Well, this method is different from the paid method that forbidden by forum.
The alternate method is simply explained in Chinese at following website.
本方法的中文阐述：https://hikaricalyx.com/2018/04/03/nokia-7-bootloader-unlock-test/
Click to expand...
Click to collapse
As far as I know, this method tested on following models:
- Nokia 6.1 (TA-1054 only)
- Nokia 7
- Nokia 8
- Sharp Aquos S2
WARNING! THIS METHOD IS PRETTY COMPLICATED AND DANGEROUS!
I'M NOT RESPONSIBLE FOR BRICKING THE DEVICE! DO IT AT YOUR OWN RISK!
FIH made Android Phones with Android 7.x pre-installed can unlock the phone with the method I mentioned.
Preparations:
- Your phone must have Android 7.x running, or you're able to downgrade abl/xbl provided with Android 7.x firmware with other methods.
You can find an excuse at service point to let them downgrade for you, like "My work application is incompatible with Android 8.0" or something.
But Nokia 6.1 Android One Global Variant has Android 8.0 installed out of factory, so it's not likely possible.
Install following software on your PC.
- Patched OST LA 6.0.4: https://drive.google.com/open?id=1n91aYT9Di6_v4F3Wjlv8TjfeLc64AcYA
To install it properly, extract the archive and right click on setup.bat, run it with Administrator previleges. You may want to reinstall every Visual C++ Redistributable Runtime.
- QPST, the newer the better, I personally choose 2.7.460, the latest version should be 2.7.472.4. You can find it by simply Googling.
- A Hex editor. You can choose HxD or any other professional Hex Editor like UltraEdit.
And of course, the stock firmware for your phone. For example, I’ve posted the stock firmware for Nokia 7 on xda-developers Nokia 7 forum.
Since the guide involves the proprietary tool OST LA, it only works on Windows. I recommend you use latest Windows 10 stable release to finish the guide.
Minimal OS: Windows 7 Service Pack 1 with latest updates installed, both 32bit and 64bit are acceptable
Let’s get started.
Part 1: Before Unlocking
1. Backup your data on the phone, and logout your Google Account if you’ve logged in.
2. Enable Allow OEM Unlocking and USB Debugging to make following procedure convenient.
3. Extract early stock firmware or I'll upload required abl (to be added).
Part 2: Flash Service abl/xbl
You have multiple methods to flash abl/xbl.
If your phone is running Android 7.1, you can use old "Edit Phone Information" method I mentioned on Nokia 6 forum.
But let me tell you a method to flash service bootloader.
1. Enter fastboot mode (Download mode), and check which slot are you using.
Code:
fastboot getvar current-slot
I assume your current slot is A.
2. Now calculate the md5 checksum of your serial number. For example, the md5 checksum of PL2GAM1234567890 is 154b7ad463038ec186aafa5909505695.
If you have no idea about your serial number, execute this command:
Code:
fastboot devices
Expected output:
Code:
PL2GAM1234567890 fastboot
Of course your serial number can't be PL2GAM1234567890, I'm just making an example.
3. Execute these commands to flash service abl and xbl:
Code:
fastboot oem dm-verity 154b7ad463038ec186aafa5909505695
fastboot flash abl_a D:\C1N-0-0430-abl_service.elf
fastboot flash xbl_a D:\C1N-0-0430-xbl_service.elf
If the fastboot returns "unknown command" when executing first command, your phone is running Android 8.x.
Try to downgrade the abl with disassembly and wire trick to EDL.
You'll realize how to achieve that when reading Part 4.
Click to expand...
Click to collapse
The service abl and xbl are extracted from Nokia 7 stock firmware, which can be also used on Nokia 6.1.
4. Reload the service bootloader:
Code:
fastboot reboot-bootloader
Part 3: Enter EDL mode
Skip this part if you can use wire trick to trigger EDL mode.
Execute these commands:
Code:
fastboot oem dm-verity 154b7ad463038ec186aafa5909505695
fastboot oem reboot-edl
Part 4: Dump a partition
1. Check Device Manager, "Port (COM and LPT)" category to see if your phone is listed as HS-USB QDLoader 9008 (COMx).
If it's listed as HS-USB Diagnostics 9008 or QUSB__BULK in "Universal Serial Bus devices", you need to update the driver manually to HS-USB QDLoader 9008 (COMx), then force reboot your phone and re-enter the EDL mode.
2. Open QFIL, and load the firehose file from stock firmware.
If you're using Nokia 8, you'll also need to change the storage type to UFS in FireHose Configuration.
3. Click "Tools" - "Partition Manager", and click OK.
4. Find deviceinfo (not devinfo) partition, right click on it and click "Manage Partition", then click "Read Image". This will dump deviceinfo partition.
Dumped deviceinfo partition will be placed at "%AppData%\Qualcomm\QFIL\COMPORT_*" with filename like this:
ReadData_eMMC_Lun0_0xb828_Len2048_DT_15_04_2018_15_16_32.bin
5. Use a Hex Editor and jump to offset 0x5101, data will be looked like this:
Code:
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00005000 02 50 ED 13 EF C4 07 C3 67 3B CC 83 E1 7F 0B 7E
00005010 CC 40 DD DF 66 6A E8 52 F4 E8 78 7C 8B 87 CC DC
00005020 0F 45 EE F7 E9 71 E6 B0 DE 53 6E 97 84 10 EA 15
00005030 F3 78 07 B4 30 87 29 E3 1B DF 96 31 DE 30 1B 46
00005040 EC D3 33 F5 19 1D 56 EE 0A 5A A9 48 8D A1 83 80
00005050 F6 BA 29 AC 1A 10 BF FD A9 64 D5 79 4D C2 AF 9B
00005060 BD 62 87 49 07 A6 CB 88 22 6D 8C 65 10 94 CD 2F
00005070 3B B7 0C C9 91 92 67 F5 02 17 32 55 4C 5E 8B E7
00005080 1B 4D 70 65 61 46 CB 63 F4 C3 EE F8 45 E0 8D 48
00005090 6B 1E 1C FB 0C 94 48 BB FE AF 01 98 4F 47 4D 3A
000050A0 2A 5F 7F 3E 1E 49 C9 6D 4A 11 A5 19 D6 F1 E7 91
000050B0 5D B6 C8 A4 FA AA 15 BB 69 5F 8B C8 72 2A DD A5
000050C0 D0 DC 8B 4E 33 C8 20 57 6D D5 B8 D4 BF 17 0E B1
000050D0 30 5B 3E 13 BC FF 08 10 4C E2 3E 12 9F 9A A6 54
000050E0 6B D8 DE 98 D4 D7 44 37 7C 6D 43 CA A4 BA D9 C7
000050F0 BB F1 1F 12 90 8D 0D 4B 1B 1E 04 69 69 FD 44 1B
00005100 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
If data exists between 0x5000 and 0x5100, you'll be able to use this method to unlock. Modify the value of 0x5101 to 0xFF like this:
Data above are shown for example. You can't use it and you must use your own deviceinfo.
Click to expand...
Click to collapse
Code:
00005100 06 FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00
6. Save it as deviceinfo_mod.bin to another place and use QFIL to write it back.
Click "Load Image" and choose your deviceinfo_mod.bin. This will write modified deviceinfo back to your phone.
7. Close QPST and reboot your phone to fastboot mode (Download mode).
Part 5: Unlock the phone
1. Remember to keep the OST LA opened to make sure your phone will stay at Download mode.
2. Execute following commands:
Code:
fastboot oem dm-verity 154b7ad463038ec186aafa5909505695
fastboot oem cert_timecount get
If the output cert_timecount is not zero, you can proceed. Otherwise... (Click to unhide)
execute these commands and check again:
Code:
fastboot flash deviceinfo D:\deviceinfo_mod.bin
fastboot reboot-bootloader
3. Then unlock your phone with following commands:
Code:
fastboot oem dm-verity 154b7ad463038ec186aafa5909505695
fastboot flashing unlock_critical
(Do confirmation on your phone)
fastboot oem dm-verity 154b7ad463038ec186aafa5909505695
fastboot oem unlock-go
(Do confirmation on your phone again)
Now your phone is fully unlocked with not serious typo:
Your device has been unlocker and cann't be trusted.
ID: PL2GAM1234567890
Your device will be continue in 5 seconds.
Click to expand...
Click to collapse
Part 6: Restore to stock
You may not be able to install further OTA update unless you switch the slot to previous build and update again, or reinstall stock firmware.
To switch the slot, check your current slot with this command (I assume the current slot is A):
Code:
fastboot --set-active=_b
Then reboot your phone and reinstall OTA update.
To reinstall stock firmware, follow the guide on Nokia 7 plus forum:
https://forum.xda-developers.com/nokia-7-plus/how-to/workaround-flashing-oreo-firmware-t3793791
Required service abl/xbl and firehose for Nokia 6.1 and Nokia 7:
https://drive.google.com/open?id=1lN24vWc8edc_i9BINRTyg-bsNpsKfqCs
Extract password is "WLBGFIH123" (without quotes)
Special thanks:
@heineken78 for Sharp Aquos S2 bootloader unlock
Hello and thanks for sharing.
One question: How can we extract the abl/xbl services as well as firehose from stock rom?
I have a Nokia 2 and would very much like to unlock it.
I did extract the source rom (and also boot.img, system.img, recovery.img), but i don't know how to get the abl/xbl services and firehose firmware.
Can you help me on that?
Thanks
Hi,
Today I was brave enough to risk and dump 200$(TA-1054) in the garbage.
I've followed the procedure up to the modified deviceinfo upload.
For me QFIL wasn't writing the modified bin file on the device unless it's in the folder %AppData%\Qualcomm\QFIL\COMPORT_ (working directory)
After writing it, though, the rest was up to the letter.
I'm currently updating to 8.0 and will post feedback how it works after the updates.
Also, for some reason, I don't have _b slot. Should I worry ?
C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot --set-active=_b
Setting current slot to 'b'...
FAILED (remote: Invalid Slot Suffix)
finished. total time: -0.000s
Edit:
The phone is now updated to 8.1 august patch.
Everything I've tested since yesterday works as before, except wi-fi hotspot (I've read it's some 8.1 issue) mobile data. I'll do some testing to try and figure out where this problem came from.
Edit2:
For some reason mobile data is not working after installing august update. Restored it back to July update and everything seems to be ok(including wi-fi hotspot).
Related
I recently installed TWRP 2.5. I had backed up my system with it and everything was working fine. I recently went back to restore and it said I was successful. When I rebooted the tablet the TWRP comes up. now every time I reboot is the same. TWRP 2.5 starts. No matter what rom I try to install it reboots to the recovery.
Did you try usong the bootloader?
Sent from my GT-I9300 using xda app-developers app
danielbr14 said:
Did you try usong the bootloader?
Sent from my GT-I9300 using xda app-developers app
Click to expand...
Click to collapse
No, I'm not familiar with that program. I am kinda at a disadvantage because the tablet only boots to the TWRP recovery . Not allowing me to use a usb connection. The only thing I can do is remove the external sd card and copy files to it. Use the TWRP recovery to try to install, but then the tablet just boots back to the recovery.
The bootloader is like the bios of your computer it is what you need to unlock to install custom roms . you need to hold down the power button and when the tablet vibrates press the volume down than press the volume down button to navigate . choose the android logo and press the volume up button. Tell me if that helps.
Btw i didnt got notified when you replied me so it took me some time sorry
Sent from my GT-I9300 using xda app-developers app
danielbr14 said:
The bootloader is like the bios of your computer it is what you need to unlock to install custom roms . you need to hold down the power button and when the tablet vibrates press the volume down than press the volume down button to navigate . choose the android logo and press the volume up button. Tell me if that helps.
Btw i didnt got notified when you replied me so it took me some time sorry
Sent from my GT-I9300 using xda app-developers app
Click to expand...
Click to collapse
No, the bootloader is not working. Tried power / volume down / etc. but only the TWRP comes up.
Did you do a clean install.. It's sounds like your stuck on a bootloop???
X10a-Freedom
zorprime01 said:
Did you do a clean install.. It's sounds like your stuck on a bootloop???
X10a-Freedom
Click to expand...
Click to collapse
Don't think I know how to do that. I have tried installing different roms, and the recovery says successful, but when rebooting the tablet, The TWRP recovery comes up again.
A full install is when you drlete the dalcik and cache and the preform the installition if that doesnt help try to do a full internal storge wipe and then install the rom .
But dont forget to move all of your importent data to your sd card so you wont loose it
Sent from my GT-I9300 using xda app-developers app
danielbr14 said:
A full install is when you drlete the dalcik and cache and the preform the installition if that doesnt help try to do a full internal storge wipe and then install the rom .
But dont forget to move all of your importent data to your sd card so you wont loose it
Sent from my GT-I9300 using xda app-developers app
Click to expand...
Click to collapse
I always delete the caches. I have done the full storage wipe through the TWRP. then tried to instal roms, including the latest op system from asus.
Getting the same results as above. Even tried to re-install The TWRP recovery again.
Try getting adb shell access to your recovery (on Windows, you may need to install some drivers first).
_that said:
Try getting adb shell access to your recovery (on Windows, you may need to install some drivers first).
Click to expand...
Click to collapse
Not quite sure of that procedure, could you provide a good link on how to do it? Don't you need to plug the tablet into your computer and be recognized? I have the drivers for the tablet installed but because I can only boot into the TWRP recovery, My computer wont recognize it.
cnh56 said:
Not quite sure of that procedure, could you provide a good link on how to do it? Don't you need to plug the tablet into your computer and be recognized? I have the drivers for the tablet installed but because I can only boot into the TWRP recovery, My computer wont recognize it.
Click to expand...
Click to collapse
With the correct drivers, the computer should recognize the recovery's adb interface and you should be able to use "adb shell" to get a command prompt from your recovery. I can't help you with the drivers, but apparently this one should work: http://forum.xda-developers.com/showpost.php?p=41458912&postcount=2472 . You will also need to get adb binaries for your PC from somewhere.
Alternative: Try using the internal command terminal in TWRP - it's not very powerful but maybe it is enough and then you don't need to mess with the computer or drivers at all. Run the following command:
Code:
ls -l /dev/block/mmc*
and tell me if you see mmcblk0, mmcblk0p1, mmcblk0p2, mmcblk0p3, etc. up to mmcblk0p8 (and some more).
_that said:
With the correct drivers, the computer should recognize the recovery's adb interface and you should be able to use "adb shell" to get a command prompt from your recovery. I can't help you with the drivers, but apparently this one should work: http://forum.xda-developers.com/showpost.php?p=41458912&postcount=2472 . You will also need to get adb binaries for your PC from somewhere.
Alternative: Try using the internal command terminal in TWRP - it's not very powerful but maybe it is enough and then you don't need to mess with the computer or drivers at all. Run the following command:
Code:
ls -l /dev/block/mmc*
and tell me if you see mmcblk0, mmcblk0p1, mmcblk0p2, mmcblk0p3, etc. up to mmcblk0p8 (and some more).
Click to expand...
Click to collapse
Yes, I ran that internal command in TWRP and got these
/dev/block/mmcblk0
/dev/block/mmcblk0boot0
/dev/block/mmcblk0boot1,
/dev/block/mmcblk0p1
/dev/block/mmcblk0p10
/dev/block/mmcblk0p2
/dev/block/mmcblk0p3
/dev/block/mmcblk0p4
/dev/block/mmcblk0p5
/dev/block/mmcblk0p6
/dev/block/mmcblk0p7
/dev/block/mmcblk0p8
/dev/block/mmcblk0p9
/dev/block/mmcblk1
/dev/block/mmcblk1p1
What does that mean?
cnh56 said:
What does that mean?
Click to expand...
Click to collapse
That means your recovery can still see all the partitions of the internal storage, which is good, so we can proceed with the next command:
Code:
hexdump -C -n 512 /dev/block/mmcblk0p3
Ignore the hexadecimal numbers and read the text in the right column, if any. Does it look like this?
Code:
00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000200
or like this:
Code:
00000000 62 6f 6f 74 2d 72 65 63 6f 76 65 72 79 00 00 00 |boot-recovery...|
00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000040 72 65 63 6f 76 65 72 79 0a 2d 2d 77 69 70 65 5f |recovery.--wipe_|
00000050 64 61 74 61 0a 00 00 00 00 00 00 00 00 00 00 00 |data............|
00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000200
or differently?
_that said:
That means your recovery can still see all the partitions of the internal storage, which is good, so we can proceed with the next command:
Code:
hexdump -C -n 512 /dev/block/mmcblk0p3
Ignore the hexadecimal numbers and read the text in the right column, if any. Does it look like this?
Code:
00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000200
or like this:
Code:
00000000 62 6f 6f 74 2d 72 65 63 6f 76 65 72 79 00 00 00 |boot-recovery...|
00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000040 72 65 63 6f 76 65 72 79 0a 2d 2d 77 69 70 65 5f |recovery.--wipe_|
00000050 64 61 74 61 0a 00 00 00 00 00 00 00 00 00 00 00 |data............|
00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000200
or differently?
Click to expand...
Click to collapse
It looks like the first set of codes
cnh56 said:
It looks like the first set of codes
Click to expand...
Click to collapse
OK, no forced reboot to recovery, so your ROM is unhappy with something.
Which ROM did you try to install last?
_that said:
OK, no forced reboot to recovery, so your ROM is unhappy with something.
Which ROM did you try to install last?
Click to expand...
Click to collapse
Stock rom from asus. "US_epad-user-10.6.1.14.8.zip" I renamed it "Asus Update" Loded it into my ext.card and used TWRP to install it. After a while it says it was successful. I wiped the cache's and rebooted. Same ole...TWRP came up again.
cnh56 said:
Stock rom from asus. "US_epad-user-10.6.1.14.8.zip" I renamed it "Asus Update" Loded it into my ext.card and used TWRP to install it. After a while it says it was successful. I wiped the cache's and rebooted. Same ole...TWRP came up again.
Click to expand...
Click to collapse
If you don't have any important data on your device, try formatting the data partition. This will wipe all of your internal storage - apps, app data and /sdcard.
_that said:
If you don't have any important data on your device, try formatting the data partition. This will wipe all of your internal storage - apps, app data and /sdcard.
Click to expand...
Click to collapse
I did as instructed. Same result... Back to TWRP. Dammit!!! :crying:
When you reboot your device, do you see the boot animation before TWRP starts? Or does it go directly from the white ASUS logo to the blue curtains of TWRP?
Hello guys. I just got my phone back from a repair by HTC. They changed the LCD and the motherboard, and there started the problems. I was not able to unlock the bootloader using HTCDEV for that reason. Then I found out that I can s-off the phone without unlocking the bootloader, and thats what I did (it took me a while thought with that wire trick ) . I got the phone SuperCID also.
I wanted to install a recovery after that, but for some reason it wouldn't let me do that. I rooted the phone using the one click root tool from this thread: http://forum.xda-developers.com/showthread.php?p=26280760 . Then I installed official european RUU , which in the past worked just fine for me. But now the phone is still sim locked (to T-Mobile if it matters).
So I started searching for a solution. I found this thread: http://forum.xda-developers.com/showthread.php?t=1192300 and tried to do it according to the instructions in post #3 . No success there too. It was saying that access is denied or something like that.
So now I don't know what else to do. Can you help me out with this guys?
Thanks a lot.
tx3m said:
Hello guys. I just got my phone back from a repair by HTC. They changed the LCD and the motherboard, and there started the problems. I was not able to unlock the bootloader using HTCDEV for that reason. Then I found out that I can s-off the phone without unlocking the bootloader, and thats what I did (it took me a while thought with that wire trick ) . I got the phone SuperCID also.
I wanted to install a recovery after that, but for some reason it wouldn't let me do that. I rooted the phone using the one click root tool from this thread: http://forum.xda-developers.com/showthread.php?p=26280760 . Then I installed official european RUU , which in the past worked just fine for me. But now the phone is still sim locked (to T-Mobile if it matters).
So I started searching for a solution. I found this thread: http://forum.xda-developers.com/showthread.php?t=1192300 and tried to do it according to the instructions in post #3 . No success there too. It was saying that access is denied or something like that.
So now I don't know what else to do. Can you help me out with this guys?
Thanks a lot.
Click to expand...
Click to collapse
what were you trying to do exactly and it said that access denied?
rzr86 said:
what were you trying to do exactly and it said that access denied?
Click to expand...
Click to collapse
What I get is:
C:\Android>adb shell
[email protected]:/ $ strings -n 8 /dev/block/mmcblk0p6
strings -n 8 /dev/block/mmcblk0p6
strings: /dev/block/mmcblk0p6: Permission denied
1|[email protected]:/ $
I had to be able to find an unlock code after entering that line, and that's what I was trying to do. Am I wrong? And if I am, what is the way to do it?(unlock SIM) As I said before, the phone is s-off and rooted, but the bootloader is locked (thats what it says) and I have no recovery (I wasn't able to install one).
tx3m said:
What I get is:
C:\Android>adb shell
[email protected]:/ $ strings -n 8 /dev/block/mmcblk0p6
strings -n 8 /dev/block/mmcblk0p6
strings: /dev/block/mmcblk0p6: Permission denied
1|[email protected]:/ $
I had to be able to find an unlock code after entering that line, and that's what I was trying to do. Am I wrong? And if I am, what is the way to do it?(unlock SIM) As I said before, the phone is s-off and rooted, but the bootloader is locked (thats what it says) and I have no recovery (I wasn't able to install one).
Click to expand...
Click to collapse
you can't install a custom recovery because your bootloader is locked so you can't use any fastboot command to flash the recovery
first flash 3.33 universal from here
http://forum.xda-developers.com/showthread.php?t=1459767
it will give you a patched hboot also which is unlocked
follow the instructions to the letter
and before flashing check md5 sums(important)
after that flash a custom recovery
then start again the unlock method
rzr86 said:
you can't install a custom recovery because your bootloader is locked so you can't use any fastboot command to flash the recovery
first flash 3.33 universal from here
http://forum.xda-developers.com/showthread.php?t=1459767
it will give you a patched hboot also which is unlocked
follow the instructions to the letter
and before flashing check md5 sums(important)
after that flash a custom recovery
then start again the unlock method
Click to expand...
Click to collapse
May be a noob question, but how do I check the md5 sums on windows? I was always doing it through recovery on the phone, but now I dont have one?
tx3m said:
May be a noob question, but how do I check the md5 sums on windows? I was always doing it through recovery on the phone, but now I dont have one?
Click to expand...
Click to collapse
you can do it also with any file manager to check md5 sums
from pc use md5 checker
rzr86 said:
you can do it also with any file manager to check md5 sums
from pc use md5 checker
Click to expand...
Click to collapse
So I just did what you suggested. Here is what appeared on the screen after entering the same code:
Code:
C:\Android>adb shell
[email protected]:/ $ su
su
[email protected]:/ # strings -n 8 /dev/block/mmcblk0p6
strings -n 8 /dev/block/mmcblk0p6
macaddr=1C:B0:94:F0:DB:D7
sromrev=3
vendid=0x14e4
devid=0x432f
boardtype=0x4b9
boardrev=0x36
boardflags=0x200
xtalfreq=37400
pa0b0=5190,5190,5576
pa0b1=64229,64229,64172
pa0b2=65121,65121,65155
pa0itssit=62
pa0maxpwr=82
ofdmpo=0xCC888888
mcs2gpo0=0xCCCC
mcs2gpo1=0xCCCC
rssismf2g=0xa,0xa,0xa
rssismc2g=0xb,0xb,0xa
rssisav2g=0x3,0x3,0x3
rcal_flag=0x61
ccode=ALL
cctl=0x0
cckdigfilttype=0
ofdmdigfilttype=1
rxpo2g=0
boardnum=1
otpimagesize=182
hwhdr=0x05ffff031030031003100000
RAW1=80 32 fe 21 02 0c 00 22 2a 01 01 00 00 c5 0 e6 00 00 00 00 00 40 00 00 ff f
f 80 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 00 00 00 00 00 00 00 00 00 00 ff
20 04 D0 2 29 43 21 02 0c 00 22 04 00 20 00 5A
sd_gpout=0
sd_oobonly=1
rssi_offset=0
20130518
4109125C01997
HT15RT503206
HT15RT503206
MB320T501997
MB320T501997
99HNA003-02
CF93FF83
4109125C01997
PG5810000
T-MOB010
PG5810000
1CB094F0DBD7
2013/05/18
35506604772****
T-MOB010
v:@"C#@,/
[email protected]:/ #
So I guess trying to get a code didn't work. I'll try the other suggested method in the same thread. Thanks again for your help
EDIT: After trying the second method it worked just fine. I'm free again ) Thanks again bro
tx3m said:
So I just did what you suggested. Here is what appeared on the screen after entering the same code:
Code:
C:\Android>adb shell
[email protected]:/ $ su
su
[email protected]:/ # strings -n 8 /dev/block/mmcblk0p6
strings -n 8 /dev/block/mmcblk0p6
macaddr=1C:B0:94:F0:DB:D7
sromrev=3
vendid=0x14e4
devid=0x432f
boardtype=0x4b9
boardrev=0x36
boardflags=0x200
xtalfreq=37400
pa0b0=5190,5190,5576
pa0b1=64229,64229,64172
pa0b2=65121,65121,65155
pa0itssit=62
pa0maxpwr=82
ofdmpo=0xCC888888
mcs2gpo0=0xCCCC
mcs2gpo1=0xCCCC
rssismf2g=0xa,0xa,0xa
rssismc2g=0xb,0xb,0xa
rssisav2g=0x3,0x3,0x3
rcal_flag=0x61
ccode=ALL
cctl=0x0
cckdigfilttype=0
ofdmdigfilttype=1
rxpo2g=0
boardnum=1
otpimagesize=182
hwhdr=0x05ffff031030031003100000
RAW1=80 32 fe 21 02 0c 00 22 2a 01 01 00 00 c5 0 e6 00 00 00 00 00 40 00 00 ff f
f 80 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 00 00 00 00 00 00 00 00 00 00 ff
20 04 D0 2 29 43 21 02 0c 00 22 04 00 20 00 5A
sd_gpout=0
sd_oobonly=1
rssi_offset=0
20130518
4109125C01997
HT15RT503206
HT15RT503206
MB320T501997
MB320T501997
99HNA003-02
CF93FF83
4109125C01997
PG5810000
T-MOB010
PG5810000
1CB094F0DBD7
2013/05/18
35506604772****
T-MOB010
v:@"C#@,/
[email protected]:/ #
So I guess trying to get a code didn't work. I'll try the other suggested method in the same thread. Thanks again for your help
Click to expand...
Click to collapse
yeap it doesn't show you the unlock code above your imei number
but i just remembered something else
in order to use the unlock process you have to be on gb firmware(that means 1.17 or1.18 hboot version)
it was a mistake from my side to tell you to flash 3.33 universal
but you can flash gb firmware from the firmware thread again(don't forget to check md5 sums again too)
then try the unlock process again
there is a way to do it also with 1.27 hboot version but i am still looking for it
edit:i think i found it
http://forum.xda-developers.com/showthread.php?p=27813767#post27813767 (post #531)
Like the alternate Nokia 8.1 Bootloader Unlock method before, here's what you need:
- TWRP accessibility with proper bootloader downgrading. You must use Chinese 7to TWRP I posted last year (In Nokia 6 Root Guide) to achieve this (either 3.1.1 or 3.2.1 are OK), so downgrading the bootloader back to Nougat is necessary.
If your phone still stay at Android 7 or 8, great, you're welcome to NB1-Collision method.
As I've introduced in Nokia 8.1 forum:
Since it uses the unlock key from Nokia 8 and I tricked the phone as Nokia 8, I called the unlock method "NB1-Collision".
Click to expand...
Click to collapse
The identification to verify if the unlock key valid is located at deviceinfo partition, and here are the offsets:
SN: 0x00000010
IMEI1: 0x00002010
Still, editing the IMEI1 here will not change the actual IMEI stored at NVRAM, so you can't use this to do anything illegal.
If you know the point, you can unlock your phone without reading this guide. In case you don't, let me tell you how.
Part 0: Obtain an official unlock key for Nokia 8, and you must know it's IMEI1 and SN
Same as before, I will not provide mine, please do it yourself.
Part 1: Boot to TWRP
Skip this part if you can boot to TWRP already. Just boot to TWRP and do Part 2.
To make sure the phone will definitely boot to TWRP with proper signature, you can flash TWRP to boot partition directly:
Code:
fastboot oem dm-verity (md5)
fastboot flash aboot /path/to/D1C-0-331A-emmc_appsboot_service.mbn
fastboot reboot-bootloader
fastboot oem dm-verity (md5)
fastboot flash boot /path/to/7to-twrp.img
The extraction password of the service bootloader zip is "WLBGFIH123", in case you want to know.
Then reboot to the TWRP:
Code:
fastboot reboot
OK, now you've entered the TWRP.
Part 2: Dump the deviceinfo partition and hack it
If you're familiar with adb commands, here's how:
Code:
adb shell dd if=/dev/block/bootdevice/by-name/deviceinfo of=/tmp/deviceinfo.img
adb pull /tmp/deviceinfo.img
The rest of the procedure are straight forward. Use a Hex Editor to edit the deviceinfo partition:
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 46 49 48 45 32 50 5F 42 00 00 00 00 01 00 00 00 FIHE2P_B........
00000010 4E 42 31 47 41 44 32 37 38 30 30 31 32 33 34 35 NB1GAD2780012345
00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00002000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002010 31 32 33 34 35 36 37 38 39 30 31 32 33 34 37 00 123456789012347.
00002020 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 00 xxxxxxxxxxxxxxx.
And save it as deviceinfo_mod.img.
Push it back to your phone, along with new version of emmc_appsboot, either service or retail are OK - you can extract it from recent OTA packages.
Code:
adb push /path/to/deviceinfo_mod.img /tmp/d1
adb push /path/to/D1C-0-562H-emmc_appsboot.mbn /tmp/d2
adb shell dd if=/tmp/d1 of=/dev/block/bootdevice/by-name/deviceinfo
adb shell dd if=/tmp/d2 of=/dev/block/bootdevice/by-name/aboot
adb reboot bootloader
Part 3: Unlock the bootloader
Code:
fastboot flash unlock /path/to/unlock.key
fastboot flashing unlock_critical
Your phone will reboot immediately. Don't stop right here, execute following command straight forward:
Code:
fastboot oem alive
When fastboot responsed OKAY, please proceed:
Code:
fastboot flash unlock /path/to/unlock.key
fastboot oem unlock-go
All done. Your phone has unlocked bootloader.
Part 4: Restore original deviceinfo and reinstall stock firmware with OST LA
Code:
fastboot flash deviceinfo /path/to/deviceinfo.img
I needn't to mention how to flash stock firmware with OST LA or NOST.
FYC, firmware can be downloaded from https://fih-firmware.hikaricalyx.com/hmd_en.html#d1c .
Good luck then!
Specially thanks to HMD Global for releasing official Nokia 8 bootloader unlock, otherwise it would be impossible.
I was think about this method before you release. But noone provide me the unlock.key, so I cancel to research this method. But thank for your effort
Elvaa said:
I was think about this method before you release. But noone provide me the unlock.key, so I cancel to research this method. But thank for your effort
Click to expand...
Click to collapse
You can ask for an existing unlock key requested, before the_laser got banned here as alternate method.
But you also need to know it's IMEI1 and SN.
So, you can't flash new emmc_appsboot after you hacked deviceinfo partition.
You can upload the file: deviceinfo.img edited to NB1 and we just need to save the stock deviceinfo.img of the device. And flash directly your deviceinfo.img.
That would be faster
App Unlockbootloader.apk :
Messages Error: Device not support.
???
taicracker said:
You can upload the file: deviceinfo.img edited to NB1 and we just need to save the stock deviceinfo.img of the device. And flash directly your deviceinfo.img.
That would be faster
Click to expand...
Click to collapse
You can't simply do this. As I mentioned before, deviceinfo partition contains unique and critical credentials for your phone, and it will not accept the credentials from other devices.
Also, deviceinfo partition contains your IMEI, and disclose IMEI here is strictly forbidden.
The Unlock.key
Can you Explain me Little About The Unlock Key Please
Việt nam
Until now, it is possible to root nokia 6 ta 1021 android 8.1.0
hikari_calyx said:
You can't simply do this. As I mentioned before, deviceinfo partition contains unique and critical credentials for your phone, and it will not accept the credentials from other devices.
Also, deviceinfo partition contains your IMEI, and disclose IMEI here is strictly forbidden.
Click to expand...
Click to collapse
WARNING: This package is never meant for non-experienced members!
Chinese translation of this guide is on the way. (本教程的中文版仍在编写中)
Code:
#include <std_disclaimer.h>
/*
* Your warranty is now void. *
* I am not responsible for bricked devices, dead SD cards,
* thermonuclear war, or you getting fired because the alarm app failed.
Please do some research if you have any concerns about features included in this ROM before flashing it! YOU are choosing to make these modifications, and if you point the finger at me for messing up your device, I will laugh at you.
*/
We changed the flashing procedure this time, so it will:
- Prevent noobs without any experiences
- Avoid installing many dumb security updates
Target: PDA-311A-0-00WW-B02
Now it's available for public.
Please download and install this to your phone via ADB sideload of 874 command: https://android.googleapis.com/pack.../ace851ea59294177f677018648d6c0614317510e.zip
To Chinese Nokia X5 owners: Please convert your phone to Global Nokia 5.1 Plus before flashing, and don't forget to change SKUID to 600WW.
What's the requirement for flashing?
- Nokia 5.1 Plus X5 with Global Android one firmware installed (any version)
- Rooted phone (either MTK-SU or regular root method are OK)
Or:
- The Bootloader is Unlocked
Here's how (if rooted):
Due to the spelling error of the script, the correct one is attached below.
Please replace it to the one inside package, if you want to use "Click_Me_To_Flash.cmd"..
Click to expand...
Click to collapse
- Download the package and extract it. You'll get 17 img files, and 6 other files.
- Create one directory called "pda-3110" on your phone's internal storage. THIS IS CASE SENSITIVE, so don't use uppercase "PDA".
- Copy all the img files to the pda-3110 directory.
- Execute this under command prompt:
Code:
adb shell
- Check what's your current slot:
Code:
getprop ro.boot.slot_suffix
Take a note whether the slot is "_a" or "_b".
- Grant root permission:
Code:
su
If necessary, grant root permission on the phone. If grant successful, you'll see the dollar ($) symbol will become into hash (#) symbol.
If your phone is rooted with MTK-SU, you must do this:
- Open Magisk Manager and install Magisk on another slot.
After installation complete, stay at installation complete screen and don't reboot.
- Now execute following commands.
If current slot is "_a", then execute these:
Code:
dd if=/storage/emulated/0/pda-3110/boot.img of=/dev/block/bootdevice/by-name/boot_b
dd if=/storage/emulated/0/pda-3110/cam_vpu1.img of=/dev/block/bootdevice/by-name/cam_vpu1_b
dd if=/storage/emulated/0/pda-3110/cam_vpu2.img of=/dev/block/bootdevice/by-name/cam_vpu2_b
dd if=/storage/emulated/0/pda-3110/cam_vpu3.img of=/dev/block/bootdevice/by-name/cam_vpu3_b
dd if=/storage/emulated/0/pda-3110/cda.img of=/dev/block/bootdevice/by-name/cda_b
dd if=/storage/emulated/0/pda-3110/lk.img of=/dev/block/bootdevice/by-name/lk_b
dd if=/storage/emulated/0/pda-3110/logo.img of=/dev/block/bootdevice/by-name/logo_b
dd if=/storage/emulated/0/pda-3110/md1img.img of=/dev/block/bootdevice/by-name/md1img_b
dd if=/storage/emulated/0/pda-3110/odmdtbo.img of=/dev/block/bootdevice/by-name/odmdtbo_b
dd if=/storage/emulated/0/pda-3110/preloader.img of=/dev/block/bootdevice/by-name/preloader_b
dd if=/storage/emulated/0/pda-3110/scp.img of=/dev/block/bootdevice/by-name/scp_b
dd if=/storage/emulated/0/pda-3110/spmfw.img of=/dev/block/bootdevice/by-name/spmfw_b
dd if=/storage/emulated/0/pda-3110/sspm.img of=/dev/block/bootdevice/by-name/sspm_b
dd if=/storage/emulated/0/pda-3110/system.img of=/dev/block/bootdevice/by-name/system_b
dd if=/storage/emulated/0/pda-3110/systeminfo.img of=/dev/block/bootdevice/by-name/systeminfo_b
dd if=/storage/emulated/0/pda-3110/tee.img of=/dev/block/bootdevice/by-name/tee_b
dd if=/storage/emulated/0/pda-3110/vendor.img of=/dev/block/bootdevice/by-name/vendor_b
If current slot is "_b":
Code:
dd if=/storage/emulated/0/pda-3110/boot.img of=/dev/block/bootdevice/by-name/boot_a
dd if=/storage/emulated/0/pda-3110/cam_vpu1.img of=/dev/block/bootdevice/by-name/cam_vpu1_a
dd if=/storage/emulated/0/pda-3110/cam_vpu2.img of=/dev/block/bootdevice/by-name/cam_vpu2_a
dd if=/storage/emulated/0/pda-3110/cam_vpu3.img of=/dev/block/bootdevice/by-name/cam_vpu3_a
dd if=/storage/emulated/0/pda-3110/cda.img of=/dev/block/bootdevice/by-name/cda_a
dd if=/storage/emulated/0/pda-3110/lk.img of=/dev/block/bootdevice/by-name/lk_a
dd if=/storage/emulated/0/pda-3110/logo.img of=/dev/block/bootdevice/by-name/logo_a
dd if=/storage/emulated/0/pda-3110/md1img.img of=/dev/block/bootdevice/by-name/md1img_a
dd if=/storage/emulated/0/pda-3110/odmdtbo.img of=/dev/block/bootdevice/by-name/odmdtbo_a
dd if=/storage/emulated/0/pda-3110/preloader.img of=/dev/block/bootdevice/by-name/preloader_a
dd if=/storage/emulated/0/pda-3110/scp.img of=/dev/block/bootdevice/by-name/scp_a
dd if=/storage/emulated/0/pda-3110/spmfw.img of=/dev/block/bootdevice/by-name/spmfw_a
dd if=/storage/emulated/0/pda-3110/sspm.img of=/dev/block/bootdevice/by-name/sspm_a
dd if=/storage/emulated/0/pda-3110/system.img of=/dev/block/bootdevice/by-name/system_a
dd if=/storage/emulated/0/pda-3110/systeminfo.img of=/dev/block/bootdevice/by-name/systeminfo_a
dd if=/storage/emulated/0/pda-3110/tee.img of=/dev/block/bootdevice/by-name/tee_a
dd if=/storage/emulated/0/pda-3110/vendor.img of=/dev/block/bootdevice/by-name/vendor_a
- Now back to Magisk Manager.
If your phone is rooted with MTK-SU:
Tap Reboot on installation complete screen now, and enjoy Android 10.
If your phone is rooted with regular method (which is, latest Magisk installed properly):
- Open Magisk Manager and install Magisk on another slot.
After installation complete, reboot immediately. Then you should be able to enjoy Android 10 with rooted state.
And here's how (if bootloader unlocked and prefer flashing via fastboot):
- Download the package and extract it. You'll get 17 img files, and 6 other files.
- Use some hex editor (e.g. HxD) to open preloader.img file, and remove the content from 0x0-0x7FF, save it.
Because fastboot will flash preloader.img file you inputted to the offset 0x7FF of actual fastboot partitions, so we must remove header from preloader.img dump, otherwise it will kill the phone.
- After removing header, file size should be 284,672 bytes (278 KiB).
Content range for reference:
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 45 4D 4D 43 5F 42 4F 4F 54 00 00 00 01 00 00 00 EMMC_BOOT.......
00000010 00 02 00 00 FF FF FF FF FF FF FF FF FF FF FF FF ....ÿÿÿÿÿÿÿÿÿÿÿÿ
00000020 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000007E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000007F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000800 4D 4D 4D 01 38 00 00 00 46 49 4C 45 5F 49 4E 46 MMM.8...FILE_INF
00000810 4F 00 00 00 01 00 00 00 01 00 05 05 10 0F 20 00 O............. .
And here's after removed:
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 4D 4D 4D 01 38 00 00 00 46 49 4C 45 5F 49 4E 46 MMM.8...FILE_INF
00000010 4F 00 00 00 01 00 00 00 01 00 05 05 10 0F 20 00 O............. .
00000020 44 4E 04 00 00 00 08 00 F0 00 00 00 6C 06 00 00 DN......ð...l...
00000030 F0 00 00 00 01 00 60 C2 4D 4D 4D 01 0C 00 01 00 ð.....`ÂMMM.....
00000040 01 00 00 00 4D 4D 4D 01 64 00 07 00 90 00 00 00 ....MMM.d.......
00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
- Use img2simg to convert system.img and vendor.img into sparse images.
If you're Windows user, please find img2simg binaries yourself.
This is known available by default on Ubuntu and Debian (sudo apt install img2simg).
Code:
img2simg system.img system.simg
img2simg vendor.img vendor.simg
- Check current slot:
Code:
fastboot getvar current-slot
In this case, the current slot is a.
- Flash these partitions (including modified preloader) to the slot you currently have (slot a in this case):
Code:
fastboot flash boot_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/boot.img
fastboot flash cam_vpu1_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/cam_vpu1.img
fastboot flash cam_vpu2_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/cam_vpu2.img
fastboot flash cam_vpu3_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/cam_vpu3.img
fastboot flash cda_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/cda.img
fastboot flash lk_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/lk.img
fastboot flash logo_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/logo.img
fastboot flash md1img_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/md1img.img
fastboot flash odmdtbo_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/odmdtbo.img
fastboot flash preloader_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/preloader_header_removed.img
fastboot flash scp_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/scp.img
fastboot flash spmfw_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/spmfw.img
fastboot flash sspm_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/sspm.img
fastboot flash system_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/system.simg
fastboot flash systeminfo_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/systeminfo.img
fastboot flash tee_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/tee.img
fastboot flash vendor_a /path/to/HCTSW_PDA-3110-0-00WW-B01_600WW_10_20200405.fdump.lzma2/vendor.simg
fastboot -w reboot
- After reboot, enjoy Android 10.
Download link:
AFH: https://www.androidfilehost.com/?fid=4349826312261767469
SHA256 Checksum: f000263c677ff7f0963a34ece67ecaa2ceb16089e3aa1887dddbbe20d46d590c
FAQ
Q1: Why you don't just leak OTA packages like before?
A1: This time I don't want to make my life harder in the future.
Q2: When Android 10 will be pushed to my country?
A2: I don't know. I even don't know when HMD Chinese localization team will be back. So no hope for localized Android 10 for Nokia X5 now.
Q3: How can I rollback to Android 9 if not satisfied?
A3: If not bootloader unlocked, switch the slot back to A under fastboot mode, then flash the phone with SP Flash Tool (Download only). Always backup the whole emmc to for the worst case.
If unlocked, use NFT featured on Nokia 7.2 forum: https://forum.xda-developers.com/nokia-7-2/development/tool-nft-1-0-1-nokia-flash-tool-to-t4003267
Q4: How can I unlock the bootloader?
A4: It's paid method and how to request cannot be disclosed here, or it will violate the rules of XDA.
Q5: My phone is bricked!
A5: I'm not responsible at all. We tested it on Nokia X5 sold in China already.
Q6: Can I use GCam?
A6: No. Nokia 5.1 Plus X5 doesn't support Camera2API at all, so no GCam.
Q7: What does HCTSW stand for?
A7: Hikari Calyx Tech SoftWare.
Reserved #2
Can I roll back to android 9 if I change my active partition to a if installed android 10 on b ??
bx2_nero said:
Can I roll back to android 9 if I change my active partition to a if installed android 10 on b ??
Click to expand...
Click to collapse
Probably yes, but you need to perform factory reset under stock recovery before switching slot.
Any reported bug by your tester?
bx2_nero said:
Any reported bug by your tester?
Click to expand...
Click to collapse
CTS probably cannot be passed which expected.
After that, didn't see any bug so far.
One known issue:
- This Android 10 build seems cannot be rooted with regular procedure of Magisk Manager.
hikari_calyx said:
One known issue:
- This Android 10 build seems cannot be rooted with regular procedure of Magisk Manager.
Click to expand...
Click to collapse
That means no payment app will work because of SafetyNet and no magisk so no bypassing that.
hikari_calyx said:
One known issue:
- This Android 10 build seems cannot be rooted with regular procedure of Magisk Manager.
Click to expand...
Click to collapse
In MTK-SU thread it says that any update after March 20 will block temp root , so I think April security patch fixed the MTK-SU method and it is included in the Android 10 build.
Tips to users who want to downgrade the phone:
- You must perform a regular factory reset on settings (Don't do factory reset on recovery or you will get stuck at FRP lock that requires you to install further updates)
After reset done, don't connect the phone to Internet and just reboot to fastboot mode.
- Switch the slot to A under fastboot mode right after factory reset.
Code:
fastboot --set-active=a
- Use SP Flash Tool to flash any Android 9 firmware on following website:
https://fih-firmware.hikaricalyx.com/hmd_en.html#pda
Any PDA-2***-0-00WW-B** (excluding PDA-209B-0-00WW-B06) are OK. I recommend PDA-214A-0-00WW-B01.
- Skip wifi connection at first boot, or you'll be asked to install latest updates and MTK-SU will be blocked.
- root the phone and follow the guide on topic.
I strongly recommend you, don't login Google account until everything is done.
Three Bugs noticed So far in Android™ 10 beta
1◆ Swiping left (The back button should appear on left) toggles back button on Right side
2◆Accent color: Color changes for text and not. bar but not in settings
3◆A white bar appearing above when using apps
To subscribers of this topic:
PDA-311A-0-00WW-B01 minor patch released!
What's new? I don't know - I don't have access to their changelog at all.
But, to install it, you must have PDA-3110-0-00WW-B01 installed and install the package via external SD card. ADB Sideload is unavailable.
https://www.androidfilehost.com/?fid=4349826312261794057
Cannot run su in adb
i have acquired root in phone with mtksu and suboot with magisk , but getting permission denied output when trying to run su in cmd. Shouldi I run mtksu through cmd? I tried doing that but I was getting cannot find su command.
xdriv3r said:
i have acquired root in phone with mtksu and suboot with magisk , but getting permission denied output when trying to run su in cmd. Shouldi I run mtksu through cmd? I tried doing that but I was getting cannot find su command.
Click to expand...
Click to collapse
Make sure that you have acquired root access buy using any root checker , then change the installation to inactive slot in magisk and wait on the same screen after it is successful, it will prompt to reboot..don't reboot open cmd and flash A10 beta , 'su' command should give a prompt on your phone to allow root access in adb , allow that then only you will be able to use the dd commands.
Dm me if you need further assistance.
bx2_nero said:
Make sure that you have acquired root access buy using any root checker , then change the installation to inactive slot in magisk and wait on the same screen after it is successful, it will prompt to reboot..don't reboot open cmd and flash A10 beta , 'su' command should give a prompt on your phone to allow root access in adb , allow that then only you will be able to use the dd commands.
Dm me if you need further assistance.
Click to expand...
Click to collapse
Successfully flashed Android 10 Beta. Thank you all so much.
Is it possible to factory reset the device?
xdriv3r said:
Is it possible to factory reset the device?
Click to expand...
Click to collapse
After the installation of A10 beta ... absolutely....and it will make it more stable.
bx2_nero said:
After the installation of A10 beta ... absolutely....and it will make it more stable.
Click to expand...
Click to collapse
I'll factory reset from the Android settings?
xdriv3r said:
I'll factory reset from the Android settings?
Click to expand...
Click to collapse
Yes you can.
I have an Android device with a QComm SDM680 SOC. The QCom part# of the SOC is SM6225.
How do I find the "hw_soc_version" and "soc_version" of the SDM680/SM6225 ?
I've found some general scripts that collate this type of info, like this one. But the SDM680 is not in any of those lists.
I've searched on the rooted device, grepped the kernel logs and the kernel opensource. fastboot getvar all doesn't expose this info either.
Does anybody know how to find these values?
Oh, that's easy. You just run an EDL client, they always ask the HWID.
You don't even need to have a loader for it.
On my EDL client just:
Code:
C:\>edl /l
Found EDL 9008
Serial: 12345678
HWID: 000cc0e100000000, QC: 000cc0e1, OEM: 0000, Model: 0000
Hash: 7be49b72f9e43372-23ccb84d6eccca4e-61ce16e3602ac200-8cb18b75babe6d09
You can also attach a UART while booting.
Code:
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.XF.1.4-00246-S660LZB-1
S - IMAGE_VARIANT_STRING=Sdm660LA
S - OEM_IMAGE_VERSION_STRING=cibuild
S - Boot Interface: Unknown
S - Secure Boot: Off
S - Boot Config @ 0x00786070 = 0x000001c1
S - JTAG ID @ 0x00786130 = 0x000cc0e1
Note that even though this is a SDM636 the log speaks of 660, but the "JTAG ID" is the correct HWID.
Usually the certs in xbl/abl has the HW_ID in it.
Also:
Code:
Teletex string 11 3007 0000 0000 0000 0000 0000 0000 0000 0000 0000 SOC_VERS
(I've never run into this soc_version before.)
Also, AFAIK, your friendly Firehose loader repository doesn't have a loader for this.
Edit: Oh, you're not looking for the HWID?
Renate said:
Oh, that's easy. You just run an EDL client, they always ask the HWID.
You don't even need to have a loader for it.
On my EDL client just:
Code:
C:\>edl /l
Found EDL 9008
Serial: 12345678
HWID: 000cc0e100000000, QC: 000cc0e1, OEM: 0000, Model: 0000
Hash: 7be49b72f9e43372-23ccb84d6eccca4e-61ce16e3602ac200-8cb18b75babe6d09
...
Edit: Oh, you're not looking for the HWID?
Click to expand...
Click to collapse
Thanks for the tip. I checked the SAHARA output. It seems that this HWID consists of the MSM_ID+OEM+MODEL. For the SDM680 I got: HW_ID: 0x001b80e100000000 (MSM_ID=0x001b80e1 OEM_ID=0x0000 MODEL_ID=0x0000).
Looking at bkerler's qualcomm_config.py, it seems that the hw_soc_version and hwid are two different things. For example for the SDM660, the msmid entry is 0x08C0E1, with a comment that the soc_hw_version is different:
Code:
0x08C0E1: "SDM660", # 0x30060000 soc_hw_version
Renate said:
Usually the certs in xbl/abl has the HW_ID in it.
Click to expand...
Click to collapse
Even though it's about the hwid, I looked into this too. It seems that around 2016, the HWID was stored in OU fields in the certificiates in the XBL file (see pages 10-11). But after 2019, it is now stored in the metadata of the MBN image (see page 9) within the XBL file. I only mention it because I thought it might prove useful for you.
Curiously, the HWID wasn't in the certs or metadata in my stock ROM's xbl.elf. Strange.
Yahoo Mike said:
For the SDM680 I got: HW_ID: 0x001b80e100000000...
Click to expand...
Click to collapse
The good news for you is that it's not stamped OEM/model.
There's some chance that this is not SecureBoot.
Which means that any loader that's compatible with your SoC will work.
What does this say: fastboot getvar secure
What does this say: cat /proc/cpuinfo (Just the name line.)
You can also look in the DTB, either decoded or raw, it's at the beginning.
Then there's the other wrinkle that Qualcomm has SDM numbers, MSM numbers and code names for SoCs.
Maybe that cpuinfo will tell you a codename.
Renate said:
The good news for you is that it's not stamped OEM/model.
There's some chance that this is not SecureBoot.
Which means that any loader that's compatible with your SoC will work.
What does this say: fastboot getvar secure
Click to expand...
Click to collapse
I think SecureBoot is on. I've had to do a test-points recovery a few times - after I tried to run with a patched (and incorrectly signed) ABL.
In fastbootd & bootloader menus, it says SecureBoot is on. And (as you suggested) fastboot utility agrees:
Code:
C:\>fastboot getvar secure
secure: yes
Finished. Total time: 0.001s
Renate said:
What does this say: cat /proc/cpuinfo (Just the name line.)
You can also look in the DTB, either decoded or raw, it's at the beginning.
Then there's the other wrinkle that Qualcomm has SDM numbers, MSM numbers and code names for SoCs.
Maybe that cpuinfo will tell you a codename.
Click to expand...
Click to collapse
The codename is khaje.
Code:
TB128FU:/ # cat /proc/cpuinfo
Processor : AArch64 Processor rev 4 (aarch64)
...<info about 8 processors>...
Hardware : Qualcomm Technologies, Inc KHAJE
That agrees with the run-time /sys/devices/soc0/soc_id value of 518, which is "khaje" according to the stock ROM's /vendor/bin/init.qti.display_boot.sh and /vendor/bin/init.qcom.post_boot.sh.
Curiously, at the beginning of the DTB it says it's "Bengal":
Code:
00 00 00 03 00 00 00 33 00 00 00 00 51 75 61 6C .......3....Qual
63 6F 6D 6D 20 54 65 63 68 6E 6F 6C 6F 67 69 65 comm Technologie
73 2C 20 49 6E 63 2E 20 42 65 6E 67 61 6C 20 31 s, Inc. Bengal 1
47 62 20 44 44 52 20 48 44 2B 20 53 6F 43 00 00 Gb DDR HD+ SoC..
But at offset 0x2A62D0 it changes its name:
Code:
00 00 00 00 00 03 00 00 00 26 00 00 00 00 51 75 .........&....Qu
61 6C 63 6F 6D 6D 20 54 65 63 68 6E 6F 6C 6F 67 alcomm Technolog
69 65 73 2C 20 49 6E 63 2E 20 4B 68 61 6A 65 20 ies, Inc. Khaje
53 6F 43 00 00 00 00 00 00 03 00 00 00 0B 00 00 SoC.............
I can't believe how many different numbers/strings QCom has to describe a SoC: soc_id, codename, hwid, msm_id ... and the ever-elusive hw_soc_version.
Anyway, I'll load up this SoC's firehose program to bkerler's edl. I'll slip in a question about how to query the hw_soc_version. I'll post back any reply.
Yahoo Mike said:
The codename is khaje.
Click to expand...
Click to collapse
Khajeh is a city in Iran: https://en.wikipedia.org/wiki/Khajeh,_Iran
Yahoo Mike said:
Curiously, at the beginning of the DTB it says...
Click to expand...
Click to collapse
That's because you are probably looking at multiple DTBs.
You can simply grep/scan for "Qualcomm Technologies".
I don't know why they do that.
The abl scans through them and find the one that best matches.
S/N: 0x7BD1BDD5
HW ID: 0x001B80E10015006D -> HUAWEI
HASH: 0xB25DECD85D217F5D9B53DC3C42EF7846DCEF59DD3E0AF4D12606199F5099FF23D73C3AFFBE5EFBF421A81A197E41FDF5
PBL : 0x00000000
HASH TYPE: SHA384
DEV HASH: 0x0000003AC0D4
CPU : Undefined CPU: 001B80E10015006D