My phone is CID locked, I ran doctest (now I know it was stupid!).
So for now I have only bootloader screen, how to restore valid CID block ?
--
Cmd>info 2
GetDeviceInfo=0x00000002
GetDeviceCID: Error - InitDecoder
HTCS ´í•6HTCE
Cmd>
---
Cmd>set 32 0
+ SD Controller init
- SD Controller init
+StorageInit
CMD55 failed
+ SD Controller init
- SD Controller init
+StorageInit
CMD55 failed
GetDeviceCID: Error - InitDecoder
g_cKeyCardSecurityLevel = FF
HTCE
Cmd>
--
As I understand gsmdata is broken after 'doctest' - so and I can't use http://www.imei-check.co.uk/ to unlock CID.
Is any way to restore gsmdata?
Only on CID unlocked G3 devices that allow downgrade to an SPL that doesn't protect that zone of the bdk1 binary partition (QTEK 1.06)
sorry
Related
I have a bricked Hermes due to Pocket HAck MAster. I'm trying to read the control registry and load the correct values for the CPU frequency (hopefully this is the only thing that PHM changed). Anyway I was able to get the password and read something from the bootloader but I need help to understand the output for rmdr command. This is what I get:
Code:
USB>password B~~00~~0e1u7~000
HTCSPass1.CMˆËHTCEUSB>set 1e 1
USB>
USB>rbmc tmp.txt 0x4C000004 F
GetExtRomData+(): *pszPathName=tmp.txt, dwStartAddress=57600000, dwLength=F
:F=tmp.txt
:A=57600000
:L=0000000F
:rbmc=
HTCSÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
In this case I"m trying to read the MPLLCON control register at address 0x4C00004 to test if the loaded value is the correct 0x00096030.
Any help on understand the rbmc output? How can I read and write in 0x4C00004? After the rmdr command the bootloader is stuck with the long sequence of "ÿ".
Thanks
Crepatas
I need to use wdatah, too. But it is not clear where I put the value I want to be stored in memory.
From the wiki help I should use the following sintax (I attached the help below):
wdatah 4 0x4C00004
But where do I put the value that I want to be loaded? e.g. 0x00096030
Thanks
Crepatas
PS: do I need to worry about checksum/signatures?
Code:
wdatah
Seems to replace / extend the old wdata command which writes data to memory
Usage: wdata [Len [StartAddr]]
Write data to memory(if write to ROM, need erase first).
StartAddr : Start address of memory.
Len : How many bytes will be written.
Length must not more than 0x80000 bytes(buffer limitation).
Write to RAM: 4 bytes(CRC checksum limitation).
1 byte(in user mode).
Write to ROM: 4 bytes(CRC checksum limitation).
2(16-bit)/4(32-bit) bytes(in user mode).
Write to ROM(16-bit data bus): 32 bytes(writebuffer mode).
Write to ROM(32-bit data bus): 64 bytes(writebuffer mode).
Length must be 4 bytes boundary(CRC checksum) if not in user mode.After command execute, then send out the data to terminal. Data format: HTCS(4 bytes)+DATA+checksum(4 bytes, if not in user mode)+HTCE(4 bytes).
Password is needed to use this command:
USB>wdatah
Command is Locked!
Example commands issued by ROMUpgradeUt:
wdatah 80000 33d5115e
wdatah 80000 723a520b
I have big problem!
I kill my TyTN,
I go to multi port...........
---------------------------------------------
USB>task 32
Level = 0
USB>task 28
Storage format start
Write Nand Success
dwBlockToWrite = 13
Storage start block: 473
Storage Total block: 463
Total Bad Block in CE: 0
NeedToEraseBlockStart: 486
Storage format success
USB>lnb RUU_SIGNED.nbh
:F=RUU_SIGNED.nbh
:A=501A0000
:O=00000000
:L=FFFFFFFF
start NB image downloadSH
Load ADDR: 501A0000 Length: 5544382
***************************************
****************************************
*******************************
****************************************
****************************************
****************************************
****LAST BLOCK, dwBytesCollected=0x10000
Code entry point at 0x556E0000
Write Nand Success
USB>task 28
Storage format start
Write Nand Success
dwBlockToWrite = 17
Can't find OS in flash!!!
Storage format success
USB>task 8
-----------------------------------------------------------
can you halp me? please!
ouch.... you tried to flash the entire nbh. This file contains os, extrom, radio and splash screens. You need to take that apart first with nbhextract to get os.nb then flash that instead. Hopefully you'll be able to....
I had problem with SD card and i thought if i use different rom it will solve it
i have made the upgrade to to WM 6.1 VanillaManila v2.0 Ultimate & v1.0 For New Gene
After finishing flashing the rom it restart alone and stuck on the windows mobile 6.1 boot screen
I made hard rest and the problem persists.
And the sd card not work
Now when it boots appears
ONBL 1.10.0000
SPL 1.10.0000
GSM 08.79.90
OS 1.17.0.0
Smart mobility
And my htc s/n:Ht807******
And I use Orefkov
mtty1_42
but gives me that massage and not make the screen white
Cmd>ls boot.bin
clean up the image temp buffer at 0x8C100000 Length 0x03A00000
BOOTLOAD_PAGE_TABLE_BASE_C_VIRTUAL= 0x8C080000
Clear image temp buffer done .
MTTYDownloadImage
Not allow operation!
Error : DownloadImage return error (code = 0xFFFFFFFF)
I don’t know what to do
Please help me
smb_do said:
I had problem with SD card and i thought if i use different rom it will solve it
i have made the upgrade to to WM 6.1 VanillaManila v2.0 Ultimate & v1.0 For New Gene
After finishing flashing the rom it restart alone and stuck on the windows mobile 6.1 boot screen
I made hard rest and the problem persists.
And the sd card not work
Now when it boots appears
ONBL 1.10.0000
SPL 1.10.0000
GSM 08.79.90
OS 1.17.0.0
Smart mobility
And my htc s/n:Ht807******
And I use Orefkov
mtty1_42
but gives me that massage and not make the screen white
Cmd>ls boot.bin
clean up the image temp buffer at 0x8C100000 Length 0x03A00000
BOOTLOAD_PAGE_TABLE_BASE_C_VIRTUAL= 0x8C080000
Clear image temp buffer done .
MTTYDownloadImage
Not allow operation!
Error : DownloadImage return error (code = 0xFFFFFFFF)
I don’t know what to do
Please help me
Click to expand...
Click to collapse
bro try this again and jus bfore this wen u connect ur fone to ur pc kill the WCESCOMM.exe by holding ctrl+alt+del
wen u type ls boot.bin(remember its small L not I) hold ur camera button bfore hitting ENTER on ur PC and keep the camera button pressed till u get a white screen
hope this will work for you
set 32 1
+ SD Controller init
- SD Controller init
+StorageInit
SDInit+++
SDCmd8 Command response time-out. MMC_STAT = 80
SDCmd8 Command response time-out. MMC_STAT = 80
SDCmd8 Command response time-out. MMC_STAT = 80
SDInit - SD ver1.0
SDCmd1 Command response time-out. MMC_STAT = 80
SDCmd1 Command response time-out. MMC_STAT = 80
SDCmd1 Command response time-out. MMC_STAT = 80
SD clock to 24MHz
***** user area size = 0x79000000 Bytes
SDInit---
SDInit OK
g_cKeyCardSecurityLevel = FF
Cmd>ls boot.bin
clean up the image temp buffer at 0x8C100000 Length 0x03A00000
BOOTLOAD_PAGE_TABLE_BASE_C_VIRTUAL= 0x8C080000
Clear image temp buffer done .
MTTYDownloadImage
Not allow operation!
Error : DownloadImage return error (code = 0xFFFFFFFF)
Cmd>
i do eveything right but i dont know why it is become not allow operation
please help me
press and hold camera button before pressing enter in ls boot.bin command and release it after the command is completed
g_cKeyCardSecurityLevel = FF
Click to expand...
Click to collapse
This is your problem, the value should be 00. Your phone is CID Locked so it is not allowing the custom SPL to be patched. The only way to solve your problem is to get the original WM 6 or 5 whatever ROM came on your phone and flash it. This CID lock will only allow official ROMs to be flashed. After you get your phone working, first patch your SPL and then try upgrading your phone to any custom ROM from here. And also, please try to read the tutorials to flashing etc that are sticky posts in this forum before doing these dangerous things to your phone.
WARNING: If your phone came with WM 6 original, find the original ROM and flash it. But if it came with WM 5, you better give it to service center for flashing. Most WM 5 Roms available on forum cause phones to become dead. So flash WM 5 rom if and only if you are certain that its the original one for your particular phone.
Think you very much for your explanation
I tried to make the secreen white to flash the rom but it wont be
my phone problem from begging is the SD card not working however how i can found wm5 original rom
That, my friend, i really dont know. Ask Ramerson, he may be able to give you one or may be able to provide you with information on whom to contact. And please, ASK Specifically for a official ROM as you cannot flash custom roms in your current situation.
I'm looking for some experienced eyes to scan through the partition info of a CyberNav tablet that I've mucked up by being very stupid. The CyberNav is a cheap Chinese GPS/Android tablet. It works great, or rather worked great until I very stupidly left it attached to my computer after downloading a track of my latest dirtbiking exploits. Later that evening I decided to make another Ubuntu USB startup disk... well, you can guess the rest.
At this point, the tablet will not mount the internal "sdcard" memory. It still boots, everything works, not bricked yet. When connected to USB, it will share out this external storage just fine. It just won't mount it within Android. It reports "Preparing memory device, checking for errors." Never gets past that point. I do have a backup of the original internal sdcard contents (made that when I first got the device) and anything that was important to me. Yes, I make backups, been burned too many times. I've also managed to find a factory ROM for it and I've successfully flashed that to the device. It made no difference with the problem. I've also got a root prompt via ADB shell using psneuter.
I have a copy of parted and gdisk, though I've not tried to run them yet. In other words, it's time to start figuring out what to fix in the partition tables.
I think the problem is here:
# busybox fdisk -l /dev/block/mmcblk2p6
... Device Boot Start End Blocks Id System
/dev/block/mmcblk2p6p1 1 1017 3436381 5 Extended <<<<< HERE
/dev/block/mmcblk2p6p5 1 1017 3436379 b Win95 FAT32
Does that seem right? Am I in any danger of bricking this device if I blow away the mmcblk2p6p1 partition and/or the entire mmcblk2p6? How bad do things generally have to get in these partitions before the device bricks?
What is the best/safest way to remove this partition and if I have to blow the whole mmcblk2p6 partition away will I have to manually recreate it before rebooting?
Any advice appreciated,
David...
P.S. Here is all the hopefully relevant information I've so far managed to locate:
Cybernav Mini: CPU: IMAPX200 ARM11 800MHz, also known as YFPi08, now flashed to Android 2.2-104.
# cat /proc/partitions
Code:
major minor #blocks name
179 16 3878912 mmcblk2
179 17 4096 mmcblk2p1
179 18 8192 mmcblk2p2
179 19 153600 mmcblk2p3
179 20 1 mmcblk2p4
179 21 277760 mmcblk2p5
179 22 3435072 mmcblk2p6
# busybox fdisk -l /dev/block/mmcblk2
Code:
Disk /dev/block/mmcblk2: 3972 MB, 3972005888 bytes
1 heads, 16 sectors/track, 484864 cylinders
Units = cylinders of 16 * 512 = 8192 bytes
Device Boot Start End Blocks Id System
/dev/block/mmcblk2p1 9 520 4096 30 Unknown
Partition 1 does not end on cylinder boundary
/dev/block/mmcblk2p2 521 1544 8192 31 Unknown
Partition 2 does not end on cylinder boundary
/dev/block/mmcblk2p3 1545 20744 153600 83 Linux
Partition 3 does not end on cylinder boundary
/dev/block/mmcblk2p4 20745 484864 3712960 5 Extended
Partition 4 does not end on cylinder boundary
/dev/block/mmcblk2p5 20753 55472 277760 83 Linux
/dev/block/mmcblk2p6 55481 484864 3435072 b Win95 FAT32
# busybox fdisk -l /dev/block/mmcblk2p6
Code:
Disk /dev/block/mmcblk2p6: 3517 MB, 3517513728 bytes
109 heads, 62 sectors/track, 1016 cylinders
Units = cylinders of 6758 * 512 = 3460096 bytes
Device Boot Start End Blocks Id System
/dev/block/mmcblk2p6p1 1 1017 3436381 5 Extended
/dev/block/mmcblk2p6p5 1 1017 3436379 b Win95 FAT32
# cat /proc/kmsg
Code:
...
<3>[ 2.295000] imapx200_iic imapx200_iic.0: iic thread TX_ABORT occur
<3>[ 2.295000] imapx200_iic imapx200_iic.0: source is 1
<3>[ 2.295000] imapx200_iic imapx200_iic.0: slave address is 1a
<4>[ 2.300000] mmc_request bus 2 cmd 5 error -110
<4>[ 2.300000] mmc_request bus 2 cmd 5 error -110
<4>[ 2.300000] set info,open device error -939392608
<4>[ 2.305000] mmc_request bus 2 cmd 5 error -110
<3>[ 2.305000] imapx200_iic imapx200_iic.0: iic thread TX_ABORT occur
<3>[ 2.305000] imapx200_iic imapx200_iic.0: source is 1
<3>[ 2.305000] imapx200_iic imapx200_iic.0: slave address is 1a
<4>[ 2.305000] mmc_request bus 2 cmd 5 error -110
<6>[ 2.330000] mmc2: new high speed SDHC card at address 0002
<6>[ 2.330000] mmcblk2: mmc2:0002 3.69 GiB
<6>[ 2.335000] mmcblk2: p1 p2 p3 p4 < p5 p6 >
<4>[ 2.400000] custom info start sector 8182
<4>[ 2.430000] i2c-imapx200 transfer timeout
...
<6>[ 4.095000] EXT4-fs (mmcblk2p3): mounted filesystem with ordered data mode
<6>[ 4.635000] EXT4-fs (mmcblk2p5): recovery complete
<6>[ 4.645000] EXT4-fs (mmcblk2p5): mounted filesystem with ordered data mode
...
<3>[ 26.285000] FAT: invalid media value (0xa5)
<6>[ 26.285000] VFS: Can't find a valid FAT filesystem on dev mmcblk2p6.
... x3 above spaced to end of log.
dmesg:
Code:
...
<6>[ 0.295000] Imap Framebuffer Driver Initialization OK!
<4>[ 0.340000] set info,open device error -939392608
<4>[ 0.440000] set info,open device error -939392608
<4>[ 0.540000] set info,open device error -939392608
<4>[ 0.640000] set info,open device error -939392608
<4>[ 0.740000] set info,open device error -939392608
<4>[ 0.845000] set info,open device error -939392608
<6>[ 0.925000] Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
...
<3>[ 96.180000] FAT: invalid media value (0xa5)
<6>[ 96.180000] VFS: Can't find a valid FAT filesystem on dev mmcblk2p6.
... x2 above
adding a little info
# /data/local/tmp/parted /dev/block/mmcblk2
GNU Parted 1.8.8.1.179-aef3
Using /dev/block/mmcblk2
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) print all
print all
Model: SD (sd/mmc)
Disk /dev/block/mmcblk2: 3972MB
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Number Start End Size Type File system Flags
1 65.5kB 4260kB 4194kB primary
2 4260kB 12.6MB 8389kB primary
3 12.6MB 170MB 157MB primary ext4
4 170MB 3972MB 3802MB extended
5 170MB 454MB 284MB logical ext4
6 454MB 3972MB 3518MB logical
But,
# /data/local/tmp/parted /dev/block/mmcblk2p6
GNU Parted 1.8.8.1.179-aef3
Using /dev/block/mmcblk2p6
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) print all
print all
Error: Can't have a partition outside the disk!
(parted)
Every command I try just reports: "Error: Can't have a partition outside the disk!"
Okay, Okay, I get it. No how do I get rid of said partition?
Back at: # /data/local/tmp/parted /dev/block/mmcblk2
(parted) check 6
check 6
Error: Could not detect file system.
(parted)
dare I go: rm 6
If I just reboot at that point, what are the odds of the bootloader just recreating this partition for me? Should I recreate the partition via parted first? Something like: mkpart logical fat32 454 3972 and then format it by Windows Computer via USB mode, or (man for parted says this is discouraged) mkpartfs logical fat32 454 3972 to let it format right away?
I guess what I'm really asking is: what are the odds of bricking it if I blow this partition away? Seem low, what with it not working properly now, but I figure I should at least make an attempt at asking before I suck it up and hit the button.
Anyone?
David...
fixed:
rm 6 and mkpartfs logical fat32 454 3972 then a reboot did the trick. I've copied all the data back and set the tablet back to where it was. All done
Only took 2 weeks of head-banging, trying to figure out the Android way. Not an easy thing, what with all the fragmentation, and it pushed my Linux skills to their limit as well. By the hour, this $100 tablet is now worth an order of magnitude more but those skills should be worth it, even if the tablet isn't.
David...
Hi, I am having issues with a Huawei modem E173u-1 on my tablet Archos 101 g9 8gb
driver not found.
Can you help me, pls?
USB_ModeSwitch log from Wed Apr 09 17:50:44 PKT 2014
Raw args from udev: 1-1/1-1:1.0
Using top device dir /sys/bus/usb/devices/1-1
----------------
USB values from sysfs:
manufacturer HUAWEI
product HUAWEI Mobile
serial
----------------
bNumConfigurations is 1 - don't check for active configuration
SCSI attributes not needed, moving on
checking config: /data/data/de.draisberghof.pppwidget/app_tmp/12d1.14fe
! matched. Reading config data
devList 1:
config: TargetVendor set to 12d1
config: TargetProduct set to 1506
Driver module is "option", ID path is /sys/bus/usb-serial/drivers/option1
Logger is: /system/bin/log
Command to be run:
usb_modeswitch -I -W -D -s 20 -u -1 -b 1 -g 2 -v 12d1 -p 14fe -f $cB
Verbose debug output of usb_modeswitch and libusb follows
(Note that some USB errors are to be expected in the process)
--------------------------------
Reading long config from command line
* usb_modeswitch: handle USB devices with multiple modes
* Version 1.2.4 (C) Josua Dietze 2012
* Based on libusb0 (0.1.12 and above)
! PLEASE REPORT NEW CONFIGURATIONS !
DefaultVendor= 0x12d1
DefaultProduct= 0x14fe
TargetVendor= 0x12d1
TargetProduct= 0x1506
TargetClass= not set
TargetProductList=""
DetachStorageOnly=0
HuaweiMode=0
SierraMode=0
SonyMode=0
QisdaMode=0
GCTMode=0
KobilMode=0
SequansMode=0
MobileActionMode=0
CiscoMode=0
MessageEndpoint= not set
MessageContent="55534243123456780000000000000011062000000100000000000000000000"
NeedResponse=0
ResponseEndpoint= not set
InquireDevice disabled
Success check enabled, max. wait time 20 seconds
System integration mode enabled
Use given bus/device number: 001/002 ...
Looking for default devices ...
bus/device number matched
searching devices, found USB ID 12d1:14fe
found matching vendor ID
found matching product ID
adding device
Found device in default mode, class or configuration (1)
Skipping the check for the current configuration
Using interface number 0
Using endpoints 0x01 (out) and 0x81 (in)
USB description data (for identification)
-------------------------
Manufacturer: HUAWEI
Product: HUAWEI Mobile
Serial No.: not provided
-------------------------
Looking for active driver ...
OK, driver found; name unknown, limitation of libusb1
OK, driver "unkown" detached
Setting up communication with interface 0
Using endpoint 0x01 for message sending ...
Trying to send message 1 to endpoint 0x01 ...
OK, message successfully sent
Resetting response endpoint 0x81
Could not reset endpoint (probably harmless): -34
Resetting message endpoint 0x01
Could not reset endpoint (probably harmless): -6
Device is gone, skipping any further commands
Bus/dev search active, referring success check to wrapper. Bye.
ok:busdev
--------------------------------
(end of usb_modeswitch output)
Checking success of mode switch for max. 20 seconds ...
Waiting for device file system (1 sec.) ...
Waiting for device file system (2 sec.) ...
Waiting for device file system (3 sec.) ...
Waiting for device file system (4 sec.) ...
Waiting for device file system (5 sec.) ...
Waiting for device file system (6 sec.) ...
Waiting for device file system (7 sec.) ...
Reading attributes ...
Mode switch has completed
Mode switching was successful, found 12d1:1506 (HUAWEI: HUAWEI Mobile)
Device class of first interface is ff
Now checking for bound driver ...
No driver has bound to interface 0 yet
Module loader is /sbin/insmod
Trying to find and install main driver module "option"
Trying to find module "option"
Loading support module /lib/modules/usb_wwan.ko
Error: insmod: cannot insert '/lib/modules/usb_wwan.ko': Invalid module format (-1): Exec
format error
Loading main driver module "option"
Error: insmod: cannot insert '/lib/modules/option.ko': Invalid module format (-1): Exec
format error
Falling back to "usbserial"
Module "usb_serial" not found, can't do more here
Driver binding seems to have failed
All done, exiting
please answer!!!
i'm solved the problem by replacing the nucleus