root questions
Hi
I'm about to try to root the device, assuming it goes according to plan, can we then install SuperSU? Do we need a TWRP for the device if we want to install another ROM and are there generic ROMS out there that would work on this tablet? Sorry if these are noob questions, I've been an apple jailbreaker for years and just bought and rooted and installed a custom ROM on a Samsung Galaxy S4. I installed a new android tablet NAV in my BMW and I needed a device to act as a hotspot, so I use Tasker and AutoApps with it to automate the process and it works really well. When I rooted the Galaxy S4 there are a ton of ROMS available for every variant so it was easy to follow the instructions. However, this is totally new territory for me. This device isn't nearly as popular so I wondered what options are available to us once we have it rooted?

same issue failed unknown error
Hi
I am using the Rogers K81 and I am encountering the same failed unknown error when I try to write the patched boot file. I also was able to read the firmware file without issue. I rebooted into edl mode and then tried to write the patched file -
NB - for those who have yet to try, move the k81tool.exe and the patched boot file to your c drive and make sure your at the root of c and then remove the B05 in the patch file name so that it can find the file if you are just cutting and pasting the command line instructions above, otherwise you'll get an error that it can't find the file. If the k81tool.exe isn't in the current directory you are in you will get an error saying k81tool.exe is not a known command ..etc.etc. This might seem obvious to some but for those with little command line experience, it will save you from having to post questions about your errors.

There is a product ZTE primetime K92 which is a successor of a ZTE K81.
Do you plan to support root for ZTE Primetime K92?

huaji2333 said:
There is a product ZTE primetime K92 which is a successor of a ZTE K81.
Do you plan to support root for ZTE Primetime K92?
Click to expand...
Click to collapse
A friend of mine has the k92, and currently it has a locked bootloader even with the firehose and all. So he is working to find an exploit to allow it to be unlocked. But no ETA at this time.
Sent from my iPhone using Tapatalk

Thank you for providing this. I have the Virgin Mobile device currently. Just a question before I try this. My past experience with a tablet from Rogers a few years ago was that whenever you put a different sim card in, it would force you to reset the entire device. To get around this, I was lucky that there were other generic firmware available for that device. Does the Rogers firmware that you provide force a reset if you change the sim? I'd ideally like to have the option to change sims when traveling. Thanks.

I own a Virgin Mobile Canada ZTE K81 tablet. As much as I like a rooted device, my goal, if possible, is to replace the Bell firmware with the Rogers firmware. The reason I would want to do this is because Bell has done some nasty things with this tablet. The SIM card is IMEI locked to this tablet, I cannot use the SIM card on anything else. So I decided this tablet could be used as a wifi hotspot. Unfortunately, Bell did something to the firmware to make wifi and bluetooth tethering impossible.
I guess the other question I have is will the IMEI lock still work on this Bell tablet after the Rogers firmware is installed?

wow i didn't think development for this device would've gotten this far already. we're gonna need our own device forum soon
---------- Post added at 12:20 PM ---------- Previous post was at 12:19 PM ----------
bridonca said:
I own a Virgin Mobile Canada ZTE K81 tablet. As much as I like a rooted device, my goal, if possible, is to replace the Bell firmware with the Rogers firmware. The reason I would want to do this is because Bell has done some nasty things with this tablet. The SIM card is IMEI locked to this tablet, I cannot use the SIM card on anything else. So I decided this tablet could be used as a wifi hotspot. Unfortunately, Bell did something to the firmware to make wifi and bluetooth tethering impossible.
I guess the other question I have is will the IMEI lock still work on this Bell tablet after the Rogers firmware is installed?
Click to expand...
Click to collapse
imei locks are independent of the device itself. you need to get the carrier to give you an unlock code

Online Gravy said:
wow i didn't think development for this device would've gotten this far already. we're gonna need our own device forum soon
---------- Post added at 12:20 PM ---------- Previous post was at 12:19 PM ----------
imei locks are independent of the device itself. you need to get the carrier to give you an unlock code
Click to expand...
Click to collapse
I got Bell to IMEI lock the SIM to another, better tablet, a LG G Pad IV 8.0 FHD (LGV533) from Fido. The SIM works perfectly, I can now wifi tether!
That makes it an easier choice to hack at the Bell K81, now that the IMEI lock is not tied to this K81 tablet anymore. If the Bell K81 works with the Rogers firmware, bonus. If it bricks, not the end of the world. My data plan will still work. I just need to find the time to do the hack!

bridonca said:
I got Bell to IMEI lock the SIM to another, better tablet, a LG G Pad IV 8.0 FHD (LGV533) from Fido. The SIM works perfectly, I can now wifi tether!
That makes it an easier choice to hack at the Bell K81, now that the IMEI lock is not tied to this K81 tablet anymore. If the Bell K81 works with the Rogers firmware, bonus. If it bricks, not the end of the world. My data plan will still work. I just need to find the time to do the hack!
Click to expand...
Click to collapse
I have flashed my Bell k81 with Rogers firmware and it works properly.
Sent from my iPhone using Tapatalk

any chance of getting Pie GO installed on this thing, mine lags to even tap and the stock settings leave only 400mb free of ram

I can't successfully flash the rogers firmware on the VM (Bell) device. When the flashing process gets to 'reading through the sparse file' for the userdata.img file, I get an error. The log reads:
{ERROR: sparse_open:1939 Didn't properly read the sparse_header!
If I delete this file as a test (not sure if that was a good idea), it continues on to reading the ddr.img file, but halts again and the error refers to this file being 0 bytes.
I may have missed a step. When is the kernel file used? Is the Rogers firmware file complete?

s_021 said:
I can't successfully flash the rogers firmware on the VM (Bell) device. When the flashing process gets to 'reading through the sparse file' for the userdata.img file, I get an error. The log reads:
{ERROR: sparse_open:1939 Didn't properly read the sparse_header!
If I delete this file as a test (not sure if that was a good idea), it continues on to reading the ddr.img file, but halts again and the error refers to this file being 0 bytes.
I may have missed a step. When is the kernel file used? Is the Rogers firmware file complete?
Click to expand...
Click to collapse
Delete DDR as well and any of the ones it complains about that are empty. When I have sometime I'll upload a new package with those removed.

Decided to try the k81tool to just root instead, but I'm getting the same Failed:unknown error as others have posted.
(Using VM stock firmware)
---------- Post added at 11:20 PM ---------- Previous post was at 11:14 PM ----------
If you put in a Rogers sim, does it attempt to do a hard reset or just the usual reboot?
thanks
deadman96385 said:
I have flashed my Bell k81 with Rogers firmware and it works properly.
Sent from my iPhone using Tapatalk
Click to expand...
Click to collapse

deadman96385 said:
Delete DDR as well and any of the ones it complains about that are empty. When I have sometime I'll upload a new package with those removed.
Click to expand...
Click to collapse
Deleting the files also fails. The error is {ERROR: handleProgram:8615 'ddr.img' not found. You could possibly try --notfiles=ddr.img,OtherFileToSkip.bin (note, exiting since you specified --noprompt)
Adding back ddr.img, the error is
{ERROR: handleProgram:8666 Filesize is 0 bytes. This is usually a mistake!! Please check 'C:\ZTE\rogers\ddr.img'

Question Lenovo phab plus pb1-770m dead

Hello every body
I need your help
My tab appeare blue screen then stopeed work
It now dead
No chareg led
Not open
I try download firmware but having error i sahara
I try tool studio it start to download but stop at 8% as cannot find valid disk
I found program deal with dead qualcomm but neeed firmware in zip and stock .
Please help me
Thanks

Process Index:0
Programmer Path:F:\770\PB1-770M_USR_S000165_1605050132_Q2043_YAMADA\PB1-770M_USR_S000165_1605050132_Q2043_YAMADA\prog_emmc_firehose_8936.mbn
Image Search Path:F:\770\PB1-770M_USR_S000165_1605050132_Q2043_YAMADA\PB1-770M_USR_S000165_1605050132_Q2043_YAMADA
Please select the XML file
Start Download
Program Path:F:\770\PB1-770M_USR_S000165_1605050132_Q2043_YAMADA\PB1-770M_USR_S000165_1605050132_Q2043_YAMADA\prog_emmc_firehose_8936.mbn
COM Port number:3
Sahara Connecting ...
Sahara Version:2
Start Sending Programmer
Sending Programmer Finished
Switch To FireHose
Max Payload Size to Target:49152 Bytes
Device Type:eMMC
Platform:8x26
Disable Ack Raw Data Every N Packets
Ack Raw Data:False
Skip Write:False
Always Validate:False
Use Verbose:False
COM Port number:3
Sending NOP
NOP: Fail Code: 9
Unable to send FireHose NOP, Device is not in Firehose mode !
Download Fail:System.Exception: Failed to send Firehose NOP to the phone.
at QC.QMSLPhone.Phone.QPHONEMS_FireHoseNOP()
at QC.SwDownloadDLL.SwDownload.FireHoseDownloadImage(Boolean bResetPhone, List`1 rawprogramFilesList, List`1 patchFilesList, Single& fImageSizeInMB, Single& fThroughput)
Download Fail:FireHose Fail FireHose Fail
Finish Download

kedamsa said:
Hello every body
I need your help
My tab appeare blue screen then stopeed work
It now dead
No chareg led
Not open
I try download firmware but having error i sahara
I try tool studio it start to download but stop at 8% as cannot find valid disk
I found program deal with dead qualcomm but neeed firmware in zip and stock .
Please help me
Thanks
Click to expand...
Click to collapse
Hello kedamsa.
Mee too got this blue screen... its blinking sometimes blue screen and turns off.
Have you manage to fix your phone?

overwhelmed

I would recommend trying the open source edl tool (https://github.com/bkerler/edl) and flash partitions one by one.

I warmed up the CPU to 150-200C:
* now current ok (1000-1100 mA)
* and charge screen works!
But the processor gets unusual hot while screen is on

JohnJr4 said:
I warmed up the CPU to 150-200C:
* now current ok (1000-1100 mA)
* and charge screen works!
But the processor gets unusual hot while screen is on
Click to expand...
Click to collapse
You might have those earlier rev PHAB Plus which overheated?

CalyxOS

Hi All,
Just want to make everyone aware that CalyxOS is available for the Pixel 5. It has a lot to offer for anyone security or privacy-focused.
MicroG is baked right in and is actually part of the setup process. I've been running this ROM for weeks and it runs flawlessly.
calyxos.org

WaxysDargle said:
Hi All,
Just want to make everyone aware that CalyxOS is available for the Pixel 5. It has a lot to offer for anyone security or privacy-focused.
MicroG is baked right in and is actually part of the setup process. I've been running this ROM for weeks and it runs flawlessly.
calyxos.org
Click to expand...
Click to collapse
microg did not work for me..maybe they will fix that on the next update.

vinicioh23 said:
microg did not work for me..maybe they will fix that on the next update.
Click to expand...
Click to collapse
you have to dial *#*#CHECKIN#*#* on the dialer and then reboot to activate microg push notifications.

Hi, I would love to use calyxos on my Pixel 5 but on flashing it keeps saying that there is no space on the device to extract system.img:
extracting product.img (1008 MB) to disk...ziparchive W 11-13 12:05:40 2186 2186 Zip: unable to write 32768 bytes to file; No space left on device fastboot: error: failed to extract 'product.img': I/O error
What shoudl I do?

TheOriginalDude said:
Hi, I would love to use calyxos on my Pixel 5 but on flashing it keeps saying that there is no space on the device to extract system.img:
extracting product.img (1008 MB) to disk...ziparchive W 11-13 12:05:40 2186 2186 Zip: unable to write 32768 bytes to file; No space left on device fastboot: error: failed to extract 'product.img': I/O error
What shoudl I do?
Click to expand...
Click to collapse
Someone helped me in another forum: the parameter TMPDIR (capital letters) should point to a folder with more than 3 GB of memory. Then, the flasher will work.

How To Guide [ADVANCED] [UNTESTED] Possible Fix - MSM Errors (Sahara, Param info, etc)

WARNING: THE FOLLOWING IS FOR INFORMATIONAL PURPOSES ONLY AND MAY FURTHER DAMAGE YOUR DEVICE. EXERCISE EXTREME CAUTION. USE ONLY AS A LAST RESORT.​
This was tested with a Global OnePlus 9 LE2115
Overview​
So I was encountering an error with MSM Download Tool that would show "Sahara communication failed" after about 18 seconds. This resulted in me being 100% unable to recover my device with MSM as it was continuously rebooting into EDL mode with no possibility of entering fastboot.
After much research, I stumbled upon a solution completely by accident. I was able to fix the issue by utilizing the following tools:
Qualcomm Sahara Tools - https://github.com/bkerler/edl
Oppo/OnePlus Decryption Tools - https://github.com/bkerler/oppo_decrypt
You need:
- Latest version of Python 3
- C/C++ build tools (gcc, Visual Studio, XCode) to build pip dependencies
- Dependencies installed using pip as specified in README.md of each repo
- Linux or macOS (Windows untested)
- *.ops file from your corresponding MSM Download Tool package
Process​
Follow the instructions contained within the README of the above repos to download all files and install dependencies before continuing.​
Spoiler: Extract ops package
Use opscrypto.py to extract the ops file you obtained earlier.
This results in a directory full of the decrypted contents of the update image (a collection of bin, img, and other files):
Code:
$ ./opscrypto.py decrypt lemonade_xxxx.ops
This creates an extract directory containing the decrypted files
Spoiler: Flash using edl.py
The wl subcommand for edl.py can then be used to write the aforementioned partitions.
The documentation describes the command thusly:
Code:
./edl.py wl dumps --memory=ufs >> to write all files from "dumps" folder to according partitions to flash and try to autodetect lun
I ran the command on the extract directory that was previously decrypted.
Additionally, I had to explicitly specify the OP9 EDL loader as well as specify that the flash memory was UFS and not EMMC:
Code:
$ sudo ./edl.py wl extract --memory=ufs --loader=Loaders/oneplus/0000000000514d67_a26bc25799770106_fhprg_op9.bin
This output was produced:
Code:
main - Using loader Loaders/oneplus/0000000000514d67_a26bc25799770106_fhprg_op9.bin ...
main - Waiting for the device
...............
.main - Device detected :)
main - Mode detected: sahara
Device is in EDL mode .. continuing.
sahara -
------------------------
HWID: <CLIPPED>
CPU detected: "lahaina"
PK_HASH: <CLIPPED>
Serial: <CLIPPED>
sahara - Uploading loader Loaders/oneplus/0000000000514d67_a26bc25799770106_fhprg_op9.bin ...
Successfully uploaded programmer :)
firehose - Chip serial num: <CLIPPED>
firehose - Supported Functions: program,read,nop,patch,configure,setbootablestoragedrive,erase,power,firmwarewrite,getstorageinfo,benchmark,emmc,ufs,fixgpt,getsha256digest
firehose -
firehose_client - Target detected: lahaina
firehose - TargetName=
firehose - MemoryName=UFS
firehose - Version=
firehose_client - Supported functions:
-----------------
program,read,nop,patch,configure,setbootablestoragedrive,erase,power,firmwarewrite,getstorageinfo,benchmark,emmc,ufs,fixgpt,getsha256digest
firehose -
Reading from physical partition 0, sector 8, sectors 1
Progress: |██████████████████████████████████████████████████| 100.0% Complete
Progress: |██████████████████████████████████████████████████| 100.0% Complete
oneplus - Oneplus protection with prjid 19825 detected
Writing ./param.bin to partition param.
firehose -
Writing to physical partition 0, sector 8, sectors 256
Writing ./persist.img to partition persist.
firehose -
Writing to physical partition 0, sector 2056, sectors 8192
Writing ./misc.bin to partition misc.
firehose -
Writing to physical partition 0, sector 10248, sectors 256
Writing ./frp.bin to partition frp.
firehose -
Writing to physical partition 0, sector 10632, sectors 128
Writing ./carrier.img to partition carrier.
QCSparse - Sparse Format detected. Using unpacked image.
firehose -
Writing to physical partition 0, sector 18440, sectors 12288
Writing ./opluslog.img to partition opluslog.
QCSparse - Sparse Format detected. Using unpacked image.
firehose -
Writing to physical partition 0, sector 34824, sectors 65536
Writing ./metadata.img to partition metadata.
firehose -
Writing to physical partition 0, sector 108616, sectors 4096
Writing ./super.img to partition super.
QCSparse - Sparse Format detected. Using unpacked image.
firehose -
Writing to physical partition 0, sector 145480, sectors 1
Writing ./userdata.img to partition userdata.
QCSparse - Sparse Format detected. Using unpacked image.
firehose -
Writing to physical partition 0, sector 2877512, sectors 2105
Writing ./ocdt.bin to partition ocdt.
firehose -
Writing to physical partition 3, sector 576, sectors 32
Writing ./oplusreserve2.img to partition oplusreserve2.
QCSparse - Sparse Format detected. Using unpacked image.
firehose -
Writing to physical partition 4, sector 6, sectors 32768
Writing ./devinfo.bin to partition devinfo.
firehose -
Writing to physical partition 4, sector 722224, sectors 1
Writing ./apdp.mbn to partition apdp.
firehose -
Writing to physical partition 4, sector 722481, sectors 4
Writing ./storsec.mbn to partition storsec.
firehose -
Writing to physical partition 4, sector 817779, sectors 6
Writing ./mdcompress.mbn to partition mdcompress.
firehose -
Writing to physical partition 4, sector 826302, sectors 12
Writing ./spunvm.bin to partition spunvm.
firehose -
Writing to physical partition 4, sector 831486, sectors 87
Writing ./rtice.mbn to partition rtice.
firehose -
Writing to physical partition 4, sector 839678, sectors 65
Writing ./abl_log.bin to partition abl_log.
firehose -
Writing to physical partition 4, sector 839870, sectors 4048
Writing ./android_log.bin to partition android_log.
firehose -
Writing to physical partition 4, sector 847966, sectors 4048
Writing ./qsee_log.bin to partition qsee_log.
firehose -
Writing to physical partition 4, sector 852014, sectors 4048
Writing ./hyp_log.bin to partition hyp_log.
firehose -
Writing to physical partition 4, sector 856062, sectors 4048
Conclusion​After performing the above on a macOS device, the device successfully flashed in MSM on Windows 11.
I rebooted the device prior to attempting to flash after performing the above steps.
Addendum​This isn't a foolproof guide and may not even work for your device or may even damage it further.​The process described above is somewhat advanced and very much undocumented and unsupported/unofficial/hacky.​
I cannot vouch for the quality, security or effectiveness of the tools linked above.
I'm putting this out there in hopes it helps others and to gather more information about how MSM Download Tool and EDL mode actually work.
Please let me know if this solves any issues with MSM and I can potentially produce a guide if this method is proven safe.
Spoiler: Speculation / Thoughts
Firehose appears to be an executable elf file that is ran on the device, which then parses settings.xml and provision_*.xml contained within the ops file.
These files appear to contain the directives that allow MSM to recover bricked devices.
MSM appears to transmit these XML files to the firehose executable after loading it on the device.
These files reference the stock images, partition sizes, names, and extents that firehose then uses to provision the device.
Since firehose is simply an elf file that appears to rely on some preexisting data to be present on the device, some bricks may cause firehose to fail due to corruption of certain partitions.
Producing errors such as:
- Device mismatch
- Param preload error
- Sahara communication failure
- Waiting for device
- Waiting for COM port
The partitions shown in the output log appear to not be touched by MSM prior to sending firehose to the device, suggesting that it assumes they have been untouched.
Therefore, firehose may throw an error or fail to run entirely when attempting to recover some devices, even when using the correct MSM tool and drivers.
Despite being contained in the ops file, MSM doesn't appear to touch these partitions in its default Upgrade Mode.
That functionality may be locked behind more advanced modes such as SMT Download Mode, however, that mode is well known for causing more issues than it solves.
The tools above are open source reverse engineering tools that can do some rudimentary communication with OnePlus devices in EDL mode by utilizing a custom firehose binary (known as the "loader").
These appear to permit operations not possible with MSM's default behavior.
Spoiler: Observations
I was only able to get the edl.py tool to work on macOS.
I was unable to get this tool (edl.py) to work in Windows. It threw various libusb related errors despite using zadig as directed.
I observed that writing to any partition that was part of A/B dynamic partitioning would report that it was written successfully but in reality would only write 1 sector of the provided file.
However, a handful of other partitions appear to be writable, ones that typically can't be written to/aren't written with fastbootd or OTA side loading.
My IMEI and Serial Number were fully intact after flashing.

Bruh my pro was in that constant reboot state. Buss laugh if this is a Tually a fix for that
Click to expand...
Click to collapse
Hopefully it is. I'm curious to see if it works for others. I stumbled upon this right as I had given up and submitted a ticket to OnePlus.
At which point they said there's nothing to do and the device needed repaired.
So hopefully this is a reliable fix for devices that are super-bricked, because it saved me from having to send my device in.

Op9 was there all except I could always get to fastboot by pressing all buttons and hold until off and back on fb ,also several times monfrios all in one would read it dump and could reboot to fastboot .lol thanks again mon ,and I do some dumb junk to mine trying to get 5g on att all the time eventually I may need this .thanks in advanced for your efforts and interest .

Jessp4046 said:
Op9 was there all except I could always get to fastboot by pressing all buttons and hold until off and back on fb ,also several times monfrios all in one would read it dump and could reboot to fastboot .lol thanks again mon ,and I do some dumb junk to mine trying to get 5g on att all the time eventually I may need this .thanks in advanced for your efforts and interest .
Click to expand...
Click to collapse
This may be a solution to a problem that isn't all that widespread.
I found myself in this situation after flashing an Android 12 GSI to my device which involved mucking around with stuff I probably shouldn't have touched.
I've used MSM many times while experimenting but this time I really messed up and was out of options.
Amazingly, I stumbled across the tools above and was able to bumble my way to a solution. This took me about 4 days to resolve as the device refused to enter fastboot.

GlitterFartzz said:
This may be a solution to a problem that isn't all that widespread.
I found myself in this situation after flashing an Android 12 GSI to my device which involved mucking around with stuff I probably shouldn't have touched.
I've used MSM many times while experimenting but this time I really messed up and was out of options.
Amazingly, I stumbled across the tools above and was able to bumble my way to a solution. This took me about 4 days to resolve as the device refused to enter fastboot.
Click to expand...
Click to collapse
This is exactly what cause mine to loop. I tried flashing a 12 GSI lol

Jhoopes517 said:
This is exactly what cause mine to loop. I tried flashing a 12 GSI lol
Click to expand...
Click to collapse
I was actually able to get the GSI to boot, albeit with no cellular, fingerprint, etc. OP9 claims to be treble-compliant in the props but methinks that's a total lie.

I m waiting here
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

flameteam said:
I m waiting here
View attachment 5364413
Click to expand...
Click to collapse
Looks like you're trying to do a full dump of LUN 0 into a single bin file. LUN 0 contains a large chunk of data as it houses the super partition and the userdata partition.
I would recommend using the r subcommand to dump individual partitions or just use rl which will dump your whole device while neatly separating each partition into individual files.
To see exactly what each LUN is comprised of, you can use the printgpt command:
Code:
./edl.py printgpt --memory=ufs
Given that you're running in a VM, your I/O speeds are likely much lower.
I recommend at least booting into a Linux Live USB to do this.
If security is a concern, at a minimum I would recommend vfio passthrough via QEMU to pass your entire USB controller through from a Linux host.
IMO, virtualizing the USB connection will kill your throughput and put you at risk of data corruption.

GlitterFartzz said:
I was actually able to get the GSI to boot, albeit with no cellular, fingerprint, etc. OP9 claims to be treble-compliant in the props but methinks that's a total lie.
Click to expand...
Click to collapse
I couldn't this time. I was able to prior but no go.

my one plus 8t is completely hard bricked, black screen, no logo, no vibration, nothing. Now i cant use msm cuz always got sahara communication failed. This seems like the way to go, will update you if it works

Help me guys. I can't access anything and it's saying Sahara Comm. error at 18 sec. I tried this on Windows and Linux but it does not work........ It gives me this:
File "opscrypto.py", line 160
self.info = print
^
SyntaxError: invalid syntax

_MartyMan_ said:
Help me guys. I can't access anything and it's saying Sahara Comm. error at 18 sec. I tried this on Windows and Linux but it does not work........ It gives me this:
File "opscrypto.py", line 160
self.info = print
^
SyntaxError: invalid syntax
Click to expand...
Click to collapse
same here! oneplu 9 chinese version model 2110, screen its just black, but computer detects it.
thanks in advance

Kind of progress but still does not work... I get this error message:
Somebody help pls.......
@GlitterFartzz do you have any idea what this could be?

I have tried everything to get my Global one plus 9 back up and running again … monster what I do with drivers I get this error on msm tool . As you can see my phone is detected in tool but can put go past this point . I do not have access to download or fast or mode . Last steps I took was through this thread ——https://forum.xda-developers.com/t/fastboot-rom-pc-required-op9-stock-oos-11-2-2-2aa.4275727/—— and reached 1/2 way point (waiting on device) and now I can’t get oos back on phone .. does anyone have any tips or knowledge they can guide me to get my phone working with msm tool ? Much appreciated

Toggle on "Use lite Firehose" before running

Thanks shooter7889 , got past the SMT error by setting date back 2 years on laptop and turning Wi-Fi off. Now i am getting the Sahara error after 18 sec and if I toggle use lite firehouse i get the PARAM error after 8 sec. I have tried to follow steps on the READ ME section (advanced GitHub page )but i dont have any experience with the process as shown. Is it possible to get a easy step guide that can be put together to get past the Sahara error? for us less advanced members? Anything helps at this point. phone is a brick , only thing i can get into is EDL mode .

Justingaribay7 said:
Thanks shooter7889 , got past the SMT error by setting date back 2 years on laptop and turning Wi-Fi off. Now i am getting the Sahara error after 18 sec and if I toggle use lite firehouse i get the PARAM error after 8 sec. I have tried to follow steps on the READ ME section (advanced GitHub page )but i dont have any experience with the process as shown. Is it possible to get a easy step guide that can be put together to get past the Sahara error? for us less advanced members? Anything helps at this point. phone is a brick , only thing i can get into is EDL mode .
Click to expand...
Click to collapse
Mate what's your device model ? If you device model LE2113 flash https://androidfilehost.com/?fid=2188818919693804750 9pro eu msm rom. and after ınstallation flash op9 https://drive.google.com/drive/folders/1R_j8sML_46YrTp1HGfpS6zrAUeFl8uJU?usp=sharing

This is a great resource to have, nice work. I'll give it a go if I ever hit that state again. I've only had success using the pro msm tools up to this point for some reason with lite firehose when I get the Sahara or param info device not match error. Once I've lite msmed with the pro tool, I can normal msm with the nonpro tool, just like flame team mentioned

flameteam said:
Mate what's your device model ? If you device model LE2113 flash https://androidfilehost.com/?fid=2188818919693804750 9pro eu msm rom. and after ınstallation flash op9 https://drive.google.com/drive/folders/1R_j8sML_46YrTp1HGfpS6zrAUeFl8uJU?usp=sharing
Click to expand...
Click to collapse
Thanks for the reply flameteam . My device is LE2115 Global . Would this method still work on this Version?

I tried running the Eu tool . No luck . Same errors as the O2 tool . Tried different flash options such as light firehouse on and off .. Sahara error and Parameters error still present

GSI on V60

has anyone installed any kind of GSI or custom rom on the V60 ?
here are some roms for those who looking to test on the v60.
Generic System Image (GSI) list
Notes about tinkering with Android Project Treble. Contribute to phhusson/treble_experimentations development by creating an account on GitHub.
github.com
Device support (Project Treble)
harvey186 I see that you seem to know a lot. I installed a generic a/b treble image on my pixel 3a sargo. It works fine. but it says the base image is months out of date. How can I manually upgrade it?
community.e.foundation
Treble-Enabled Device Development A/AB ROMS
Treble-Enabled Device Development A/AB ROMS
forum.xda-developers.com

I just learned that the V60 tmobile variant has no vendor or system or product partition. I has a super partition which seems to have system and vendor combined. can someone confirm this and if so how do we flash a GSI to the V60?

heres a video that might help use get some GSI on our newer dynamic partitions

i manged to flash 3 different gsi roms only 2 booted, but never entered android environment

Finally got GSI installed on v60 so snappy and no bloated ware. everything seems to work except no audio over bluetooth

blaze2051 said:
Finally got GSI installed on v60 so snappy and no bloated ware. everything seems to work except no audio over bluetooth
Click to expand...
Click to collapse
Wondering if you've used any Bkerler edl utilities on the V60? If so do you have a working copy of the v60 "loader". This is of course just the v60 firehose renamed.

hooutoo said:
Wondering if you've used any Bkerler edl utilities on the V60? If so do you have a working copy of the v60 "loader". This is of course just the v60 firehose renamed.
Click to expand...
Click to collapse
i couldnt get it to work on my v60

blaze2051 said:
i couldnt get it to work on my v60
Click to expand...
Click to collapse
Was this the error you got?????? The important part is at the end. The loader (firehose) it can't upload is the one provided by Bkerler.
edl$ edl printgpt --memory=ufs --lun=0 --loader=000c30e100310000_e746e34f737403f4_fhprg.bin
Capstone library is missing (optional).
Keystone library is missing (optional).
Qualcomm Sahara / Firehose Client V3.53 (c) B.Kerler 2018-2021.
main - Using loader 000c30e100310000_e746e34f737403f4_fhprg.bin ...
main - Waiting for the device
......
main - Hint: Press and hold vol up+dwn, connect usb. For some, only use vol up.
main - Xiaomi: Press and hold vol dwn + pwr, in fastboot mode connect usb.
Run "./fastpwn oem edl".
main - Other: Run "adb reboot edl".
...............
....main - Device detected
main - Mode detected: sahara
Device is in EDL mode .. continuing.
sahara -
------------------------
HWID: 0x000c30e100310000 (MSM_ID:0x000c30e1,OEM_ID:0x0031,MODEL_ID:0x0000)
CPU detected: "SM8250:CD90-PH805-1A"
PK_HASH: 0xe746e34f737403f40212cf29f0c0cab9f1038aa8bce6c097e82cc93213020edb
Serial: 0xff08b1ae
sahara - Uploading loader 000c30e100310000_e746e34f737403f4_fhprg.bin ...
sahara
sahara - [LIB]: [Errno 2] No such file or directory: '000c30e100310000_e746e34f737403f4_fhprg.bin'

blaze2051 said:
Finally got GSI installed on v60 so snappy and no bloated ware. everything seems to work except no audio over bluetooth
Click to expand...
Click to collapse
can you link the gsi rom

FernSal said:
can you link the gsi rom
Click to expand...
Click to collapse
the link is provided

hooutoo said:
Was this the error you got?????? The important part is at the end. The loader (firehose) it can't upload is the one provided by Bkerler.
edl$ edl printgpt --memory=ufs --lun=0 --loader=000c30e100310000_e746e34f737403f4_fhprg.bin
Capstone library is missing (optional).
Keystone library is missing (optional).
Qualcomm Sahara / Firehose Client V3.53 (c) B.Kerler 2018-2021.
main - Using loader 000c30e100310000_e746e34f737403f4_fhprg.bin ...
main - Waiting for the device
......
main - Hint: Press and hold vol up+dwn, connect usb. For some, only use vol up.
main - Xiaomi: Press and hold vol dwn + pwr, in fastboot mode connect usb.
Run "./fastpwn oem edl".
main - Other: Run "adb reboot edl".
...............
....main - Device detected
main - Mode detected: sahara
Device is in EDL mode .. continuing.
sahara -
------------------------
HWID: 0x000c30e100310000 (MSM_ID:0x000c30e1,OEM_ID:0x0031,MODEL_ID:0x0000)
CPU detected: "SM8250:CD90-PH805-1A"
PK_HASH: 0xe746e34f737403f40212cf29f0c0cab9f1038aa8bce6c097e82cc93213020edb
Serial: 0xff08b1ae
sahara - Uploading loader 000c30e100310000_e746e34f737403f4_fhprg.bin ...
sahara
sahara - [LIB]: [Errno 2] No such file or directory: '000c30e100310000_e746e34f737403f4_fhprg.bin'
Click to expand...
Click to collapse
i dont remember exactly, basically it says device detected but it cant load the firehose file or non found something like that

blaze2051 said:
the link is provided
Click to expand...
Click to collapse
i meant the specific rom that worked for you

FernSal said:
i meant the specific rom that worked for you
Click to expand...
Click to collapse
https://images.ecloud.global/dev/treble_arm64_bvN/IMG-e-0.19-q-20211027142973-dev-treble_arm64_bvN.zip

blaze2051 said:
https://images.ecloud.global/dev/treble_arm64_bvN/IMG-e-0.19-q-20211027142973-dev-treble_arm64_bvN.zip
Click to expand...
Click to collapse
thanks bro i appreciate it

blaze2051 said:
Finally got GSI installed on v60 so snappy and no bloated ware. everything seems to work except no audio over bluetooth
Click to expand...
Click to collapse
I have lg v60 a12 and i downloaded elixir gsi when i flash in fastboot it shows error like no partition found. Can you help me

Naziraslam88 said:
I have lg v60 a12 and i downloaded elixir gsi when i flash in fastboot it shows error like no partition found. Can you help me
Click to expand...
Click to collapse
you were not in the correct fastboot, you need to type "fastboot reboot fastboot"