Related
Hello there, for anyone with a Hipstreet FLARE (HS-9DTB4) who has had the nightmare of trying to find a ROM for it, I have a solution!
These models typically come from Canada, like myself, although I don't know if it's exclusive. I spent many hours modding operating system files when I almost accidently came up with a MUCH easier solution.
This instructional assumes you have installed your USB drivers and have a copy of ADB
1: BACK UP YOUR ROM
(if you're like me and you lost the original you can probably skip this)
2: Follow the instructions at A13 ROM JB 4.2.2 + DRIVERS and install FaaastJB v2.5 (4.2.2).
Once installed, your touchscreen and gsensor will NOT work
3: Download the TS driver from the installation link: - ft5x_ts, goodix_ts, gslX680, nt11003+mxc32x0
4: Unzip the file to your ADB directory
5: Open the file 'setupsensors.sh'
Remove this line: insmod /system/vendor/modules/mxc32x0.ko
6: Insert this:
Code:
#9inch
insmod /system/vendor/modules/ft5x_ts.ko
insmod /system/vendor/modules/goodix_ts.ko
insmod /system/vendor/modules/nt11003.ko
# insmod /system/vendor/modules/ssd253x_ts.ko
# insmod /system/vendor/modules/ssd2533_ts.ko
insmod /system/vendor/modules/gslX680.ko
#7inch
# insmod /system/vendor/modules/gt811.ko
# insmod /system/vendor/modules/gsl1680.ko
# insmod /system/vendor/modules/ssd253x_ts.ko
# insmod /system/vendor/modules/sitronix_ts.ko
# insmod /system/vendor/modules/pixcir_touch_811.ko
# insmod /system/vendor/modules/gslX680.ko
#insmod G-sensor driver
insmod /system/vendor/modules/mma7660.ko
# insmod /system/vendor/modules/mecs.ko
# insmod /system/vendor/modules/mxc622x.ko
# mkdir /data/misc/sensors 0777 system system
-- Loading these modules into other A13 ROM is possible but I couldn't for the life of me get the WIFI working (properly), except in FaaastJB.
7: Connect your Hipstreet FLARE via USB and execute the 'run.bat' that came with the TS modules.
8: Enjoy having Google Play on your (crappy) Hipstreet Flare
Not sure if I like the new launcher, but thanks for pointing me toward the newer faastjb.. dunno if I like the bootscreen either..
ANYHOW.. In the past, on my Hipstreet Flare, I was using the gt_828 ? driver.. and it seemed to work, however, I never bothered getting the sensors working/etc.. However I would like the camera to work, and, it doesn't seem to with these drivers / this rom .. (crashes when opening cam app)
Mucho thanks for posting the drivers to use with the Flare, touch and gsensors seem to be working fine.
And many thanks to Toxicro for making the rom etc !
As a newbie to flashing android, I thought I might point out that when you edit the 'setupsensors.sh' file, do NOT use notepad.
Notepad++ seems to work fine (it is compatible with this file format).
I used Livesuit 2 to flash, and did have trouble getting the driver to load. Best I could get was a USB - unknown device showing in device manager.. but from there it was easy enough to argue with Win7 and finally manage to manually point to the Livesuit/driver folder.
One thing I noticed, is that you can still get into a recovery mode with FAAST-JB.
In the stock Flare, from power off, you hold the Vol- and Power until the unit responds, then start pressing Power repeatedly (while holding Vol-). With Faast-JB loaded, you have to hold the Vol+ instead (since the keys are reversed in the flash, no biggie).
This now brings up a CWM recovery screen.
I would think that Backup and Restore probably work fine.
But what about "Install zip from sd card" ?
Would this work for further flashing, or would that not be recommended due to the odd structure of these A10/13 devices ?
Any original rom to Hipstreet FLARE HS-9DTB4-4GB
Dave
Thanks a lot, first i use notepad to edit and G-sensor dont go... now user notepad++ y i am back the g-sensor.
However, i lost the camera i read about edit some BIN file, mi tablet is a oldie Hipstreet FLARE HS-9DTB4-4GB without Google Play, i flashing to get this market and now have the problem, i need solve the camera problem or almost get the original ROM to this model .
* what program edit script.bin??
Thanks again
DaveCarp said:
Mucho thanks for posting the drivers to use with the Flare, touch and gsensors seem to be working fine.
And many thanks to Toxicro for making the rom etc !
As a newbie to flashing android, I thought I might point out that when you edit the 'setupsensors.sh' file, do NOT use notepad.
Notepad++ seems to work fine (it is compatible with this file format).
I used Livesuit 2 to flash, and did have trouble getting the driver to load. Best I could get was a USB - unknown device showing in device manager.. but from there it was easy enough to argue with Win7 and finally manage to manually point to the Livesuit/driver folder.
One thing I noticed, is that you can still get into a recovery mode with FAAST-JB.
In the stock Flare, from power off, you hold the Vol- and Power until the unit responds, then start pressing Power repeatedly (while holding Vol-). With Faast-JB loaded, you have to hold the Vol+ instead (since the keys are reversed in the flash, no biggie).
This now brings up a CWM recovery screen.
I would think that Backup and Restore probably work fine.
But what about "Install zip from sd card" ?
Would this work for further flashing, or would that not be recommended due to the odd structure of these A10/13 devices ?
Click to expand...
Click to collapse
Please, can you send me the file. I got bootloop in every variant. I flashed tousends times.
Thanks!
Edit: Sorry, I quoted wrong post.
HipStreet Flare 1 working firmware 95%
HS 9dtb4-8GB Hipstreet Flare (1) running on
MaPan_MX913_DC_Jelly_Bean_4.1os_Root_
Firmware_D201 30601_UP
Only missing top inch of TS, looking here about injecting just the TS driver, or can someone tell me how to ajust my TS touching surface.
Hi.
I'll teach right now how to get ANY USB DEVICE working in iNew V1.
Maybe this works for another MTK6582 devices... I don't know. Try it. The worse that can happens is an enormous amount of nothing, nothing at all...
Firstly I must say that I'm not responsible for damages in your devices.
If you do this way, all gonna be ok.
1- Root your device using KingRoot app (google it)
2- Using an app of your preference, add the following lines into the given files
In this file: /system/etc/permissions/android.hardware.usb.host.xml
Add these lines:
<permissions>
<feature name="android.hardware.usb.host" />
</permissions>
In file: /system/etc/permissions/handheld_core_hardware.xml
Add this line:
<feature name="android.hardware.usb.host" />
3- Reboot your device.
4- Buy an OTG Y CABLE, or do yourself one (as I did, very very very easy). There's so much DIY tutorials. (google it too)
https://encrypted-tbn3.gstatic.com/...kjVfRSRaow08v6j-Z9OpLvpUm3x6ok1WWIntw02m5NObA
iNew V1 comes with a kernel that supports OTG. That's the point... There is no necessary compile another kernel.
Worked for me, I can ensure to you.
Adriano-A3 said:
Hi.
I'll teach right now how to get ANY USB DEVICE working in iNew V1.
Maybe this works for another MTK6582 devices... I don't know. Try it. The worse that can happens is an enormous amount of nothing, nothing at all...
Firstly I must say that I'm not responsible for damages in your devices.
If you do this way, all gonna be ok.
1- Root your device using KingRoot app (google it)
2- Using an app of your preference, add the following lines into the given files
In this file: /system/etc/permissions/android.hardware.usb.host.xml
Add these lines:
<permissions>
<feature name="android.hardware.usb.host" />
</permissions>
In file: /system/etc/permissions/handheld_core_hardware.xml
Add this line:
<feature name="android.hardware.usb.host" />
3- Reboot your device.
4- Buy an OTG Y CABLE, or do yourself one (as I did, very very very easy). There's so much DIY tutorials. (google it too)
https://encrypted-tbn3.gstatic.com/...kjVfRSRaow08v6j-Z9OpLvpUm3x6ok1WWIntw02m5NObA
iNew V1 comes with a kernel that supports OTG. That's the point... There is no necessary compile another kernel.
Worked for me, I can ensure to you.
Click to expand...
Click to collapse
But there is no file named handheld_core_hardware.xml present in /system/etc/permissions/
Description
File patcher to enable signature spoofing on Android (especially useful for projects like microG).
Success rate is now near 100%.
Download
Tingle (git version)
NOTE: Currently there isn't yet any release, only the git version.
Credits
@moosd (thanks for Needle)
@MaR-V-iN (thanks for the help)
@AnonVendetta (thanks for testing)
@Aaren11 (thanks for testing)
@ChristianTC (thanks for testing)
@_Kosmas_ (thanks for testing)
XDA:DevDB Information
[TOOL] Tingle - Android patcher, Tool/Utility for all devices (see above for details)
Contributors
ale5000
Source Code: https://github.com/ale5000-git/tingle
Version Information
Status: Testing
Created 2016-08-13
Last Updated 2017-11-04
Reserved
Reserved
@ale5000: I got the patch to work, I had to deodex my system APKs and JARs. Then I applied the patch. Everything works so far.
However, on a friend's LG D415 running 5.1.1 SlimROM, it fails. Phone still boots but MicroG says signature spoofing isn't enabled. Will post a log later.
Edit: I meant to say that my friend is running SlimROM v6.0.1 Marshmallow, not v5.1.1 Lollipop.
I also just tested your patch on my Galaxy Tab 2 7.0 (SM-P3113) running SlimROM 5.1.1. The patch works flawlessly. But I had to deodex it too. My friend's phone is already deodexed, not sure why it didn't work on his device.
AnonVendetta said:
My friend's phone is already deodexed, not sure why it didn't work on his device.
Click to expand...
Click to collapse
If you can, please post the original framework.jar so I can make some tests.
Here is his unmodified framework.jar.
I'm running the latest (7/8/2016) version of XenonHD on my LG G3 D855 for the past few days, and whereas I had no problem using needle to patch the build from a few months ago - this latest update throws an error even when using tingle.
I'm fairly certain I've set everything up correctly - I'm using my laptop at the hospital rather than my regular terminal, but I've installed Python 3, linked it in the PATH environmental variables updated Java RTE and made sure that I have working ADB drivers. Needle runs fine, pulls the framework and modifies it, but encounters an error. (I can post screenshots if necessary)
I've attached my unmodified framework.jar to this post, and any help possible would be most appreciated
The ROM is supposedly deodexed, so I haven't tried that yet, to be honest it isn't something I've ever done before or would know where to start with.
View attachment framework.jar
View attachment framework-res.apk
I have found the problem, I need some time to make some tests and trying to fix it.
In the first option FileNotFounError: [WinError 2]
In the second option comes off as all done but framework.jar modified it has the same MD5 that he framework.jar original
I leave the framework.jar, Thank you very much for your time
I'm stupid, I was going to Settings/Applications and mark all permissions and then I was going to
Settings/Privacy and mark all the permissions that were not marked and these permits are Disable app Wi-Fi usage and Disable app cellular usage, he was removing internet access.
I'm stupid.
Sorry.
The only thing that not works is the weather widget from Cyanogenmod 13, everything else works, synchronization contacts, calendar, Chrome and location for cellular it works.
Thanks for the help.
ChristianTC said:
In the first option FileNotFounError: [WinError 2]
Click to expand...
Click to collapse
What does it say if you run manually this?
Code:
adb devices
adb identifies the device as: 4df785271f4440c7
And for disconnect the device of the USB I have to kill process adb.exe from the Task Manager from Windows.
@ChristianTC: Can you please compress all the content of the folder of the patch with included your adb as you use it and put it here so I can try it directly?
ale5000 said:
@ChristianTC: Can you please compress all the content of the folder of the patch with included your adb as you use it and put it here so I can try it directly?
Click to expand...
Click to collapse
Here it is, I have this folder in C:/adb
@AnonVendetta and @Aaren11
You have both the same issue, the framework.jar you have contains 2 dex and the file to patch is inside the first dex but patching it exceed the limit of 64k methods (limit of a single dex) and so it fails, I have added a workaround in my code to move some methods in the second dex (that isn't full) so now it should work but always do a backup before use the patch to be sure.
Please report back if everything works.
@ChristianTC
- For the first option: I was only searching for system wide adb, it never use adb in the folder of the script; in the latest version it search adb also in the tools folder so place it here (after updating Tingle).
- For the second option: This option was added recently and the modified file was only kept in the temp folder, now it is copied to the output folder.
Please report back if everything works.
Tells me that All done but framework.jar modified It has the same MD5 that he framework.jar original.
ChristianTC said:
Tells me that All done but framework.jar modified It has the same MD5 that he framework.jar original.
Click to expand...
Click to collapse
It is really strange.
Try these steps:
1) Please make sure you have the latest version of Tingle (all files and folders, not just patch.py) by clicking "Clone or download" and then "Download ZIP" in the GitHub page.
2) Make sure to extract it in a user writable folder, like Documents; if you extract it under "C:\Program Files" then the patch may not have write permissions to write the file.
3) The patch read the file inside the input folder but write the final file in the output folder so it never overwrite the original file.
4) In case it still do not work open the command prompt with "Run as administrator" and then run the patch from here (it shouldn't really be needed but as last resort it can be tried).
One of the steps should hopefully fix the problem, please report back what happened.
@ale5000: Cancel my request, I caught my now ex-friend trying to steal from me, so I no longer have an incentive to help him with patching his framework.jar. However, if you would still like to provide a technical explanation as to why the patch didn't succeed, then I'd like to hear it anyway.
Sorry for the wasted time.....
Testers wanted: Anyone who uses this method, let me know if you can access stock recovery after this method.
Summery
Thanks to the amazing work by our active member @bibikalka, a method was found to unbrick these devices Thread link here. The method he found was slightly tedious for some people, so I've decided to put together a Linux iso that you can boot into on your computer with everything you need to get your device running again. It uses the same methods proposed but makes things easier. This comes with all the necessary drivers, scripts to do everything you need, all the img files needed to flash, a hex editor for advanced users, and more. Before the scripts included in this OS, determining the option (A, B, or C) to take in order to unbrick the device required .part files to be evaluated manually. Now with the custom script, it can quickly evaluate what option to take.
Video Instructions
Brief Instructions
1. Download the Linux iso:
Linux ISO
2. Burn the iso to a USB drive or cd
3. Boot into the operating system
4. Type "root" at the login prompt
5. Right click on the desktop and choose file manager. Go to "aftv2-tools" folder
6. Right click on file manager and press "open in terminal"
7. From device turned off, enter command "./handshake.py", then plug in device. You may need to do this a couple times to get a connection. Try pressing volume keys & power etc to get it connected. See video if you have problems
8. After handshake is complete, run "./reader.sh"
9. After all addresses are read in, run "./determineOption.sh". You should get back a result of A, B, or C
10. Depending on the option returned (A,B,or C), run "./readerSpecialOptionA.sh", "./readerSpecialOptionB.sh", or "./readerSpecialOptionC.sh". This is an optional step but may be useful if you want to back up part files or their were no options available. Back up part files to a usb drive if you want to be safe.
11. Now the actual unbricking. Run "./unbrickOptionA.sh", "./unbrickOptionB.sh", or "./unbrickOptionA.sh" depending on your option. This can take about 40 minutes
12. hold volume up and run "./complete.sh" at the same time to get into TWRP
13. boot into your default operating system on your computer
BE VERY CAREFUL FROM NOW ON
13. We will be installing Fire OS 5.3.1. If you are not installing this ROM, make sure you know what you are doing. Download the ROM:
update-kindle-20.5.5.2_user_552153420.bin
14. Download 5.4.1_1133_stock_recovery_uboot.zip: 5.4.1_1133_stock_recovery_uboot.zip. Without this you could turn your device into a paperweight. This installs stock recovery and a uboot version that MUST be installed. This file was taken from the thread here: how-to-upgrade-to-lollipop-root-gapps
15. Rename the ROM extension from .bin to .zip
16. Transfer the two files to the Fire
17. Do a factory reset. Flash the ROM and uboot&recovery file
18. Reboot! Your device should now be working. It will take about 15 mins to boot up.
Big thanks to @bibikalka for helping work everything out and for the initial unbrick method.
Edit 10/13/21: Fixed Google Drive Link
Linux ISO Changelog
Updated 10/5/16:
*Optomized scripts
*Added "complete.sh" This reboots the device
Updated 9/27/16:
*Added script to auto-detect which unbrick option to use (determineOption.sh)
*Added scripts to write img files to correct addresses ( unbrickOptionA.sh, unbrickOptionB.sh, and unbrickOptionC.sh)
*Added scripts to read in and label part files (readerSpecialOptionA.sh, readerSpecialOptionB.sh, and readerSpecialOptionC.sh)
*Nemo open in terminal fixed
*.part files set to open with ghex by default
Updated 9/24/16:
*Nemo as default file manager
*Updated html page with instructions from forum
well, after seriously struggling with the parent thread mentioned in the OP I've managed to get to TWRP & am just waiting for my win10 machine to install it's updates before attempting to adb push the uboot & zip files for installation back to fireOS.
feels great to see the screen displaying something other than the looping amazon logo after months of frustration. I do not have the words to express my gratitude for @powerpoint45 for an excellent & well thought through tool and walkthrough. special mention also goes out to @bibikalka
gascomm said:
well, after seriously struggling with the parent thread mentioned in the OP I've managed to get to TWRP & am just waiting for my win10 machine to install it's updates before attempting to adb push the uboot & zip files for installation back to fireOS.
feels great to see the screen displaying something other than the looping amazon logo after months of frustration. I do not have the words to express my gratitude for @powerpoint45 for an excellent & well thought through tool and walkthrough. special mention also goes out to @bibikalka
Click to expand...
Click to collapse
great to hear! I hope everything works for you! After you get everything done, can you check if you can get into recovery.
after flashing both zips & rebooting I've now got my working fire (OS 5.3.1.0) back. thank you Mr PowerPoint!
i tried rebooting to recovery & it now takes me to the stock amazon recovery not TWRP..... which is unfortunate.
I did get asked if I wanted to install SuperUser which was a no-brainer YES. although I'm staying offline until I identify a functional (fast) flavour of android to flash. suggestions welcome.
gascomm said:
after flashing both zips & rebooting I've now got my working fire (OS 5.3.1.0) back. thank you Mr PowerPoint!
i be tried rebooting to recovery & it now takes me to the stock amazon recovery not TWRP..... which is unfortunate.
I did get asked if I wanted to install SuperUser which was a no-brainer YES. although I'm staying offline until I identify a functional (fast) flavour of android to flash. suggestions welcome.
Click to expand...
Click to collapse
Good to hear everything is working. Ya TWRP does not work with 5.x bootloader. Good to hear you can get into stock recovery because I had some incidents where I could not get into it. Thanks for responding. The only custom ROM ATM is CM13.
powerpoint45 said:
The only custom ROM ATM is CM13.
Click to expand...
Click to collapse
sorry to trouble you again but do you know where I can find a guide/walkthrough of how to root via adb & install twrp or cwm to allow flashing of a rom & gapps..
I can only find the kingroot method & the CM11 rom discussion. where might I find the CM13 you mentioned?
I have searched fruitlessly. I guess I just need a little guidance to avoid running straight into another brick.
cheers.
gascomm said:
sorry to trouble you again but do you know where I can find a guide/walkthrough of how to root via adb & install twrp or cwm to allow flashing of a rom & gapps..
I can only find the kingroot method & the CM11 rom discussion. where might I find the CM13 you mentioned?
I have searched fruitlessly. I guess I just need a little guidance to avoid running straight into another brick.
cheers.
Click to expand...
Click to collapse
I meant to say CM11. This guide is probably one of the best http://forum.xda-developers.com/fire-hd/general/how-to-upgrade-to-lollipop-root-gapps-t3163950/page1
This is a bit older one: http://forum.xda-developers.com/fire-hd/general/how-to-downgrade-to-4-5-3-root-device-t3139351/page1
In order to have TWRP, you must have a 4.x bootloader so CM11 would work with it.
Thank you
I have a question I can work downgrade from 5.3.1 to 4.5.3
I'm currently on version 5.3.1
PRInCEI7 said:
Thank you
I have a question I can work downgrade from 5.3.1 to 4.5.3
I'm currently on version 5.3.1
Click to expand...
Click to collapse
yes you should be fine doing that
Unfortunately, did not respond
I worked
MacBook-Air-2:ROOT IP$ ./handshake.py
Waiting for preloader...
Found port = /dev/cu.usbmodem1420
Handshake complete!
In the second step does not respond to the order ./reader.sh
Also tried
/.read_mmc.py 0x0000000 0x1000 0x0000000.part
Does not respond
By the way tried way on more than one device
And tried through the system Max os x and the system arch-custom-firehd67-unbrick100516.iso did not work and also the same result
MY device Amazon Fire HD 6 version 5.3.1 All functions work, but I need to work downgrade to 4.5.3
Is there a solution to my problem
[/SIZE]
@powerpoint45 thanks for the pointers. I am now the proud owned of an hd6 booting straight into cm11 & it's been well worth the wait. I am forever in your digital debt.
gascomm said:
@powerpoint45 thanks for the pointers. I am now the proud owned of an hd6 booting straight into cm11 & it's been well worth the wait. I am forever in your digital debt.
Click to expand...
Click to collapse
sweet!!!
PRInCEI7 said:
Unfortunately, did not respond
I worked
MacBook-Air-2:ROOT IP$ ./handshake.py
Waiting for preloader...
Found port = /dev/cu.usbmodem1420
Handshake complete!
In the second step does not respond to the order ./reader.sh
Also tried
/.read_mmc.py 0x0000000 0x1000 0x0000000.part
Does not respond
By the way tried way on more than one device
And tried through the system Max os x and the system arch-custom-firehd67-unbrick100516.iso did not work and also the same result
MY device Amazon Fire HD 6 version 5.3.1 All functions work, but I need to work downgrade to 4.5.3
Is there a solution to my problem
[/SIZE]
Click to expand...
Click to collapse
I am also getting the same results with my HD 7 4th gen. The handshake completes just fine, but the reader just hangs. When I'm in recovery, I get errors saying the /cache folder failed to mount. I'm thinking the memory is corrupt and there is no way to fix this.
nai1ed said:
I am also getting the same results with my HD 7 4th gen. The handshake completes just fine, but the reader just hangs. When I'm in recovery, I get errors saying the /cache folder failed to mount. I'm thinking the memory is corrupt and there is no way to fix this.
Click to expand...
Click to collapse
Unfortunately it appears that with the latest bootloader on the latest Amazon update that they have disabled these commands (such as reading and writing). Unfortunately if you can't get into recovery with (vol+ & power) then it is currently unrecoverable. Best option for an unrecoverable device would be to buy another motherboard from eBay or some place. They are pretty cheap and easy to replace. I've had to do it a couple times now.
Confused
First you say it should be OK to downgrade:
powerpoint45 said:
PRInCEI7 said:
Thank you
I have a question I can work downgrade from 5.3.1 to 4.5.3
I'm currently on version 5.3.1
Click to expand...
Click to collapse
yes you should be fine doing that
Click to expand...
Click to collapse
Although, it's unclear how, since reports indicate that sideloading older
firmware bricks the device (or, does that only apply to 5.x?).
Then, we learn that the preloader trick (from aftv2-tools) doesn't work anymore:
Code:
[[email protected] aftv2-tools]# ./handshake.py
Waiting for preloader...
Found port = /dev/ttyACM0
Handshake complete!
[[email protected] aftv2-tools]# ./reader.sh
^CTraceback (most recent call last):
File "./read_mmc.py", line 355, in <module>
if msdc_dma_status():
File "./read_mmc.py", line 146, in msdc_dma_status
return False if sdr_read32(MSDC_CFG) & MSDC_CFG_PIO else True
File "./read_mmc.py", line 82, in sdr_read32
check(dev.read(2), b'\x00\x00') # arg check
File "/usr/lib/python3.5/site-packages/serial/serialposix.py", line 450, in read
ready, _, _ = select.select([self.fd, self.pipe_abort_read_r], [], [], timeout)
KeyboardInterrupt
^CTraceback (most recent call last):
File "./read_mmc.py", line 355, in <module>
if msdc_dma_status():
File "./read_mmc.py", line 146, in msdc_dma_status
return False if sdr_read32(MSDC_CFG) & MSDC_CFG_PIO else True
File "./read_mmc.py", line 82, in sdr_read32
check(dev.read(2), b'\x00\x00') # arg check
File "/usr/lib/python3.5/site-packages/serial/serialposix.py", line 450, in read
ready, _, _ = select.select([self.fd, self.pipe_abort_read_r], [], [], timeout)
KeyboardInterrupt
^Z
[1]+ Stopped ./reader.sh
[[email protected] aftv2-tools]# kill %1
[[email protected] aftv2-tools]#
[1]+ Terminated ./reader.sh
[[email protected] aftv2-tools]#
The above is for a 4th gen HD7 with this device showing in 'lsusb':
Code:
Bus 001 Device 006: ID 0e8d:3000 MediaTek Inc.
powerpoint45 said:
Unfortunately it appears that with the latest bootloader on the latest Amazon update that they have disabled these commands (such as reading and writing). Unfortunately if you can't get into recovery with (vol+ & power) then it is currently unrecoverable. Best option for an unrecoverable device would be to buy another motherboard from eBay or some place. They are pretty cheap and easy to replace. I've had to do it a couple times now.
Click to expand...
Click to collapse
BTW, are we sure that this is *disabled* as opposed to _tweaked_?
(e.g. by changing the protocol slightly by, say, requiring an extra byte
or two "confirmation" before execution? has anyone bothered reversing
the bootloader? [Please excuse my ignorance, but would this be handled
by UBOOT, TEE1, or some other component?])
So, what's the current best option for 5.3.1?
---------- Post added at 11:23 ---------- Previous post was at 10:58 ----------
draxie said:
BTW, are we sure that this is *disabled* as opposed to _tweaked_?
(e.g. by changing the protocol slightly by, say, requiring an extra byte
or two "confirmation" before execution? has anyone bothered reversing
the bootloader?
Click to expand...
Click to collapse
OK. So, I found this post by @zeroepoch,
which makes it very clear that said exercise has been performed for the AFTV2...
No reason to believe that this would be different for the Fire HD7...
draxie said:
First you say it should be OK to downgrade:
Although, it's unclear how, since reports indicate that sideloading older
firmware bricks the device (or, does that only apply to 5.x?).
Then, we learn that the preloader trick (from aftv2-tools) doesn't work anymore:
The above is for a 4th gen HD7 with this device showing in 'lsusb':
BTW, are we sure that this is *disabled* as opposed to _tweaked_?
(e.g. by changing the protocol slightly by, say, requiring an extra byte
or two "confirmation" before execution? has anyone bothered reversing
the bootloader? [Please excuse my ignorance, but would this be handled
by UBOOT, TEE1, or some other component?])
So, what's the current best option for 5.3.1?
---------- Post added at 11:23 ---------- Previous post was at 10:58 ----------
OK. So, I found this post by @zeroepoch,
which makes it very clear that said exercise has been performed for the AFTV2...
No reason to believe that this would be different for the Fire HD7...
Click to expand...
Click to collapse
My understanding is that you only need to worry about bricking if You are downgrading to another lollypop ROM. We found out that the device has a fuse that is set in later lollypop ROMs where it will check against the current version. But this check only seems to be on lollipop ROM's. As for the aftv2 protocol, you might be right but I don't know enough about that yet to know. Currently we have no unbrick method for latest bootloader. If you can get into recovery then you could sideload but most can't get into recovery during brick.
I've followed the steps but not into twrp, only screen amazon and reset. I'm not good at English
error trying to unbrick hd6
[[email protected] aftv2-tools]# ./complete.sh
1: 0xd1
4: 0x00 0x00 0x00 0x00
4: 0x00 0x00 0x00 0x01
Traceback (most recent call last):
File "/usr/lib/python3.5/site-packages/serial/serialposix.py", line 468, in read
'device reports readiness to read but returned no data '
serial.serialutil.SerialException: device reports readiness to read but returned no data (device disconnected or multiple access on port?)
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "./read32.py", line 69, in <module>
ret = read32(addr, size)
File "./read32.py", line 45, in read32
print_hex_byte(dev.read(2)) # status
File "/usr/lib/python3.5/site-packages/serial/serialposix.py", line 475, in read
raise SerialException('read failed: {}'.format(e))
serial.serialutil.SerialException: read failed: device reports readiness to read but returned no data (device disconnected or multiple access on port?)
[[email protected] aftv2-tools]#
kingwill101 said:
[[email protected] aftv2-tools]# ./complete.sh
1: 0xd1
4: 0x00 0x00 0x00 0x00
4: 0x00 0x00 0x00 0x01
Traceback (most recent call last):
File "/usr/lib/python3.5/site-packages/serial/serialposix.py", line 468, in read
'device reports readiness to read but returned no data '
serial.serialutil.SerialException: device reports readiness to read but returned no data (device disconnected or multiple access on port?)
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "./read32.py", line 69, in <module>
ret = read32(addr, size)
File "./read32.py", line 45, in read32
print_hex_byte(dev.read(2)) # status
File "/usr/lib/python3.5/site-packages/serial/serialposix.py", line 475, in read
raise SerialException('read failed: {}'.format(e))
serial.serialutil.SerialException: read failed: device reports readiness to read but returned no data (device disconnected or multiple access on port?)
[[email protected] aftv2-tools]#
Click to expand...
Click to collapse
You are on any version.
You can access to recovery now
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
(Success Stories)
jonathanmohamed said:
I have successfully ported s7 and n7 firmware using this guide.
Awesome guide!. 9/10
Click to expand...
Click to collapse
corsicanu said:
@malbert16442 this is pure GOLD. Gave you all my thanks for today. I'll try it myself today. Also waiting patiently for updates [emoji28] . Cheers!
Click to expand...
Click to collapse
armaowl said:
is the reason i was allowed me to port my own Rom!
Click to expand...
Click to collapse
1. Kernel is second most important because it determines if rom boots or whether
we could access a log.
2. Since we are trying to boot a rom not meant to be on our device, it could be alittle hard getting this thing to run.
3 Contact a kernel dev and ask them for adb insecure kernel or a kernel with usb debugging enabled at boot. This will help us obtain those logs at boot.
4. In some rare cases Logs might show that specific kernel services are not accessible.
In this case we only change the init.environ.rc. Which has the frameworks needed to boot.
5. If you can't get kernel logging at boot use this in recovery after 2 mins of booting.
Code:
adb pull /data/tombstones
6.Update
DaKillaz98 said:
Hello All! I am posting this fix because on my Note Edge, I wasn't able to get logcat or adb access at boot, no matter what property I set, it didn't work. I finally figured out a way to get true logcat right as the boot animation comes up.
First off, you NEED Notepad++ if you don't want garbage clumped up editing.
1. In Android Image Kitchen, depack the Boot image.
2. Then, go to split image and modify boot.img-cmdline and add
Code:
buildvariant=userdebug
.
3. Save that file, then go to the ramdisk folder and edit your default.prop. change these values.
Code:
ro.secure=1 > ro.secure=0
ro.adb.secure=1 > ro.adb.secure=0
ro.debuggable=0 > ro.debuggable=1
4. Save that file, then go to init.rc, and use find to search for adbd to jump to this.
Code:
# adbd is controlled via property triggers in init.<platform>.usb.rc
5. Change the original code from
Code:
service adbd /sbin/adbd --root_seclabel=u:r:su:s0
class core
socket adbd stream 660 system system
disabled
seclabel u:r:adbd:s0
TO:
service adbd /sbin/adbd --root_seclabel=u:r:su:s0
disabled
socket adbd stream 660 system system
seclabel u:r:adbd:s0
6. Change this to new code.
Code:
# adbd on at boot in emulator
on property:ro.kernel.qemu=1
start adbd
TO:
# allows adbd at boot with property trigger below
on property:ro.debuggable=1
write /sys/class/android_usb/android0/enable 0
write /sys/class/android_usb/android0/idVendor 04E8
write /sys/class/android_usb/android0/idProduct 6860
write /sys/class/android_usb/android0/functions adb
write /sys/class/android_usb/android0/enable 1
start adbd
7. Rebuild the kernel and install in TWRP or however you install kernels, ADB will be accessible right at boot so nothing is lost during logging. If your kernel doesn't need this, don't bother, but if like me, you couldn't get anything, this will fix your issues.
In some cases, you will still need to push adb_keys to /data/misc/adb/, however.
@malbert16442 Please consider putting this in OP for those who have issues getting logcat at boot.
Click to expand...
Click to collapse
Part 2
Adb is key in any port. Adb is the secret. It gives us the ability to access logs be able to debug issues in our ROM.
1. Download adb drivers
http://forum.xda-developers.com/showthread.php?p=48915118#post48915118
Thanks Member @Snoop05
2. Test adb by using 'adb devices" in cmd
You should see online
3. If offline try using adb kill-server and repeat step 2.
4. When making a loging for these ports we use the phrase adb logcat *:E > filename
this ensures that we filter the logs by errors and remove the long set of lines like thermal updates ...etc
Part 3
In order to port firmware
1. Download Stock firmware extract it with tool
Websites to get stock firmware are
http://updato.com/firmware-archive-select-model
or https://forum.xda-developers.com/galaxy-tab-s/general/tool-samfirm-samsung-firmware-t2988647
2.We will deodex our rom using Fulmics or similar deodexer
Either a kitchen like "http://forum.xda-developers.com/chef-central/android/kitchen-superrs-kitchen-t3202296/page26" or similar.
Thanks @SuperR
https://forum.xda-developers.com/android/software-hacking/tooll-03-12-fulmics-deodexer-1-0-t3512081
Thanks @xpirt
3. Learn how to use APK DECOMPILE TOOLS SUCH AS TICKLEMEANDRIOD
http://forum.xda-developers.com/showthread.php?t=1633333
Thanks @Ticklefish
4. Remove Apps Priv-app and Framework of base. In a new folder use Fulmics to deodex this. Store somewhere safe.
5. Deodex Port and copy the Apps, Framework and Priv-app into the Base of stock rom.
6. In Ticklemeandriod you notice we have 6 work Areas. For our Roms we will only need two. The most common files we will use are services.jar, and framework.jar.
7. Take the services and framework our our Port and decompile in work area 1.
8. Take the services and framework of our Base and decompile in work area 2.
9. We will Perform a quick Step to help if App signatures become corrupt or cannot be read.
Follow this guide by @ikrom
http://forum.xda-developers.com/showpost.php?p=62496153&postcount=2957
10. After this lets move to debugging our apps and frameworks.
Part 4 (Tools and debugging)
My favorite tools to use include WinMerge and FileSeek
1. Winmerge enables us to compare two files. For example a stock jar and one of our port.
2. File seek allows us to search for a specific references.
I use file seek to search for weird terminology I see on my log.
3. Terminology
Part 5 ( Terminology)
1. In a logcat we are looking for three things when debugging. "E JavaBinder:", "E art", "E AndroidRuntime: FATAL EXCEPTION:"
2. The order to debug we search in logcat. When beginning it is not specific but, I usually search for Art errors first.
3. So for example if I get in my logcat
Code:
"01-01 01:26:25.169 5599 7183 E JavaBinder: java.lang.NoSuchMethodError: No virtual method activityPauseTrigger(Landroid/content/Intent;Landroid/content/pm/ActivityInfo;Landroid/content/pm/ApplicationInfo;)V in class Lcom/android/internal/app/ActivityTrigger; or its super classes (declaration of 'com.android.internal.app.ActivityTrigger' appears in /system/framework/framework.jar:classes2.dex)"
I got the location which is framework jar Class2
Code:
activityPauseTrigger(Landroid/content/Intent;Landroid/content/pm/ActivityInfo;Landroid/content/pm/ApplicationInfo;)V is the missing info in the port smalis and
log says it is somewhere in
Code:
Lcom/android/internal/app/ActivityTrigger; or the files with idential names to Activity trigger
4. In this case missing method could be found in stock smali. This is where we use win merge to cleanly copy new method from stock to port.
5. But Mike what if The logcat doesnt tell me location. We will then use fileseek in this instance.
Example: Log tells me
Code:
"01-01 00:24:17.509 7524 7539 E JavaBinder: java.lang.UnsatisfiedLinkError: No implementation found for void com.android.internal.app.ActivityTrigger.native_at_pauseActivity(java.lang.String) (tried Java_com_android_internal_app_ActivityTrigger_native_1at_1pauseActivity and Java_com_android_internal_app_ActivityTrigger_native_1at_1pauseActivity__Ljava_lang_String_2)
"
No implementation means that we must remove this file as it is not found in the libs. What location? We dont know yet ?
Code:
com.android.internal.app.ActivityTrigger.native_at_pauseActivity(java.lang.String
is what we are looking for
According to fileseek I would look for pauseActivity because it is a keyword
According to file seek I may get 100 references but I see one that says
Code:
.method ActivityTrigger.native_at_pauseActivity
I would then use winmerge to cleanly delete/copy the file from my stock smali to the new one. From the location I found in Fileseek.
6. Let me give a example of a Runtime error.
Code:
"07-25 09:17:08.975 16379 16379 E AndroidRuntime: java.lang.NoSuchMethodError: No interface method setDataFromNSFLP(ILandroid/os/Bundle;)V in class Landroid/location/ILocationManager; or its super classes (declaration of 'android.location.ILocationManager' appears in /system/framework/framework.jar)
So log told us to look in framework for a file with
Code:
setDataFromNSFLP(ILandroid/os/Bundle;)V
Boot up file seek and repeat steps above.
Part 6
So we booted now what.
Lets now work on fixing local errors.
Use logcat to possible fcs and reboots.
All firmware edits are different so this guide will help if you are learning the way android works.
What to look out for
Remember the Base folder we deodexed. We will use this to help fix issues in our rom.
1. Take the McRegistry Folder and ffffffff0000000 File move this to our booted rom.
2. Now in the Ported firmware copy the Fonts folder and the files named font in /etc to our booted rom.
3. Delete these folders - " preloadedmdm ", " sipdb " and " tts from booted rom and replace with that from ported firmware.
4. Open " Media " folder in booted rom
Delete Audio folder
Replace with Ported firmware audio folder.
5. In /etc/permission add the missing software permissions not hardware like slocation or camera-flash.
6. In build-prop
Replace these values with that of port.
Code:
ro.build.scafe.size=
ro.build.scafe.shot=
ro.build.scafe.cream=
ro.build.scafe.version=
ro.com.google.gmsversion=
ro.build.version.sdl=
ro.config.ringtone=
ro.config.notification_sound=
ro.config.alarm_alert=
ro.config.media_sound=
ro.config.ringtone_2=
ro.config.notification_sound_2=
7. Add this code to build-prop
Code:
wlan.wfd.hdcp=disable
Let's Fix Messages and Phone FCS on first boot
1. From ported from take the libselinux.so to fix message fcs
2. To fix Phone fcs take the mapconprovider.xml from port
64 bit firmware to 32bit
1. Replace 64 bit libs with 32 bit alternatives.
2. You could find 32 bit libs in 32 bit firmware.
32bit all that could be found will be attached here for all users
Fix location problems in Rom
With our services.jar decompiled take these smalis from base and use Winmerge to copy to Port jar.
Code:
services.jar\smali\com\android\server\location folder to that of port
also take the
Code:
services.jar\smali\com\android\server\LocationManagerService$xxx
Smalis and move from base to port location.
1. Take NFC.apk and Bluetooth.apk from base and move to new Rom folder.
OR A more complex NFC fix would be to look in PackageManagerService.smali
of services.jar
look for the NFC model of the device you are porting from
1. So use FileSeeker
to search for method with "supportNfc"
2. Replace it with your model number.
Example the NFC number of Note 7 is S3FWRN5
I would replace it with the NFC number of S5 which is NXP_PN547C2
Blur
https://forum.xda-developers.com/showpost.php?p=69547250&postcount=10031
AOD FRAMEWORK FIX
Credits :
@Patrick.H (NX Team)
@karkasss (NX Team)
@Develoid ALT and F4 (AOD touch / Bluelight filter fix)
@asc1977, @DaOldMan (AOD brightness control)
(Please copy & paste when you add our credits)
Download this file extract to services.jar
https://mega.nz/#!KgMxwQDR!g0yy7a6Izk8U8szRsggaZAXLaF4pjSMYAc8p6kOjIs4
Compare the PowerManagerService Smails.
then recompile
OR
thanks @oluwaponmile
follow this guide
https://forum.xda-developers.com/showpost.php?p=69594939&postcount=8139
Lets fix ported Cameras
Code:
[SIZE="3"]GUIDE IS IN PROGRESS[/SIZE]
Debug solution not fix:
This will be a hard thing to accomplish. Also make sure that Camera is recompiled using New signatures.
First lets find the native resolutions of your camera. For this we look in native camera apk.
Find the native resolutions in arrays or strings xml.
Save resolutions found in port apk for later reference. These are the values we are going to replace with stock hexadecimal values.
Use a Decimal to Hexadecimal Converter to find the values for the resolutions in smali.
For example 1080 would be 438 and 1920 would be 780.
For this value we will intrepid the hexadecimal value as 0x438 and 0x780 respectively in andriod.
When we are looking for the resolutions in port apk we grep the values based on the hexadecimal.
So in an example if resolution of port camera is 1920x1080 and stock is 1080x1920, then in smali we might get a value of 0x438, 0x780 in assortment. Simply replace 0x438 with 0x780 and 0x780 with 0x438.
Replace these values in port apk with the stock equivalent. Recompile.
Keep this open in one window.
Now open up camera and take log.
Most likely you would get a error saying missing resolution
KNOX STATUS REVERT (Kernel)
@topjohnwu for reset prop
The reset prop source was removed from topjohnwu thread however you could use the prebuilt binary in his magisk release zips.
1. Pick your device arch and remove binary from zip
2. Now download a tool to extract boot images.
3. Navigate to sbin and drop your resetprop binary.
4. Get back to root directory and add this file http://www106.zippyshare.com/v/AzldZO7A/file.html
5. Now in init.rc add this code
Code:
# Call Knox Reset
service knox-daemon /system/bin/sh /init.knox.sh
class main
user root
oneshot
Device Specific Section
(Section will detail device specific edits for particular devices once users post.)
mitko7411 said:
So I haven't really made a new list of smalis for porting roms, but here's the ones just to boot ANY 6.0.1 firmware on J5 2015.
Debug
GpsLocationProvider
KnoxVpnPacProcessor
TADriver
SchedPolicyManager
Click to expand...
Click to collapse
No Pm type message below.
Also I will post below all the logs I used to boot Note 7 firmware on my s5
All the edits used to boot Note 7 firmware on S5 it is different for every device.
https://mega.nz/#!8ZtzWCJR!rqTrvD5K3pUvHOAMq_540L_z7Hx0LFZawSzpobFDF98
Thanks for this guide..
A nice guide. Thanks! :highfive:
Ticklefish said:
A nice guide. Thanks! :highfive:
Click to expand...
Click to collapse
Thanks
Sent from my SM-A810S using Tapatalk
Great Extremely helpful, time for noobs to port now
Thanks mate you finally did it big help
Thanks manYou helped me.
Well ,,
Malbert , im sure 100% , too much things missed in ur guide mate , this way how u do it isn't an how to ported rom from different devices , or high end to previous years device's , sorry to say this but this isn't a full guide & its just a point for drop app/prev/fram to ur stock base then try to booted then with bootloop logcat u will got what's the missing things well ,
Sorry to say it but this isn't a Full guide for HOW TO PORT Roms , ....
Edit ::
Next time try to be more specific & gives more details & which files / jars / smali / apks / libs / xml / config & which we can use & got from ported base to stock base ,
thereassaad said:
Well ,,
Malbert , im sure 100% , too much things missed in ur guide mate , this way how u do it isn't an how to ported rom from different devices , or high end to previous years device's , sorry to say this but this isn't a full guide & its just a point for drop app/prev/fram to ur stock base then try to booted then with bootloop logcat u will got what's the missing things well ,
Sorry to say it but this isn't a Full guide for HOW TO PORT Roms , ....
Edit ::
Next time try to be more specific & gives more details & which files / jars / smali / apks / libs / xml / config & which we can use & got from ported base to stock base ,
Click to expand...
Click to collapse
Thanks assaad will fix when I get time I get what you are saying but this is a intro. I can't explicitly state which jars apks or libs are needed because they are all different for different devices. XML and permissions I could elaborate on but you can't expect me to possibly give a overview of everything right. Hope you understand thanks. I never explicitly stated this was a full guide and you shouldn't treat it as such.
Sent from my SM-A810S using Tapatalk
Well my friend , i never do ,,
For example without editing systemserver.smali the rom will never booted & u know this very well , i just means to be very static for some useful tips for such framework / & well known smali that need to be our eyes on them .. that's all my point means ..
Good luck my friend
thereassaad said:
Well my friend , i never do ,,
For example without editing systemserver.smali the rom will never booted & u know this very well , i just means to be very static for some useful tips for such framework / & well known smali that need to be our eyes on them .. that's all my point means ..
Good luck my friend
Click to expand...
Click to collapse
Ohh I understand what you are saying. I will expand on this guide when I get time hopefully you also could help support and add to this guide as XDA is a community. ? Over time we could help many users thanks for your advice.
Sent from my SM-A810S using Tapatalk
@malbert16442 Can you help me with my S5 which is G9008V China Mobile variant?
I can't boot on Thunderbolt A8 rom...
What should I Fix?
I have successfully ported s7 and n7 firmware using this guide.
Awesome guide!. 9/10
I have one small issue, in your log n79 you have "E SQLiteDatabase: " How did you fix this error? I am having the same issue, with one of my builds.
Solved:
FileSeek ftw!
jonathanmohamed said:
I have successfully ported s7 and n7 firmware using this guide.
Awesome guide!. 9/10
I have one small issue, in your log n79 you have "E SQLiteDatabase: " How did you fix this error? I am having the same issue, with one of my builds.
Solved:
FileSeek ftw!
Click to expand...
Click to collapse
Thanks happy for you. How would you rate your level of expertise so I could set a difficulty level for this
Sent from my Pixel XL using Tapatalk
Learned new debug problems in Sammy Roms updating guide soon, making it more appealing too. Happy that one person actually made a port from this guide.
thnx alot @malbert16442 .... but i have 2 bugs i didnt manage to fix
1-wifi work and i can see available network but when i try to connect i get 'failed to connect' .. I tried to use my stock wifi-service.jar but the device not boot)
2-Camera work (back and front) and i can take photos...but when i try to record video i get 'Recording faield' fixed
Allooosh98 said:
thnx alot @malbert16442 ...using this guide i ported S7e, G532F to j7.....but i have 2 bugs i didnt manage to fix
1-wifi work and i can see available network but when i try to connect i get 'failed to connect' .. I tried to use my stock wifi-service.jar but the device not boot)
2-Camera work (back and front) and i can take photos...but when i try to record video i get 'Recording faield' fixed
Click to expand...
Click to collapse
When you add wifi serivce jar you have edits to make in framework you will see in your log
But don't work I have a fix for stock files too. I work on this guide this weekend make it look better
Okay so alot of people are pming me about fixing camera will post solution or debug solutions here soon
hey @malbert16442 bro can u help me to fix the problem?? there is a E art error in logcat that i cant fix it :
E art : No implementation found for int android.os.storage.sensitive.SecureStorageLSM.lsmInitialize() (tried Java_android_os_storage_sensitive_SecureStorageLSM_lsmInitialize and Java_android_os_storage_sensitive_SecureStorageLSM_lsmInitialize__)
i checked smali files but its as same as stock,i attached the log,if its ok look at it and tell me what should i do