Hello all,
My device
I have a Rikomagic MK 802 IIIS mini PC with the following specs:
Model MK802 IIIS 8GB Dual Core
CPU RK3066 Dual Core - Cortex-A9 Up to 1.6GHz
GPU Quad- Core 2D/ 3D/ OpenGL ES2.0(AMD Z430)/ OpenVG1
OS Android 4.1
RAM 1GB DDR3
Memory 8GB Flash
Expansion Micro SD T-Flash(Maximum support 32GB)
Video Format WMV/ASF/MP4/3GP/3G2M4V/AVI/MJPEG/RV10/DivX/VC-1/MPEG-2/MPEG-4/H.263/H.264/1280*720P HD 30 fps, 1080P/720*480 D1 30fps
Audio Format MP3/WMA/APE/FLAC/AAC/OGG/AC3/WAV
Picture format Max.8000x8000 JPEG BMP GIF PNG
WiFi 802.11 b/g/n
Flash Supports flash 11.1
HDMI(male),Micro SD slot, USB host*1,USB OTG*1, USB power port; LED(Blue)
My primary problem (long story short): I managed to brick the MK802 IIS device in the process of installing Pi****u Linux on it. After trying to install the Linux kernel on the recovery partition manually, by doing from Android cmdline "busybox dd if=ug802recovkernel.img of=/dev/block/mtd/by-name/recovery bs=8192" and then "su" and "reboot recovery", I ended up with a non-booting system. I tried several times power off + power on cycles, but Android is not loading anymore. So, I would like to reflash the factory firmware on my device, to have the Android 4.1 booting again ... and I know about RKAndroidTool v1.35 for Windowses, but ...
... I am not using Windows OSes (better said, I avoid using them as much as I can, by trying to find *nix based solutions).
Therefore my main question: Is there Linux software to restore factory firmware on a Rikomagic MK802 IIIS device?
During my research, after googling for "rkandroidtool for linux" I found this promising link on our XDA community: http://forum.xda-developers.com/showthread.php?t=1286305
This "rkflashtool for Linux and rk2808, rk2818 and rk2918 based tablets" is reported to work fine by many, and later on in the above thread, user "frankjt" says:
there are good news, updated with ProductID 0x300a like this:
. . .
if (!(h = libusb_open_device_with_vid_pid(c, 0x2207, 0x300a)))
. . .
rkflashtool works on Cube's rk3066 tablets too (all functions: r, w, b).
Thanks to Ivop's excellent tool my Cube U30GT-H (firmware 1.02) is rooted now.
Click to expand...
Click to collapse
So, it seems this rkflashtool for Linux does a great job on rk3066 tablets, but is it working on mini PCs too?
Has anyone tried this tool on miniPC ? Preferably Rikomagic MK802 IIIS, but if you have experience on similar models, please share them here.
Is there a guide on how to reflash miniPCs with Linux software only? Please post it.
What are the hexadecimal addresses to be used when attempting to write an .img file on the Rikomagic MK802 IIIS mini PC?
Any advice, or feedback on these questions are very welcomed!
Regards.
Hi,
Doing a little bump of this thread.
After doing more google research, this time for "rk3066 flash tool linux" I've found:
armtvtech dot com and the rest of the link is: /armtvtechforum/viewtopic.php?f=66&t=350
slatedroid dot com and the rest of the link is: /topic/42826-flashing-rk3066-with-linux/
So definetly I'm not a singular case in my frustrations.
It seems that recommandations point to the rkflashtool that I mentioned in my previous post:
arctablet dot com and the rest of the link is: /wiki/index.php/Update_tablet_using_Linux (see the "Preparation" section)
Now the main question that remains: Anyone tested (successfully or not) Linux rkflashtool on a Rikomagic MK 802 IIIS mini PC?
Or, to put it simpler: Anyone tested Linux rkflashtool on any RK3xxx based android stick computer (aka mini PC) ?
If yes, please post your stories here.
PS: Sorry for the cryptic weblinks syntax, but I am still a new member, not allowed to post these ..
PSS(off-topic): Sorry for giving Pic Untu a "bad name" in the opening post, it wasn't my intention
Never mind, I was thinking of a different device.
Sent from my One X using xda app-developers app
---------- Post added at 08:49 PM ---------- Previous post was at 08:37 PM ----------
This person reports success with rkflashtool on an mk808: http://www.slatedroid.com/topic/460...08-from-linux/page__view__findpost__p__631970
ragesoss said:
Never mind, I was thinking of a different device.
Sent from my One X using xda app-developers app
---------- Post added at 08:49 PM ---------- Previous post was at 08:37 PM ----------
This person reports success with rkflashtool on an mk808: slatedroid com /topic/46001-writing-images-to-the-mk808-from-linux/page__view__findpost__p__631970
Click to expand...
Click to collapse
Thanks a lot, ragesoss!
I read the tutorial and the feedback, looks very promising!!
I'll test it myself on my MK802 IIIS and post the results here.
Very frustrating: seems that rkflashtool restore isn't working on Rikomagic MK802IIIS
First of all, the explanation for why I bricked my Rikomagic MK802 IIIS: when trying to install Pic Untu, I did that dd command on the recovery partition (see the first post in this thread for the exact command). Well, the procedure is not working like this because when accessing the mtdblock devices with normal *nix commands (dd, cat), the mtdblock Android driver is not handling I/O as usual and it causes data corruption on all the mtd device. That's why I bricked the device.
So, not having a backup before, I had to use a WindowsXP vmware VM with windows RK flashing utility. I restored the device to firmware "Rikomagic MK802IIIS 4GB, 8GB Recovery Software (20130121)" downloaded from rikomagic.co.uk.
Restoring was successfull so here I am with a fully functional Android which boots up OK. All fine for a day...
I decided to make a full device backup using Linux rkflashtool which I downloaded from the thread I mentioned in my first post (http://forum.xda-developers.com/showthread.php?t=1286305), this is the link: http://forum.xda-developers.com/attachment.php?attachmentid=785592&d=1321547155
I modified the source so that the rk3066 chipset is recognized (I added the 2207 usb vendor id).
The OS/computer I've used: Kubuntu 12.04 LTS 64 bit on a Thinkpad T420:
Code:
[email protected]:~# uname -a
Linux awesome 3.2.0-49-generic #75-Ubuntu SMP Tue Jun 18 17:39:32 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux
Now follows the copy/paste of commands & output of the backup operation, with the mention that: of course I put the device in flashing mode first, using paperclip + power-on cable in device's OTG connector linked to laptop :
Code:
[email protected]:~# ./rkflashtool r 0x00000000 0x01000000 > /mnt/media/mk802iiis_android_backup_20130706.bin
[email protected]:~# du /mnt/media/mk802iiis_android_backup_20130706.bin
8388608 /mnt/media/mk802iiis_android_backup_20130706.bin
[email protected]:~# du -h /mnt/media/mk802iiis_android_backup_20130706.bin
8.0G /mnt/media/mk802iiis_android_backup_20130706.bin
[email protected]:~#
[email protected]:~# hexdump -C /mnt/media/mk802iiis_android_backup_20130706.bin |head -10
00000000 50 41 52 4d 5b 02 00 00 46 49 52 4d 57 41 52 45 |PARM[...FIRMWARE|
00000010 5f 56 45 52 3a 34 2e 30 2e 34 0d 0a 4d 41 43 48 |_VER:4.0.4..MACH|
00000020 49 4e 45 5f 4d 4f 44 45 4c 3a 72 6b 33 30 73 64 |INE_MODEL:rk30sd|
00000030 6b 0d 0a 4d 41 43 48 49 4e 45 5f 49 44 3a 30 30 |k..MACHINE_ID:00|
00000040 37 0d 0a 4d 41 4e 55 46 41 43 54 55 52 45 52 3a |7..MANUFACTURER:|
00000050 52 4b 33 30 53 44 4b 0d 0a 4d 41 47 49 43 3a 20 |RK30SDK..MAGIC: |
00000060 30 78 35 30 34 31 35 32 34 42 0d 0a 41 54 41 47 |0x5041524B..ATAG|
00000070 3a 20 30 78 36 30 30 30 30 38 30 30 0d 0a 4d 41 |: 0x60000800..MA|
00000080 43 48 49 4e 45 3a 20 33 30 36 36 0d 0a 43 48 45 |CHINE: 3066..CHE|
00000090 43 4b 5f 4d 41 53 4b 3a 20 30 78 38 30 0d 0a 4b |CK_MASK: 0x80..K|
As you can see, the resulted backup file has 8 GB size, and the hexdump of it shows the usual stuff for a non-corrupted backup.
Note1: I avoided to "spam" the thread with the whole header of the hexdumped backup file, but I assure you that it has the boot command line with the size/offset of all the partitions. So, it is a backup successfully created.
Note2: The backup operation took about 25-30 minutes, no errors in the system logs.
After backup was done, Android still boots OK, all is fine. Until the nightmare came...
I decided to test the restore process, so I added the device once more in flashing mode (with paperclip & OTG), and did:
Code:
[email protected]:~/rk3066-rkflashtool/rk3066-rkflashtool-master/trunk# ./rkflashtool e 0x00000000 0x01000000
rkflashtool: info: interface claimed
rkflashtool: info: erasing flash memory at offset 0x00ffff00
[email protected]:~# ./rkflashtool w 0x00000000 0x01000000 < /mnt/media/mk802iiis_android_backup_20130706.bin
...
...
...
rkflashtool: info: writing flash memory at offset 0x00fffe80
rkflashtool: info: writing flash memory at offset 0x00fffea0
rkflashtool: info: writing flash memory at offset 0x00fffec0
rkflashtool: info: writing flash memory at offset 0x00fffee0
rkflashtool: info: writing flash memory at offset 0x00ffff00
rkflashtool: info: writing flash memory at offset 0x00ffff20
rkflashtool: info: writing flash memory at offset 0x00ffff40
rkflashtool: info: writing flash memory at offset 0x00ffff60
rkflashtool: info: writing flash memory at offset 0x00ffff80
rkflashtool: info: writing flash memory at offset 0x00ffffa0
rkflashtool: info: writing flash memory at offset 0x00ffffc0
rkflashtool: info: writing flash memory at offset 0x00ffffe0
Note1: Writing operation took 2 hours and 8 minutes, no errors in the system logs..
Note2: ... but it was the end of my working mk802iiis !
When I reconnected the device, Android won't boot, instead the device seems to enter the flashing mode again. I say it "seems" because I am not really sure, actually it should not even attempt to enter flashing mode because I'm not touching the little oriffice with the paperclip.
So that's it on short: Android does not start!
When I specifically manually entered flashing mode again, I tried to read several megabytes from near the start addresses of the flash memory. Unfortunately, I get garbage:
Code:
[email protected]:~# hexdump -C recoverytry.bin |head -10
00000000 ae e6 ff a7 75 26 3e 6f ee b7 d3 66 33 f7 e7 fa |....u&>o...f3...|
00000010 97 b4 e6 fe bf da 10 4e 70 b6 a7 d9 db 9f 3b b7 |.......Np.....;.|
00000020 6b 3d f6 7f fe ff bf 5e e1 af ef 3e ff df 93 f7 |k=.....^...>....|
00000030 d7 ee 3f ef 31 d2 cb cc ef eb db f7 f7 ff 7f e7 |..?.1...........|
00000040 cf 6d 96 e9 dd a5 d6 9f f7 11 67 ef 6d dc dd fd |.m........g.m...|
00000050 5e 4b f3 77 7d fd bd cd 9f 15 f9 17 83 fb f7 5b |^K.w}..........[|
00000060 b9 11 fd 61 b4 cd dd 93 b9 f7 de d7 f8 d1 9b ef |...a............|
00000070 76 fe bf 1f 67 77 f5 5f 67 e2 97 96 15 f7 ae 7f |v...gw._g.......|
00000080 e4 ce 7d e5 36 fb fe 56 ce e6 fb ca f3 f7 d0 37 |..}.6..V.......7|
00000090 3d af 49 cd d5 71 ff f9 33 db fe 34 f6 17 d3 1d |=.I..q..3..4....|
Compare the output above with the first 10 lines of my backup file posted earlier and you can understand what I mean by garbage.
So to resume:
1) I managed to create a correct backup of mk802iiis using rkflashtool ("rkflashtool r" worked as expected)
2) Rkflashtool failed to restore the backup ("rkflashtool w" doesn't work, at least not for restoring all 8 GB).
Does anyone experienced similar situations?
Is 8 GB too much to backup at once?
Is there some workaround for this?
Could be a PC problem or device problem?
Is 2 hours too long(or too short) for flashing 8 GB to NAND?
Please help.
Regards,
Lexminriko
An important omission from my previous post (my apologies for not realizing the importance of the following):
Using Linux rkflashtool on my Kubuntu 12.04 64bit I was able to successfully backup /restore partitions.
For example, I could restore recovery partition with the command:
Code:
./rkflashtool w 0x000010000 0x000008000 < /mnt/media/mk802iiis_original_recovery_part_20130706.bin
The "brickeage" occured only when I tried to restore all NAND in one step, with the command already mentioned in my previous post:
Code:
./rkflashtool w 0x00000000 0x01000000 < /mnt/media/mk802iiis_android_backup_20130706.bin
Main questions remain:
Anyone experienced similar situations on Rikomagic MK802 IIIS ?
Is there a way to fix this bricked device in Linux(with rkflashtool or other Linux software), given the command that caused the damage?
If you experienced similar troubles, please post.
Regards,
Lexminriko
lexminriko said:
Hello all,
My device
I have a Rikomagic MK 802 IIIS mini PC with the following specs:
Model MK802 IIIS 8GB Dual Core
CPU RK3066 Dual Core - Cortex-A9 Up to 1.6GHz
GPU Quad- Core 2D/ 3D/ OpenGL ES2.0(AMD Z430)/ OpenVG1
OS Android 4.1
RAM 1GB DDR3
Memory 8GB Flash
Expansion Micro SD T-Flash(Maximum support 32GB)
Video Format WMV/ASF/MP4/3GP/3G2M4V/AVI/MJPEG/RV10/DivX/VC-1/MPEG-2/MPEG-4/H.263/H.264/1280*720P HD 30 fps, 1080P/720*480 D1 30fps
Audio Format MP3/WMA/APE/FLAC/AAC/OGG/AC3/WAV
Picture format Max.8000x8000 JPEG BMP GIF PNG
WiFi 802.11 b/g/n
Flash Supports flash 11.1
HDMI(male),Micro SD slot, USB host*1,USB OTG*1, USB power port; LED(Blue)
My primary problem (long story short): I managed to brick the MK802 IIS device in the process of installing Pi****u Linux on it. After trying to install the Linux kernel on the recovery partition manually, by doing from Android cmdline "busybox dd if=ug802recovkernel.img of=/dev/block/mtd/by-name/recovery bs=8192" and then "su" and "reboot recovery", I ended up with a non-booting system. I tried several times power off + power on cycles, but Android is not loading anymore. So, I would like to reflash the factory firmware on my device, to have the Android 4.1 booting again ... and I know about RKAndroidTool v1.35 for Windowses, but ...
... I am not using Windows OSes (better said, I avoid using them as much as I can, by trying to find *nix based solutions).
Therefore my main question: Is there Linux software to restore factory firmware on a Rikomagic MK802 IIIS device?
During my research, after googling for "rkandroidtool for linux" I found this promising link on our XDA community: http://forum.xda-developers.com/showthread.php?t=1286305
This "rkflashtool for Linux and rk2808, rk2818 and rk2918 based tablets" is reported to work fine by many, and later on in the above thread, user "frankjt" says:
So, it seems this rkflashtool for Linux does a great job on rk3066 tablets, but is it working on mini PCs too?
Has anyone tried this tool on miniPC ? Preferably Rikomagic MK802 IIIS, but if you have experience on similar models, please share them here.
Is there a guide on how to reflash miniPCs with Linux software only? Please post it.
What are the hexadecimal addresses to be used when attempting to write an .img file on the Rikomagic MK802 IIIS mini PC?
Any advice, or feedback on these questions are very welcomed!
Regards.
Click to expand...
Click to collapse
You can use the official Linux tool called 'upgrade_tool' ... simply do a google search for 'linux upgrade_tool' and you'll get a several sites with guides and useful info about it.
Related
Dear all [especially the developers],
Is there a practical way of changing the above mentioned ROM's page pool?
Is there a tool?
I tried Latest Page Pool Changer release [V.2.21] but it doesn't behave as it should.
With JCEspi2005's help I realized it doesn't report or write the right or, at least, the reported and visible values...
How can we sort this out?
Can someone point me in the right direction?
Hang Tua, given the fact I am solely using your ROMs would you be so kind you would help me?
Click to expand...
Click to collapse
Dear all,
INTRODUCTION
With JCEspi2005 precious help and guidance and Swiftblade precious information, we both came to the conclusion that Raphael page pool change method can now be unveiled.
CONSIDERATIONS
JCEspi2005 changed a ROM's page pool to 24 and I tested it.
Result: Ok.
I changed 2 ROM's page pool and tested it.
Result: Ok.
TOOLS
A Hex editor like:
XVI32 V.2.31 ¤ Link
HexEdit V.1.03 ¤ Link
PROCEDURE [Information source: Link]
Address: 70F0
Values:
[00MB Pagepool] |00 15 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB|
[12MB Pagepool] |03 15 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB|
[16MB Pagepool] |10 16 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB|
[18MB Pagepool] |12 16 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB|
[24MB Pagepool] |18 16 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB|
1. Open the OS.nb or the .NBH file with a Hex Editor
2. Search the for hex string pattern |03 15 A0 03 | 02 15 A0 13 | 00 10 83 E5 | DA C2 FF EB| [Two addresses should be found]
3. At the first address found, change the first two bytes "03 15" to "12 16" for 18MB pagepool
4. Repeat Step Nº 3 at the 2nd address found
5. Save & Exit the Hex Editor
6. If you are using the OS.nb, start cooking your new ROM with it
7. Flash the new .NBH file to your Raphael and enjoy the 18MB True Pagepool
For other pagepool sizes, change the first byte "03" to "XX" hex value corresponding to your desired pagepool in Step Nº 3 and 4. [Remember that this is hex value, i.e. "10" = 16MB, "12" = 18MB, "18" = 24MB, etc.]
Happy Page Pool changing, happy flashing and cheers!
P.S. There were some doubts about dynamic page pool [Page Pool 0] usage but after a day of testing 0 page pooled ROMs I can almost assure the there are not stability issues.
Although several more days of testing [at least 2] are needed to ensure it doesn't affect stability, by now, I can infer that it is quite stable as well as reliable.
MEMORY
Do note that your available memory will differ according to the page pool you use.
If you feel like knowing how much memory you will have available after page pool change, maybe it's time for some linear and simple arithmetics
This post will be updated as we find out about new information or outcoming issues.
Special thanks to JCEspi2005. I hope out «partnership» goes on and on
Cheers and good luck to all.
Hi there,
I've tried pagepool changer and it appears to work just as it says on the tin!
If you look on the right hand side of the windows there is a box where you can change the pagepool size. Hit the button and you'll notice that the ROM file has been changed (Check the date stamp if you don't believe me) I've checked the ROm image with a hex editor and it has change the corrct values.
Hope this helps.
WizP said:
Hi there,
I've tried pagepool changer and it appears to work just as it says on the tin!
If you look on the right hand side of the windows there is a box where you can change the pagepool size. Hit the button and you'll notice that the ROM file has been changed (Check the date stamp if you don't believe me) I've checked the ROm image with a hex editor and it has change the corrct values.
Hope this helps.
Click to expand...
Click to collapse
Attached is a little application to run in your PDA. DevHealth.exe generates a mem_X.txt file on your SD card root (let some time to do it). Inside this file you can view the real PagePool.
Can you test your changed ROM to see what changes do?
Cheers
WizP said:
Hi there,
I've tried pagepool changer and it appears to work just as it says on the tin!
If you look on the right hand side of the windows there is a box where you can change the pagepool size. Hit the button and you'll notice that the ROM file has been changed (Check the date stamp if you don't believe me) I've checked the ROm image with a hex editor and it has change the corrct values.
Hope this helps.
Click to expand...
Click to collapse
That's not the question...
The question is: Does it read and change the right addresses?
No it doesn't. JCEspi2005 created a ROM with PP12 and the referred tool reads 6.
I'll try to find a tool that correctly addresses Raphael ROMs.
Cheers.
mrvanx asked me about this thread.... yes I can confirm the pagepool changer will not work, as nk.exe dynamically sets pagepool, depending on (probably) ram size. htc niki and elf/elfin are the same deal.
this is easy to fix of course with a small assembly patch
cmonex said:
this is easy to fix of course with a small assembly patch
Click to expand...
Click to collapse
Pls guide us to the true path
cmonex said:
mrvanx asked me about this thread.... yes I can confirm the pagepool changer will not work, as nk.exe dynamically sets pagepool, depending on (probably) ram size. htc niki and elf/elfin are the same deal.
this is easy to fix of course with a small assembly patch
Click to expand...
Click to collapse
Thanks, this is just i was beleaving...
Are you planing yo make the "small" patch for us?
Following this post http://forum.xda-developers.com/showpost.php?p=2274534&postcount=1 i managed to create a modified NBH of WWE shipped ROM wirh 24Mb PagePool for someone to test it (i can't do it for now...)
The link
http://rapidshare.com/files/1488550...el_CRC_52.33.25.17_1.02.25.19_Ship_PP24Mb.rar
Report back, please...
Thanks.
cmonex said:
mrvanx asked me about this thread.... yes I can confirm the pagepool changer will not work, as nk.exe dynamically sets pagepool, depending on (probably) ram size. htc niki and elf/elfin are the same deal.
this is easy to fix of course with a small assembly patch
Click to expand...
Click to collapse
Would you be so kind you would inform us (if you can) of the addresses and values for Raphael ROM's pagepool?
Even if there is no tool yet, we can HEX edit the NBH and change it.
I am personally interested in pagepool 0 [dynamic].
Thank you in advance.
Cheers.
well, here is an example:
.text:80058220 B0 28 9F E5 LDR R2, =dword_803F6350
.text:80058224 A8 78 9F E5 LDR R7, =0xA8081064
.text:80058228 00 30 95 E5 LDR R3, [R5]
.text:8005822C 9C 88 9F E5 LDR R8, =0x52444C55
.text:80058230 94 08 9F E5 LDR R0, =aKPagePoolSize0
.text:80058234 01 0C 53 E3 CMP R3, #0x100
.text:80058238 03 15 A0 03 MOVEQ R1, #0xC00000
.text:8005823C 02 15 A0 13 MOVNE R1, #0x800000
.text:80058240 00 10 82 E5 STR R1, [R2]
.text:80058244 00 30 97 E5 LDR R3, [R7]
.text:80058248 08 00 53 E1 CMP R3, R8
.text:8005824C 01 15 A0 03 MOVEQ R1, #0x400000
.text:80058250 00 10 82 05 STREQ R1, [R2]
0x803F6350 is what the pagepool changer usually patches, this is set to 6MB by default in the nk.exe. the problem is the real pagepool will never be 6MB, this code above dynamically decides if 4, 8, or 12MB it should be. (on my raphael it went for 12MB)
the elf patch is ok, as long as the STREQ on the last line doesn't execute, if it does, then copying the elf patch is not enough. so I suggest this patch:
STR R1, [R2] -> NOP (00 00 A0 E1)
and STREQ R1, [R2] -> another NOP (00 00 A0 E1)
after this pagepool changer should work nicely, and this is easier than that patching for Elf. once you patch the nk.exe like this, it will be fine.
on top of that, an entirely cosmetic patch: you can change the R1 contents too (similar to Elf patch) so KITL log will show the right value.
P.S: my guess is it only sets it to 4MB if ULDR is loaded. so usually not of importance.
Raphael ROMs Page Pool Changing
First post updated. Do read it
Cheers.
cmonex said:
well, here is an example:
.text:80058220 B0 28 9F E5 LDR R2, =dword_803F6350
.text:80058224 A8 78 9F E5 LDR R7, =0xA8081064
.text:80058228 00 30 95 E5 LDR R3, [R5]
.text:8005822C 9C 88 9F E5 LDR R8, =0x52444C55
.text:80058230 94 08 9F E5 LDR R0, =aKPagePoolSize0
.text:80058234 01 0C 53 E3 CMP R3, #0x100
.text:80058238 03 15 A0 03 MOVEQ R1, #0xC00000
.text:8005823C 02 15 A0 13 MOVNE R1, #0x800000
.text:80058240 00 10 82 E5 STR R1, [R2]
.text:80058244 00 30 97 E5 LDR R3, [R7]
.text:80058248 08 00 53 E1 CMP R3, R8
.text:8005824C 01 15 A0 03 MOVEQ R1, #0x400000
.text:80058250 00 10 82 05 STREQ R1, [R2]
0x803F6350 is what the pagepool changer usually patches, this is set to 6MB by default in the nk.exe. the problem is the real pagepool will never be 6MB, this code above dynamically decides if 4, 8, or 12MB it should be. (on my raphael it went for 12MB)
the elf patch is ok, as long as the STREQ on the last line doesn't execute, if it does, then copying the elf patch is not enough. so I suggest this patch:
STR R1, [R2] -> NOP (00 00 A0 E1)
and STREQ R1, [R2] -> another NOP (00 00 A0 E1)
after this pagepool changer should work nicely, and this is easier than that patching for Elf. once you patch the nk.exe like this, it will be fine.
on top of that, an entirely cosmetic patch: you can change the R1 contents too (similar to Elf patch) so KITL log will show the right value.
P.S: my guess is it only sets it to 4MB if ULDR is loaded. so usually not of importance.
Click to expand...
Click to collapse
Thanks for so deep info
The procedure is like the Elfin one...
Cheers
jcespi2005 said:
Thanks for so deep info
The procedure is like the Elfin one...
Cheers
Click to expand...
Click to collapse
yeah, and who pointed that out originally?
I've tried the posted procedure for finding, and changing the Pagepool - but everytime i search for the hex string, i get no returned results. Am i doing something wrong?
I bricked my X10 (so-01b) and got Yellow exclamation mark after I tried to debrand it by SEUS.
After that, I tried almost all the methods posted on the website.
1. Using the X10flash tools including unbricked method and root method(first step).
It seems flash is working, however the flash procedure last only around 3 minutes not 5 minutes as most people mentioned. It also ended up with a "test" which means the flashing is completed without any error.
However, after removing the cable, rebooting the phone, Yellow exclamation mark is still there.
2. Method of replacing the Java file into the plugins folder and adding x10a~~ files into the folder of the Update Service of the SESU, also deleting the db folder before flashing.
Restore/repair by SEUS, downloading and flashing was running smoothly and ended up with flashing successfully.
However, after removing the cable, rebooting the phone, Yellow exclamation mark is still there.
3. Deleted the SEUS , re-installed, and changed another brand new cable.Tried the method 2 mentioned above.
However, the result is the same. Failed.
4. Using Omnious. Flashing end up with "Failed" and an error code returned, which you can take a look as following. Result is the same as above three.after removing the cable, rebooting the phone, Yellow exclamation mark is still there.
Code:
Action journal
22:29:08 Flash
22:29:08 Allows to change languages supported by the phone and upgrade its firmware.
22:29:08 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
22:29:08 Application version: 0.07.2279 (beta)
22:29:08 . The action name is 'Flash'
22:29:08 Selected phone type: Xperia™ X10
22:29:08 i Instructions
22:29:08 i 1. Make sure the phone battery is charged to at least 50%.
22:29:08 i 2. Switch off the phone!
22:29:08 i 3. Remove the phone battery and wait at least 5 seconds before reinserting it!
22:29:08 i 4. Press and hold the return back button, then connect the cable to the phone!
22:29:08 . The action started waiting for the user
22:29:25 . The action finished waiting for the user
22:29:25 Connecting via SEMC USB Flash Device (USB3)...
22:29:25 Device driver version: 2.2.0.5
22:29:25 Detected chipset: QSD8250
22:29:25 Boot mode: EROM
22:29:25 IMEI: [email protected]@@
22:29:25 Sending loader...
22:29:26 Establishing connection to the server...
22:29:29 Receiving news...
22:29:34 i No news
22:29:34 Actual credit: 0.00
22:29:40 Writing file phone.zip...
22:30:18 Writing file X10i_GENERIC_1234_8465R8A_R1FB001.zip...
22:33:38 e Failed!
22:33:38 . The action entered shutdown phase
22:33:38 . The action reported failure
Error code
# E39CDD9F86C3082E
Error details
---
61 C6 C0 A4 65 CB CD 00 FF 08 E1 72 F3 9F B5 AE
13 9B E7 8D E5 86 63 FA 78 BD E4 7E ED 5F 85 68
09 52 D0 4B 3E 18 6D E0 61 94 3A D6 3F 7D 06 ED
11 DB BB C5 11 03 FE 12 A2 17 E5 DB 4F B0 1E 0D
C5 5C E6 DF 47 8B A0 93 02 E4 6C 19 80 4D 59 91
46 C1 3B 15 F6 69 01 6B CA 64 A3 13 2E 26 7A 7C
7E AD 9A 9E 1D EB 00 E8 80 F0 7A 96 0F 25 D0 BA
D5 FD 93 6D 4B 5B 30 D9 6C D7 4D 92 B4 C0 04 64
F7 56 66 50 2A AA 3B E5 F3 13 07 8D EE A3 41 61
48 50 E9 72 04 6F 71 F5 55 D4 0A 0C 6D 2F 05 E8
77 58 E8 34 2A 17 BD A1 E1 9A FF 0A ED 48 D5 09
C7 38 25 15 95 C7 43 B0 6F 20 0C E7 BD 5C 0B 29
17 8E 39 EE F3 F9 7F 69 EF 5B A1 DC B3 74 21 FF
19 DE A7 ED 25 46 5D DE 0F B6 8F 34 FD F2 BB 58
E7 3F D9 C4 D5 24 2D E1 A1 DA BF 44 5B 79 BB 34
F9 22 57 42 85 66 03 14 99 C1 7C 7F
---
I can show you my hardware infomation identified by Omnious.
Code:
Action journal
23:48:43 Identify
23:48:43 Shows detailed information about the connected phone.
23:48:43 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
23:48:43 Application version: 0.07.2279 (beta)
23:48:43 . The action name is 'Identification'
23:48:43 Selected phone type: Xperia™ X10
23:48:43 Selected connection method: USB EROM
23:48:43 i Instructions
23:48:43 i 1. Make sure the phone battery is charged to at least 50%.
23:48:43 i 2. Switch off the phone!
23:48:43 i 3. Remove the phone battery and wait at least 5 seconds before reinserting it!
23:48:43 i 4. Press and hold the return back button, then connect the cable to the phone!
23:48:43 . The action started waiting for the user
23:48:50 . The action finished waiting for the user
23:48:50 Connecting via SEMC USB Flash Device (USB3)...
23:48:50 Device driver version: 2.2.0.5
23:48:50 Detected chipset: QSD8250
23:48:50 Boot mode: EROM
23:48:50 EROM version: 1226-2253 R8A013
23:48:50 IMEI: [email protected]@@
23:48:50 Device ID: 7E2914576285FCBDDB99FD73DE3CC610FDEF4539
23:48:50 Minimum loader AID: 0001
23:48:50 Minimum software AID: 0001
23:48:50 Minimum EROM AID: 0001
23:48:50 Minimum customization AID: 0001
23:48:50 Minimum simlock AID: 0001
23:48:50 Serial number: CB511JJNU6
23:48:50 Color: Red SEMC
23:48:50 Simlock state:
23:48:50 Phone model (from TA): SO-01B
23:48:50 Current CXC (from TA): 1227-4612_R1EA018
23:48:50 Current CDA (from TA): 1233-7397_R16A
23:48:50 Current FS (from TA): 1227-4607_R1EA018
23:48:50 Sending loader...
23:48:51 Waiting for loader response...
23:48:52 Flash chip ID: 002C-00B3
23:48:52 Turning off the phone...
23:48:54 i Please disconnect battery and cable from the phone!
23:48:54 s Successfully done.
23:48:54 . The action entered shutdown phase
23:48:54 . The action reported success
Additional details
---
2C B5 7E 53 CE E0 A6 3F 3C 23 1E 6B 18 79 5E 29
34 FB 48 D0 90 2F EA 9F 2C DC 52 9B F8 29 3A 1E
72 19 76 4D 80 8F 86 61 E4 89 80 CF 76 E9
---
I feel really sad and frustrated, seems most of the guys here can solve the Yellow exclamation mark issue with one of the 4 methods I have tried. I really need your help!
Thanks a million in advance!
I had this yesterday, just connect now phone to seus and repair it. It helped and now everything is working
Sent from my X10i using XDA App
maxld said:
I had this yesterday, just connect now phone to seus and repair it. It helped and now everything is working
Sent from my X10i using XDA App
Click to expand...
Click to collapse
Tried at the very beginning, but failed......
Strange, does it connect in bootloader mode?
Sent from my X10i using XDA App
maxld said:
Strange, does it connect in bootloader mode?
Sent from my X10i using XDA App
Click to expand...
Click to collapse
Sure, every methods require the x10 connected in flash mode.
Remove battery, wait 15 minutes. Put battery in but don't turn on, just enter straight into bootloader mode when you need to.
Clear out content in SEUS folder and start over again.
Good luck!
So is your phone originally the SO-01B (docomo)? If so, then you should either be using SO-01B files or X10i (NOT X10a).
Can you try reflashing to SO-01B firmware to make sure that there isn't anything wrong with your phone? Just run step1 from the following (this is the original root package, which used docomo firmware). Don't run any other steps.
ROOT_F2v1.rar (borrowed from [GUIDE] Root your X10 R2BA023 !)
For the SEUS method, why did you replace the java files? That's only for decrypting ROMs, not for flashing your phone. Also, you should be using X10i files.
For the Omnius method, did you put the files in the correct order? Application should be X10i_GENERIC_1234_8465R8A_R1FB001.zip (large file, ~100MB) and Customization should be phone.zip (small file, ~15MB). Since you have the SO-01B, you could also try these files:
SO-R1EA025-DEK.rar (borrowed from Decrypted x10 roms - latest r2ba024 rom - with sin reconstructor)
mtechfan said:
Remove battery, wait 15 minutes. Put battery in but don't turn on, just enter straight into bootloader mode when you need to.
Clear out content in SEUS folder and start over again.
Good luck!
Click to expand...
Click to collapse
Hi, Dear friend, Thanks a million for your suggestion. I will take a trial and report the results tonight since it is already 4 am, I am live in Japan.
I already have the same problem and resolve it with SEUS.
Try to change USB port if you have an issue.
Grospolina said:
So is your phone originally the SO-01B (docomo)? If so, then you should either be using SO-01B files or X10i (NOT X10a).
Can you try reflashing to SO-01B firmware to make sure that there isn't anything wrong with your phone? Just run step1 from the following (this is the original root package, which used docomo firmware). Don't run any other steps.
ROOT_F2v1.rar (borrowed from [GUIDE] Root your X10 R2BA023 !)
For the SEUS method, why did you replace the java files? That's only for decrypting ROMs, not for flashing your phone. Also, you should be using X10i files.
For the Omnius method, did you put the files in the correct order? Application should be X10i_GENERIC_1234_8465R8A_R1FB001.zip (large file, ~100MB) and Customization should be phone.zip (small file, ~15MB). Since you have the SO-01B, you could also try these files:
SO-R1EA025-DEK.rar (borrowed from Decrypted x10 roms - latest r2ba024 rom - with sin reconstructor)
Click to expand...
Click to collapse
Hi, Dear friend, Thanks a million for your suggestions. My handset is originally the SO-01B (docomo). I have runned step1 from original root package with docomo firmware you suggested at the very beginning. However, I failed. I am supprised it only took 3 minutes to complete the flashing for the first step which normally take 5 minutes regarding the others comments. Although the cmd windows shows it completes with ~test in the end without any error, I am afraid it actually missd flashing some files. As for the second suggestion on SEUS method, I will take a trial and report here later. As for the third suggestion on Omnious, I thout I have made a mistake with the oder placing the two files. I have just re-flashed my X10 by Omnious tools according to your suggestion, which the application is with X10i_GENERIC_1234_8465R8A_R1FB001.zip (large file, ~100MB) and Customization is with phone.zip (small file, ~15MB), however I still got a failed results during the application file flashing.(the customization file flashing has not even started ). You may take a look at following log infomation.
Code:
Action journal
02:46:27 Flash
02:46:27 Allows to change languages supported by the phone and upgrade its firmware.
02:46:27 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
02:46:27 Application version: 0.07.2279 (beta)
02:46:27 . The action name is 'Flash'
02:46:27 Selected phone type: Xperia™ X10
02:46:27 i Instructions
02:46:27 i 1. Make sure the phone battery is charged to at least 50%.
02:46:27 i 2. Switch off the phone!
02:46:27 i 3. Remove the phone battery and wait at least 5 seconds before reinserting it!
02:46:27 i 4. Press and hold the return back button, then connect the cable to the phone!
02:46:27 . The action started waiting for the user
02:47:10 . The action finished waiting for the user
02:47:10 Connecting via SEMC USB Flash Device (USB4)...
02:47:10 Device driver version: 2.2.0.5
02:47:10 Detected chipset: QSD8250
02:47:10 Boot mode: EROM
02:47:10 IMEI: [email protected]@@
02:47:10 Sending loader...
02:47:15 Establishing connection to the server...
02:47:19 Receiving news...
02:47:22 i No news
02:47:22 Actual credit: 0.00
02:47:30 Writing file X10i_GENERIC_1234_8465R8A_R1FB001.zip...
02:50:33 e Failed!
02:50:33 . The action entered shutdown phase
02:50:33 . The action reported failure
Error code
# E39CDD9F86C3082E
Error details
---
4B B3 B7 81 D4 A0 1C 73 C2 C5 F8 25 C2 05 14 45
22 C8 3E 2E F6 CF F4 37 F9 CC B3 85 FC 8A 04 EB
6A 93 97 D6 31 F3 FC 13 5E A7 6D 6B B0 C8 5F 7E
8C 06 02 D8 7E 88 D1 41 5F E4 82 A6 DC 1B 27 CE
18 DF 1F FC F6 E0 77 1E 43 57 F5 22 4F 46 86 82
19 E0 9C 4E E5 DC EE C6 4B 17 FA 16 C1 8D 85 81
9F 90 1D 7D 92 00 EF 1B 3D 43 DD AB 00 6C F1 29
C8 5C B4 F6 D8 AE E1 14 6D D8 5A EF DB E9 3D A7
D6 57 61 8B 9B 3F EA 68 CC DC 1E CE 21 D6 E0 72
E9 F3 30 29 17 26 E0 26 2A A7 53 09 80 06 84 95
16 99 51 A9 25 02 D2 AC DE 55 58 B7 9E 15 74 77
5A E2 15 9C F8 4E 94 E3 6E D1 65 9A 2C 09 32 EA
CA 0D 40 CB 42 6E AE 64 50 14 C8 E7 7E 83 F8 E2
44 FD FE 4E 36 F1 B4 73 8E C5 D8 C9 12 59 BC AB
F8 FE 60 DF A6 31 C4 2C 1E 6B E8 79 56 30 9A A9
E6 7D 70 DF EA 91 D4 D9 9A CE 65 04
---
Flashing with DoCOMO SO-R1EA025-DEK, Failed too.
Code:
Action journal
03:11:20 Flash
03:11:20 Allows to change languages supported by the phone and upgrade its firmware.
03:11:20 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
03:11:20 Application version: 0.07.2279 (beta)
03:11:20 . The action name is 'Flash'
03:11:20 Selected phone type: Xperia™ X10
03:11:20 i Instructions
03:11:20 i 1. Make sure the phone battery is charged to at least 50%.
03:11:20 i 2. Switch off the phone!
03:11:20 i 3. Remove the phone battery and wait at least 5 seconds before reinserting it!
03:11:20 i 4. Press and hold the return back button, then connect the cable to the phone!
03:11:20 . The action started waiting for the user
03:11:35 . The action finished waiting for the user
03:11:35 Connecting via SEMC USB Flash Device (USB4)...
03:11:35 Device driver version: 2.2.0.5
03:11:35 Detected chipset: QSD8250
03:11:35 Boot mode: EROM
03:11:35 IMEI: [email protected]@@
03:11:35 Sending loader...
03:11:40 Establishing connection to the server...
03:11:43 Receiving news...
03:11:45 i No news
03:11:46 Actual credit: 0.00
03:11:54 Writing file FILE_277398338_1275040924000_1274947104000_277398125_112659344_INFILE_LONGTERM.zip...
03:14:56 e Failed!
03:14:56 . The action entered shutdown phase
03:14:56 . The action reported failure
Error code
# E39CDD9F86C3082E
Error details
---
6F CF 37 25 E8 9C D0 F1 4A 7F 34 00 0E B5 A8 80
E4 4C 92 CA 2A 2D E0 AB ED 76 EF 5F 30 F8 98 07
22 29 7B B2 CD F1 10 AF 96 63 E9 0F 7C 44 DB 12
18 C2 F6 82 A2 6A 3D 23 4B 5E D6 42 10 69 B3 1C
EC 1B CB 58 36 22 A3 E2 4B 6D 39 F8 03 CA 3A AE
71 5A C8 D4 45 3E C2 A4 5F 2D 2E CC 8D 01 E9 ED
2B 54 B1 99 EE 7C 63 59 F5 07 D1 B1 4C E0 0D 3B
A0 E6 D8 AC 84 B2 0D 88 85 E2 7E 75 97 65 A9 75
5E 13 35 D1 5B 03 26 EA 44 66 2A EA ED 5A AC A0
7D C9 9C 33 CB 3A 0C 44 3E E3 07 2D B0 74 E8 79
5E DD 45 33 D9 FE 3E 10 16 91 2C D3 AE 66 08 27
32 3F AB 7B 24 52 80 81 86 6B C1 7E 1C 85 A6 C6
C2 37 14 6F 7E 52 62 98 58 2E F4 C3 32 0F 4C CE
2C 47 52 2A 6A 13 A0 EF 66 FF 04 ED 5E D5 28 C7
4C C4 F4 3B 26 B3 B0 90 D6 2F EC 63 E6 42 66 45
72 C7 E4 7B B6 73 C0 BB 8E F4 B1 60
---
I will report more results later since it is already 4 am in Japan. I have to go to bed.
Thank you again for your big help.
Battosai94 said:
I already have the same problem and resolve it with SEUS.
Try to change USB port if you have an issue.
Click to expand...
Click to collapse
Hi friend, thank you four suggestion. i will take a trial and report here later.
when flashing with x10flash deal, step one of root, you have to wait till it says press any key to continue, or you have only flashed a portion of the full rom, it will read like it's done several times throughout the process
mtechfan said:
Remove battery, wait 15 minutes. Put battery in but don't turn on, just enter straight into bootloader mode when you need to.
Clear out content in SEUS folder and start over again.
Good luck!
Click to expand...
Click to collapse
Unfortunately, I do the process according to your suggestion, but the result is the same as before.
dan-htc-touch said:
when flashing with x10flash deal, step one of root, you have to wait till it says press any key to continue, or you have only flashed a portion of the full rom, it will read like it's done several times throughout the process
Click to expand...
Click to collapse
Yes, I did exactly what the "howto" file told us to do, but failed. The flashing time is only 3 minutes.
Battosai94 said:
I already have the same problem and resolve it with SEUS.
Try to change USB port if you have an issue.
Click to expand...
Click to collapse
I have even tried with every usb ports on my PC and even tried with a different PC.
lazy i hope that you have more luck than me, my X10 was dead and send to SE to repair, you can see my history
http://forum.xda-developers.com/showthread.php?t=714538
alucine said:
lazy i hope that you have more luck than me, my X10 was dead and send to SE to repair, you can see my history
http://forum.xda-developers.com/showthread.php?t=714538
Click to expand...
Click to collapse
Hi alucine, thank you for your reply.
OMG! I have exactly the same situation as your experienced.
If it is a nand failure issue, is that mean I should give up and send my phone to SE center rather than do any trial.
However, I am wondering most of the guy who came across the Yellow exclamation mark after updating by SEUS finally saves back their phones by using one of the methods. How can Bin4ry expected our issue is related to the NAND failure issue. How can we confirm whether we have the NAND failure issue or not after we got the Yellow exclamation mark. Is it exactly related to the battery condition when flashing the x10 with any method?
Can we draw the concultion that, the X10 user will got NAND failure(HW related) if the flashing was under poor battery condition.
Hi,
please be so kind and upload the log of the X10flash program. Because i personally dont know the Omnius Program
Like you said the falsher finishes the progress, if its 3 minutes or 5 minutes , i dont know I never measured the time of the process
If you upload the flashlog maybe we can help you.
The problem is following:
Maybe you have a bad nand, then X10flash, Omnius, SEUS or whatever try to flash your phone, all data is send correctly but the phone doenst write it to nand correct.
So what happens now after flash ? The bootloader checks and validates the firmware which is on your phone, if the calculated checksum is not correct the bootloader sends you to semc recovery (you see the triangle and the exclamation mark ! )
If nothing helps and X10flash runs correctly etc. then the last option is that your nand is ****ed up (this happens sometimes , you can compare it to faulty ram on PC or smth.). This is not too bad for you because SE has to exchange your device into a new one.
But first of all, please upload your X10 flashlog, and lets see what happens there
Regards
Bin4ry
Hi Bin4ry, thanks a million for your reply. I just re-flashed the x10 according to the first step in your tutorial. (http://forum.xda-developers.com/showthread.php?t=711907)
I attached the log code in my cmd windows. Pls take a look. seems there are three error info. in the end of the log files. I belive you understand well what is that mean. BTW, I still got triangle mark after this flashing. Thank you in advance for your great help. I also appreciate your great work for us in XDA forum.
Code:
2010-7-20 19:10:15 X10flash main
信息: start
2010-7-20 19:10:15 X10flash readReply
信息: <<< cmd=1,flags=1,length=46
2010-7-20 19:10:15 X10flash testPluged
信息: <<<VER="R8A013";DATE="20100119";TIME="17:24:00";
2010-7-20 19:10:15 X10flash writeCmd
信息: write(cmd=1) (finish)
2010-7-20 19:10:15 X10flash readReply
信息: <<< cmd=1,flags=1,length=586
2010-7-20 19:10:15 X10flash testCmd01
信息: <<<PROT_VER="01";DATE="20100119";TIME="17:24:00";VER="R8A013";UNIQUE_DEV_ID="7E2914576285FCBDDB99FD73DE3CC610FDEF4539";CXC="1226-2253";TYPE="S1_EROM";SEC_LOCK_STATUS="LOCKED";HASH_PUB_KEY="00000000000000000000000000000000";EROM_AID="0001";LOADER_AID="0001";SW_AID="0001";CUST_AID="0001";SIM_LOCK_AID="0001";IMEI="35949603234196";MSN="CB511JJNU6";SIN_VER="0001";SIMLOCK_TAMP="";AID_TAMP="NOT_TAMPERED";LOADER_ROOT="S1_Loader_Root_f851";EROM_ROOT="S1_EROM_Root_b15e";SW_ROOT="S1_SW_Root_ac12";CUST_ROOT="S1_Cust_Root_5789";SIM_LOCK_ROOT="S1_SL_Root_f20d";HW_CONF_ROOT="S1_HWConf_Root_ee5d";
2010-7-20 19:10:15 X10flash writeCmd
信息: write(cmd=9) (finish)
2010-7-20 19:10:15 X10flash readReply
信息: <<< cmd=9,flags=1,length=0
2010-7-20 19:10:15 X10flash writeCmd
信息: write(cmd=10) (finish)
2010-7-20 19:10:15 X10flash readReply
信息: <<< cmd=10,flags=1,length=0
2010-7-20 19:10:15 X10flash writeCmd
信息: write(cmd=5) (finish)
2010-7-20 19:10:15 X10flash readReply
信息: <<< cmd=5,flags=1,length=0
2010-7-20 19:10:15 X10flash writeCmd2
....................................................
....................................................
....................................................
The content is the similar, so I delete large amount of log info. here,
....................................................
....................................................
....................................................
2010-7-20 19:12:29 X10flash readReply
信息: <<< cmd=6,flags=1,length=0
2010-7-20 19:12:29 X10flash writeCmd
信息: write(cmd=6) (finish)
2010-7-20 19:13:18 X10flash readReply
信息: <<< cmd=6,flags=0,length=0
2010-7-20 19:13:18 X10flash writeCmd
信息: write(cmd=5) (finish)
2010-7-20 19:13:18 X10flash readReply
信息: <<< cmd=5,flags=0,length=0
2010-7-20 19:13:18 X10flash writeCmd
信息: write(cmd=7) (finish)
2010-7-20 19:13:18 X10flash readReply
信息: <<< cmd=7,flags=1,length=93
2010-7-20 19:13:18 X10flash testCmd07
信息: <<<ERR_SEVERITY="MAJOR";ERR_CLASS="PROTOCOL_CLASS";ERR_STATIC="UNVALID_COMMAND";ERR_DYNAMIC="";
2010-7-20 19:13:18 X10flash writeCmd
信息: write(cmd=6) (finish)
2010-7-20 19:13:18 X10flash readReply
信息: <<< cmd=6,flags=0,length=0
2010-7-20 19:13:18 X10flash writeCmd
信息: write(cmd=7) (finish)
2010-7-20 19:13:18 X10flash readReply
信息: <<< cmd=7,flags=1,length=93
2010-7-20 19:13:18 X10flash testCmd07
信息: <<<ERR_SEVERITY="MAJOR";ERR_CLASS="PROTOCOL_CLASS";ERR_STATIC="UNVALID_COMMAND";ERR_DYNAMIC="";
2010-7-20 19:13:18 X10flash writeCmd
信息: write(cmd=13) (finish)
2010-7-20 19:13:18 X10flash readReply
信息: <<< cmd=13,flags=0,length=0
2010-7-20 19:13:18 X10flash writeCmd
信息: write(cmd=7) (finish)
2010-7-20 19:13:18 X10flash readReply
信息: <<< cmd=7,flags=1,length=93
2010-7-20 19:13:18 X10flash testCmd07
信息: <<<ERR_SEVERITY="MAJOR";ERR_CLASS="PROTOCOL_CLASS";ERR_STATIC="UNVALID_COMMAND";ERR_DYNAMIC="";
2010-7-20 19:13:18 X10flash writeCmd
信息: write(cmd=10) (finish)
2010-7-20 19:13:18 X10flash readReply
信息: <<< cmd=10,flags=0,length=0
2010-7-20 19:13:18 X10flash writeCmd
信息: write(cmd=4) (finish)
2010-7-20 19:13:18 X10flash readReply
信息: <<< cmd=4,flags=1,length=0
2010-7-20 19:13:18 X10flash run
信息: ###test end.
Hi, i've got the same case on my phone!
So what we should do?
Hi, I have bricked RAZR.
After flashing new system_signed with CMD, recovery works, now I need to apply update Blur_Version.651.167.26.XT910.Retail.en.EU.zip but error apears:
http://www.fotosik.pl/pokaz_obrazek/b09373c9b1ac9dc6.html
I need file with MD5:
cd 65 e8 27 08 93 84 fb 7d 7f e1 15 8e 5e 0a b3
Size: 372,78 MB (390.891.376 Bytes)
Can anyone help me?
borda01 said:
Hi, I have bricked RAZR.
After flashing new system_signed with CMD, recovery works, now I need to apply update Blur_Version.651.167.26.XT910.Retail.en.EU.zip but error apears:
http://www.fotosik.pl/pokaz_obrazek/b09373c9b1ac9dc6.html
I need file with MD5:
cd 65 e8 27 08 93 84 fb 7d 7f e1 15 8e 5e 0a b3
Size: 372,78 MB (390.891.376 Bytes)
Can anyone help me?
Click to expand...
Click to collapse
Firmware available, install by RSD Lite http://forum.xda-developers.com/showthread.php?t=1850683
Regards
Thread Closed
Solved
I have bricked RAZR. Please help me. What Can I do?
Hey guys... I need help!
Let me tell a little history about my E10a.
I'd buyed my phone with simlock enabled.
I'ved try many free ways to unlock sim, but nothing has works.
Looking at youtube and internet, i'ved found a way to do this using "Omnius for SE".
Worked fine using original kernel.
To unlock bootloader i'ved try to use Flashtool. But, because the simlock status was different to SEMC, the only way i found to flash TFT was using Omnius too.
Today I decided to update my phone.
I'ved download last version of Omnius, downloaded 2.6.32.60-nAa-jb-02 kernel.
Let's flash!
At first time, Omnius has show me a message telling me: You can't update your kernel because you don't have credits anymore and blablabla...
I forced to update checking the "Unsigned flashing".
So, now my phone wont power up anymore. I'ved try force shutdown using power + home, but nothing happens.
Sorry my very poor english. I'm from Brazil and I'm very nervous about this situation.
Plz anyone can help me? My experience with flashing android phones was since out'11. I'm not total n00b.
Next, the last log showed in Omnius:
Code:
Action journal
14:55:49 Flash
14:55:49 Allows to change languages supported by the phone and upgrade its firmware.
14:55:49 Operating system: Microsoft Windows 7 Home Premium Edition Service Pack 1 (build 7601), 64-bit
14:55:49 Application version: 1.40.4823
14:55:49 . The action name is 'Flash'
14:55:49 Selected phone type: Xperia™ X10 mini
14:55:49 i Instructions
14:55:49 i 1. Make sure the phone battery is charged to at least 50%.
14:55:49 i 2. Switch off the phone!
14:55:49 i 3. Remove the phone battery and wait at least 5 seconds, then insert the battery back to the phone!
14:55:49 i 4. Press and hold the return back button, then connect the cable to the phone!
14:55:49 . The action started waiting for the user
14:55:57 . The action finished waiting for the user
14:55:57 Connecting via SEMC USB Flash Device (USB2)...
14:55:57 Device driver version: 3.0.0.0
14:55:57 Detected chipset: MSM7227
14:55:57 Boot mode: EROM
14:55:57 IMEI: 01231300503142
14:55:57 Sending loader...
14:55:59 i Waiting for connection to the server...
14:56:05 Receiving news...
14:56:06 i News
14:56:06 i Omnius for Samsung v1.18 - Experimental unlock code read for Samsung Galaxy S II and similar, FREE
during test period
14:56:06 i Omnius 1 Year licenses purchased after 1st Oct 2011 now gained
unlimited android unlocking!
14:56:11 Unlocking loader...
14:56:16 i Unsigned flashing is enabled.
14:56:16 Writing file X10_V1_BLRelock.ftf...
14:56:20 e Failed!
14:56:20 . The action entered shutdown phase
14:56:20 . The action reported failure
Error code
# 973C36BE0FC7F2B7
Error details
---
67 5B 47 A0 8F 07 C1 3C D3 F0 24 A5 87 5E D7 31
FA 32 7D 70 C3 C1 C1 03 23 52 65 F4 D0 EF F9 26
4B 79 1D 41 7F 86 9F 12 8D 2E CB 30 27 D1 4E F1
35 1B 1D 90 31 FC 06 C3 68 3C 55 05 77 AE 99 7C
22 5D B8 92 E1 9A FF 76 56 F0 79 77 6A A7 C1 B1
69 6F 17 E9 AC F4 62 55 D7 5D 09 EA D2 37 6B 4E
D4 F5 3F 81 EC 15 62 FE 00 C7 C6 07 CB A7 56 97
97 07 F0 83 2D 71 34 9E 51 51 E8 0C 08 3A 90 87
E8 08 9B 61 0C 92 1E EA E8 CC C9 A3 42 8C 05 EB
3F C3 4D B1 E2 DF AC 69 7F 94 8C E6 C8 22 A7 C0
AA 82 AC 20 77 9F 6D F5 95 2B 28 E9 2D D7 D8 02
C5 1C FC 99 DD 13 2B AE 86 B2 D5 79 09 D2 19 76
09 09 DE 83 CF DB 81 7C 93 2C AB B8 B9 5A 17 67
3C BC 6D 31 11 56 51 9E C0 61 FB 06 C7 13 B9 9C
0B 3C D3 82 AB 45 71 45 CD 02 F5 32 5E B3 55 CC
F5 6A 23 B0 8F C4 F1 4C 83 8A F6 FE 74 38
---
Thank's a lot for any help!
Format /system
Hello,
did you format /system before flashing the new kernel?
http://forum.xda-developers.com/showthread.php?t=2138771:
Read through this post. Don't rush into flashing. Be sure you understand the process before you start or you risk damaging your device
This is a custom 2.6.32 kernel developed for Android Jellybean 4.x. This kernel only works for mimmi, a.k.a. X10miniPro
Do NOT try this kernel on other Android versions or phones - you are totally unsupported
This kernel uses a custom mtd partitioning with larger /system partition to hold the extra JB calories. If you are moving from another custom kernel, EXCEPT 2.6.29-nAa-jb to this one, you MUST first format /system /data and /cache via the embedded CWM recovery
Click to expand...
Click to collapse
gmamorim said:
Hey guys... I need help!
14:56:11 Unlocking loader...
14:56:16 i Unsigned flashing is enabled.
14:56:16 Writing file X10_V1_BLRelock.ftf...
14:56:20 e Failed!
Thank's a lot for any help!
Click to expand...
Click to collapse
You didn't flash the nAa-kernel but the Bootloader Relock kernel for the X10, your phone is probably bricked. If you can't get it into flash-mode anymore, it may need JTagging at a repair shop to get it back up working.
phone bricked, because it flashed the X10_V1_BLRelock.ftf, you will need to take it to a repair shop.
Do your PC react when connect the phone via USB?!
ferotakis said:
Do your PC react when connect the phone via USB?!
Click to expand...
Click to collapse
No... don't react
another newbie who bite the disaster...
Sent from my E10i using xda app-developers app
R3v3nGe said:
another newbie who bite the disaster...
Sent from my E10i using xda app-developers app
Click to expand...
Click to collapse
Thank you guy so much!
That's i want to hear...
...NOT!
Man, if you can't help, don't post things like this!
This is bull****! And won't help anybody!
Or maybe you think have a bigger post count is a great advantage!
"Another forum newbie..."
How old r u? 15?
hi bro does your x10 mini bootup or not??? sorry bro.... im only 14 years old and post count and rank does not matter here... this is a forum that has no competition...
Sent from my E10i using xda app-developers app
You hardbricked your phone, your bootloader is damaged.
JTAG is the solution, search for a repair center.
hello all, is there a cyanogenmod rom for Acer Liquid Z3 (Z130)
Thanks
bryan-k said:
hello all, is there a cyanogenmod rom for Acer Liquid Z3 (Z130)
Thanks
Click to expand...
Click to collapse
here stock rom for z130 bro : http://www.acer.com.sg/ac/en/SG/content/drivers/4889;-;Z130
:victory:
is there any custom rom that would work on the z3 ?
((
micdarau85 said:
is there any custom rom that would work on the z3 ?
((
Click to expand...
Click to collapse
Mhh, just found this post, was never a ROM for this phone developed?
I just would like to skin down the stock rom and make it lighter...
g
Rom developing
It is possible to root the acer liquid Z3 (Z130) as well as installing TWRP. I'm about to develop Cyanogenmod for it. I hope that admins will give me a thread to start posting instructions:
Howto root it: root it using the app framaroot: http://forum.xda-developers.com/apps/framaroot/root-framaroot-one-click-apk-to-root-t2130276
Howto flash it with TWRP: Install and execute rashr and flash recovery with TWRP:
https://docs.google.com/file/d/0B0XQigIT17uEcDQtaDJ3U0UtOWc/edit?pli=1
The kernel source is availible at http://us.acer.com/ac/en/US/content/drivers
The supposed procedure in getting the z130 specific image is (excerpt of kernel source readme):
Build steps:
1. Download Android 4.2.2 source code from google
2. Modify buildGPL.sh, replace the Your_Toolchain_PATH with your tool path in android code.
for example: android/prebuilts/gcc/linux-x86/arm/arm-linux-androidYour_Toolchain_PATHeabi-4.6/bin
3. Run the script under your shell
./buildGPL.sh
Thanks!
Click to expand...
Click to collapse
I'm happy if I get a companion while developing. If you're new to cyanogenmod you can start with:
http://wiki.cyanogenmod.org/w/Build_for_a700#Build_CyanogenMod_and_ClockworkMod_Recovery
Give me a thread and device section !
Greets,
wendenerp
going on
My main motivation in getting cyanogenmod running is to get a german android system language. Since I bought the Z130 in the Phlippines
it only came with English and a couple of Asian languages. None of the language programs (morelocale2, locale, Sprache) could change the system language to german even while rooted. Today I tried to flash a system partition of the Acer homepages' Update images, namely the OS_Acer_AV052.Z130.1.007.00.LA.GEN1s_A42J_A
TWRP worked fine, but it didn't boot. I could rescue to the old system.ext4.win after the Acers' image failed.
I already contacted Acer. Maybe they will at least tell me which image has the german system language and works with the dual sim kernel... I'm still considering cyanogenmod's images though.
I added some detailed german instructions on rooting the liquid z3 and installing TWRP: http://www.wendenerp.de/Sonstiges.html
So far,
wendenerp said:
My main motivation in getting cyanogenmod running is to get a german android system language. Since I bought the Z130 in the Phlippines
it only came with English and a couple of Asian languages.
Click to expand...
Click to collapse
i have the single sim version with european languages. i wish i could get some asian languages on this phone X)
I started a cyanogenmod project on github for the Acer liquid Z3: https://github.com/wendenerp/android_device_acer_zx. I had some trouble with the local manifest file, but I think this should be alright:
<?xml version="1.0" encoding="UTF-8"?>
<manifest>
<project name="wendenerp/android_device_acer_zx" path="device/acer/zx" remote="github" revision="cm-11.0" />
</manifest>
Click to expand...
Click to collapse
Next thing is to get the vendor specific programs and drivers out of the original firmware...
I'm having some problems with getting the ramdisk image out of boot.img.
The boot.img is 6 mb in size. I tried unpackbootimg, unmkbootimg and split_bootimg. All of these tools split the same way:
The kernel gets 4mb and the ramdisk 600k, which adds up to 4.6mb. Additionally the ramdisk is of file type data:
Code:
file boot_img.lzma
boot_img.lzma: data
so neither gunzip nor lzma -dc works to extract the initramfs. I assume there is a bug in all of these split tools or acer made up some strange boot.img format...
boot.img split error
Unfortunately the split utilities don't split the boot image correctly.
The image should contain the size and location of the kernel and ramdisk inn the first bytes of the boot.img, but this is how it looks like:
Code:
[email protected]:~/Android-Hacking/z130_full_backup$ hd boot.emmc.win |grep 'ANDROID' -n4
1:00000000 41 4e 44 52 4f 49 44 21 58 36 3d 00 00 80 00 10 |ANDROID!X6=.....|
2-00000010 34 bc 09 00 00 00 00 11 00 00 00 00 00 00 f0 10 |4...............|
3-00000020 00 01 00 10 00 08 00 00 00 00 00 00 00 00 00 00 |................|
4-00000030 31 33 37 37 37 30 33 33 30 39 00 00 00 00 00 00 |1377703309......|
5-00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
The split_bootimg.scrip takes the values out of the first too rows in little endian to determine the sizes and locations:
Code:
[email protected]:~/Android-Hacking/z130_full_backup$ ./split_bootimg.pl boot.emmc.win
Page size: 2048 (0x00000800)
Kernel size: 4011608 (0x003d3658)
Kernel location: 268468224 (0x10008000)
Ramdisk size: 638004 (0x0009bc34)
Ramdisk location: 285212672 (0x11000000)
Second size: 0 (0x00000000)
Board name: 1377703309
Command line:
Writing boot.emmc.win-kernel ... complete.
Writing boot.emmc.win-ramdisk.gz ... complete.
Unfortenutely the location exceeds the size of the boot.img:
Code:
[email protected]:~/Android-Hacking/z130_full_backup$ hd boot.emmc.win
...
0046fc30 00 81 11 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
0046fc40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00600000
So it looks like the scipt only pulls some random data from the memory for the kernel and for the ramdisk
In fact the ramdisk starts at a different location:
Code:
[email protected]:~/Android-Hacking/z130_full_backup$ hd boot.emmc.win |grep '1f 8b 08'
00005220 6e 20 65 72 72 6f 72 00 1f 8b 08 00 00 00 00 00 |n error.........|
003d4200 1f 8b 08 00 00 00 00 00 00 03 ec 7d 0b 7c 54 c5 |...........}.|T.|
All 3 split utilities do the same:
unpackbootimg, unmkbootimg, split_bootimg
---------- Post added at 12:41 PM ---------- Previous post was at 11:42 AM ----------
since the bootloader is u-boot I think the image has a different format:
HTML:
http://www.compulab.co.il/workspace/mediawiki/index.php5/U-Boot:_Images#Image_format
progress
I also was able to extract the ramdisk out of the boot.img and added it together with the mkvendor.sh output at github.
I was also able to compile the kernel from sources provided at acer.com. I requested the sources of the u-boot image too.
You are doing great job dude keep going )))
U-Boot Source Code request
This is my request to Acer for the U-Boot source:
Dear Sir/Madam,
thank you for your reply. Software licensed under the GPL2 can be reused and modified and sold with the restriction of handing out the source and build instructions for the sold product.
In case of the Acer Liquid Z130, Acer has aquired and modified the following Software:
Linux Kernel, the Android OS, the U-boot bootloader, of which the linux kernel and U-boot is licensed under the GPL2, meaning that acer is obliged to hand out the source code of its modified U-boot and the modified kernel plus the build instructions. Since Acer only handed out the instructions and source of the modified linux kernel on its webpage, it hasn't yet met its obligations.
Since Android uses a different licence, you can refuse to hand out part of its code but you can gain popularity in the opensource community by doing so.
Yours sincerely
Denis Wentland
The request dates from 3th of July. How much time to give them and how to proceed in case they don't follow?
U-boot
While investigating usb-traffic, I encountered some CDC-ACM messages on the powered off, battery removed, usb-connected device . For 1 second the device opens its USB serial port and spams some READYREADYREADY messages . Then it closes it for some 8 seconds again.
On factory mode it asks for the input password on the /dev/ttyACM0 port.
I hope I can find out the password and enter U-Boot command prompt.
Since U-boot is under GPL Acer should hand out the source for me to find out the pasword.
hexdumping the boot loader firmware it has some uboot-messages:
000277f0 2d 20 0a 00 5b 25 73 5d 20 55 6e 70 6c 75 67 67 |- ..[%s] Unplugg|
00027800 65 64 20 43 68 61 72 67 65 72 2f 55 73 62 20 62 |ed Charger/Usb b|
00027810 65 74 77 65 65 6e 20 50 72 65 2d 6c 6f 61 64 65 |etween Pre-loade|
00027820 72 20 61 6e 64 20 55 62 6f 6f 74 20 69 6e 20 4b |r and Uboot in K|
00027830 65 72 6e 65 6c 20 43 68 61 72 67 69 6e 67 20 4d |ernel Charging M|
00027840 6f 64 65 2c 20 50 6f 77 65 72 20 4f 66 66 20 0a |ode, Power Off .|
but unfortunetaly not the Serial output messages
I have a french Acer Z3 Single SIM and as many on XDA i am a kind of flasholic.
I found a file .ZIP opened it and found boot.zip, system.img, recovery.zip that I I flashed from ADB\Fastbboot.
Was able to boot the phone but it’s from dual SIM update Thaï operator.
This one : Update_Acer_AV052_Z130_1.005.00_AAP_AISH https://www.dropbox.com/s/5s07i8g1hq3ekga/Z130SingleSIM_Tha%C3%AFSTOCK_ROM.zip
I don’t get any network signal from it. If it can help…maybe?
WARNING: if some of you decide to dowload this, please do not install it on your phone, because you will not be able to install another System.zip. Or unless you want an asian DUO SIM THAÏ Operator ok! :good:
wendenerp said:
While investigating usb-traffic, I encountered some CDC-ACM messages on the powered off, battery removed, usb-connected device . For 1 second the device opens its USB serial port and spams some READYREADYREADY messages . Then it closes it for some 8 seconds again.
On factory mode it asks for the input password on the /dev/ttyACM0 port.
I hope I can find out the password and enter U-Boot command prompt.
Since U-boot is under GPL Acer should hand out the source for me to find out the pasword.
hexdumping the boot loader firmware it has some uboot-messages:
000277f0 2d 20 0a 00 5b 25 73 5d 20 55 6e 70 6c 75 67 67 |- ..[%s] Unplugg|
00027800 65 64 20 43 68 61 72 67 65 72 2f 55 73 62 20 62 |ed Charger/Usb b|
00027810 65 74 77 65 65 6e 20 50 72 65 2d 6c 6f 61 64 65 |etween Pre-loade|
00027820 72 20 61 6e 64 20 55 62 6f 6f 74 20 69 6e 20 4b |r and Uboot in K|
00027830 65 72 6e 65 6c 20 43 68 61 72 67 69 6e 67 20 4d |ernel Charging M|
00027840 6f 64 65 2c 20 50 6f 77 65 72 20 4f 66 66 20 0a |ode, Power Off .|
but unfortunetaly not the Serial output messages
Click to expand...
Click to collapse
sory idk what it means. but does that mean we cant get it on our z3?
---------- Post added at 06:32 AM ---------- Previous post was at 06:30 AM ----------
hello guys. may i know what bloatware that can safely be remove from this phone? its full with useless app. wish i could uninstall all of it to make it more like stock android
Salut,
as-tu trouver une roms stock pour le z3 ?
Merci
Hi,
Anybody have an original stock ROM for z130 EMEA ?
Please help me. I have lost mine...
Thx...
Sent from my Nexus 5 using XDA Free mobile app
hi guys..
is there Polish language for this device..?
http://www.acer.com.sg/ac/en/SG/content/drivers/4889;-;Z130