Database Info

[Q] Recovering an n8010 from the leaked and locked n8000 kitkat

First, I am not an expert. I cannot code, I do not produce ROMS in a kitchen. I can use google and I am determined and have learned bits. I offer what worked for me in the hope of helping others.
So, here’s the thing. Like others I went for the release version of KitKat for n8000 and by missing out the modem bit flashed it via Odin. Now the proper KitKat for n8010 comes out but it won’t update via odin, KIES is not happy either. I blame no one but me for this.
I figure it is the sboot that is the problem so I look for a way to flash without it. When I say “I figure” I mean I have put two and two together from many hours of google reading. I may be wrong but in the end I managed it.
Long story a little shorter I find Heimdall and I extracted the components from the n8010 kitkat update (I used winrar on the BTU version) and flashed them leaving out the sboot.img and tz.img bits as either would lead to failed flash. I now have a working n8010 with KitKat which under device, under settings, gives the n8010 build number and is recognised as an n8010 by kies.
It still says n8000 under download mode (due to locked sboot) but if I may get future updates via kies, as it recognises it as an n8010 and says it is up to date for now, then that works well enough for me.
Detailed instructions:
1. Download and unzip your update file of choice and extract the tar.md5 file to separate files. I used winrar but suspect 7-zip would work equally.
2. Download Heimdall (just Google it!).
3. Unzip Heimdall and you should have several files in the folder called Heimdall.exe, Heimdall-Frontend.exe, QtCore4.dll, QtGui4.dll, Readme.txt and drivers folder containing zadig.exe.
4. Run zadig.exe from the Drivers folder of the Heimdall Suite.
5. If you get an error as follows:
The program can't start because MSVCP100.dll is missing from your computer.
This means that you haven't installed the Microsoft Visual C++ 2010 runtimes. Download Microsoft Visual C++ 2010 Redistributable Package (x86) and install it. Use the x86 even if you are running 64 bit Windows.
6. Put you tab into Download mode (while the tab is OFF hold Volume Down + Power Button). Hook the tab up to you PC.
7. Once you’ve started Zadig.exe and connected to PC choose Options » List All Devices from the menu.
8. Select Samsung USB Composite Device or MSM8x60 or Gadget Serial or Device Name from the drop down menu. (If nothing relevant appears, try uninstalling any Samsung related Windows software, like Samsung Windows drivers and/or Kies).
9. Click Replace Driver (having selected "Install Driver" from the drop down list built into the button).
10. If you are prompted with a warning that the installer is unable to verify the publisher of the driver, select Install this driver anyway. You may receive two more prompts about security. Select the options that allow you to carry on.
11. You will need to re-install the Samsung drivers later if you want to run kies.
12. Run Heimdall-Frontend.exe.
13. Hit the utilities tab then detect button.
14. If it doesn’t say detected in the output box it will not work. Try to repeat the above steps. Use a different usb port or a different pc.
15. Now you need to create a pit file. Hit save as and give it a name. Then hit download and it will create a pit file for you.
16. Go to Flash tab and hit browse and find the pit file you created earlier.
17. Then hit the add button. You will notice a drop down menu has appeared next to partition name. Then if you look below under Partition ID in brackets it says what sort of file it needs. So for example MD5HDR in the drop down requires md5.img. Use browse to find the relevant file from the files you extracted in step 1 and select then hit add again. Then repeat this until you have selected all the extracted files EXCEPT sboot.img and tz.img.
18. Hit start.
19. Bask in your new updated n8010 without needing kies or odin.
If you want to repeat this on another tab you can create a heimdall install package using the partitions and pit file you’ve created using the create package tab.
Now comes the question...
I've found places that offer an app for testing whether the sboot is locked (not sure how useful that is?) but several also offer a method for replacing a locked sboot. Such as this batch file:
@ECHO Restore OLD BOOTLOADER N7100!
@pause
@ECHO --- STARTING ----
@ECHO --- WAITING FOR DEVICE
@files1\adb wait-for-device
@ECHO --- Restore BOOTLOADER ---
@files1\adb push sboot.bin /sdcard/sboot.bin
@files1\adb shell su -c "dd if=/sdcard/sboot.bin of=/dev/block/mmcblk0p1"
@files1\adb shell rm /sdcard/sboot.bin
@files1\adb reboot fota_bl
@pause
There are others for different Samsung devices but all have the same block/mmcblk0p1 as the block to replace the sboot. And I also found a common block for the tz.img; mmcblk0p2. My question is whether this would work for the n8010, could we edit this batch slightly, grab the relevant files from a n8010 kitkat update and then have a n8010 sboot again?
Just hoping someone is either expert enough to know or brave enough to try?

I was thinking on a different aproache.
Using the leaked firmware as a guide and UK firmware. Change the sboot.bin and the tz.img on UK firm to that one on the leaked. And try to flash trough Odin.
Enviado do meu OT-995 através de Tapatalk

That may also work.
What do you think of my suggested method to replace the sboot?
jika23 said:
I was thinking on a different aproache.
Using the leaked firmware as a guide and UK firmware. Change the sboot.bin and the tz.img on UK firm to that one on the leaked. And try to flash trough Odin.
Enviado do meu OT-995 através de Tapatalk
Click to expand...
Click to collapse

azureus139 said:
That may also work.
What do you think of my suggested method to replace the sboot?
Click to expand...
Click to collapse
Your method works very well for me. However, we need to find someone willing on XDA to find a solution to revert the bootloaders to N8010 from N8000.

I am downloading the gtn7100 kitkat and will extract to check whether they are the same size. That should get us one step closer. I am still not brave enough to use adb to replace the sboot until someone more expert can comment on whether it is likley to be same address on the n8010.
YOSEFE said:
Your method works very well for me. However, we need to find someone willing on XDA to find a solution to revert the bootloaders to N8010 from N8000.
Click to expand...
Click to collapse

In a tar file isn't something like the updater script like in a flashable zip. Cause if there is we should know with that where the sboot is flashed.

that batch file won't do it
Decided to give it a try after further research.
I learned what the different commands did and I made an edit of the batch file. All seemed to go well replacing the sboot and tz but it didn't work, still showing as n8000 in download mode.

azureus139 said:
Decided to give it a try after further research.
I learned what the different commands did and I made an edit of the batch file. All seemed to go well replacing the sboot and tz but it didn't work, still showing as n8000 in download mode.
Click to expand...
Click to collapse
perhaps that can help
http://forum.xda-developers.com/showthread.php?t=1944858

Sadly that will not help. I have discovered it is because the leaked n8000 kitkat rom has a knox bootloader which cannot, as far as I can discover, be replaced. Thank you for the suggestion.
ivica81 said:
perhaps that can help
http://forum.xda-developers.com/showthread.php?t=1944858
Click to expand...
Click to collapse

secure boot key is what your looking for
From past devices with SECURE.. NOT LOCKED boot loader.
This new knox boot loader is locked.. And im assuming.. that its locked with a SBK.. Secure boot key.. We had this issue back with the acer a 500. Where we could sign and flash a custom rom. If rom / android version was same or newer then the Versions set in the Secure boot key.
EVENTUALLY Someone found a way to Turn off that sbk . but this was only to those who had not yet flashed the sbk secure boot loader. So if today someone finds a fix for this.. It will ONLY Help those not in your situation . I think PEOPLE Should start screaming at and Protesting samsung that you DO not want there sbk boot loader as default on all devices and you should be able to remove it. But i can tell you. its a waster cause. and this device is not popular enough for someone to break up a the boot loader to get the sbk algorithms . LOok up the old threads ON THE ACER A500 Tablet.. you will see its Quite similar .
SO you are Likely STUCK...
Sorry . this is why i have NOT Flashed one of these roms on my n8013.. I will NOT Be in this situation..

Well I was already out of warranty so that isn't an issue and I have it working with the proper kitkat for my device so tbh I don't know what difference it really makes. It shows n8000 in download mode and I will have to do something tricky via heimdall for any future updates, is that the only difference? Does it mean no access to custom roms as so far I've been happy to use stock and remove all bloat so that won't be too bad for me personally although it would be a real pain for some.
erica_renee said:
From past devices with SECURE.. NOT LOCKED boot loader.
This new knox boot loader is locked.. And im assuming.. that its locked with a SBK.. Secure boot key.. We had this issue back with the acer a 500. Where we could sign and flash a custom rom. If rom / android version was same or newer then the Versions set in the Secure boot key.
EVENTUALLY Someone found a way to Turn off that sbk . but this was only to those who had not yet flashed the sbk secure boot loader. So if today someone finds a fix for this.. It will ONLY Help those not in your situation . I think PEOPLE Should start screaming at and Protesting samsung that you DO not want there sbk boot loader as default on all devices and you should be able to remove it. But i can tell you. its a waster cause. and this device is not popular enough for someone to break up a the boot loader to get the sbk algorithms . LOok up the old threads ON THE ACER A500 Tablet.. you will see its Quite similar .
SO you are Likely STUCK...
Sorry . this is why i have NOT Flashed one of these roms on my n8013.. I will NOT Be in this situation..
Click to expand...
Click to collapse

As i said i never flashed that on my device. I am thinking all the issues/ benefits quarks of having the n 8000 boot loader on a non n 8000 device.. There may be NO Disadvantage unless Samsung Chooses to change how they sign there roms and so on.I just think Samsung Should Give us a way to avoid this .

so would we be best to wipe data before doing this? just still have all the n8000 icons in the top corner like data icon etc.

I did no wipes and just flashed over the top. All apps and data as before but no phone icon.
JamesEsh said:
so would we be best to wipe data before doing this? just still have all the n8000 icons in the top corner like data icon etc.
Click to expand...
Click to collapse

Any news on restoring the n8010 bootloader? Would a jtag service be able to restore it?

raducux said:
Any news on restoring the n8010 bootloader? Would a jtag service be able to restore it?
Click to expand...
Click to collapse
Nothing from me. Everything I found says no way to unlock or replace the kitkat sboot. The n7100 apparently has a way but none for the 8xxx that I have found. Don't know what a jtag is?

fail to finish
azureus139 said:
Firstly, great guide
Extremely happy you made this guide.
I'm getting stuck though at the download on Heimdall
Either getting: Initialising connection... Detecting device... Claiming interface... Setting up interface... Initialising protocol... ERROR: Protocol initialisation failed! Releasing device interface...
OR
ERROR: Failed to send data!
really wanting to get my tablet back up and running as I only had it for a few days before i tried to update it/brick it with n8000
Just wondering if you can create a package in Heimdall or upload pit files as i'm struggling to make to get through.
thanks heaps!
Click to expand...
Click to collapse

If you can't get heimdall to detect your tablet then it isn't going to flash to it either so a pit file wouldn't help you. It looks like a driver problem. I'd try uninstalling any samsung drivers and / or kies then reinstalling the heimdall ones.
keevo2481 said:
azureus139 said:
Firstly, great guide
Extremely happy you made this guide.
I'm getting stuck though at the download on Heimdall
Either getting: Initialising connection... Detecting device... Claiming interface... Setting up interface... Initialising protocol... ERROR: Protocol initialisation failed! Releasing device interface...
OR
ERROR: Failed to send data!
really wanting to get my tablet back up and running as I only had it for a few days before i tried to update it/brick it with n8000
Just wondering if you can create a package in Heimdall or upload pit files as i'm struggling to make to get through.
thanks heaps!
Click to expand...
Click to collapse
Click to expand...
Click to collapse

This driver is too tired
Thought that could be the issue as it changes every time I reinstall the usb driver. Currently too tired. Going to do a fresh windows or Linux install on my spare computer so it's fresh to go and hopefully doesn't have driver issues. Will confirm how it goes either way. Computer needed an upgrade from 7->8.1 anyway.

wifi problem
hy guys i just did that the guide said everything is working very well i m on 4.4.2 stock samsung. But the WIFI is not working. :crying: can you help me how to fix?

totally bricked? Alcatel Pixi 3 (8) WiFi - model 8070

Hello. This Alcatel Pixi 3 tablet was meant as a gift add-on to an Orange (PL) LG G4c / Spirit LTE phone.
What is really weird is that there is no such model on Alcatel's website. It seems that this version was very unpopular.
It came with Lollipop 5.0.1 onboard. On boot screen it says ALCATEL onetouch Pixi3(8). on the back there is a sticker with Model: 8070 and some other numbers, but the thing is:
I was simply being an impatient one and i wanted to have this white boy rooted so i installed newest KingRoot. And it worked!
But then I've seen there's an app that does the magic and replaces kinguser with supersu. And it was called 'SuperSU Me', kind of.
Unfortunately it must have been a very old version (i tried the newest on my phone and it comes in two stages so it's different). After using it i don't remember if I ran su binary update but i think i did and then reboot. And of course it all went wrong after that.
It was stuck at the Alcatel boot animation, repeating itself endlessly. And instead of looking for solution i did something else. I went to the bootloader mode (vol+ and power) which lets you go into recovery or fastboot and i went to recovery. Where it actually says Android system recovery <3e> with additional line saying LRX21M and options apply update from ADB, sdcard, cache and some others.
So here's what I did: at first I wiped cache partition and then I wiped data ('wipe data/factory reset'). And this is mess.
There is no Alcatel animation, no more. Now it won't go further than this boot screen and it would just display this ALCATEL onetouch Pixi3(8) logo until it runs out of battery power. So i guess, that's my first bricked device for being naughty and too greedy to have some rooted stuff happening.
Please, is there any hope? Help?

Same Problem with Alcatel Pixi 3 (10) Model:8079!!!!

You might be able to restore ROM using Mobile upgrade tool from Alcatel. Or you can flash it with phone flash tool.

Hi @dam85 I found and downloaded "Mobile Upgrade S" tool from Alcatel's server directly (v4.2.8) but I cannot make the tool detect this Pixi 8070 model. The main Alcatel site doesn't have this model, so I got their tool from the Pixi 3 (8) 3G page. However, not sure what is missing as there seems to be a driver needed for the Alcatel tool to detect the table. Any idea? This 8070 model apparently uses quad-core MediaTek MT8127 processor.
I have purchased this device from a local shop, not via operator. Model is "TCL" and "8070" in the menus.
@Bethain: I had a friend who had to wipe and re-install the ROM on an Alcatel D5 phone, due to some boot loop like yours; and he was able to do that using the Alcatel Upgrade tool. Please try this and let us know how you did it and more importantly, which drivers you used on Windows! Thanks and good luck.

konsti said:
Hi @dam85 I found and downloaded "Mobile Upgrade S" tool from Alcatel's server directly (v4.2.8) but I cannot make the tool detect this Pixi 8070 model. The main Alcatel site doesn't have this model, so I got their tool from the Pixi 3 (8) 3G page. However, not sure what is missing as there seems to be a driver needed for the Alcatel tool to detect the table. Any idea? This 8070 model apparently uses quad-core MediaTek MT8127 processor.
Click to expand...
Click to collapse
It's true that this model is buried for some weird reason. You can't find anything specific for this model (pixi 3 (8) wifi), only for the 3g edition that is totally different hardware if I remember correctly.
I can suggest another option. I've managed to read back the stock rom from mine. I could send it to you and you can try to flash it with SP flash tool. If you're interested, pm me and I'll guide you.

Hi @dam85 thank you for posting back, it's great to hear that someone managed to work on this.
For the sake of information with others, can you kindly share info on the tools, versions (and if not asking too much, links here in XDA) that you used to extract the ROM? There's tonns of crap on the internet and some confusing driver versions found here, too...
I was battling with MtkDroid Tools 2.5.3 but I think I've installed the wrong VCOM driver, not sure if it supports the device (MT8127 processor) or perhaps I am doing something wrong.
The official Alcatel Mobile Upgrade S (v4.2.8 that I've installed) has a generic "One Touch Pixi 8" entry as you can see in the screen shot but I get some error when trying to connect my device. This is supposed to allow a download of an image to re-flash Alcatel devices... Perhaps this tool isn't compatible, as you say.
I have contacted Alcatel asking for support....
I haven't rooted nor I want to mess with that. Just wanted to make a safe backup of the current ROM. When I entered (official) the Recovery menu of the device (POWER + VOLup) there wasn't any entry in the options to "dump" the ROM on the SD, unfortunately.

konsti said:
For the sake of information with others, can you kindly share info on the tools, versions (and if not asking too much, links here in XDA) that you used to extract the ROM? There's tonns of crap on the internet and some confusing driver versions found here, too...
I was battling with MtkDroid Tools 2.5.3 but I think I've installed the wrong VCOM driver, not sure if it supports the device (MT8712 processor) or perhaps I am doing something wrong.
Click to expand...
Click to collapse
I'll post a mini guide later on how I did it. Also, I'd like to see a user with a bricked pixi to try and flash back the ROM to see if it can be revived!
konsti said:
The official Alcatel Mobile Upgrade S (v4.2.8 that I've installed) has a generic "One Touch Pixi 8" entry as you can see in the screen shot but I get some error when trying to connect my device. This is supposed to allow a download of an image to re-flash Alcatel devices... Perhaps this tool isn't compatible, as you say.
Click to expand...
Click to collapse
Yeap. I tried this one too, with vcom drivers up and running, but nothing happened. Maybe we'll have to wait for an update.
konsti said:
I have contacted Alcatel asking for support....
Click to expand...
Click to collapse
Looking forward to hear their answer.
konsti said:
I haven't rooted nor I want to mess with that. Just wanted to make a safe backup of the current ROM. When I entered (official) the Recovery menu of the device (POWER + VOLup) there wasn't any entry in the options to "dump" the ROM on the SD, unfortunately.
Click to expand...
Click to collapse
Just to make it clear. There is no way to dumb the rom with droid tools or sp flash tool without root. The most easy and safe way to root this tablet is with Kingroot v4.5. It's safe to use because there is an option for unroot inside the app (I've done it several times, it works flawlessly).

I am having the same exact issue and followed the same steps as you to get into this mess! Only difference is i am on a onetouch Pixi 7 i got from tmobile for free. Were you ever able to flash it back to stock and can you tell me how you did it if you were successful?

waldosdad said:
I am having the same exact issue and followed the same steps as you to get into this mess! Only difference is i am on a onetouch Pixi 7 i got from tmobile for free. Were you ever able to flash it back to stock and can you tell me how you did it if you were successful?
Click to expand...
Click to collapse
Hi @waldosdad I suggest you try obtaining the official Alcatel Mobile Upgrade S software from their site, this will hopefully download and restore your device. Please kindly post details on your model, CPU, which drivers you eventually managed to make work, on which Windows, etc.
http://www.alcatelonetouch.com/fr/assistance/telechargements/pixi_7.html
Click to expand...
Click to collapse
There's no ROM available for flashing except whatever backups private people do... Haven't found custom recovery either... I personally haven't rooted my Pixi 3 (8) to avoid that exact issue...
IMPORTANT EDIT:
I was browsing through the downloads section of Alcatel One Touch and found that for some reason, they have released more versions of the same "Mobile Upgrade S" for some other devices, rather than keeping a unified version across all platforms/tablets/products.
For example, found versions v4.3.0, or v4.4.1 in other devices, which could imply "newer" database or detection, inside Alcatel Mobile Upgrade S. As @dam85 told me, there may need to be a newer version of this proggie to detect Pixi 3 (8) -- will try it soon...

Hi guys i have the same tablet but i'm having problems rooting it. Tried many differnet apk's with no luck. @dam85 how you managed to root it?
Some extra info just to be sure:
Manufacturer: TCL
Model: 8070
Android Version: 5.0.1
Build ID: vN4BH2-AndroidL-KR080-EMEA_GREEK
Board ID: 8070
Chipset Platform: mt8127
Edit: Ok, it seems that i have used different versions of Kingroot (4.1, 4.8) except 4.5 that you mentioned. It worked now. Dumb me i guess..

spithash said:
Hi guys i have the same tablet but i'm having problems rooting it. Tried many differnet apk's with no luck. @dam85 how you managed to root it?
Some extra info just to be sure:
Manufacturer: TCL
Model: 8070
Android Version: 5.0.1
Build ID: vN4BH2-AndroidL-KR080-EMEA_GREEK
Board ID: 8070
Chipset Platform: mt8127
Edit: Ok, it seems that i have used different versions of Kingroot (4.1, 4.8) except 4.5 that you mentioned. It worked now. Dump me i guess..
Click to expand...
Click to collapse
Καλησπέρα @spithash, I suggest you try backing up your ROM now that you've rooted it, as @dam85 did already, as there's no ROM available for flashing back in case of bricking... I personally haven't rooted yet. If you manage to install proper Windows drivers etc. please let us know what you used i.e. SP Flash Tool, Mtk Droid Tools etc. Thanks!

konsti said:
Καλησπέρα @spithash, I suggest you try backing up your ROM now that you've rooted it, as @dam85 did already, as there's no ROM available for flashing back in case of bricking... I personally haven't rooted yet. If you manage to install proper Windows drivers etc. please let us know what you used i.e. SP Flash Tool, Mtk Droid Tools etc. Thanks!
Click to expand...
Click to collapse
So, i made a backup using MTK Droid Tools.
Is there a known way to flash a custom recovery on this device?
If i hit Recovery and Boot button in MTK Droid Tools it gives me this error: ERROR :Not read Block: bootimg

Yes

mohamedwinners said:
Yes
Click to expand...
Click to collapse
What is the "Yes" for? You managed to flash a custom recovery?

spithash said:
So, i made a backup using MTK Droid Tools.
Is there a known way to flash a custom recovery on this device?
If i hit Recovery and Boot button in MTK Droid Tools it gives me this error: ERROR :Not read Block: bootimg
Click to expand...
Click to collapse
You can flash it with SP flash tool. Read all my post first and then act.
Open the app, hit "scatter-loading" button, choose your droid tool-creater scatter file with the name of the cpu mt8127 (make sure you have the exctracted rom backup with it), then wait a few secs till the app done loading the files, check if the check boxes are checked and loaded with the appropriate image files as shown in the image.
Leave any unchecked box as is. Make sure to rename factory_NONmodified_recovery.img to recovery.img before doing the above process, or else the program won't load it automatically.
Then, press the green download arrow and connect the device switched off and the process will start automatically.
I can't guarantee the success of the process because I haven't try it yet, but I know that this process is correct for this type of devices.
So, you can take the risk if you want (if it's bricked already, you won't have anything to lose I guess) and you can give as feedback.

dam85 said:
You can flash it with SP flash tool. Read all my post first and then act.
Open the app, hit "scatter-loading" button, choose your droid tool-creater scatter file with the name of the cpu mt8127 (make sure you have the exctracted rom backup with it), then wait a few secs till the app done loading the files, check if the check boxes are checked and loaded with the appropriate image files as shown in the image.
Leave any unchecked box as is. Make sure to rename factory_NONmodified_recovery.img to recovery.img before doing the above process, or else the program won't load it automatically.
Then, press the green download arrow and connect the device switched off and the process will start automatically.
I can't guarantee the success of the process because I haven't try it yet, but I know that this process is correct for this type of devices.
So, you can take the risk if you want (if it's bricked already, you won't have anything to lose I guess) and you can give as feedback.
Click to expand...
Click to collapse
I think my backup is not right, there are many files missing. I tried several times.

Follow this guide http://forum.xda-developers.com/showthread.php?p=38337401

dam85 said:
Follow this guide http://forum.xda-developers.com/showthread.php?p=38337401
Click to expand...
Click to collapse
Create scatter file in MTK Tools is greyed out

spithash said:
Create scatter file in MTK Tools is greyed out
Click to expand...
Click to collapse
Edit the config file, remove every other mt entries and add the 8127 and try again
I've attached mine, if you want to use it.

dam85 said:
Edit the config file, remove every other mt entries and add the 8127 and try again
I've attached mine, if you want to use it.
Click to expand...
Click to collapse
i managed to create a scatter file from the firmware.info from backup using MTK Rom Studio but it doesn't seem right:
Edit: It gives me the same scatter file if i add the 8127.
---------- Post added at 05:17 PM ---------- Previous post was at 05:11 PM ----------
dam85 said:
I've attached mine, if you want to use it.
Click to expand...
Click to collapse
When i open yours is the same as mine.

[RESEARCH|MT8127] Bootloader hack ideas for LeapFrog Epic

I dunno, but I thought maybe I could make a separate thread about a possible way to poke into the LeapFrog Epic's preloader so it could accept unsigned images. LeapFrog won't spill the beans for us, as their staff (falsely) claims to know next to nothing about it, so unless we somehow managed to social-engineer them into giving us a signed ROM or an unlocked bootloader, our only chance is to patch it so it would ignore the lack of digital signatures.
What I've done so far is to run a strings check on the preloader and uboot binaries - fastboot seems watered down somehow as it lacked references to "oem unlock" and so on, but none of that Amazon Fire-style failsafe seems present from what I can tell.
Preloader: http://pastebin.com/H9QbzqC0
lk: http://pastebin.com/kSxRKYna
Boot files from the latest firmware revision are attached here, so if anyone is interested, please please please let me know so we can fix bricked units and finally port TWRP to this underrated kids' tablet.

blakegriplingph said:
I dunno, but I thought maybe I could make a separate thread about a possible way to poke into the LeapFrog Epic's preloader so it could accept unsigned images. LeapFrog won't spill the beans for us, as their staff (falsely) claims to know next to nothing about it, so unless we somehow managed to social-engineer them into giving us a signed ROM or an unlocked bootloader, our only chance is to patch it so it would ignore the lack of digital signatures.
Click to expand...
Click to collapse
Bumping the thread.
Would also like to know is this is possible
If I may ask, how did you extract the strings from preloader and lk? Did you use a hexeditor or there is another app?

Gibz97 said:
Bumping the thread.
Would also like to know is this is possible
If I may ask, how did you extract the strings from preloader and lk? Did you use a hexeditor or there is another app?
Click to expand...
Click to collapse
I used this utility to do a strings dump off an Epic ROM:
http://split-code.com/strings2.html
It did turn up some interesting stuff but I was wondering if a binwalk or perhaps an IDA disassembly analysis would do wonders so we can finally poke into this tablet.

blakegriplingph said:
I used this utility to do a strings dump off an Epic ROM:
http://split-code.com/strings2.html
It did turn up some interesting stuff but I was wondering if a binwalk or perhaps an IDA disassembly analysis would do wonders so we can finally poke into this tablet.
Click to expand...
Click to collapse
Thanks for the tool but I cannot seem find a way to use it.
 @gursewak.10 or @smartmanvartan please chime in to help us because they were able to hack the preloader of k4 note and lk of RCA Viking Pro respectively

I also know a friend who is willing to donate a spare Epic, if that helps.
As for using Strings2, the following batch script should work:
Code:
@echo off
strings2 %1 > test.txt
pause
Just drag a binary to be analysed into the batch file, and a resulting text file with strings and stuff should be generated.

Hello friend
You need to tweak lk to unlock bootloader . i am giving you my phone's both files(.you can easily compare them.
on unlocked bootloader u can flash unsigned images via write memory option of SP flash tool .
Try HxD hex editor

gursewak.10 said:
Hello friend
You need to tweak lk to unlock bootloader . i am giving you my phone's both files(.you can easily compare them.
on unlocked bootloader u can flash unsigned images via write memory option of SP flash tool .
Try HxD hex editor
Click to expand...
Click to collapse
Hmm, I can flash the preloader to my leapfrog via SPFT, but not anything else. Write memory works, and I can flash stuff one at a time to it, but I couldn't get the tablet to force itself out of flash/download mode and into normal mode. There's no reset button, and not even taking the battery off does the trick.

However, on my working Epic, I can alter the demo system image, flash it back using Write Memory and still end up with a working device, just as long as the preloader isn't messed with in any way. Right now I am at a loss as to how to revive my other Epic, short of taking it apart and shorting KCOLO and GND. It also didn't help that the testpoints aren't labeled at all. :/
Also, I did a quick logcat while running the FOTA utility, and I managed to get a few URLs off the said logs. Problem is that while the ZIPs may be of some use, they're incremental and there doesn't seem to be a full scatter/zip image to restore a faulty unit. There definitely needs to be a way to patch the bootloader so we can do whatever we want to it, but is there any one of you guys who are experts when it comes to MTK modding?

Any more ideas?

Anyone, please?

Bumping in case there's anyone interested in poking into this.

Now this is interesting let us see what we can do.

Warrior1988 said:
Now this is interesting let us see what we can do.
Click to expand...
Click to collapse
You happen to have an Epic with you? Please let me know if you need more than just the firmware images. I've tried contacting LeapFrog regarding this issue to no avail. They did give my friend and I the kernel sources, but it's no use as the bootloader has to be unlocked for custom boot or recovery images to be used.

Is anyone willing to test if SP Flash Tool 5.1532.00 works on the Epic? I managed to flash a complete system image to a bricked Epic but I was unable to revive it as it has been bricked prior due to a botched preloader flash. The ROM's on my main Epic discussion thread, but one should take note to flash just the boot, recovery and system images and see if the device still works.

im also poking around in this since my volume up button doesnt work in bootloader mode
i have a figo gravity x55l
i can also upload the stock rom files that can be checked if needed

SP6RK said:
im also poking around in this since my volume up button doesnt work in bootloader mode
i have a figo gravity x55l
i can also upload the stock rom files that can be checked if needed
Click to expand...
Click to collapse
Are you able to muck around with LK or sbchk using IDA Pro or some other tool? Makes me wonder if merely deleting /system/bin/sbchk would disable boot-time checks or if there's more to it than just that.

blakegriplingph said:
Are you able to muck around with LK or sbchk using IDA Pro or some other tool? Makes me wonder if merely deleting /system/bin/sbchk would disable boot-time checks or if there's more to it than just that.
Click to expand...
Click to collapse
well i tried hex editors but lk.bin isnt decoded for my rom so half of my lk file is not showing me anything exept weird characters but i can see some of the other half.
if you delete the file...will it brick?...will it even boot?

GREAT NEWS I MANAGED TO GET ROOT WITHOUT UNLOCKING THE BOOTLOADER ALL YOU NEED IS TO
1.download your firmware and extract it
2.extract the boot.img from the firmware and put it on your phone REMEMBER WHERE YOU PUT IT SINCE YOU WILL NEED THIS!
3download magiskmanager install it and open it.
4click install and choose the boot.img it will install magisk into it
5.put it back in your firmware folder on your pc
6 look for a file that says Checksum_gen and run it
7 once that completes use spflash tool and load your scatterfile and flash JUST THE BOOT.IMG wait for the reboot and you have root!
THANK YOU DEVELOPERS OF MAGISKMANAGER!

SP6RK said:
GREAT NEWS I MANAGED TO GET ROOT WITHOUT UNLOCKING THE BOOTLOADER ALL YOU NEED IS TO
1.download your firmware and extract it
2.extract the boot.img from the firmware and put it on your phone REMEMBER WHERE YOU PUT IT SINCE YOU WILL NEED THIS!
3download magiskmanager install it and open it.
4click install and choose the boot.img it will install magisk into it
5.put it back in your firmware folder on your pc
6 look for a file that says Checksum_gen and run it
7 once that completes use spflash tool and load your scatterfile and flash JUST THE BOOT.IMG wait for the reboot and you have root!
THANK YOU DEVELOPERS OF MAGISKMANAGER!
Click to expand...
Click to collapse
What device are you referring to? Is this for an MT8127 tablet?

blakegriplingph said:
What device are you referring to? Is this for an MT8127 tablet?
Click to expand...
Click to collapse
i have a figo gravity x55l ? and it is not a tablet
it is a mt6753 great phone btw!
im a starting developer and got this phone so i can learn from my mistakes of course?
but this should work on any device that you can get a hold of its boot.img from its firmware

how to unbrick a pixel 4a anyone need help

flashed from graphene os and back to stock during stock flashing something failed and gives me a black screen and goesinto the screenshot provided

You can try to go through the applicable steps in this guide:
[GUIDE] UNLOCKING, DOWNGRADING TO A10, TWRP, ROOT
Hello, I'm posting this guide for those (like me) who can't do without TWRP on their device. I'm providing only a step-by-step explanation. Credits to @nikamura for his kernel and TWRP...
forum.xda-developers.com
Like installing the USB drivers, and SDK platform tools.
Then put the phone in fastboot mode and download an image from google and do a "flash-all.bat"

JohnC said:
You can try to go through the applicable steps in this guide:
[GUIDE] UNLOCKING, DOWNGRADING TO A10, TWRP, ROOT
Hello, I'm posting this guide for those (like me) who can't do without TWRP on their device. I'm providing only a step-by-step explanation. Credits to @nikamura for his kernel and TWRP...
forum.xda-developers.com
Like installing the USB drivers, and SDK platform tools.
Then put the phone in fastboot mode and download an image from google and do a "flash-all.bat"
Click to expand...
Click to collapse
it wont work , that is what caused the issue, there is no adb or fasboot commands as the phone has nothing to load or read, it was flashing the official latest stock firmware using the flash-all.bat, then after the first rebbot and waiting for devices it goes to a black screen and shows what i put in the screen shot,(i believe the battery died during flashing) there is two modes it goes into the qusb which is the qualcomm download mode and some other mode i cant tell neither can the pc device find drivers to read the phone, techinically this phone is not fixable using normal methods , but i believe there is a way to flash to firmware back on,i have looked into using edl and qspt flashing but it still doesnt read the phone, any help would be greatful i have device protection but they are sending me a refurbished phone i would rather try to fix this before i do get the replacement, as it was a new and working device

i have been able to find a working qualcomm driver is there anyway to edl or msm file for the pixel 4a to fix this, now that the phone is being read properly it should be able to take commands as it is reconized as a modem driver or port

Any Ideas Why Its Failing , says sahari protocal failed

files needed to repair phone, anyone able to extract or have files
RAM file (MPRGXXXX.mbn), e.g: MPRG8916.mbn
Boot file (XXXX_msimage.mbn), e.g: 8916_msimage.mbn

miko12312 said:
files needed to repair phone, anyone able to extract or have files
RAM file (MPRGXXXX.mbn), e.g: MPRG8916.mbn
Boot file (XXXX_msimage.mbn), e.g: 8916_msimage.mbn
Click to expand...
Click to collapse
I did the same thing as you trying to got back to stock. Still trying to find those files to unbrick myself.

vabeachboy0 said:
I did the same thing as you trying to got back to stock. Still trying to find those files to unbrick myself.
Click to expand...
Click to collapse
I believe Qualcomm is the ones that obtain these files not Google , only other way is to dump the files from download mode on a working device

I'd like to help by dumping the required files, I didn't know anything about EDL before doing research for this thread, but as I understand using EDL mode require a device-specific non-free "loader".
I'm trying to use B. Kerler's EDL tool (https://github.com/bkerler/edl) but fail because it doesn't have the proper loader file in its database.
If anyone come across the loader for the Pixel 4a (000e60e10066000a_3ef72a02fb931be1_fhprg.bin), I'd be happy to share boot and memory dump from my phone.

I encountered the same situation as you, did you solve it?

Older thread I know, but I've used EDL mode (on LG phones) to save partitions and write partitions.
But you have to have a 'programmer file' for the specific device for it to work. Aka a 'firehose' file for the specific device / chip.
Some mfg's make this available, some don't. Google does not. So, even having the file(s) you want to flash won't help, not if you don't have the firehose file.
sorry, cheers

Has anyone figured this out? Could really use some help. Thank you

Did anyone managed to unbrick phone? I bricked my phone. Now it's just black screen.

mizzunet said:
Did anyone managed to unbrick phone? I bricked my phone. Now it's just black screen.
Click to expand...
Click to collapse
Only suggestions are the go to software of choice,, pixel flasher or android flash tool, both need bootloader unlocked

@hammered58 Gladly, I was able to get it back. I was trying to relock bootloader with custom ROM. But failed.
Has anyone relocked bootloader with LineageOS/custom ROM?
I was following https://forum.xda-developers.com/t/signing-boot-images-for-android-verified-boot-avb-v8.3600606/ to sign boot and recovery images. Then flashed and relocked bootloader. But phone stuck at black screen. Has anyone managed to self...
forum.xda-developers.com

mizzunet said:
@hammered58 Gladly, I was able to get it back. I was trying to relock bootloader with custom ROM. But failed.
Has anyone relocked bootloader with LineageOS/custom ROM?
I was following https://forum.xda-developers.com/t/signing-boot-images-for-android-verified-boot-avb-v8.3600606/ to sign boot and recovery images. Then flashed and relocked bootloader. But phone stuck at black screen. Has anyone managed to self...
forum.xda-developers.com
Click to expand...
Click to collapse
Glad u got it going, the only time I relock is when I sell the phone, otherwise I have no need as all my apps work with unlocked

hammered58 said:
Glad u got it going, the only time I relock is when I sell the phone, otherwise I have no need as all my apps work with unlocked
Click to expand...
Click to collapse
Right. Every apps working even on unlocked state. But would be nice to get rid of the warning while booting.

mizzunet said:
Right. Every apps working even on unlocked state. But would be nice to get rid of the warning while booting.
Click to expand...
Click to collapse
I will second that, unfortunately I don't think it's possible, at least not that IAM aware of

[HELP] Redmi 9 Hard Bricked

Hello i've flashed a custom ROM for my Redmi 9 this morning but it failed.
Now my phone doing a big f* bootloop, the recovery (TWRP) is dead and the fastboot too.
I've found a tool named SP Tool to repair the phone but the problem is when i plug my phone to my computer the phone is charging (logic) and instead showing the animation of the battery it bootloop until it runs out of battery.
So someone can help me please
Thanks
Edit: Oh i forgot, now i've realised than when i flashed the rom i've wiped the entire phone (internal storage too)
My bad...

Is your device Merlin or Lancelot? If you're not sure, what processor do you have, Qualcomm or MTK?
If it is Qualcomm, try test-point method to access EDL mode, then use Mi Flash Tool to flash MIUI on your device. Read this FAQ to learn more.
If it is MTK, then follow this guide and download the tools used in the video from here. You can find your device ROM (Lancelot) here.
Just make sure you're flashing global version if your device is global or chinese if your device is chinese.
If you're not sure what you're doing, I highly recommend sending it to a professional.
Goodluck.

Hi, my phone has the codename Lancelot with a MTK Helio G80.
I will try, thanks

XDHx86 said:
Is your device Merlin or Lancelot? If you're not sure, what processor do you have, Qualcomm or MTK?
If it is Qualcomm, try test-point method to access EDL mode, then use Mi Flash Tool to flash MIUI on your device. Read this FAQ to learn more.
If it is MTK, then follow this guide and download the tools used in the video from here. You can find your device ROM (Lancelot) here.
Just make sure you're flashing global version if your device is global or chinese if your device is chinese.
If you're not sure what you're doing, I highly recommend sending it to a professional.
Goodluck.
Click to expand...
Click to collapse
It worked! Thanks
But now i've got a little problem..
The phone don't have a IMEI anymore

LeCaptain said:
It worked! Thanks
But now i've got a little problem..
The phone don't have a IMEI anymore
Click to expand...
Click to collapse
Both SIM slots have no IMEI? I assume you wiped all and didn't backup?
You'll need Modem Meta and ENG ROM to fix that, you can get the ROM and the specific way to fix it from here.
If you're lost you'll find all the answers in the thread, but don't be afraid to ask there just don't ask an already asked question.
Here is a brief guide made by the same person to provide the ROM.
Goodluck.

LeCaptain said:
It worked! Thanks
But now i've got a little problem..
The phone don't have a IMEI anymore
Click to expand...
Click to collapse
hey can i contract to you? i have a same problem too need some help
thank.

LeCaptain said:
It worked! Thanks
But now i've got a little problem..
The phone don't have a IMEI anymore
Click to expand...
Click to collapse
can i contract to you? i have a same problem too need help

XDHx86 said:
Is your device Merlin or Lancelot? If you're not sure, what processor do you have, Qualcomm or MTK?
If it is Qualcomm, try test-point method to access EDL mode, then use Mi Flash Tool to flash MIUI on your device. Read this FAQ to learn more.
If it is MTK, then follow this guide and download the tools used in the video from here. You can find your device ROM (Lancelot) here.
Just make sure you're flashing global version if your device is global or chinese if your device is chinese.
If you're not sure what you're doing, I highly recommend sending it to a professional.
Goodluck.
Click to expand...
Click to collapse
I followed the guide in the video. But failing in the LibUSB Step. Mediathek device is not showing up. My Redmi 9 is hard bricked, just seeing a "redmi logo" bootloop. No matter if I try to boot normally, recovery or fastboot. Any Idea?

Kisle said:
I followed the guide in the video. But failing in the LibUSB Step. Mediathek device is not showing up. My Redmi 9 is hard bricked, just seeing a "redmi logo" bootloop. No matter if I try to boot normally, recovery or fastboot. Any Idea?
Click to expand...
Click to collapse
This tool installs the driver required to unbrick your device, if you can find your device specific driver to install on your PC then you can skip using this tool and install the driver manually.
If you can't find the driver, then try using a different cable when connecting the phone to the PC. Or a different port in the PC (Like the legacy 2.0 USB port in the motherboard).
The tool should first detect any device connected to install the driver it doesn't work the other way. If it still doesn't work then your only option is to find the driver manually. Or maybe you can find an updated version of the same tool or a similar tool.

XDHx86 said:
This tool installs the driver required to unbrick your device, if you can find your device specific driver to install on your PC then you can skip using this tool and install the driver manually.
If you can't find the driver, then try using a different cable when connecting the phone to the PC. Or a different port in the PC (Like the legacy 2.0 USB port in the motherboard).
The tool should first detect any device connected to install the driver it doesn't work the other way. If it still doesn't work then your only option is to find the driver manually. Or maybe you can find an updated version of the same tool or a similar tool.
Click to expand...
Click to collapse
Thanks for your help. Actually I got it working with a lot of try and error... not even sure which drivers worked at the end. Also I had to switch to a win 7 computer. On win 11 drivers just didnt work. But with MTK Bypass tool + SP flash Tool, I was able to flash the stock image and recover my briked phone!

Kisle said:
Thanks for your help. Actually I got it working with a lot of try and error... not even sure which drivers worked at the end. Also I had to switch to a win 7 computer. On win 11 drivers just didnt work. But with MTK Bypass tool + SP flash Tool, I was able to flash the stock image and recover my briked phone!
Click to expand...
Click to collapse
Glad it worked out in the end mate.
Might be a random guess but it could be because signature protection was enabled on the win 11 PC.
Don't brick your phone again!

LeCaptain said:
It worked! Thanks
But now i've got a little problem..
The phone don't have a IMEI anymore
Click to expand...
Click to collapse
Hi can I contact you I also have the same problem and it's my only mobile thank you

DISC0DEVIL said:
Hi can I contact you I also have the same problem and it's my only mobile thank you
Click to expand...
Click to collapse
Hey, i can help you by sending videos that helped me to fix my problem but i've lost them.
Do you have a bootloader locked or unlocked? (here to know how)
If it's the 1st option, relax, you can modify easily
If it's the 2nd a little bit less
NB: i don't use really use this phone, just for developpment and some things than it can break the OS because it had some problems with apps and updates.
Have a great day and i hope than you have found a solution before my answer.

XDHx86 said:
Is your device Merlin or Lancelot? If you're not sure, what processor do you have, Qualcomm or MTK?
If it is Qualcomm, try test-point method to access EDL mode, then use Mi Flash Tool to flash MIUI on your device. Read this FAQ to learn more.
If it is MTK, then follow this guide and download the tools used in the video from here. You can find your device ROM (Lancelot) here.
Just make sure you're flashing global version if your device is global or chinese if your device is chinese.
If you're not sure what you're doing, I highly recommend sending it to a professional.
Goodluck.
Click to expand...
Click to collapse
I just made an account to tell all of you amazing people in this forum how much i truly appreciate your support:
YOU ALL ARE AWESOME!!!! I was legit going to loose my job if i didn't unbrick this darn Redmi 9 coz it's my boss's daughter's device
e putting the blame on me being the spoiled lil brat she is :/ so it was either this phone gets working or i get thrown onto the streets.
I soared through so many websites and articles that i had almost given up XD... until i landed here.
I love ya'll! keep up the good work!

LeCaptain said:
Hello i've flashed a custom ROM for my Redmi 9 this morning but it failed.
Now my phone doing a big f* bootloop, the recovery (TWRP) is dead and the fastboot too.
I've found a tool named SP Tool to repair the phone but the problem is when i plug my phone to my computer the phone is charging (logic) and instead showing the animation of the battery it bootloop until it runs out of battery.
So someone can help me please
Thanks
Edit: Oh i forgot, now i've realised than when i flashed the rom i've wiped the entire phone (internal storage too)
My bad...
Click to expand...
Click to collapse
please tell me you didnt reflash preloader

XDHx86 said:
Is your device Merlin or Lancelot? If you're not sure, what processor do you have, Qualcomm or MTK?
If it is Qualcomm, try test-point method to access EDL mode, then use Mi Flash Tool to flash MIUI on your device. Read this FAQ to learn more.
If it is MTK, then follow this guide and download the tools used in the video from here. You can find your device ROM (Lancelot) here.
Just make sure you're flashing global version if your device is global or chinese if your device is chinese.
If you're not sure what you're doing, I highly recommend sending it to a professional.
Goodluck.
Click to expand...
Click to collapse
Bro in my device when i Connect my mobile.. libusb not recognized my phone.. What should i do

optsiam said:
Bro in my device when i Connect my mobile.. libusb not recognized my phone.. What should i do
Click to expand...
Click to collapse
Is it in EDL mode?

No but I am gonna try it Tomorrow

Someone help me please? Two days ago i bricked my redmi 9 eea after update via ota. He just died, no infinite loop or charge. After a tutorial from here was able to revive him with sp flash, phyton and other stuffs. Everyting went OK and my phone is alive again. Whatever now I've getting issues that weren't there before hard brick. My redmi doesnt recognize my Sim card. I enter my pin security and then don't get any sim card signal. Also can't log on play store with my Google account, i get this message "there was a problem communicating with Google servers, try again later." Tried to wipe Google play services data, also from play store, formated redmi from recovery but the problems remains. Maybe i need to reinstall rom again, im pretty sure it was the right rom i flashed because i download it from miui official website. Unfortunately after reviving my redmi with sp flash, my bootloader got locked again. Sense i cant log with Google account because phone doesn't recognize my chip to activate data sim card, i cant either unlock with mi unlock. Is there any solution for this? Thanks.
Perhaps flashing phone with another rom the problem gets fixed. I can still flash my phone with sp flash even with bootloader blocked right? My redmi comes with a European rom. To revive him i used rom last update, maybe should try a previous version?

LeCaptain said:
It worked! Thanks
Click to expand...
Click to collapse
Are all the steps performed with the phone turned off and connected to the computer?