Definitive Guide for Windows 10 ARM installation - OnePlus 6 Guides, News, & Discussion

Hi.
You have heard of Renegade Project, for installation of Windows 10/11 ARM64 on Snapdragon 845 devices. There are many issues with the drivers, which result in Qualcomm Crash Dump or Blue screen. After multiple trials and errors, I finally figured the definitive guide for installation of Windows 10 ARM64 on OnePlus 6. This d guide does not requires installation of any drivers as all the drivers and MS Office for ARM, are preinstalled. It is a bootable recovery image of my own working build.
Although initial setup needs to be done and this will render the android system unbootable:
1. Copy parted to root of sdcard/storage of the phone
2. Boot the latest twrp recovery:
Code:
adb shell
cp /sdcard/parted /sbin/ && chmod 755 /sbin/parted
umount /data && umount /sdcard
parted /dev/block/sda
Remove all partitions Note: Android will be removed
Code:
rm 17
rm 16
rm 15
rm 14
Make necessary partitions (128GB model)
Code:
mkpart esp fat32 6559MB 7000MB
mkpart win ntfs 7000MB 120GB
mkpart pe fat32 120GB 121GB
mkpart userdata ext4 121GB 125GB
set 14 esp on
quit
Reboot to twrp and format the partitions
Code:
adb shell
mkfs.fat -F32 -s1 /dev/block/by-name/pe
mkfs.fat -F32 -s1 /dev/block/by-name/esp
mkfs.ntfs -f /dev/block/by-name/win
mke2fs -t ext4 /dev/block/by-name/userdata
Reboot to twrp and copy pe folder to adb folder:
Code:
adb push pe /sdcard/pe/
adb shell
mount /dev/block/by-name/pe /mnt
cp -r /sdcard/pe/* /mnt
Now flash the UEFI boot image for Oneplus 6 from bootloader
Code:
fastboot flash boot boot.img
Copy Backupimage.win (which was downloaded) and DISM++ to a pendrive, wait for PE image to boot. Connect usb keyborad, mouse and pendrive via USB-C Hub.
In command prompt, enter following commands:
Code:
diskpart
select disk 0
list part
select part 14
assign letter=Y
exit
Now open Dism++ARM64.exe and click on REcovery tab ---> System Restore
Browse and select backupimage.wim from pendrive, and select destination (C:\) and check "Add Boot".
Now wait patiently as i may take some time.
After Restore is finished, enter following commands in Command Prompt:
Code:
bcdedit /store Y:\efi\microsoft\boot\bcd /set {Default} testsigning on
bcdedit /store Y:\efi\microsoft\boot\bcd /set {Default} nointegritychecks on
bcdedit /store Y:\efi\microsoft\boot\bcd /set {Default} recoveryenabled no
shutdown -s -t 0
Remove all USB devices/Hub and let the phone boot.
Enjoy.
Everything except Camera, is working.
Acknowledgements:
1. TWRP
2. Renegade Project
3. Microsoft
4. Oneplus
Download Links: Mediafire Link

Related

[Q] (vold.fstab) storage is messed up \O/

I edit ( vold.fstab ) for swaping sdcard with external_sdcard .
but now my tab dose not show any storage ?
tab: karbonn tornado
problem resolved
Flash with stock rom, and its done :good:
Download any stock rom from here :
androidxda(.)com/download-karbonn-stock-rom-models
:victory:
or you can change it with ADB PULL
Here some text which i find on net :
Download the Android Debug Bridge from here, and extract the contents (to the same directory).
Connect your device to your computer using the USB cable and open up a command prompt (Windows logo key + R, type cmd and press Enter).
Once that is open, type the following commands:
cd <entire path to adb.exe file>
adb shell
su
mount -o remount,rw /system (if that doesn't work: mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system)
exit
exit
adb push <path to original file> /system.etc/vold.fstab
adb reboot
That will grant root, mount the system as writeable and then push the original file and overwrite the modified one (and reboot your device).
Click to expand...
Click to collapse
I don't know about Android Commander, but a simpler way (in my opinion) would be to use ADB. You may have already installed the Android SDK (if not, go here). I assume that you don't have modified your System Path.
Move your vold.fstab to C:\Program Files\Android\android-sdk\platform-tools or C:\Program Files (x86)\Android\android-sdk\platform-tools
Go to the android-sdk folder, shift+right click on platform-tools and choose "Open command prompt here"
Next steps depends if you have a custom rom (a) or not (b) (see comments).
We take root privilege:
a) If your device is 4.0 or above, type adb root
b) Type adb shell then su
We make /system writeable:
a) adb remount
b) mount -o remount,rw /system then exit
adb push vold.fstab /system
adb reboot
This should do the trick.
Click to expand...
Click to collapse
to pull (read) should not need root.
adb pull /system/etc/vold.fstab
or
adb pull /etc/vold.fstab
what output did you get?
_____________________________________________________
adb pull /etc/vold.fstab
edit vold.fstab and change the following line:
dev_mount usbdisk /mnt/usbdisk auto /devices/platform/tegra-ehci
to
dev_mount usbdisk /mnt/usbOTG auto /devices/platform/tegra-ehci
save the file, and go back to the command line
adb remount
adb push vold.fstab /etc/vold.fstab
abd reboot
Click to expand...
Click to collapse
But i dont get any of em

Restore your Baseband in MT65XX Devices

HOW TO RESTORE YOUR BASEBAND IF YOU LOST IT DURING A FORMAT - MT65XX DEVICES
Thanks go to abdullahi_ for this solution. His original post from another forum can be found below:
https://forum.hovatek.com/thread-116-post-376.html#pid376
Prequisites
Phone Rooted
Smart Phone Flash Tool Backup - Specifically protect_f file (for a Dual SIM phone, maybe different for a single SIM phone)
Linux OS - I used Ubuntu in a virtual machine
Android SDK platform tools for ADB access
From a terminal (CTRL + ALT + T)
Code:
mkdir -p ~/protect_f/f
cd ~/protect_f
At this point copy the file "protect_f" in the ~/protect_f
then continue:
Code:
sudo mount -t ext4 -o loop protect_f f/
Enter your password
then continue:
Code:
cd f
sudo chown -R $USER:$USER *
Copy the files in the f/md folder to a folder on your phone and using a file manager with root access copy the two files into the /protect_f folder or any toher means
NOTE: You will probably get back your cell access immediately. However, please continue to make the permissions and ownership are the same as the original.
Also if you have a dual SIM, one of the files from the protect_f folder will automatically be created in the protect_s folder
To clean up the files on the Linux OS:
Code:
cd ~/protect_f
sudo umount f/
cd ~
rm -rf protect_f
To change permissions and ownership on the files
From an adb shell for your phone:
Code:
su
cd /protect_f
ls -l
Take note of the ownership of the md folder, on the phone I used they were ccci & nvram, in Linux the ownership was 9996 & 9997.
At this point I put the phone in airplane mode, just as a precaution to make sure the rest went smoothly
Code:
cd md
chown ccci:nvram *
chmod 660 *
If you have a DUAL SIM phone, for the second folder....
Code:
cd /protect_s/md
chown ccci:nvram *
chmod 660 *
You can now take the phone off of airplane mode and reboot your phone to be sure it is working,
ALL DONE!
REMOVED

[GUIDE] How to restore logd to your device/fix adb logcat read failure or empty logs

A few days ago, I flashed a zip onto my phone that set SELinux to permissive. However, there was a problem: it deleted logd, which is essential to adb logcat. Considering I'm an Android developer, that isn't a good thing! It took me a bit to figure out how to get it back, so I'm making this guide to share with you guys to help whatever poor soul has to fix this next.
Note that these steps were designed with Linux in mind, though they might be adaptable to Cygwin/OSX with some effort.
Also, make sure you delete any SELinux permissive scripts from init.d/su.d first!
Prerequisites
The OTA or custom rom zip that your device is currently running
adb
simg2img (available in the Ubuntu software repositories)
sdat2img (available here)
Instructions
Put your OTA/custom ROM zip file in a new folder and unzip it (this example is using the Pure Nexus ZIP):
Code:
mkdir restore_logd
cp pure_nexus_hammerhead-7.0-20161025-HOMEMADE.zip restore_logd
cd restore_logd
unzip pure_nexus_hammerhead-7.0-20161025-HOMEMADE.zip
Now, look for a file named either system.new.dat or system.img.
If you have system.img, then run:
Code:
simg2img system.img system.raw.img
If you have system.new.dat AND system.transfer.list, instead run:
Code:
sdat2img.py system.transfer.list system.new.dat system.raw.img
Either way, you should now have a file named system.raw.img. Next, mount it:
Code:
mkdir system_mnt
sudo mount -t ext4 -o loop system.raw.img system_mnt
This will mount the system image onto the system_mnt folder.
Plug in your device to your computer and make sure USB debugging is enabled, then run:
Code:
adb push system_mnt/bin/logd /sdcard/logd
adb shell
You should now be in a shell connected to your device. Inside, run:
Code:
su
mount -o rw,remount /system
cp /sdcard/logd /system/bin/logd
chmod 755 /system/bin/logd
exit
This will install the logd binary and close the shell.
This next part is very important! Making sure you closed the adb shell and are still inside the directory you created, run:
Code:
ls -Z system_mnt/bin/logd
If the output looks like this:
Code:
? system_mnt/bin/logd
then you have nothing else to do. Otherwise, it might look a bit like this:
Code:
u:object_r:logd_exec:s0 system_mnt/bin/logd
Copy part before the path; in this case, it's:
Code:
u:object_r:logd_exec:s0
Then, run:
Code:
adb shell su root chcon permission /system/bin/logd
replacing permission with the string you copied.
Now you can unplug and restart your device; logd should now be fully working!
Last but not least, run:
Code:
sudo fusermount -u system_mnt
to unmount the system image from your computer.
Enjoy!
Execute command failed while replacing permission
Code:
adb shell su root chcon permission /system/bin/logd
u:object_r:logd_exec:s0
/system/bin/sh: <stdin>[1]: u:object_r:logd_exec:s0: not found

How to pull mmcblk0 or any partition directly to pc?

I have tried following command on ADB to extract partition, but failed.
source:fciotti.com/2017/02/26/clone-android-memory
Code:
chmod +r /dev/block/mmcblk0
returns
Code:
Bad mode
Code:
adb pull /dev/block/mmcblk0 "mmc.img"
returns
Code:
remote permission denied
I have post a question on stack exchange, and found a command working but failed after dumping 4gb on sdcard (not directly to pc) because of file system.
source:android.stackexchange.com/questions/185433/problem-with-coping-mmcblk0-to-pc?noredirect=1#
Code:
adb exec-out "su -c 'cat /dev/block/mmcblk0'" > mmc.img
but it create a 0kb img file.
Please anyone help.

[RECOVERY] TWRP 3.5.2 | Unihertz Jelly 2

How to install:
Unlock bootloader:
Boot your device into the official OS.
Go to Settings > About phone, tap the "build number" several times to enable developer settings.
Go to Settings > System > Developer Settings, enable OEM unlocking and ADB debugging.
Connect your phone to your PC and open a terminal or a command line window.
Run adb reboot bootloader on your PC (there is no way to enter bootloader directly, only possible through adb).
Once your device has finished booting run fastboot flashing unlock and comfirm unlock on device (THIS WILL WIPE ALL DATA!).
Run fastboot reboot to reboot your device and now you should see an unlocked warning during boot screen.
Disable AVB:
Download vbmeta.img from the latest release page of your device.
Connect your phone to your PC and open a terminal or a command line window.
Run adb reboot bootloader on your PC to put your device in bootloader mode.
Once your device has finished booting run fastboot flash --disable-verification --disable-verity vbmeta vbmeta.img
Then run fastboot flash --disable-verification --disable-verity vbmeta_system vbmeta.img
Also run fastboot flash --disable-verification --disable-verity vbmeta_vendor vbmeta.img
Flash recovery image:
Connect your phone to your PC and open a terminal or a command line window.
Run adb reboot bootloader on your PC to put your device in bootloader mode.
Once your device has finished booting run fastboot erase recovery. For some reason, image may be not actually flashed, even if fastboot reported success (at least over the stock recovery image), so in order make sure that the custom image is always flashed it's better to always erase the partition before flashing. After the erasing run fastboot flash recovery recovery.img
Run fastboot reboot and after the screen goes dark press volume up until you see the TWRP logo. Also you can type fastboot reboot recovery to boot to recovery mode immediately.
Please note that booting in stock ROM will bring stock recovery back.
This recovery image is built using binaries from non-european (TEE) version of Jelly 2. Theoretically it should work on european (EEA). If it won't - contact me, I'll prepare an image based on EEA binaries.
Source code https://github.com/Meetoul/twrp_device_Unihertz_Jelly2
Thanks!
This fantastic!
its work on EEA!
Meetoul said:
Source code https://github.com/Meetoul/twrp_device_Unihertz_Jelly2
Click to expand...
Click to collapse
I just received my Jelly 2. It was on 2020 and I went straight through your files. Your TWRP does not respond on my European Jelly 2. Meaning, the touch screen does not respond. But I connected an USB trackball and switched in between adb sideloads. So I finally got it working.
For some reason during reboot TWRP warns me that there is no OS installed. But LoS 18.1 (yours) booted fine. Also flashed opengapps 2707 nano.
After a reboot (phone is still restoring apps) there is a "serial console is enabled" message "performance is impacted, check bootloader". Any instructions on how to get rid of that?.
I cannot seem to mount system as R/W with GSI image from https://github.com/phhusson/treble_experimentations/releases from within TWRP. I guess that's a more general problem, though
Any ideas?
kkazakov13 said:
I cannot seem to mount system as R/W with GSI image from https://github.com/phhusson/treble_experimentations/releases from within TWRP. I guess that's a more general problem, though
Any ideas?
Click to expand...
Click to collapse
Dave you tried the latest release a suggested by Meetoul?
[ROM] [UNOFFICIAL] Lineage OS 17.1 | Unihertz Jelly 2
https://drive.google.com/drive/u/0/folders/1VSmj_-a1PYNzFWtUfbsDGWg4uIh-Tgkd This ROM is built using binaries from non-european (TEE) version of Jelly 2. Theoretically it should work on european (EEA). If it won't - contact me, I'll prepare ROW...
forum.xda-developers.com
Release Fix gt1151qm touch in recovery · Meetoul/twrp_device_Unihertz_Jelly2_TEE
Recovery image based on new kernel image with patches for both gt1x and gt1151qm touch panel drivers.
github.com
Great Job!
I have Jelly2_JP.
I tried your recovery.img for Jelly2_TEE.
It can boot my Jelly2_JP, and it can enable adb shell, but it looped the splash screen.
But I execute following command in adb shell, twrp starts gui("Keep System Read only?" screen)
Jelly2_TEE:/ # mount -o ro /dev/block/mapper/system /
Touchscreen works fine.
Next, I tried to build twrp for Jelly2_JP using your device tree.
But it has same problem. (It looped the splash screen until I mount system partition.)
Do you have any advice?
Attachments
recovery_tee.log is pulled file from /tmp/recovery.log in your twrp for Jelly2_TEE. Line 1119 is after I mount system partition by adb shell.
recovery_jp.log is pulled file from /tmp/recovery.log in my twrp for Jelly2_JP. Line 1356 is after I mount system partition by adb shell.
My build instructions
$ cd ~/twrp
$ repo init -u https://github.com/minimal-manifest-twrp/platform_manifest_twrp_omni.git -b twrp-10.0
$ vi .repo/local_manifests/roomservice.xml
$ repo sync --force-sync
$ cd device/Unihertz
$ cp -r Jelly2_TEE Jelly2_JP
$ cd Jelly2_JP
$ mv omni_Jelly2_TEE.mk omni_Jelly2_JP.mk
$ grep -l Jelly2_TEE * | xargs sed -i 's/Jelly2_TEE/Jelly2_JP/g'
$ grep -l g55v71c2k_dfl_tee * | xargs sed -i 's/g55v71c2k_dfl_tee/g55v71c2k_dfl_jp_felica/g'
$ ./extract-files.sh ~/stock_jp/extracted
$ unpack_bootimg --boot_img ~/stock_jp/recovery.img --out ~/stock_jp/recovery
$ cp ~/stock_jp/recovery/kernel prebuilt/Image.gz
$ cp ~/stock_jp/recovery/dtb prebuilt/dtb/mt6771.dtb
$ cp ~/stock_jp/recovery/recovery_dtbo prebuilt/dtbo.img
$ cd ~/twrp
$ source build/envsetup.sh
$ lunch omni_Jelly2_JP-eng
$ mka recoveryimage
$ ls out/target/product/Jelly2_JP/recovery/root/vendor
bin etc
$ cp -r vendor/Unihertz/Jelly2_JP/proprietary/reovery/root/vendor out/target/product/Jelly2_JP/recovery/root
$ mka recoveryimage
file upload again.
Sorry, I can't upload Attach files.
I clicked "Attach files" button and choose file.
I clicked "Save" button, but file link did not inserted.
I uploaded recovery.log to github.
How to get vbmeta.img
Three knife said:
How to get vbmeta.img
Click to expand...
Click to collapse
Direct Link
Google Drive: Sign-in
Access Google Drive with a Google account (for personal use) or Google Workspace account (for business use).
drive.google.com
See Also
Jelly 2 firmware made available by Unihertz
A post to let people interested in small Android phones know that the firmware of the Jelly 2 has been made available by Unihertz. Would be great if a LineageOS version of this could be made...
forum.xda-developers.com
Or
[HOWTO] Flash a blank vbmeta
Hey guys, As some of you know samsung made had a bunch of different changes since the release of Android 10. It took me a week to figure it out but it was really simple. I had to do two things: Repatch the the magisk boot image with Preserve AVB...
forum.xda-developers.com
I found the crash point in Jelly2_JP.
The crash point is CHECK() on line 772 of twrp/hardware/interfaces/keymaster/4.0/support/Keymaster.cpp.
C++:
CHECK(error == ErrorCode::OK)
<< "Failed to get HMAC parameters from " << *keymaster << " error " << error;
CHECK() is defined on line 495 of twrp/system/core/base/include/android-base/logging.h
C++:
#define CHECK(x) \
LIKELY((x)) || ABORT_AFTER_LOG_FATAL_EXPR(false) || \
::android::base::LogMessage(__FILE__, __LINE__, ::android::base::DEFAULT, \
::android::base::FATAL, _LOG_TAG_INTERNAL, -1) \
.stream() \
<< "Check failed: " #x << " "
I thought /system/bin/recovery was crashing due to a bug.
But it is not a bug.
/system/bin/recovery is programmed to abort if CHECK() fails.
Next, I compared the results of CHECK().
1. using your recovery.img for Jelly2_TEE.
Code:
$ adb shell
Jelly2_TEE:/ # uname -a
Linux localhost 4.14.141+ #15 SMP PREEMPT Wed May 19 11:04:10 CST 2021 aarch64
Jelly2_TEE:/ # mount -o ro /dev/block/mapper/vendor /vendor
Jelly2_TEE:/ # md5sum /vendor/lib64/libkeymaster4.so
17f162aedb3a9584e51d7f732ebbac7f /vendor/lib64/libkeymaster4.so
Jelly2_TEE:/ # umount /vendor
Jelly2_TEE:/ # md5sum /vendor/lib64/libkeymaster4.so
22ede18944c5f47daf04d699a72717b2 /vendor/lib64/libkeymaster4.so
Jelly2_TEE:/ # logcat -v brief -d -s /system/bin/recovery
E//system/bin/recovery( 324): Failed to get IAshmemDeviceService.
W//system/bin/recovery( 324): [libfs_mgr]Warning: unknown flag: resize
W//system/bin/recovery( 324): [libfs_mgr]Warning: unknown flag: resize
I//system/bin/recovery( 324): [libfs_mgr]Created logical partition product on device /dev/block/dm-0
I//system/bin/recovery( 324): [libfs_mgr]Created logical partition system on device /dev/block/dm-1
I//system/bin/recovery( 324): [libfs_mgr]Created logical partition vendor on device /dev/block/dm-2
W//system/bin/recovery( 324): DM_DEV_STATUS failed for system_image: No such device or address
W//system/bin/recovery( 324): DM_DEV_STATUS failed for vendor_image: No such device or address
W//system/bin/recovery( 324): DM_DEV_STATUS failed for product_image: No such device or address
I//system/bin/recovery( 324): fscrypt_initialize_systemwide_keys
I//system/bin/recovery( 324): List of Keymaster HALs found:
I//system/bin/recovery( 324): Keymaster HAL #1: HardwareKeymasterDevice from TrustKernel SecurityLevel: TRUSTED_ENVIRONMENT HAL: [email protected]::IKeymasterDevice/default
F//system/bin/recovery( 324): Keymaster.cpp:150] Check failed: error == ErrorCode::OK Failed to get HMAC parameters from HardwareKeymasterDevice from TrustKernel SecurityLevel: TRUSTED_ENVIRONMENT HAL: [email protected]::IKeymasterDevice/default error SECURE_HW_COMMUNICATION_FAILED
2. using my recovery.img for Jelly2_JP.
This is built with Jelly2_JP's kernel and /vendor/*.
Code:
$ adb shell
Jelly2_JP:/ # uname -a
Linux localhost 4.14.141+ #5 SMP PREEMPT Wed May 19 12:15:37 CST 2021 aarch64
Jelly2_JP:/ # mount -o ro /dev/block/mapper/vendor /vendor
Jelly2_JP:/ # md5sum /vendor/lib64/libkeymaster4.so
17f162aedb3a9584e51d7f732ebbac7f /vendor/lib64/libkeymaster4.so
Jelly2_JP:/ # umount /vendor
Jelly2_JP:/ # md5sum /vendor/lib64/libkeymaster4.so
17f162aedb3a9584e51d7f732ebbac7f /vendor/lib64/libkeymaster4.so
Jelly2_JP:/ # logcat -v brief -d -s /system/bin/recovery
E//system/bin/recovery( 327): Failed to get IAshmemDeviceService.
W//system/bin/recovery( 327): [libfs_mgr]Warning: unknown flag: resize
W//system/bin/recovery( 327): [libfs_mgr]Warning: unknown flag: resize
I//system/bin/recovery( 327): [libfs_mgr]Created logical partition product on device /dev/block/dm-0
I//system/bin/recovery( 327): [libfs_mgr]Created logical partition system on device /dev/block/dm-1
I//system/bin/recovery( 327): [libfs_mgr]Created logical partition vendor on device /dev/block/dm-2
W//system/bin/recovery( 327): DM_DEV_STATUS failed for system_image: No such device or address
W//system/bin/recovery( 327): DM_DEV_STATUS failed for vendor_image: No such device or address
W//system/bin/recovery( 327): DM_DEV_STATUS failed for product_image: No such device or address
I//system/bin/recovery( 327): fscrypt_initialize_systemwide_keys
I//system/bin/recovery( 327): List of Keymaster HALs found:
I//system/bin/recovery( 327): Keymaster HAL #1: HardwareKeymasterDevice from TrustKernel SecurityLevel: TRUSTED_ENVIRONMENT HAL: [email protected]::IKeymasterDevice/default
F//system/bin/recovery( 327): Keymaster.cpp:150] Check failed: error == ErrorCode::OK Failed to get HMAC parameters from HardwareKeymasterDevice from TrustKernel SecurityLevel: TRUSTED_ENVIRONMENT HAL: [email protected]::IKeymasterDevice/default error SECURE_HW_COMMUNICATION_FAILED
They are same Error code SECURE_HW_COMMUNICATION_FAILED.
Unfortunately, my recovery.img wasn't improved from your recovery.img when used with Jelly2_JP.
I'm sorry for the continuous posting.
I solved the decryption by modifying omni_Jelly2_JP.mk as follows.
Code:
PRODUCT_NAME := omni_Jelly2_JP
PRODUCT_DEVICE := Jelly2_JP
PRODUCT_MODEL := Jelly2_JP
PRODUCT_BOARD := g55v71c2k_dfl_jp_felica
BUILD_FINGERPRINT := "Unihertz/Jelly2_JP/Jelly2_JP:10/QP1A.190711.020/root.20210422.092852:user/release-keys"
PRODUCT_BUILD_PROP_OVERRIDES += \
TARGET_DEVICE=Jelly2_JP \
PRODUCT_NAME=Jelly2_JP \
PRIVATE_BUILD_DESC="Jelly2-user 10 QP1A.190711.020 root.20210422.092852 release-keys"
My mistake was that I only replaced "Jelly2_TEE" with "Jelly2_JP".
I had to replace "Jelly2" with "Jelly2_JP".
Anyway, now I can display the decryption screen.
Next, I tried HOW-TO-PATCH.md.
However, the touch screen does not respond on the patched kernel.
Code:
$ head -n 1 symbl_tee.txt
ffffff81dd680800 T do_undefinstr
$ grep get_boot_mode symbl_tee.txt
ffffff81ddda5b30 T get_boot_mode
$ zcat twrp/device/Unihertz/Jelly2_TEE/prebuilt/Image.gz > Image
$ aarch64-linux-android-objdump -D -b binary -m aarch64 --adjust-vma=0xffffff81dd680000 --start-address=0xffffff81ddda5b30 Image| head
ffffff81ddda5b30: d0009cc8 adrp x8, 0xffffff81df13f000
ffffff81ddda5b34: b947ad09 ldr w9, [x8,#1964]
ffffff81ddda5b38: 7100093f cmp w9, #0x2
I think you are using a different technique to enable the touch screen, because "cmp w9, #0x2" is not patched to "cmp w9, #0x0".
Please teach me your technique after you are not busy with work.
谢谢你,我用的是中国的没有Google Play的版本,按照你的步骤成功了,不过在安装完recovery.img之后,内部存储有可能无法写入,需要在recovery里删除data分区,然后就可以了
Thanks for this!
I flashed this TWRP, then installed AOSP 11, v313 of this GSI: https://github.com/phhusson/treble_experimentations/releases/tag/v313
Things seem good, except:
the battery seems to drain a little quickly
no IR blaster (ZaZa remote does not recognize it)
TWRP cannot decrypt the phone's contents, so I cannot flash gapps.
Is TWRP not able to decrypt because I'm using Android 11 and the TWRP was built for 10?
@karoooo
Sorry for not responding to you, for some reason email notifications from XDA were stopped. Please tell me if you still need patched kernel, I will try to patch it explain you the technique.
zxczxc4 said:
Thanks for this!
I flashed this TWRP, then installed AOSP 11, v313 of this GSI: https://github.com/phhusson/treble_experimentations/releases/tag/v313
Things seem good, except:
the battery seems to drain a little quickly
no IR blaster (ZaZa remote does not recognize it)
TWRP cannot decrypt the phone's contents, so I cannot flash gapps.
Is TWRP not able to decrypt because I'm using Android 11 and the TWRP was built for 10?
Click to expand...
Click to collapse
Actually, data decryption on MTK SoCs is very painful thing. I'm still waiting for stable release of Android 11 from Unihertz, but they are in no hurry...
I know that beta 11 available. Unfortunately, I was not able to update using the official way. The bootloader was locked and the moment of updating, but probably the reason is that it was unlocked before (it possible to relock bootloader using SP Flash Tool). But I manager to fetch zip update package and install it via TWRP After that I even managed to make package for SP Flash Tool based on this package, so I can to flash pure FW without updating and have locked bootloader!
UPD. I see that Unihertz have published Android 11 SW package for SP Flash Tool on their Google Drive! Soon I will try to make recovery based on this package.
@Meetoul
Thank you for your response.
Yes, yes, yes!
I want to know your technique.
Best Regards.
HI.
Summary: FRONT CAMERA not working after Bootloader Unlock
I am using Jelly2_JP (on latest Android 10) and I was wondering,
has anyone has experinced the Front Camera not working after Bootloader Unlock, and possibly the three " --disable-verification --disable-verity" commands?
The stock camera app won't recognize the front camera (not front/back switch button where there should be one), and other apps cant use the front camera either.
I can confirm that the front camera worked before unlocking the bootloader.
Reflashing stock image using SP Flash Tool and relocking Bootlader did not fix the issue.
Is anyone else experiencing the same issue?
karoooo said:
@Meetoul
Thank you for your response.
Yes, yes, yes!
I want to know your technique.
Best Regards.
Click to expand...
Click to collapse
Since Unihertz has released Android 11, I think that there is no sense to work on patching the old kernel.
Btw, now I'm working on TWRP based on Android 11 binaries from the latest FW, but no luck so far, it seems that kernel doesn't even start to boot...
@Meetoul
I wanted to learn your technique so that I could work on my own when Android 11 was released.
If Android 11 is formidable, prioritize working with Android 11.
Unfortunately, Android 11 for Jelly2_JP has not been released yet.
@kendzhi
I unlocked the bootloader with Jelly2_JP, but the front camera is still working.
@karoooo
Thank you for the reply!
May I ask, was your Jelly2_JP shipped before the latest Andorid 10 update (2021051912_g55v71c2k_dfl_jp_felica), meaning did your phone come with the previous Firmware (2020101915_g55v71c2k_dfl_jp_felica)?
I have two Jelly2_JP from Japan which came preshipped with the latest andorid Andorid 10 update (there was no need for OTA update). And in both phones, upon executing "fastboot flashing unlock" (without disableling AVB & without Rooting), the the front camera stopped working (not recognized by the system).
I even went into the Debug/Diagnostic? mode that was in Chinese (Booting by Vol down + Connecting to PC via USB), and peformed a hardware test for the Front Camera and the test froze the phone.
So I'm suspecting that Jelly2_JP that was shipped to Japan with the latest Firmware has some issues with Bootloader Unlocking breaking the Front Cam...

Categories

Resources