Database Info

[HOW-TO] Flash A/B Treble GSI ROMs without TWRP

Android devices can have different designs, so there is no generic command or set of instructions for flashing a GSI to apply to all devices. Specially for Xperias am i writing this Guides for You. So please read carefully...
1. Ensure that You have the following before You start:
Latest Fastboot Version (Or the used fastboot commands may not work)
A Method for disabling Android Verified Boot (Part of the Guide)
An unlocked Bootloader State (Official Instructions HERE)
To Start:
Download the Basic Package from Google: https://developer.android.com/topic/generic-system-image/releases
Download the AOSP Vendor Package from Sony: https://developer.sony.com/develop/open-devices/downloads/software-binaries
Open up the Zip Files and place the 3 included Images on Your fastboot destination
Boot Your Device into Fastboot:
Code:
Turn off Your Device and hold VolumeUP while connecting via USB to a PC or use ADB to reboot to fastboot
Disable the verified booting (AVB) by flashing vbmeta.img:
Code:
fastboot --disable-verification flash vbmeta vbmeta.img
Flash the Vendor to the Primary A Slot OEM:
Code:
fastboot flash oem_a nameofthesonyoemimage.img
Repeat to flash to the B Slot OEM
Code:
fastboot flash oem_b nameofthesonyoemimage.img
Flash the GSI to the Primary A Slot System:
Code:
fastboot flash system_a system.img
Repeat to flash to the B Slot System
Code:
fastboot flash system_b system.img
Wipe the user data and clear the data from other necessary partitions (for example, user data and system partitions):
Code:
fastboot -w
Reboot:
Code:
fastboot reboot
Additional:
You can use any Android 9+ GSI out of the XDA Forum here: https://forum.xda-developers.com/project-treble/trebleenabled-device-development
To get Magisk/Root; just patch Your actual Kernel with the Magisk Manager App and flash the Boot Image together with the GSI (Example below)
Patched Boot Image for Xperia 5 Users: https://forum.xda-developers.com/xp...isk-v20-3-patched-boot-image-android-t4033547

How to force unlock bootloader?
On Sony XZ3 Unlocking Bootloader is not allowed.

Firmware Flash Guide.

Hello, ALOT of people have been having tons of errors from wrong commands lying on the internet. I made a guide to fix that. Hope it works :highfive:
I am not responsible for any bricks but will help for a solution
You Must have your bootloader unlocked.
Android 10: use this link for retail firmware, will work on all device channels excluding AMX. beware.
https://mirrors.lolinet.com/firmwar...ubsidy-DEFAULT_regulatory-DEFAULT_CFC.xml.zip
After downloaded, unzip, open the folder containing all of the files and open powershell or cmd promt window here (shift + right click)
After that use
adb devices
Click to expand...
Click to collapse
to check and make sure your device is recognized. Use these commands after that.
fastboot --set-active=a
fastboot getvar max-sparse-size
fastboot oem fb_mode_set
fastboot flash partition gpt.bin
fastboot flash bootloader bootloader.img
fastboot flash vbmeta_a vbmeta.img
fastboot flash vbmeta_b vbmeta.img
fastboot flash modem_a NON-HLOS.bin
fastboot flash modem_b NON-HLOS.bin
fastboot flash fsg_a fsg.mbn
fastboot flash fsg_b fsg.mbn
fastboot erase modemst1
fastboot erase modemst2
fastboot flash bluetooth_a BTFM.bin
fastboot flash bluetooth_b BTFM.bin
fastboot flash dsp_a dspso.bin
fastboot flash dsp_b dspso.bin
fastboot flash logo_a logo.bin
fastboot flash logo_b logo.bin
fastboot flash boot_a boot.img
fastboot flash boot_b boot.img
fastboot flash dtbo_a dtbo.img
fastboot flash dtbo_b dtbo.img
fastboot flash system_a system.img_sparsechunk.0
fastboot flash system_a system.img_sparsechunk.1
fastboot flash system_a system.img_sparsechunk.2
fastboot flash system_a system.img_sparsechunk.3
fastboot flash system_a system.img_sparsechunk.4
fastboot flash system_a system.img_sparsechunk.5
fastboot flash system_b system_b.img_sparsechunk.0
fastboot flash system_b system_b.img_sparsechunk.1
fastboot flash oem_a oem.img
fastboot flash oem_b oem_other.img
fastboot flash vendor_a vendor.img_sparsechunk.0
fastboot flash vendor_a vendor.img_sparsechunk.1 fastboot flash vendor_b vendor.img_sparsechunk.0 fastboot flash vendor_b vendor.img_sparsechunk.1 fastboot erase carrier
fastboot erase userdata
fastboot erase ddr
fastboot oem fb_mode_clear
fastboot reboot
Click to expand...
Click to collapse
Android 9: Please don't use android 9.
A quick just so you know. TWRP doesn't boot on Android 10. a fix for that is coming soon.
WARNING: DO NOT DOWNGRADE FIRMWARE/ANDROID VERSIONS. IT WILL BRICK YOUR DEVICE!
Good luck all

Hi, for amx devices. How it Will work?
My code Is: amxpe.
I bought in operator from Peru. . I install android 10 soak test AND then pone started having problems with WiFi and I downgrade to android 9. And now its softbricked. I install some android 10 zip from lolinet but its stuck. I have bootloops or initial error message. Please any help

Jidnet said:
Hi, for amx devices. How it Will work?
My code Is: amxpe.
I bought in operator from Peru. . I install android 10 soak test AND then pone started having problems with WiFi and I downgrade to android 9. And now its softbricked. I install some android 10 zip from lolinet but its stuck. I have bootloops or initial error message. Please any help
Click to expand...
Click to collapse
I said in the warning don't install this specific firmware on AMX. I also said don't downgrade, wtf.

@SnowTalker these commands are not working for people same. They are also posing issues for certain users. Like i hard bricked with these commands. Stop posting half-baked stuff! harcd brick.

methuselah said:
@SnowTalker these commands are not working for people same. They are also posing issues for certain users. Like i hard bricked with these commands. Stop posting half-baked stuff! harcd brick.
Click to expand...
Click to collapse
These commands work only fro android 10 firmware and with a unlocked bootloader. I've tested them already they work.

SnowTalker said:
These commands work only fro android 10 firmware and with a unlocked bootloader. I've tested them already they work.
Click to expand...
Click to collapse
lol then again, probably i have also tried them for android 10! And then still it caused hard brick in my device case

methuselah said:
lol then again, probably i have also tried them for android 10! And then still it caused hard brick in my device case
Click to expand...
Click to collapse
What device channel.

I tested your codes in my phone : amxpe, and it works well , I recieve a message at the benning but i think is not main problem , phone now works. thanks I hope you can improve the codes

SnowTalker said:
Hello, ALOT of people have been having tons of errors from wrong commands lying on the internet.
Click to expand...
Click to collapse
The easiest way to fix the problems caused by wrong flash commands is not to post any command.
As you can see nobody cares about your warnings. But later you are the one to blame for it.
Even if you write "your device will self-destruct after using the commands", would they use them anyway.
Always refer to the flashfile.xml

Just a heads-up for anyone with the XT2019-1 version. I just successfully flashed the RETEU
https://mirrors.lolinet.com/firmwar...ubsidy-DEFAULT_regulatory-DEFAULT_CFC.xml.zip
version of Android 10 using my FlashAllPartitions.bat based on flashfile.xml
[url]https://drive.google.com/file/d/1nGl1saSSJEZkCLAucU8RHVNuFQFamP1C/view?usp=sharing
Working great.

WoKoschekk said:
The easiest way to fix the problems caused by wrong flash commands is not to post any command.
As you can see nobody cares about your warnings. But later you are the one to blame for it.
Even if you write "your device will self-destruct after using the commands", would they use them anyway.
Always refer to the flashfile.xml
Click to expand...
Click to collapse
xda has changed a lot. Now anyone with half baked info just comes here and paste something and people tries it and brick their devices. I also used these commands and had flashed ROM which snowy has posted here, even that guy didn't replied afterwards lol when i said my device is hard bricked. So just wait and see what vache says. its horrible to do stuff with this device without proper info.
i guess these threads are nothing more than thanks meter increasing stuff.

methuselah said:
xda has changed a lot. Now anyone with half baked info just comes here and paste something and people tries it and brick their devices. I also used these commands and had flashed rom which snowy has posted here, even that guy didn't replied afterwards lol when i said my device is hard bricked. So just wait and see what vache says. Its horrible to do stuff with this device without proper info.
i guess these threads are nothing more than thanks meter increasing stuff.
Click to expand...
Click to collapse
i said what is your device channel!

methuselah said:
xda has changed a lot. Now anyone with half baked info just comes here and paste something and people tries it and brick their devices. I also used these commands and had flashed ROM which snowy has posted here, even that guy didn't replied afterwards lol when i said my device is hard bricked. So just wait and see what vache says. its horrible to do stuff with this device without proper info.
i guess these threads are nothing more than thanks meter increasing stuff.
Click to expand...
Click to collapse
And when did I once ask for a thanks on this post?

SnowTalker said:
And when did I once ask for a thanks on this post?
Click to expand...
Click to collapse
I do understand the intention of your first post. But you made the same mistake as other users made. Let me explain why.
All firmware .zips for Moto devices on mirrors.lolinet.com or Telegram groups were originally downloaded from Motorola's cloud servers. They are designed to be installed with the manufacturer's flash tools (e.g. LMSA). These tools use the .xml files (flashfile and service) to execute the flash commands that are needed to install the firmware images.
So that means this is Motorola's recommended way to flash your device.
1. By flashing the complete firmware (start with gpt.bin, the GUID partition table) your device switches automatically to slot A. I would like to explain you why but I don't know it exactly.
Since fastboot always uses the active slot, there's no need to specify slot A within your commands. It's not wrong or would mess up sth, but it's not needed.
2. Just because there's a corresponding partition on slot B you don't need to flash all images on A and B. Only images named like '*_other.img' are intended for this.
You also ignored the bootloader in this context. The bootloader consists of several partitions which are also devided in A and B (example Moto G6 Plus)
mmcblk0p1 -> xbl_a
mmcblk0p2 -> xbl_b
mmcblk0p3 -> tz_a
mmcblk0p4 -> tz_b
mmcblk0p5 -> rpm_a
mmcblk0p6 -> rpm_b
mmcblk0p7 -> hyp_a
mmcblk0p8 -> hyp_b
mmcblk0p9 -> devcfg_a
mmcblk0p10 -> devcfg_b
mmcblk0p11 -> pmic_a
mmcblk0p12 -> pmic_b
mmcblk0p13 -> abl_a
mmcblk0p14 -> abl_b
mmcblk0p15 -> cmnlib_a
mmcblk0p16 -> cmnlib64_a
mmcblk0p17 -> cmnlib_b
mmcblk0p18 -> cmnlib64_b
mmcblk0p19 -> keymaster_a
mmcblk0p20 -> keymaster_b
mmcblk0p21 -> storsec_a
mmcblk0p22 -> storsec_b
mmcblk0p23 -> prov_a
mmcblk0p24 -> prov_b
The bootloader.img is structured like the firmware .zip. It contains all the images which define the 'bootloader' and it also contains the commands to flash the images. You'll find them in the header.
<flash partition="xbl" filename="xbl.elf"/>
<flash partition="prov" filename="prov64.mbn"/>
<flash partition="cmnlib" filename="cmnlib.mbn"/>
<flash partition="cmnlib64" filename="cmnlib64.mbn"/>
<flash partition="abl" filename="abl.elf"/>
<flash partition="keymaster" filename="keymaster.mbn"/>
<flash partition="storsec" filename="storsec.mbn"/>
<flash partition="rpm" filename="rpm.mbn"/>
<flash partition="pmic" filename="pmic.elf"/>
<flash partition="hyp" filename="hyp.mbn"/>
<flash partition="tz" filename="tz.mbn"/>
<flash partition="devcfg" filename="devcfg.mbn"/>
I don't know if it's possible to use 'fastboot flash bootloader_b ...' at all.
You should understand that every image of the .zip only needs to be flashed once to the correct partition. So it doesn't make sense to post or use other's flash commands. Which commands need to be used depends on which images you want to flash. This defines the correct flash commands for you.

WoKoschekk said:
I do understand the intention of your first post. But you made the same mistake as other users made. Let me explain why.
All firmware .zips for Moto devices on mirrors.lolinet.com or Telegram groups were originally downloaded from Motorola's cloud servers. They are designed to be installed with the manufacturer's flash tools (e.g. LMSA). These tools use the .xml files (flashfile and service) to execute the flash commands that are needed to install the firmware images.
So that means this is Motorola's recommended way to flash your device.
1. By flashing the complete firmware (start with gpt.bin, the GUID partition table) your device switches automatically to slot A. I would like to explain you why but I don't know it exactly.
Since fastboot always uses the active slot, there's no need to specify slot A within your commands. It's not wrong or would mess up sth, but it's not needed.
2. Just because there's a corresponding partition on slot B you don't need to flash all images on A and B. Only images named like '*_other.img' are intended for this.
You also ignored the bootloader in this context. The bootloader consists of several partitions which are also devided in A and B (example Moto G6 Plus)
mmcblk0p1 -> xbl_a
mmcblk0p2 -> xbl_b
mmcblk0p3 -> tz_a
mmcblk0p4 -> tz_b
mmcblk0p5 -> rpm_a
mmcblk0p6 -> rpm_b
mmcblk0p7 -> hyp_a
mmcblk0p8 -> hyp_b
mmcblk0p9 -> devcfg_a
mmcblk0p10 -> devcfg_b
mmcblk0p11 -> pmic_a
mmcblk0p12 -> pmic_b
mmcblk0p13 -> abl_a
mmcblk0p14 -> abl_b
mmcblk0p15 -> cmnlib_a
mmcblk0p16 -> cmnlib64_a
mmcblk0p17 -> cmnlib_b
mmcblk0p18 -> cmnlib64_b
mmcblk0p19 -> keymaster_a
mmcblk0p20 -> keymaster_b
mmcblk0p21 -> storsec_a
mmcblk0p22 -> storsec_b
mmcblk0p23 -> prov_a
mmcblk0p24 -> prov_b
The bootloader.img is structured like the firmware .zip. It contains all the images which define the 'bootloader' and it also contains the commands to flash the images. You'll find them in the header.
<flash partition="xbl" filename="xbl.elf"/>
<flash partition="prov" filename="prov64.mbn"/>
<flash partition="cmnlib" filename="cmnlib.mbn"/>
<flash partition="cmnlib64" filename="cmnlib64.mbn"/>
<flash partition="abl" filename="abl.elf"/>
<flash partition="keymaster" filename="keymaster.mbn"/>
<flash partition="storsec" filename="storsec.mbn"/>
<flash partition="rpm" filename="rpm.mbn"/>
<flash partition="pmic" filename="pmic.elf"/>
<flash partition="hyp" filename="hyp.mbn"/>
<flash partition="tz" filename="tz.mbn"/>
<flash partition="devcfg" filename="devcfg.mbn"/>
I don't know if it's possible to use 'fastboot flash bootloader_b ...' at all.
You should understand that every image of the .zip only needs to be flashed once to the correct partition. So it doesn't make sense to post or use other's flash commands. Which commands need to be used depends on which images you want to flash. This defines the correct flash commands for you.
Click to expand...
Click to collapse
The thing is I have no intention of just jumping inside the threads. Whenever I read the things that i did wrong and the half baked stuff what comes from unreliable sources, I just try people not to make same mistakes that i did.

methuselah said:
The thing is I have no intention of just jumping inside the threads. Whenever I read the things that i did wrong and the half baked stuff what comes from unreliable sources, I just try people not to make same mistakes that i did.
Click to expand...
Click to collapse
ok sir. Whatever you say

Thanks Lollyjay, works a treat & got me out of trouble.

Question Rooting Galaxy Watch4

I've unlocked bootloader, got boot.img(hashes match in update.zip and my boot.img + it boots fine), patched it and vbmeta in tar by magisk 24.3, but when i flash new boot.img, it throws me "SECURE FAILED: BOOT" error on watch and system doesn't boot, flashing unpatched boot.img gets watch to work again. Why does it happen and is there any fix? SM-R860
Files:
files.zip
drive.google.com

Sounds like Samsung baked in something to keep it from being rooted

I wrote Conversation aka PM to you...
Best Regards

sermister1 said:
I've unlocked bootloader, got boot.img(hashes match in update.zip and my boot.img + it boots fine), patched it and vbmeta in tar by magisk 24.3, but when i flash new boot.img, it throws me "SECURE FAILED: BOOT" error on watch and system doesn't boot, flashing unpatched boot.img gets watch to work again. Why does it happen and is there any fix? SM-R860
Files:
files.zip
drive.google.com
Click to expand...
Click to collapse
Magisk patch is not enough to achieve root. You need to flash the stock boot image in order to fix that.

janjan said:
Magisk patch is not enough to achieve root. You need to flash the stock boot image in order to fix that.
Click to expand...
Click to collapse
My sm-r860 boots fine only with stock boot.img, how can i get magisk to work?

Wrong posting...

Example of vbmeta from Combination Firmware...
SM-G991B Android 11
Code:
COMBINATION_FAC_FAR0_G991BXXU1AUA3_FAC_CL20796681_QB37484630_REV01_user_mid_noship_MULTI_CERT.tar.md5
Summary for my tiny brain...
A
Magisk patch vbmeta.img only 1 Byte at Offset 0x7B
00 into 03
B
In attached "Combi Example" vbmeta have more Bytes changed in Header... and Offset 0x7B is:
01
C
Some Google search findings...
What is 02 in the magisk patched vbmeta.img?
According to the Additional Info given for rooting the Android device that doesn't have ramdisk but can be rooted via recovery: we need an empty vbmeta.img and I am trying to check what it actually
android.stackexchange.com
XDA search...
[TOOL][WIN,LIN,AND,DARW] Super image tools | extract or make partitions RW in super partition
Disclaimer: Super image tools was made for testing and educational purposes, ME is not responsible for what you do on/with your device using our tools, you must agree that you using our tools on your own risk, I am not responsible for anything...
forum.xda-developers.com

Dear janjan
Please share full info/instruction for Rooting GW4 via USB.
Thanx in advance.
Best Regards

adfree said:
Dear janjan
Please share full info/instruction for Rooting GW4 via USB.
Thanx in advance.
Best Regards
Click to expand...
Click to collapse
@janjan hopefully he'll get this sent alert!

adfree said:
Dear janjan
Please share full info/instruction for Rooting GW4 via USB.
Thanx in advance.
Best Regards
Click to expand...
Click to collapse
Dear adfree,
I am still working on it. I don't own the USB myself to share any knowledge about that. But I will ofc share my work whenever I have time. I just build a kernel and I will ofc share when I finish uploading the source to GitHub. Thank you for understanding.

galaxys said:
@janjan hopefully he'll get this sent alert!
Click to expand...
Click to collapse
I will ofc share my work when I finish uploading the source to the GitHub. Work in progress. The goal is to achieve root through Netodin and as you already know it is not a easy task. It takes time. Thank you for understanding

sermister1 said:
My sm-r860 boots fine only with stock boot.img, how can i get magisk to work?
Click to expand...
Click to collapse
I tired different magisk to patch the stock boot.img but it doesn't work.
I will compile a kernel for your device. I am still waiting for Samsung to share latest source. Seems the old source doesn't work with D4 unfortunately.

janjan said:
I tired different magisk to patch the stock boot.img but it doesn't work.
I will compile a kernel for your device. I am still waiting for Samsung to share latest source. Seems the old source doesn't work with D4 unfortunately.
Click to expand...
Click to collapse
if you're talking about evd4, currently i have fvc8 rom
And can't use usb bcs i don't have triple screwdriver.

Caution! Warning!
Own Risk!
SM-R860 FVC8 Kernel
For study...
Idea is to improve our Log files...
RDX Tool is confirmed working with GW4 connected with USB cable:
Upload Mode
There are several modes that Wave bootloader supports for certain purposes. The normal mode and low power mode just start the Nucleus kernel. I'm also pretty sure everybody knows what a DOWNLOAD MODE is (one with the red letters, but if initiated...
forum.xda-developers.com
Files are based on first post...
And idea about Values came to me after this:
Rooting Galaxy Watch4
I've unlocked bootloader, got boot.img(hashes match in update.zip and my boot.img + it boots fine), patched it and vbmeta in tar by magisk 24.3, but when i flash new boot.img, it throws me "SECURE FAILED: BOOT" error on watch and system doesn't...
forum.xda-developers.com
Tasks...
A
Create TAR files for netOdin/Odin...
I have simplified to see difference in files...
boot.img not changed... it is the Magisk patched FVC8 from first post...
B
Now IMHO 3 times flashing with Odin (we will start with USB, so we can use RDX Tool)
Round 1
Flashing
1_magisk_patched-24300_oLqH6
Then RDX dump for Log
Round 2
2_vbmeta_01
Then RDX dump for Log
Round 3
3_vbmeta_02
Then RDX dump for Log
With these 3 Logs and from Original Stock Booting... so 4 RDX Dumps...
IMHO maybe visible where exactly it fails...
Best Regards
edit 1.
Additional Control Step to be sure Knox is still alive... or dead...
Code:
D:\Android\ADB>adb shell getprop ro.boot.warranty_bit
0

Here are the RDX Screenshots... taken few weeks ago... SM-R860 FVC8...
RDX shows something like:
Code:
summary.html
auto_comment
extra_info
debug_history
boot_reset
acpm_dump
header
kernel
platform
kevents
s2d
arrdumpreset
arrdumppanic
MFC-log-mem
MFC-sfr-dmp0
LPD-log-mem
LPD-srm-dmp
SM-R860 connected via USB cable and RDX Tool 6.1.4
Upload Mode
There are several modes that Wave bootloader supports for certain purposes. The normal mode and low power mode just start the Nucleus kernel. I'm also pretty sure everybody knows what a DOWNLOAD MODE is (one with the red letters, but if initiated...
forum.xda-developers.com
Best Regards

Code:
[0: 4.451206 ] Footer.magic : AVBf
[0: 4.451210 ] Footer.version : 1.0
[0: 4.451214 ] Footer.original_image_size : 0x2f6330
[0: 4.451217 ] Footer.vbmeta_offset : 0x2f7000
[0: 4.451220 ] Footer.vbmeta_size : 0x840
[0: 4.451223 ] get_original_image_size: Found Footer Info for BOTA, original size: 0x2f6330
[0: 4.451228 ] Verify_Signature_Ecdsa 0xa3e80074 3105584, 0xa4176194 512
[0: 4.473469 ] check_signature (BOOTLOADER) valid.
[0: 4.483628 ] Check DRAM STORE training data..
[0: 4.483632 ] ACPM magic code: 0xAC8338A9
[0: 4.483636 ] Write magic code: 0xF67038A9
[0: 4.547556 ] Restore DRAM training data..
[0: 4.558104 ] _sbl_bota_update: BOOTLOADER Update Completed.
[0: 4.558111 ] _sbl_bota_update: tzar.img(6292240) -> TZAR(9) Update Start.
[0: 4.558122 ] avb_footer.c:41: ERROR: Footer magic is incorrect.
security_core.c:1358: ERROR: BOTA: Error validating footer.
BOTA : Error validating footer.
[0: 4.558138 ] Verify_Signature_Ecdsa 0xa4280098 6292240, 0xa4880198 512
[0: 4.588086 ] check_signature (TZAR) valid.
[0: 4.760372 ] _sbl_bota_update: TZAR Update Completed.
[0: 4.760379 ] _sbl_bota_update: tzsw.img(1572864) -> TZSW(8) Update Start.
[0: 4.760396 ] Footer.magic : AVBf
[0: 4.760400 ] Footer.version : 1.0
[0: 4.760403 ] Footer.original_image_size : 0x100310
[0: 4.760407 ] Footer.vbmeta_offset : 0x101000
[0: 4.760410 ] Footer.vbmeta_size : 0x840
[0: 4.760413 ] get_original_image_size: Found Footer Info for BOTA, original size: 0x100310
[0: 4.760418 ] Verify_Signature_Ecdsa 0xa48803cc 1049360, 0xa49804cc 512
[0: 4.777709 ] check_signature (TZSW) valid.
[0: 4.823222 ] _sbl_bota_update: TZSW Update Completed.
[0: 4.823231 ] _sbl_bota_update: uh.bin(276120) -> UH(15) Update Start.
[0: 4.846012 ] _sbl_bota_update: UH Update Completed.
[0: 4.846020 ] _sbl_bota_update: up_param.bin(706560) -> UP_PARAM(13) Update Start.
[0: 4.871416 ] _sbl_bota_update: UP_PARAM Update Completed.
[0: 4.871425 ] _sbl_bota_update: vbmeta.img(9744) -> VBMETA(23) Update Start.
[0: 4.871435 ] avb_footer.c:41: ERROR: Footer magic is incorrect.
security_core.c:1358: ERROR: BOTA: Error validating footer.
BOTA : Error validating footer.
[0: 4.871451 ] Verify_Signature_Ecdsa 0xa4af02d0 9744, 0xa4af26d0 512
[0: 4.886209 ] check_signature (VBMETA) valid.
[0: 4.899964 ] _sbl_bota_update: VBMETA Update Completed.
[0: 4.932208 ] s2mpw03_get_vbat: vBAT=4183mV
[0: 4.932309 ] s2mpw03_get_soc: capacity (0xec0:9218)
[0: 4.959070 ] sys_restart ('N':fota_up)
[0: 4.959074 ]
[0: 4.959077 ] [SECD] clear_debug_flags: Clear DINFOM and RAMBASE
[0: 4.959082 ] set_minform_magic: before: 4e4e0000 (type: 1, magic: 4e)
[0: 4.959090 ] set_minform_magic: after: 4e4e0000
[0: 4.959095 ] set_minform_magic: before: 4e4e0000 (type: 3, magic: 0)
[0: 4.959102 ] set_minform_magic: after: 4e4e0000
[0: 4.959107 ] set_minform_magic: before: 4e4e0000 (type: 2, magic: 0)
[0: 4.959114 ] set_minform_magic: after: 4e4e0000
[0: 4.959119 ] display_drv_clear was called
[0: 4.959123 ] panel_exit +
[0: 5.079213 ] dsim_set_panel_power off +
[0: 5.091298 ] MMC0 PON set in mmc_power_off_notification
[000.000000] NOTICE: EPBL Self Decryption success
[000.046719] NOTICE: SecureBoot: [BL2] Check digital signature and RP count success
I am looking through my old Debug Logs...
Search text string:
vbmeta.img
According to filename something taken in EVB4... dumpState...log

I am unsure if fail is because vbmeta.img is invalid... maybe patched boot.img is the problem...
Maybe also procedure is incorrect or incomplete...
According to fastboot hints... unlock not at same time with boot.img...
Example what I mean
Installation
The Magic Mask for Android
topjohnwu.github.io
(Optional) If your device has a separate vbmeta partition, you can patch the vbmeta partition with command:
fastboot flash vbmeta --disable-verity --disable-verification vbmeta.img
Click to expand...
Click to collapse
And info fastboot not working...
??
This means the unlock Command not work?
Or all known Fastboot Commands not work?
Will try to find easy test...
Code:
D:\Android\ADB>fastboot
fastboot: usage: no command
D:\Android\ADB>fastboot -help
usage: fastboot [OPTION...] COMMAND...
flashing:
update ZIP Flash all partitions from an update.zip package.
flashall Flash all partitions from $ANDROID_PRODUCT_OUT.
On A/B devices, flashed slot is set as active.
Secondary images may be flashed to inactive slot.
flash PARTITION [FILENAME] Flash given partition, using the image from
$ANDROID_PRODUCT_OUT if no filename is given.
basics:
devices [-l] List devices in bootloader (-l: with device paths).
getvar NAME Display given bootloader variable.
reboot [bootloader] Reboot device.
locking/unlocking:
flashing lock|unlock Lock/unlock partitions for flashing
flashing lock_critical|unlock_critical
Lock/unlock 'critical' bootloader partitions.
flashing get_unlock_ability
Check whether unlocking is allowed (1) or not(0).
advanced:
erase PARTITION Erase a flash partition.
format[:FS_TYPE[:SIZE]] PARTITION
Format a flash partition.
set_active SLOT Set the active slot.
oem [COMMAND...] Execute OEM-specific command.
gsi wipe|disable Wipe or disable a GSI installation (fastbootd only).
wipe-super [SUPER_EMPTY] Wipe the super partition. This will reset it to
contain an empty set of default dynamic partitions.
boot image:
boot KERNEL [RAMDISK [SECOND]]
Download and boot kernel from RAM.
flash:raw PARTITION KERNEL [RAMDISK [SECOND]]
Create boot image and flash it.
--dtb DTB Specify path to DTB for boot image header version 2.
--cmdline CMDLINE Override kernel command line.
--base ADDRESS Set kernel base address (default: 0x10000000).
--kernel-offset Set kernel offset (default: 0x00008000).
--ramdisk-offset Set ramdisk offset (default: 0x01000000).
--tags-offset Set tags offset (default: 0x00000100).
--dtb-offset Set dtb offset (default: 0x01100000).
--page-size BYTES Set flash page size (default: 2048).
--header-version VERSION Set boot image header version.
--os-version MAJOR[.MINOR[.PATCH]]
Set boot image OS version (default: 0.0.0).
--os-patch-level YYYY-MM-DD
Set boot image OS security patch level.
Android Things:
stage IN_FILE Sends given file to stage for the next command.
get_staged OUT_FILE Writes data staged by the last command to a file.
options:
-w Wipe userdata.
-s SERIAL Specify a USB device.
-s tcp|udp:HOST[:PORT] Specify a network device.
-S SIZE[K|M|G] Break into sparse files no larger than SIZE.
--force Force a flash operation that may be unsafe.
--slot SLOT Use SLOT; 'all' for both slots, 'other' for
non-current slot (default: current active slot).
--set-active[=SLOT] Sets the active slot before rebooting.
--skip-secondary Don't flash secondary slots in flashall/update.
--skip-reboot Don't reboot device after flashing.
--disable-verity Sets disable-verity when flashing vbmeta.
--disable-verification Sets disable-verification when flashing vbmeta.
--unbuffered Don't buffer input or output.
--verbose, -v Verbose output.
--version Display version.
--help, -h Show this message.
Edit 1.
IMHO easiest Fastboot command to check if Fastboot is working...
Code:
fastboot devices

Tiny heartattack after stupid test in FVD4:
Code:
D:\Android\ADB>adb shell
freshbs:/ $ reboot fastboot
Leads to black screen...
I remember in older Firmwares red text fastboot...
Few attempts to leave failed...
Hold both keys for few seconds make Reboot Menu accessable...
But no Kernel boots... only black screen... both in normal and Recovery...
I was able to leave the black screen massaker by entering Download Mode USB... and here I pressed both Keys few seconds...
Then normal Booting possible.
I will search the old fastboot info... IMHO Picture postet or something like this...
Best Regards
Edit 1.
fastboot visble in Recovery Mode...
Firmware and Combination Firmware and FOTA Delta and CSC change and...
Looks like it could be harder since Tizen... A Stock Firmware for netOdin/Odin not available yet... B Combination Firmware not available yet C FOTA Delta File for study I have...
forum.xda-developers.com
Edit 2.
Oh, found my old attempt:
Firmware and Combination Firmware and FOTA Delta and CSC change and...
Looks like it could be harder since Tizen... A Stock Firmware for netOdin/Odin not available yet... B Combination Firmware not available yet C FOTA Delta File for study I have...
forum.xda-developers.com
Here I tried:
reboot bootloader
Ah okay. Tested now on FVD4 and i see in tiny red text:
Fastboot Mode..
If I hold both keys for seconds... can normal boot again.

Short summary about Upload Mode for RDX Tool aka Ramdump aka Kernel Panic...
A
This is Samsung only stuff since yearS...
B
For GW4 it looks like this on Watch... See Photo left:
Firmware and Combination Firmware and FOTA Delta and CSC change and...
Looks like it could be harder since Tizen... A Stock Firmware for netOdin/Odin not available yet... B Combination Firmware not available yet C FOTA Delta File for study I have...
forum.xda-developers.com
We see UPLOAD MODE in red
C
At the moment I know only this way to make it visible on FVD4... FVC8 Firmware...
For USB connection
Firmware and Combination Firmware and FOTA Delta and CSC change and...
Looks like it could be harder since Tizen... A Stock Firmware for netOdin/Odin not available yet... B Combination Firmware not available yet C FOTA Delta File for study I have...
forum.xda-developers.com
Firmware and Combination Firmware and FOTA Delta and CSC change and...
Looks like it could be harder since Tizen... A Stock Firmware for netOdin/Odin not available yet... B Combination Firmware not available yet C FOTA Delta File for study I have...
forum.xda-developers.com
Only as info...
Best Regards

Preparing to compare what Magisk did to FVC8 Kernel...
First Step with imjtool...
Code:
[email protected]:~/imj$ ./imjtool stock.img extract
Boot image version 2 for OS version 0x16000163 (11.128 Patch Level 2022-3) detected (1660 byte header)
Part Size Pages Addr
Kernel (@0x0000800): 25194512 12303 0x10008000
Ramdisk (@0x1808000): 743485 364 0x10000000
Device Tree(@0x18be000): 110416 54 0x10000000
MAGIC: 0x1eabb7d7
Extracting dtbo
Found [email protected]
AVB0 (@0x18da000): 2112
AVBf (@0x23fffc0):
Tags: 0x10000000
Flash Page Size: 2048 bytes
ID: c769e71ef5bec23438102c4a3af78e13dcd7d587000
Name: SRPUC03B001
CmdLine:
Found GZ Magic at offset 14333096
extracted/kernelimage.gz:
gzip: extracted/kernelimage.gz: decompression OK, trailing garbage ignored
-81.8% -- replaced with extracted/kernelimage
Extracting kernel
Extracting ramdisk
Searching for DT at 0x18be000
MAGIC: 0x1eabb7d7
Extracting dtbo - exists so renaming to _dtbo
[email protected]:~/imj$ ./imjtool patch.img extract
Boot image version 2 for OS version 0x16000163 (11.128 Patch Level 2022-3) detected (1660 byte header)
Part Size Pages Addr
Kernel (@0x0000800): 25194512 12303 0x10008000
Ramdisk (@0x1808000): 1252029 612 0x10000000
Device Tree(@0x193a000): 110416 54 0x10000000
MAGIC: 0x1eabb7d7
Extracting dtbo
Found [email protected]
AVB0 (@0x1956000): 2112
AVBf (@0x23fffc0):
Tags: 0x10000000
Flash Page Size: 2048 bytes
ID: 5477904380525186fa9fdb5eaf7863be8e37af2d000
Name: SRPUC03B001
CmdLine:
Found GZ Magic at offset 14333096
extracted/kernelimage.gz:
gzip: extracted/kernelimage.gz: decompression OK, trailing garbage ignored
-81.8% -- replaced with extracted/kernelimage
Extracting kernel
Extracting ramdisk
Searching for DT at 0x193a000
MAGIC: 0x1eabb7d7
Extracting dtbo - exists so renaming to _dtbo

Failed to mount '/vendor'(Invalid argument)

Failed to mount '/vendor'(Invalid argument)
Failed to mount '/prodcut'(Invalid argument)
Failed to mount '/odm'(Invalid argument)
I tried to flash EU ROM from EU rom 13.04 to 13.05, using TWRP 3.4.1b.
Firstly, the zip could not be seen in internal storage, someone in XDA thread suggested I changed file system from ext 2 to ext 4 and back to ext 2, but now it failed .
The zip file is now in usb drive and I use USB-OTG to flash the zip file but the above three error appeared.
1.How can I solve it ???
2.If not possible, can I use fastboot to flash back to 13.02 with all the data, apps and pictures, video etc remain in the phone ???????
Thank you !

but why you not try flash with fb mode

Mr Hassan said:
but why you not try flash with fb mode
Click to expand...
Click to collapse
There is no fastboot mode for 13.0.5.
By the way, if I fb mode for 13.0.2, will all the pics, videos, files, and apps be deleted ?

htcandroid said:
Failed to mount '/vendor'(Invalid argument)
Failed to mount '/prdocut'(Invalid argument)
Failed to mount '/odm'(Invalid argument)
I tried to flash EU ROM from EU rom 13.04 to 13.05, using TWRP 3.4.1b.
Firstly, the zip could not be seen in internal storage, someone in XDA thread suggested I changed file system from ext 2 to ext 4 and back to ext 2, but now it failed .
The zip file is now in usb drive and I use USB-OTG to flash the zip file but the above three error appeared.
1.How can I solve it ???
2.If not possible, can I use fastboot to flash back to 13.02 with all the data, apps and pictures, video etc remain in the phone ???????
Thank you !
Click to expand...
Click to collapse
remove all lock screen security
Use OTA

NOSS8 said:
remove all lock screen security
Use OTA
Click to expand...
Click to collapse
How to remove all lock screen security ? What is OTA ? and I would like to maintain all the data, pics, videos, apps etc, will using OTA erase all these ? Thank you !

htcandroid said:
How to remove all lock screen security ? What is OTA ? and I would like to maintain all the data, pics, videos, apps etc, will using OTA erase all these ? Thank you !
Click to expand...
Click to collapse
Removed security on the lock screen if you have any.
OTA
select update file and select the rom (you must have a twrp installed).
An update does not erase the data.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

NOSS8 said:
Removed security on the lock screen if you have any.
OTA
select update file and select the rom (you must have a twrp installed).
An update does not erase the data.
View attachment 5740835​
Click to expand...
Click to collapse

NOSS8 said:
Removed security on the lock screen if you have any.
OTA
select update file and select the rom (you must have a twrp installed).
An update does not erase the data.
View attachment 5740835​
Click to expand...
Click to collapse
Thank you ! But how to install OTA in my phone ? I have TWRP already installed , TWRP didn't ask me to input the security on the lockscreen.

NOSS8 said:
Removed security on the lock screen if you have any.
OTA
select update file and select the rom (you must have a twrp installed).
An update does not erase the data.
View attachment 5740835​
Click to expand...
Click to collapse
I cann't boot into my ROM now, it only goes to the recovery of TWRP !

htcandroid said:
Thank you ! But how to install OTA in my phone ? I have TWRP already installed , TWRP didn't ask me to input the security on the lockscreen.
Click to expand...
Click to collapse
You must have an update icon otherwise go to settings/my phone tap on the image where there is the 13 then the 3 dots at the top right.
Use this TWRP https://dl.akr-developers.com/?dir=skkk/TWRP/A12/v6.0_A12
If that doesn't work.
TWRP
wipe/format data type yes(data lost)
reboot twrp
Put the rom in internal storage or use OTG
flash the rom
first start takes 8/10 minutes.

htcandroid said:
I cann't boot into my ROM now, it only goes to the recovery of TWRP !
Click to expand...
Click to collapse
The post came later.
Try with the TWRP above.

Mr Hassan said:
but why you not try flash with fb mode
Click to expand...
Click to collapse
If I flash with fb mode, will all the pics, videos, files and apps installed erased ?

htcandroid said:
If I flash with fb mode, will all the pics, videos, files and apps installed erased ?
Click to expand...
Click to collapse
Nope, provided you use the correct command.

htcandroid said:
If I flash with fb mode, will all the pics, videos, files and apps installed erased ?
Click to expand...
Click to collapse
Edit flash.bat and remove fastboot -w
And flash

Mr Hassan said:
Edit flash.bat and remove fastboot -w
And flash
Click to expand...
Click to collapse
All the pics and videos, files, apps installed still there ?

Mr Hassan said:
Edit flash.bat and remove fastboot -w
And flash
Click to expand...
Click to collapse
There is not this type of command on the Xiaomi eu rom but
%fastboot% %* erase metadata
%fastboot% %* erase userdata

htcandroid said:
All the pics and videos, files, apps installed still there ?
Click to expand...
Click to collapse
Here is the Xiaomi Eu rom update script for Poco F2 you will have to check that everything corresponds to the rom you want to install and maybe modify it.
Spoiler: Command BAT
@Echo off
cd %~dp0
set fastboot=bin\windows\fastboot.exe
if not exist %fastboot% echo %fastboot% not found. & exit /B 1
echo Waiting for device...
set device=unknown
for /f "tokens=2" %%D in ('%fastboot% %* getvar product 2^>^&1 ^| findstr /l /b /c:"product:"') do set device=%%D
if "%device%" neq "lmi" if "%device%" neq "lmipro" echo This package is for "lmi" and "lmipro" devices; this is a "%device%". & exit /B 1
echo ##################################################################
echo Please wait. The device will reboot when installation is finished.
echo ##################################################################
%fastboot% %* flash cmnlib64 images\cmnlib64.mbn
%fastboot% %* flash xbl_config_5 images\xbl_config_5.elf
%fastboot% %* flash modem images\NON-HLOS.bin
%fastboot% %* flash cmnlib images\cmnlib.mbn
%fastboot% %* flash bluetooth images\BTFM.bin
%fastboot% %* flash keymaster images\km4.mbn
%fastboot% %* flash xbl_5 images\xbl_5.elf
%fastboot% %* flash tz images\tz.mbn
%fastboot% %* flash aop images\aop.mbn
%fastboot% %* flash featenabler images\featenabler.mbn
%fastboot% %* flash xbl_config_4 images\xbl_config_4.elf
%fastboot% %* flash storsec images\storsec.mbn
%fastboot% %* flash uefisecapp images\uefi_sec.mbn
%fastboot% %* flash qupfw images\qupv3fw.elf
%fastboot% %* flash abl images\abl.elf
%fastboot% %* flash dsp images\dspso.bin
%fastboot% %* flash devcfg images\devcfg.mbn
%fastboot% %* flash xbl_4 images\xbl_4.elf
%fastboot% %* flash hyp images\hyp.mbn
%fastboot% %* flash cmnlib64bak images\cmnlib64.mbn
%fastboot% %* flash cmnlibbak images\cmnlib.mbn
%fastboot% %* flash tzbak images\tz.mbn
%fastboot% %* flash aopbak images\aop.mbn
%fastboot% %* flash qupfwbak images\qupv3fw.elf
%fastboot% %* flash ablbak images\abl.elf
%fastboot% %* flash devcfgbak images\devcfg.mbn
%fastboot% %* flash hypbak images\hyp.mbn
%fastboot% %* flash boot images\boot.img
%fastboot% %* flash logo images\logo.img
%fastboot% %* flash dtbo images\dtbo.img
%fastboot% %* flash vbmeta images\vbmeta.img
%fastboot% %* flash vbmeta_system images\vbmeta_system.img
%fastboot% %* flash cust images\cust.img
%fastboot% %* flash super images\super.img
%fastboot% %* reboot

[SOLVED] GSI on BV 4900 Pro: "Cannot load Android system. Your data may be corrupt. "

tl;dr: I followed the procedure to flash Android's Generic System Image (gsi_gms_arm64-exp-TP1A.220624.014-8819323-8a77fef1) on my Blackview BV 4900 Pro, but I am stuck in a bootloop that ends with "Cannot load Android system. Your data may be corrupt."
In details:
Prep​I made sure that my phone could support GSI​
$adb shell getprop ro.treble.enabled
true
$adb shell cat /system/etc/ld.config.29.txt | grep -A 20 "\[vendor\]"
…
namespace.default.isolated = true
…
$adb shell getprop ro.product.cpu.abi
arm64-v8a
Additional Checks​
Bootloader is unlocked.
Device was launched with Android 9 or higher (it was launched with Android 10)
Android 13 GSIs was downloaded (build Build: TP1A.220624.014) was downloaded from https://developer.android.com/topic/generic-system-image/releases and checksum for ARM64+GMS was confirmed to be 8a77fef1842da4a4cff68e36802f779d65e52ae0cfce024a33901d5dc48d47d0.
The phone has Android Verified Boot (AVB):
$adb shell getprop ro.boot.veritymode
enforcing
Flashing​
I followed the official tutorial for flashing GSIs but changed a couple of things (I may have the order wrong, but I essentially did, once I was in fastboot mode
fastboot flashing unlock # To unlock bootloader
fastboot flash --disable-verity --disable-verification vbmeta vbmeta.img # Disable secure boot
fastboot reboot fastboot # Restart in fastbootd
fastboot delete-logical-partition product # I didn't have enough space for Resizing 'system' (I had FAILED (remote: 'Not enough space to resize partition'))
fastboot erase system
fastboot format:ext4 system # because when I tried to flash system.img the first time, I had "Invalid sparse file format at header magic"
fastboot flash system system.img
fastboot format:ext4 userdata
fastboot erase userdata
fastboot format:ext4 metadata
fastboot erase metadata
fastboot erase cache
But when I restart, I am always prompted with
Android Recovery
Blackview /BV4900Pro_US/BV4900Pro10/…
user/release-keys
Use volume up/down and power
Can't load Android system. Your data
may be corrupt. If you continue to get
this message, you may need to perform a
factory data reset and erase all user
data stored on this device
-------------------------
Try again
Factory data reset
-------------------------
Supported API:3
I have tried to reset factory data and to reboot, but I always have the same message…
$ adb --version
Android Debug Bridge version 1.0.41
Version 33.0.3-8952118

I just realized / remembered that this phone uses super.img instead of system.img, maybe I need to repack the system.img into a super.img, following this procedure?

tl;dr: Yes, repacking the system.img into a super.img and then flashing it was key to success.
I have essentially followed what I have described here: https://forum.xda-developers.com/t/...n-blackview-bv-4900-pro.4453955/post-87029001
Except that the three images I used were the original vendor.img, the original product.img, and
aosp_arm64-exp-TP1A.220624.014-8819323-996da050/system.img (available at
Generic System Images (GSIs) | Platform | Android Developers
developer.android.com
)
I used the command
python3 lpmakesimple.py lpbinary/binary/lpmake ./super_20220510.img 4294967296 system=system.img,vendor=./vendor.img,product=./product.img
(4294967296 being picked semi-randomly: it's a multiple of the block size (65536), less than the size of the super partition but more than the size of the three images combined + some more).
That's it: I flashed that super_20220510.img using fastboot flash super super_20220510.img and it was all good!