Vizio XR6M10/XR6P10 Smartcast Tablet Remote: Is there any interest in these? - Android Q&A, Help & Troubleshooting
These tablets were sold with certain Vizio TVs in mid-2016 into 2017, primarily used for Smartcast to the TV.
They are now obsolete since Vizio released firmware for their TVs turning them into normal Smart TVs, requiring the owners of these TVs to get new remotes and the tablets stopped being useful for this function.
Here in 2019, one can buy these tablets, at the low price end, in working condition, for $25 (for the M series) to $40 (for the P series) shipped.
The specs are as follows:
XR6M10:
Snapdragon 410 1.2GHz quadcore APQ8016
2GB RAM
8GB Storage
1280x720 IPS display
802.11n, Bluetooth 4.0
2740mAh battery
MicroUSB for charging, Qi Charging built-in for bundled charge pad or any compatible charging solution
XR6P10:
Snapdragon 615 1.45GHz octocore APQ8039
2GB RAM
16GB Storage
1920x1080 IPS display
802.11n, Bluetooth 4.0
2740mAh battery
MicroUSB for charging, Qi Charging built-in for bundled charge pad or any compatible charging solution
Both tablets feature side-firing stereo speakers, a headphone jack, and NO cameras. The size of the tablet is comparable to the size of a Galaxy Note 9, give or take.
Both tablets came with Android 5.1.1, and OTA updates upgraded them to 6.0.1. There are ZERO available stock ROM files available for the tablets. I've tried sniffing the updater and they seem to go to a dead website.
The stock ROM is fairly clean, and only has the Vizio Smartcast app which needs disabling upon setting up. Aside from this, there is no other bloatware on the tablet to speak of after running a fine-tooth comb through the system apps. You get a clean and snappy tablet.
The problem:
There's no stock ROM file available, neither for Android 5.1.1 or for 6.0.1. Vizio does not have any sort of download for either on their site, nor did in the past. The updater checked a third-party website affiliated with Vizio to manage the tablet's updates, as it does with their TVs. Since the website is inert, it can be safely said that Vizio is no longer interested in their existence at all, especially since the warranty on every single one of these tablets is now up.
The tablet seems it can have the bootloader unlocked, the developer options has the toggle for that, but there's no way to get into fastboot. Holding VOL UP+DOWN+POWER at boot or sending the "adb reboot bootloader" command sends it into a "Qualcomm HS-USB QDLoader 9008" mode under USB. This, from what I understand, is behavior persistent with the locked bootloader, but I have no idea of how to get it out of this and just into fastboot. Stock recovery does not have a fastboot option either.
The desires list:
Have someone that knows the intricacies of the MSM8916 platform and the APQ8016/APQ8039 get their hands on these tablets
Get a ROM dump of both tablets in stock form so people with bricked tablets can flash them with it
Get Root (Patch level on the 6.0.1 stock ROM is from October 2016, shouldn't be hard)
Get the bootloader unlocked, somehow, and if not, figure a way to get something like Safestrap running on it if the out-of-the-box kernel allows for it
Custom ROMs? LineageOS would be sweet, especially with some of the tablet-specific fixes that have dropped in the past couple months overall.
so I ask: is there any interest in the freeing of these super cheap tablets? The price to spec ratio is not bad (once again, I got my 6M10 for $25 shipped, and the seller has like 7 more as of the time of this writing), and it doesn't seem like it would be all too hard to unlock the bootloader and get it rooted (at least, from my perspective, that of a novice in this specific hardware field). There are plenty of these in the wild in the hands of people that bought the TVs and plenty in the hands that bought them from ebay when the tablets became obsolete.
This link contains screenshots of CPU-Z and the About Tablet settings section from the tablet, uploaded to imgur. If anyone needs more information on this tablet that needs an app or adb command, I can make this happen.
Board Pic of the XR6M10, XR6P10 should be the same inside:
(click for larger image)
Update: I have temp root.
I have temp root!-the latest kingroot (NOT Kingoroot) APK seemed to have done the trick. I was able to fire up adaway and get the hosts file set up with adblocks to keep the thing safer.
The root is still temporary so it goes away after a reboot. The rooting process involves it doing the root process once, then rebooting, then failing, then you reboot once more, and then retry rooting from the app. From here, 80% of the time, it works and you're able to get temporary root for that boot session.
Once you're done with anything you need root for, you should reboot and then uninstall Kingroot, which you then need to deactivate the device administrator priveleges for, before it will allow you to cleanly uninstall it.
I also made a huge discovery that may turn out better for anyone that can help getting this thing properly rooted and the bootloader unlocked... it seems the file manager included in the stock ROM is v3.0.0 from Cyanogenmod 12.1.
This makes me think that the ROM creator either used that since it was opensource and readily available than come up with their own solution, or that this ROM has some cyanogenmod roots.
I also found this post from another Q&A thread in this section:
TheDrive said:
This device have made by Chinese/Indian company Borqs. The code name Bennu-M. Platform is Qualcomm APQ8016 (MSM8916 w/o modem). There should work standard method to bring EDL mode. Hold Vol+ and Vol- at power on (press power). Then connect to the PC. Thus device will stay look dead, however should be detected as Qualcomm QDLoader 9008 on the PC side. This is the factory described method.
You can flash factory firmware from this mode using external bootloader (programmer) for MSM8916 firehose protocol. This procedure is described in the thousands of manuals around the net. Qualcomm tools like QPST or QFIL can be used as good as many 3rd party utils to flash and manage any another available way. Many professional 'box' tools should support this device too but only as 'generic' msm8916 (if applicable).
However I can't find the firmware package for this device anywhere. You should ask and require the manufacturer/distributor to publish firmware, the source code and all the corresponding matherials to be able to flash and rebuild firmware from sources in any manner you want without any limitations as required by GNU/GPL free open source software licenses this firmware is obligated to.
Everyone who have the device working or software dead, can try to dump the current firmware and data, stored on the internal eMMC memory module in part(s) or in whole image using free QTools project utilities and suitable external bootloader with ability to dump eMMC, not only to flash as many factory supplied programmers do. There are programmer(s) for MSM8916 available in the project repo. Read and understand manuals carefully before trying anything!
There is definitely another ways to root, dump, flash, manage the device in any manner YOU WANT, not only the way you are "allowed" to use your own device by manufacturer/distributor. FTA!
You can root the device then dump all the multiple partition images manually (dd if=/dev/block/mmbblk0...... of=/sdcard/......) or using built custom recovery like CWM/TWRP for your device. Please note, kernel sources are important but not mandatory to build e.g. CWM. You can build one using CWM image from the similar device and the kernel (boot/recovery) image binaries from your device. There are good manuals and image repacking utils available around like e.g. AndImgTool.
There are the way to produce factory image from the eMMC/partitions dump(s). Use utils like R-Studio to dump particular partition images from the eMMC dump (it's like whole HDD or UFD image with all the sectors raw, one by one, w/o any modifications/compression/etc) Manuals / utils are avavailable to make e.g. sparse and xml scripts set which is flashable by the programmer in the EDL mode (i.e. from any damaged state, because EDL is built in to the PBL and masked to the internal CPU ROM, thus can not be damaged in any manner, except firing the CPU up).
You can also flash partition images from the more common Fastboot mode, unless eMMC GPT and bootloaders (SBL/RPM/TZ/ABoot) stay intact (logo showed). You can't dump from fastboot, which is common due to the (foolish) 'safety' requirements. It's security by obscurity and is definitely not for your favor, but for the corps control over you and force to send valuable private data to foreign clouds.
Please share eMMC full and/or partitions dumps using reliable 'neverending' file cloud/hosting since there is no factory firmware available yet (ever). I do not own this device and never seen being overseas, so I can't share.
Click to expand...
Click to collapse
This gives a little bit more information but seems to be more waffle than helpful. Still need someone, or some individuals, that can get one of these devices into their hands and work on a way to get the bootloader unlocked, the eMMC dumped, and ROMs going.
Update file?
I THINK I have the update file for 6.0.1. I did a packet sniff on a 5.1.1 tablet using a mitm packet sniffer and I ran the system updater, and was able to get this URL:
http://updatev.vo.llnwd.net/v1/idownload/64821.bin
The filesize is 570MB or so, and it looks like it might be the real deal. since it's a .bin file and 7zip can't read it, I won't be able to see what it really is without going over to the box that has a copy of universal extractor installed.
I'll be doing this momentarily and editing this post once I figure out what the contents are or if it's even readable to that extent. Knowing vizio, it could very well be encrypted and need decrypting by the updater application.
Update: it seems to be encrypted. oh joy.
Update 2: I got together with a friend on discord and we successfully decompiled the updater app to a point.
This MEGA link contains all the files thus far and a copy of the tablet's /system/framework folder for decompiling purposes.
However, it doesn't seem we're getting anywhere. the file is still encrypted and I still can't figure out what's needed to decrypt it. Hopefully someone with more knowledge on this can lend a hand.
Sudosftw said:
I THINK I have the update file for 6.0.1. I did a packet sniff on a 5.1.1 tablet using a mitm packet sniffer and I ran the system updater, and was able to get this URL:
http://updatev.vo.llnwd.net/v1/idownload/64821.bin
The filesize is 570MB or so, and it looks like it might be the real deal. since it's a .bin file and 7zip can't read it, I won't be able to see what it really is without going over to the box that has a copy of universal extractor installed.
I'll be doing this momentarily and editing this post once I figure out what the contents are or if it's even readable to that extent. Knowing vizio, it could very well be encrypted and need decrypting by the updater application.
Update: it seems to be encrypted. oh joy.
Update 2: I got together with a friend on discord and we successfully decompiled the updater app to a point.
This MEGA link contains all the files thus far and a copy of the tablet's /system/framework folder for decompiling purposes.
However, it doesn't seem we're getting anywhere. the file is still encrypted and I still can't figure out what's needed to decrypt it. Hopefully someone with more knowledge on this can lend a hand.
Click to expand...
Click to collapse
Just out of curiosity, with the temp root, have you tried using dd to get the recovery image off? If we can do that, we might be able to work on getting a custom recovery built.
Qiangong2 said:
Just out of curiosity, with the temp root, have you tried using dd to get the recovery image off? If we can do that, we might be able to work on getting a custom recovery built.
Click to expand...
Click to collapse
It's not possible to get a proper recovery image from within the system files so far as I know, but my take so far has been that there is no proper way to get that at this time without decrypting that file grabbed from the update server. I'd do it on a 5.x ROM since that will get me permaroot, but the issue is getting and keeping root on a 6.x ROM.
Although encrypted (so far as I can tell) the image linked above is the real deal, and I've given all I can to get it decrypted. A proper exploit to take care of this tablet's vulnerabilities and get temp root (on 6.x) that isn't kingo is what is really needed at this point so to not hinder going around the system with crudware and shady background apps, shouldn't be hard since the security patch level for the 6.x ROM is 2016-10-01.
Even if the ROM is extracted or a recovery image found, custom recovery won't be possible until the bootloader is unlocked, and this isn't doable until someone figures out how the qualcomm qdloader9008 stuff works with this specific tablet. Fastboot is unreachable and I'm almost sure I'm doing something wrong.
I'll get temp root and see about dd'ing stuff later on. What exactly would be needed for me to dd off? Whole disk and then go through it elsewhere? I could definitely see if rsync exists and dd over rsync to another box.
Sudosftw said:
It's not possible to get a proper recovery image from within the system files so far as I know, but my take so far has been that there is no proper way to get that at this time without decrypting that file grabbed from the update server. I'd do it on a 5.x ROM since that will get me permaroot, but the issue is getting and keeping root on a 6.x ROM.
Although encrypted (so far as I can tell) the image linked above is the real deal, and I've given all I can to get it decrypted. A proper exploit to take care of this tablet's vulnerabilities and get temp root (on 6.x) that isn't kingo is what is really needed at this point so to not hinder going around the system with crudware and shady background apps, shouldn't be hard since the security patch level for the 6.x ROM is 2016-10-01.
Even if the ROM is extracted or a recovery image found, custom recovery won't be possible until the bootloader is unlocked, and this isn't doable until someone figures out how the qualcomm qdloader9008 stuff works with this specific tablet. Fastboot is unreachable and I'm almost sure I'm doing something wrong.
I'll get temp root and see about dd'ing stuff later on. What exactly would be needed for me to dd off? Whole disk and then go through it elsewhere? I could definitely see if rsync exists and dd over rsync to another box.
Click to expand...
Click to collapse
I found this today: https://forum.xda-developers.com/axon-7/development/edl-emergency-dl-mode-twrp-unlock-t3553514
The miflash tool seems promising (it works with nearly any device)
For the dd stuff, you can usually figure out the partitions easily with the fstab file in /. However, getting a raw dump is always useful.
Really, the big 3 would be the recovery.img, the boot.img, and the system.img. We can work from there
Qiangong2 said:
I found this today: https://forum.xda-developers.com/axon-7/development/edl-emergency-dl-mode-twrp-unlock-t3553514
The miflash tool seems promising (it works with nearly any device)
For the dd stuff, you can usually figure out the partitions easily with the fstab file in /. However, getting a raw dump is always useful.
Really, the big 3 would be the recovery.img, the boot.img, and the system.img. We can work from there
Click to expand...
Click to collapse
I've had that installed whilst trying to figure the image out and the qdloader stuff, it doesn't do anything for this tablet sadly :/
Sudosftw said:
I've had that installed whilst trying to figure the image out and the qdloader stuff, it doesn't do anything for this tablet sadly :/
Click to expand...
Click to collapse
Hmmm. Which tablet do you have? The M or the P?
Qiangong2 said:
Hmmm. Which tablet do you have? The M or the P?
Click to expand...
Click to collapse
this is the M. the P was out of my price range ($40 shipped over $25 shipped) when I was looking at them, but now the Ms are going for around 25 bucks but 15 shipping from another seller, bringing the price up to 40 bucks where the P was. ended up buying the other Ms from the one seller and gave them out to family members because I was so impressed... but I really should have set some money aside for one of the Ps as well and didn't.
Sudosftw said:
this is the M. the P was out of my price range ($40 shipped over $25 shipped) when I was looking at them, but now the Ms are going for around 25 bucks but 15 shipping from another seller, bringing the price up to 40 bucks where the P was. ended up buying the other Ms from the one seller and gave them out to family members because I was so impressed... but I really should have set some money aside for one of the Ps as well and didn't.
Click to expand...
Click to collapse
Okay. You said miflash doesn't do anything, does the device show up in the application and not function? Or does it not show up at all?
Qiangong2 said:
Okay. You said miflash doesn't do anything, does the device show up in the application and not function? Or does it not show up at all?
Click to expand...
Click to collapse
just doesn't show up at all. and yet installing the qualcomm qdloader drivers says it's connected in device manager, so something's up. tried on two different boxes, different cables, no dice.
Sudosftw said:
just doesn't show up at all. and yet installing the qualcomm qdloader drivers says it's connected in device manager, so something's up. tried on two different boxes, different cables, no dice.
Click to expand...
Click to collapse
Hmmm. That's unusual. Are you running it in win 7 compatibility mode?
It would be nice to see community roms for these devices. I have the XR6P. If you need any info from this device, just tell me what to do.
I'm very interested in this as I have one of these tablets that I would like to use in my vehicle as a display for my piggyback ECU tuner. It doesn't currently support USB OTG, but I read that if I can gain root access I can add the file to give it USB Host functionality. Can anyone confirm this? I have tried several apps to get it rooted including Kingroot as you were able to get a temp root with that. Unfortunately Kingroot, as all the others I have tried, won't even install on the tablet. Again, I'm only looking to get this thing to be OTG capable. If anyone here has any suggestions, I would be very grateful! Thanks all!
I just bought an M remote to replace my broken P remote. My P remote had Android 6. My M remote has Android 5, and the OTA updater says there's no update. Any way to get Android 6 on this?
I have factory firmware for Bennu P and Bennu M , but take some time to upload the file.
ALANCHONG said:
I have factory firmware for Bennu P and Bennu M , but take some time to upload the file.
Click to expand...
Click to collapse
Hey. You can lay out the firmware for XR6M10
XR6M10 and XR6P10 firmware
konog said:
Hey. You can lay out the firmware for XR6M10
Click to expand...
Click to collapse
Mega Link: mega.nz/#F!n65kVYIT!PKH8A1WoD_Nc4DU_-9dbiQ
ALANCHONG said:
Mega Link: mega.nz/#F!n65kVYIT!PKH8A1WoD_Nc4DU_-9dbiQ
Click to expand...
Click to collapse
All the time, an error pops up at 12 seconds
Flash fail (-4002)
Log:
21:59:03.576 Arrival: \\?\USB#VID_05C6&PID_9008#5&13a74b18&0&11#{86e0d1e0-8089-11d0-9ce4-08003e301f73}
21:59:03.591 Thread '_PortDownloadThread' started
21:59:04.610 Get Port ...
21:59:04.610 _GetDevicePortName (0): COM5
21:59:04.630 _ComPort: COM5
21:59:04.640 Get Port (0)
21:59:04.650 Flash ...
21:59:09.668 _Connect (0)
21:59:09.668 Downloading flash programmer: C:\_qcMUP\v8016-SIGNED-VIZIO-user-IMAGES\v8016-SIGNED-VIZIO-user-IMAGES\prog_emmc_firehose_8916.mbn
21:59:14.669 Failed to read the command from the opened port
21:59:14.669 _FlashProgrammer (-4002)
21:59:15.700 Flash (-4002)
21:59:15.700 Flash fail (-4002)
21:59:15.731 Download ended: -4002
21:59:15.763 Thread '_PortDownloadThread' ended
konog said:
All the time, an error pops up at 12 seconds
Flash fail (-4002)
Log:
21:59:03.576 Arrival: \\?\USB#VID_05C6&PID_9008#5&13a74b18&0&11#{86e0d1e0-8089-11d0-9ce4-08003e301f73}
21:59:03.591 Thread '_PortDownloadThread' started
21:59:04.610 Get Port ...
21:59:04.610 _GetDevicePortName (0): COM5
21:59:04.630 _ComPort: COM5
21:59:04.640 Get Port (0)
21:59:04.650 Flash ...
21:59:09.668 _Connect (0)
21:59:09.668 Downloading flash programmer: C:\_qcMUP\v8016-SIGNED-VIZIO-user-IMAGES\v8016-SIGNED-VIZIO-user-IMAGES\prog_emmc_firehose_8916.mbn
21:59:14.669 Failed to read the command from the opened port
21:59:14.669 _FlashProgrammer (-4002)
21:59:15.700 Flash (-4002)
21:59:15.700 Flash fail (-4002)
21:59:15.731 Download ended: -4002
21:59:15.763 Thread '_PortDownloadThread' ended
Click to expand...
Click to collapse
Please check if the driver is installed
Related
[Q] Frustrated, bricked - Hipstreet Titan-A
Hi I've looked around the XDA Forums, and on various other forums. I have a Hipstreet Titan, I tried to root using the Tasselhof's Root package, and it went reasonably well until I selected the option (#3) to copy over the build.prop file. After that I get the Android logo every boot-up. Factory wipe I guess wiped - I don't really have any way to verify. I pushed a different build.prop on, but that didn't seem to take (or make any difference). For some reason my adb shell (whateverother parms) doesn't work. It returns "- exec '/system/bin/sh' failed: No such file or directory (2) -". So I figure the OS has been toasted. (I didn't have this much trouble rooting my LG Eclypse. ) Now, I just need to find an original ROM, or some other slightly modded (rooted would be nice) ROM to get on to my device before I find out how far out my back door I can throw this thing. As this Hipstreet tablet is an off brand (really far off, but hey, I got it free), I haven't been able to find a ROM posted anywhere. Likely I just haven't looked in the right spot yet. Yes, I know, I should have backed up first - but I didn't. As soon as I get an OS working on this, I'll back it up - promise. I've also tried "adb sideload system.img" using a system image file that comes with the Android ADT kit and the factory recovery mode. That appears to upload the file, reboot the device then report (on the windows terminal) "* failed to write data 'protocol fault (no status)' *". The device reboots into the recovery system screen. So, if someone would be so kind as to point me to a rom file that will work on this device, it would be most appreciated. PS this is the Titan rev A, when I got the device (second hand) the Google Play store functioned just fine. The person I got it from is not a techy, so I doubt they applied any root or update to it, so I'm guessing it came already set up.
Ok, let me rephrase simply. Can someone with a working Hipstreet Titan, rooted or not, please send me, or post a link to their ROM? Click to expand... Click to collapse I know people have this device, and it's quite reasonable to assume that not all of them are bricked, therefore this request is technically feasible. Further, with a number of people posting about this device in technical forums, I know people with technical knowledge own this device. I would really hate to throw out an otherwise perfectly good tablet.
Jarod997 said: I would really hate to throw out an otherwise perfectly good tablet. Click to expand... Click to collapse Hi - did you ever resolve this issue?
beach9000 said: Hi - did you ever resolve this issue? Click to expand... Click to collapse Not yet. I had given up for a while. Most of my internet searches kept coming back to the same few articles on this website. I have a lead on someone who has another Titan, but they live seven hours away - it's been difficult coordinating a meeting.
Jarod997 said: Hi I've looked around the XDA Forums, and on various other forums. I have a Hipstreet Titan, I tried to root using the Tasselhof's Root package, and it went reasonably well until I selected the option (#3) to copy over the build.prop file. After that I get the Android logo every boot-up. Factory wipe I guess wiped - I don't really have any way to verify. I pushed a different build.prop on, but that didn't seem to take (or make any difference). For some reason my adb shell (whateverother parms) doesn't work. It returns "- exec '/system/bin/sh' failed: No such file or directory (2) -". So I figure the OS has been toasted. (I didn't have this much trouble rooting my LG Eclypse. ) Now, I just need to find an original ROM, or some other slightly modded (rooted would be nice) ROM to get on to my device before I find out how far out my back door I can throw this thing. As this Hipstreet tablet is an off brand (really far off, but hey, I got it free), I haven't been able to find a ROM posted anywhere. Likely I just haven't looked in the right spot yet. Yes, I know, I should have backed up first - but I didn't. As soon as I get an OS working on this, I'll back it up - promise. I've also tried "adb sideload system.img" using a system image file that comes with the Android ADT kit and the factory recovery mode. That appears to upload the file, reboot the device then report (on the windows terminal) "* failed to write data 'protocol fault (no status)' *". The device reboots into the recovery system screen. So, if someone would be so kind as to point me to a rom file that will work on this device, it would be most appreciated. PS this is the Titan rev A, when I got the device (second hand) the Google Play store functioned just fine. The person I got it from is not a techy, so I doubt they applied any root or update to it, so I'm guessing it came already set up. Click to expand... Click to collapse It looks like they made a few different versions of the tablet and it matters also about how much storage as to which firmware you should try. The person here: http://www.androidtablets.net/forum...eet-titan-a13-7-inch-tab-firmware-needed.html was able to load the firmware from another device that was similar. There were some major issues, but better to get it running first and sort that out later I guess. But his link has a bunch of other a13 tablet firmwares. If that is the same as yours, possibly one of them will be enough to boot up.
es0tericcha0s said: It looks like they made a few different versions of the tablet and it matters also about how much storage as to which firmware you should try. The person here: (link manually removed) was able to load the firmware from another device that was similar. There were some major issues, but better to get it running first and sort that out later I guess. But his link has a bunch of other a13 tablet firmwares. If that is the same as yours, possibly one of them will be enough to boot up. Click to expand... Click to collapse Thanks for the help! I'll have a look at some of those. I'd really like to have a tablet back that doesn't have a 3.5" screen. So I managed to get LiveSuit 1.11 installed on Win 8-64, yes it IS doable. But, my problem is I can't get the tablet recognized. The Power+Vol boot takes it in to "recovery" mode, (so reports "adb devices") - does this keep it from being able to be used by LiveSuit? "adb wait-for-device" hangs In my Device Manager I have Android Device->Android ADB Interface, and Universal Serial Bus controllers->USB Device(VID_1f3a_PID_efe8) with a yellow exclamation. I know I had "adb wait-for-device" passing fine at one point, but I don't remember what I had to do to get there. So much trouble for a free tablet.
I have a Titan that I unfortunately tried to root using what would only work on the ICS model and it's the JB model. It bootloops on the Android boot sequence. I can adb into the tablet and browse it, and I can see in the logcat where it gives up and restarts. I saw the post on that other forum about using the Tragidy firmware but that file at Dorkfiles now appears to be paywalled. If anyone has that or another compatible firmware already downloaded and would be able to share, that would be wonderful. At this point the Titan in front of me may as well be a mini cutting board or a large coaster. Not that it matters much, as some store gave it out to my parents for free and we all own better devices. It's just that they don't own any Androids and I thought I could configure this one as an easy remote for them to push content from their media server to their Smart TV instead of using the TV's complicated interface.
cmstlist said: I have a Titan that I unfortunately tried to root using what would only work on the ICS model and it's the JB model. It bootloops on the Android boot sequence. I can adb into the tablet and browse it, and I can see in the logcat where it gives up and restarts. I saw the post on that other forum about using the Tragidy firmware but that file at Dorkfiles now appears to be paywalled. If anyone has that or another compatible firmware already downloaded and would be able to share, that would be wonderful. At this point the Titan in front of me may as well be a mini cutting board or a large coaster. Not that it matters much, as some store gave it out to my parents for free and we all own better devices. It's just that they don't own any Androids and I thought I could configure this one as an easy remote for them to push content from their media server to their Smart TV instead of using the TV's complicated interface. Click to expand... Click to collapse So I managed to get a system backup off of my father-in-law's Titan - just have to figure out how to get it on my brick. I'm having great difficulty trying to do a restore while in recovery mode.
What means did you use to back it up? Sent from my Nexus 5 using Tapatalk
cmstlist said: What means did you use to back it up? Sent from my Nexus 5 using Tapatalk Click to expand... Click to collapse adb backup
Jarod997 said: adb backup Click to expand... Click to collapse The adb backup command doesn't back up the system files. Unless there's some other way to use it that I'm not aware of? Sent from my Nexus 7 using Tapatalk
cmstlist said: The adb backup command doesn't back up the system files. Unless there's some other way to use it that I'm not aware of? Sent from my Nexus 7 using Tapatalk Click to expand... Click to collapse Aw crap, really? The cutting board a-la-iPad commercial is sounding like such a good idea at the moment. On the good tablet I could get in the shell - "adb shell", and then "su", but then what? How do you copy all the files off the system through the USB onto the computer from the shell? For whatever reason (and I dislike ADB for this) I could not do "adb pull /* /destination-folder/*" - it kept saying that it was skipping a lot of files. Or otherwise if I was trying other variations on commands and parameters, adb would just spew its help page - never mind telling me what's wrong with the command I just entered. Why, oh why, is it so hard to take a copy of a good working OS and put it on to another tablet? But, make you a deal - help me get a good system image off this working tablet and I'll toss it to ya.
If you can find the right mount points on the partition table got may be able to make a system dump using dd. But restoring it I have no idea since there's no custom recovery available for this tablet. Sent from my Nexus 7 using Tapatalk
Lenovo Tab3 8" (2016) Custom Recovery / or any modern Tablet in UK under £100
Hi @Tzul / All, You got me all excited when I saw you had created the custom recovery for the Lenovo Tab3... only to find out that Lenovo have another Tablet called the Tab3 that came out later this year, and it was this one that I was interested in getting. The Tablet has a model No: ZA170136GB Any idea if it is possible to create a custom recovery for this too?? Or does anyone know a decent Tablet in the UK for under £100, that has a Custom Recovery, and some fairly recent roms for it... Mainly need the recovery to backup the current rom, and once I have set the Tablet up for my father, to make an image of that too... Cheers, Lister
Hi @Tzul / All, Just found this link, not sure if its for the same (newer Tablet) just the smaller 7" version, instead of the 8" version. But it mentions Android 6.0x which is the default OS on the newer Tablet. https://webcache.googleusercontent....or-lenovo-tab3.html+&cd=7&hl=en&ct=clnk&gl=uk The only thing I can't work out, is what the model number is for the newer 2016 8" model, as I've been told its "ZA170136GB" which seems a bit long... Where as most like the 7" version appears to be just "TB3-730X" and makes sense. Cheers, Lister
Lenovo has quite a few tablets called "Tab3" / "TB3". There are at least 4 or 5 different versions of 7 inch models. Plus 8 inch and 10 inch models. As far as I know, all of them are based on MediaTek chips, meaning if you need to create and restore backups of entire partitions, you don't even need a custom recovery, as you can use the MediaTek SmartPhone Flash Tool (SPFT) for that. However, in order to use the SPFT, you'll need a "scatter file" that matches the device in question. The scatter file contains details about the device's partitioning (start addresses, sizes, and more). You can create one manually, taking an existing one from a similar device as template, but that requires some specific knowledge and experience. Creating a custom recovery isn't easy either, particularly if you don't have the device in question at hand. For starters, you need an existing firmware update or backup (e.g. a readback made with the SPFT), from which some required data can be extracted.
Hi @Tzul, LOL, just found you in this thread too... spooky/small world... https://forums.lenovo.com/t5/Lenovo...-me-unbrick-Lenovo-Tab3-850f-pls/td-p/3433458 Click to expand... Click to collapse Corr, they don't like to make it easy for their users... do they!!! There's even more than I first suspected then, talk about confusing!!! lol Yeah this one I've spotted is also a MediaTek chipset too... Does this SPFT tool belong to Lenovo/MediaTek, or apply to many different hardware configurations? Where would I obtain a Scatter file for this Tablet? I've done a bit more Google'ing, and think the unit could be a TB3-850F (although that links to an American version of the one Ive seen in the UK). Its a fairly good Tablet as it is anyway, so do you think its best just to get it anyway, and hope development / support comes for it at a later date?? Once I get the Tablet, I would be able to know what the EXACT model is for sure then... If so, is there anything I can do, in the way of dumping a rom... I believe I may of found the official rom for it on Lenovo's website earlier today at work too. So maybe able to get a rom dump that way... If I could, do you think it would be possible to make a TWRP based on the Recovery.IMG dumped from the rom.... Or do you still need the device to actually develop and test on...?? Just wonna try get a good Tablet, that I can then create a backup/image of stock build (inc TWRP recovery) and one that I've customised App-wise for my dad to use and back that up. So if he messes it up, I can restore it quickly... Many thanks for getting back to me so promptly, and so detailed reply. Cheers, Lister
The SPFT software is by MediaTek and generally works with all MediaTek-based phones and tablets - provided you have a suitable scatter file. Once you have the tablet, it should be easy to determine the exact type by going to the Android system settings, about the tablet, and check the values there; primarily model and build number. It should also be on the packaging. I can build TWRP without owning the tablet, but it's more difficult that way as I basically have to do it "blind". I have done it for the TB3-710I, because a firmware dump was available, and someone provided me with all the info I needed. I guess I could do it for the TB3-850F as well, if I find the time and have all necessary data.
Is that the same tool that would or could be used, if ever I wish to factory reset it (if can't get TWRP onto it) or do you think Lenovo have another method, if things go really screwy?? lol As for the model, I shall certainly be picking it up tomorrow... As I've spent many-a-days now trying to find an ideal one for my dad, and this one comes in really cheap esp for the spec. So if TWRP can go on it, it will make it an even bigger BONUS... So will find out tomorrow what the exact model is, I'm hoping it will be a TB3-850F... As did a bit of Google'ing from the 7" model, came across that model for the 8" which appears to be exactly the same as the UK model... The website is the same, except the cpu seems to be 300mhz faster.. Im sure the UK model is 1GHz, where as they USA is 1.3GHz. Hopefully so, as that will be easier for you too I'm guessing, as it looks like you already have the Scatter file in the other forum... or at least a close template, with luck.. I'll do my best to get what ever, and as much info to you as possible... And really really appreciate any efforts you could spare to try and get TWRP on it. No worries if you can't and appreciate you're busy with other things in your life, so absolutely no rush... As said, any effort at all is really appreciated!!! Thank you for even taking the time to read and reply to my request/info... thanks Cheers, Lister
Hi @Tzul, Ok, I picked the Tablet up from the shop yesterday for my dad and although we've not unboxed it yet. It is indeed the same model you appeared to be helping the use in the thread here. TB3-850F Hopefully I'll be on it tonight, to find out more information. It appears there are at least 3 or 4 different models sold, WiFi and LTE versions, and they differ from USA to UK. The USA version features a QuadCore 1.3 Ghz CPU The UK vesion features a QuadCore 1.0 Ghz CPU So not sure if that's gonna cause issues, I'll run some software on it tonight to find out the exact CPU inside it... (I have the UK version, 1.0 Ghz... if thats any use?) I'm also gonna try ask Lenovo (not expecting a speedy response from that company, if I'm honest) to see if they have a factory restore image/tool.... Like all Samsung phones/Tablets have, and even the Tesco's Hudl. They should make it easy for end users to restore their devices, should disaster occur... If can get a firmware dump, that may help in getting the Boot.Img and Recovery.Img in order to help make a TWRP. As that will be the preferred way of backing up and restoring the device... How would one flash this to the Tablet, if it's possible...?? Through ADB fastboot?? What's the risk factor of BRICKING the device, outta of 100% say...? Such as Samsung have a Download Mode (which seems they are indestructible) and can always force a stock rom too them... Cheers, Lister
I doubt that the CPU frequency differs between the US and UK version. They should be exactly the same. I wouldn't trust the info on websites. For my Tab 2 A10-70F, figures differed as well (some sources said 1.5 GHz, others 1.7 GHz; but in reality, it's 1.69 GHz). Typically, the back of the box should list the correct specs. Does it say anything about the used MediaTek chip (MTxxxx)? You can use the fastboot flash command to flash at least some partitions, but you might have to "unlock" the bootloader first (there should be an option in the Android developer settings). Alternatively, I can easily patch the bootloader to allow fastboot flash, but in order to install the patched bootloader, you need the SPFT or TWRP. If you mess up something, you'll "brick" the tablet, but with the SPFT you can almost always restore the firmware.
Hi @Tzul, Yeah, was just going via what the website says for both devices. Seems a little silly to change the builds, for different parts of the world. Prolly the same CPU and then either under or overclocked in various regions. Just got home, and on the back of the box it says... CPU: MT8161P QC 1.0GHZ 64Bit I'll have to wait an hour or so, as my dad is round our elderly neighbours house helping him out. But when he is back, I'll open the Tablet with him, then enable the "Android Developer Settings" through double/tapping the Build No 7x times. Once I'm in there, I assume it's "USB Debugging" you want me to enable/turn on...?? How will I know if the Bootloader is locked / unlocked? Is there a command / test, to fastboot the device and see if it responds, says anything back?? I don't know much about Fastboot, as my my flashing experience is either done through programs/utilities of via the device itself... Is there anyway to pull the Boot.Img / Recovery.Img via Fastboot?? Or is that done via that SPFT app...? So you saying, no matter what happens/goes wrong... I can pretty much restore/recover it like Factory via the use of SPFT... There will always be a way to PUSH a firmware to the device??? I'm fully use to using Odin (not sure if you know/aware/used that App) but if SPFT is anything like that... I know that Samsung is almost indestructible via flashing with Odin... Is SPFT the same??? I'm trying to contact Lenovo to see if they have a Factory Image, or process to see if they can have a Restore Image too... That way maybe able to pull those partition from the image file?? Cheers, Lister
Lister Of Smeg said:
Just got home, and on the back of the box it says... CPU: MT8161P QC 1.0GHZ 64Bit
Click to expand...
Click to collapse
Thanks, that's what I expected. The actual CPU frequency might be 988 MHz, but rounded up it's 1.0 GHz.
Lister Of Smeg said:
Once I'm in there, I assume it's "USB Debugging" you want me to enable/turn on...??
Click to expand...
Click to collapse
USB debugging is required for ADB, which is a useful tool. But I was thinking about the option "OEM unlocking - Allow the bootloader to be unlocked", which might or might not be present in the developer menu on your tablet.
Lister Of Smeg said:
How will I know if the Bootloader is locked / unlocked? Is there a command / test, to fastboot the device and see if it responds, says anything back?? I don't know much about Fastboot, as my my flashing experience is either done through programs/utilities of via the device itself... Is there anyway to pull the Boot.Img / Recovery.Img via Fastboot?? Or is that done via that SPFT app...?
Click to expand...
Click to collapse
Strictly speaking, a locked bootloader performs integrity checks and refuses to start the system when it was tampered with. A locked system wouldn't boot an unofficial boot.img or recovery.img (such as TWRP). That's rarely the case with MediaTek-based devices, i.e. they are usually "unlocked". However, they often have the fastboot flash command restricted/disabled, meaning you can't use fastboot to flash TWRP or other stuff, until you "unlock" the bootloader, or use a patched bootloader.
To make backups of boot.img, recovery.img, etc. you can use the SPFT or a custom recovery. Or you can do it from within Android, provided you have root.
I suggest you first try this:
Open an ADB shell (USB debugging enabled, tablet running Android connected to PC via USB), or use a terminal app, then type
Code:
getprop ro.build.version.incremental
getprop ro.product.ota.model
and tell me the output. I might be able to use that information to find Lenovo's official firmware packages for your tablet.
For my TB3-710F for example, the values are ro.build.version.incremental=Lenovo_TB3-710F_S000026 and ro.product.ota.model=LenovoTB3-710F_L.
Furthermore, boot the tablet by pressing and holding power+volume_up. That should either display a little boot menu ("normal, recovery, fastboot"), or take you directly to the recovery. In the former case, choose "fastboot", in the latter case, the recovery menu should have a "reboot to bootloader" entry at the bottom.
That should take you into fastboot mode. Connect the tablet to PC via USB, and use a fastboot client to run "fastboot getvar all". That'll dump a lot of info, including partition info, which could help with creating a scatter file.
With "fastboot reboot" you can leave fastboot mode.
Lister Of Smeg said:
So you saying, no matter what happens/goes wrong... I can pretty much restore/recover it like Factory via the use of SPFT... There will always be a way to PUSH a firmware to the device???
Click to expand...
Click to collapse
Yes, if you have a complete firmware backup including scatter file.
The MediaTek SPFT is comparable to Samsung's Odin, except that it also allows to make backups (readbacks). But again, you always need a proper scatter file first. You might be interested in reading this.
Hi @Tzul, First of all, Wow... oh WOW!!!! Are you an Android developer, as in OS specialist.... that post was epic in both detail and knowledge. Wow, you really know you're stuff... Do you work for a big company, or just a very clever/gifted hobbyist?? WOW Thanks for pointing me to that post, very interesting and giving me a heads up in the process of Lenovo architecture... Ok, I've unboxed dad's Tablet (he doesn't know this yet... LOL). Turned it on, wow... what an experience, this is the best Android/Tablet (and we've had several over the years, from ZTE phones... to Samsung phones and HP/Tesco Hudl Tablets)... Beautiful experience! Ok, 1) I've enabled Developer Tools (tapped Build No 7x times) 2) I've enabled [ADB Debugging] 3) I've turned on / enabled "OEM Unlocking". Will this trigger Lenovo software to feel it's been tampered with? Or will it just be normal and allows the bootloader to passthrough / flash a modified recovery to it? 4) getprop ro.build.version.incremental = TB3-850F_S100025_160608_ROW getprop ro.product.ota.model = LenovoTB3-850F_ROW 5) I couldn't do the Power button + Holding Volume Up button, as when holding both down... The Tablet keeps rebooting, and not loading anything up other than the Lenovo logo, then reboots again... So I tried Power button + Holding Volume Down button, and it appears to show a menu... But it was ALL in Chinese, other than the word eMMC. I had no idea how to get out of it, other than holding "Vol Up and Power button" as I found from previous, it just boots/reboots loop until let go. I did so, then it said something about SD.. and the rest in Chinese and made a loud beep, before rebooting... So not sure if I've done anything to an SD Card, internal...?? As we've not put in an external one yet... So not sure how to get into Bootloader / Recovery yet? As it keeps restarting... Interestingly, when I first turned this device on and connected it to the network, it wants to pull down a small update.... TB3-850F_S100025_160608_ROW_TO_TB3-850F_S100026_160923_ROW What it currently is... What it wants to go too... The update is only 22Mb in size.... I hope this helps? Cheers, Lister
My job doesn't really involve Android, but I've studied this, more or less. Glad to hear that the tablet is good. I'm still satisfied with my Tab 2 as well. Lister Of Smeg said: 3) I've turned on / enabled "OEM Unlocking". Will this trigger Lenovo software to feel it's been tampered with? Or will it just be normal and allows the bootloader to passthrough / flash a modified recovery to it? Click to expand... Click to collapse The latter, as far as I know. Thanks for the property values. With those, I could find the small update you mentioned. Unfortunately it doesn't contain a complete boot.img file, but at least it contains a barebones scatter file (just the partition start addresses): Code: preloader 0x0 pgpt 0x0 proinfo 0x80000 nvram 0x380000 protect1 0x880000 protect2 0x1280000 lk 0x1c80000 para 0x1d00000 boot 0x1d80000 recovery 0x2d80000 logo 0x3d80000 expdb 0x4580000 seccfg 0x4f80000 oemkeystore 0x5000000 secro 0x5200000 keystore 0x5800000 tee1 0x6000000 tee2 0x6500000 frp 0x6a00000 nvdata 0x6b00000 metadata 0x8b00000 system 0xb000000 cache 0xcb000000 userdata 0xe5800000 flashinfo 0xFFFF0084 sgpt 0xFFFF0004 Exactly the same values I used for the preliminary scatter file that you found on the Lenovo forums. If you like, you can try to use it with the SPFT to make a readback. Download the latest SPFT, unzip it, find its "option.ini" file, open it, and at the very end change "ShowByScatter=false" to "ShowByScatter=true". Download and install the USB Preloader driver (cdc-acm). Finally, run the SPFT, load my scatter file, and make a readback. Lister Of Smeg said: 5) I couldn't do the Power button + Holding Volume Up button, as when holding both down... The Tablet keeps rebooting, and not loading anything up other than the Lenovo logo, then reboots again... Click to expand... Click to collapse If you hold down the power button for too long, the tablet will probably reboot. Try this: Shut down the tablet. Hold volume up, then hold power. When the screen turns on, release the power button, but keep holding volume up. That should take you to the boot menu or recovery. If not, you can still try to get there via "adb reboot recovery" or "adb reboot-bootloader" (for fastboot). Lister Of Smeg said: So I tried Power button + Holding Volume Down button, and it appears to show a menu... But it was ALL in Chinese, other than the word eMMC. I had no idea how to get out of it, other than holding "Vol Up and Power button" as I found from previous, it just boots/reboots loop until let go. I did so, then it said something about SD.. and the rest in Chinese and made a loud beep, before rebooting... Click to expand... Click to collapse Yeah, on these MediaTek-based devices, that key combination usually takes you to the factory test menu. Avoid going there, you could mess something up. The bottom-most menu entry gets you out of there (reboot). The menu entry with "eMMC" is "wipe eMMC" - sounds as if it would delete the entire internal flash memory (the eMMC chip), but in actuality, it just does as factory reset, i.e. it only wipes the /data partition (where all user apps and settings are stored). At least it's like that on every device I've tested so far.
Hi @Tzul, Well, ya certainly know what ya talking about... was a great read. I am technically minded. I do (and have done for about 15/20 years) IT Support. I understand the talk, sometimes we all gotta re-learn new tricks... Ok, you'll love this... I spoke to Lenovo today... Actually very good support really, much better than when we phone up about PCs not working in our company. Anyway, they were still unable to help me with the Tablet. I spoke to them about not being able to get into Recovery / Bootloader. Didnt tell them why of course, but explained that I wanted to know if there was an official firmware I could download if I wished to return the Tablet to fully stock without any Apps. Blamed my dad messing it up, which is kinda true... even though he has not touched it yet. Anyway, they talked me through many things, BASICALLY WHAT YOU'VE ALREADY TOLD ME.... About holding down Vol Up and Power button. After many attempts, still not working. So I said there is a 22mb update pending, I'll try that and see if that allows me to do the key combo... Still no joy. He told me to do a factory reset in the Android OS (which I knew anyway). And so did that, and sure enough it wiped everything, even Developer Settings. However after re-enabling it again, the OEM Bootloader was STILL UNLOCKED? lol. Anyway, needless to say... I still cannot get into recovery on this device, and he seems certain I should be able too. He thinks the device may be faulty, and suggests returning it... Apart from not being able to get into Recovery, I dont think it is faulty as seems fine everywhere else. I also tried "Lenovo Smart Assistant" as it seems that can download firmware from there site. After spending a couple of hours trying to get all the (10x different Android device drivers installs, MTP, ADB, MIDI, blah blah) it still didnt automatically detect in their Smart App. So I tried to select the "Dead Device" mode, where you have to enter "Model No" and Hardware ID, typed in various things... but neither showed up the Tablet??? lol Anyway, going back to above.... 1) Installed the suggested signed drivers for the PreLoader 2) Downloaded, edited Options.ini and ran the latest SPFT 3) Opened the Scatter file, nice to see all the partitions. 4) Tried to do a ReadBack of just Boot.img and Recovery.img but nothing downloaded or seemed to happen. But was doing this in a hurry on my lunch break. Shall have another go at home, or back at work tomorrow. Ah, think I've seen where I went wrong... I didnt double click on the [File] column. I just assumed the path was already correct, looking at it. Also, can't remember the state of the device, think that was also on at the time. So will have a proper go later... and upload the boot.img and recovery.img -- Just out of interest, if I was making a STOCK ROM backup. What partitions do I need to select / include / tick, for that?? And assume if I wanted to restore it, just do the exact same. Select the partitions, select the files in the [File] tab as to what I want to restore and use DOWNLOAD only mode? Or would it be best just to make the backups in TWRP once/if it's possible...?? As I'm having no joy with the key combo, I'm gonna try the ADB commands in a sec, and let you know how those go.... Yeah, I wont be going there again in a hurry... Didnt have a clue what any of it was, and it wasn't clear at the time how to get out of it either... Sadly I selected the very first open, no idea what that was / is ???? but couldn't get out of it either and had to wait till it finished... I saw eMMC and panicked, as I have 3x Samsung devices that all suffer from the eMMC brickbug issue. Where the chip dies if using a faulty kernel. Thankfully this kernel is all but disappeared, as only came about in an official LEAKED Samsung build. And all previous/after official kernels and all custom kernels had this faulty switch removed... But whenever I see eMMC, I worry now... lol Many thanks, Lister
Hi @Tzul,
Well, after my chat to Lenovo and doing some more testing last night... I think my Tablet could be genuinely faulty...
You know I said how I can't enter Recovery (Power & Vol Up) despite you and Lenovo saying that it should work. Well Lenovo think and said it could be faulty and return to place of purchase.
I tried the ADB commands last night, the Reboot Bootloader worked and sent me into Fastboot. However the Reboot Recovery gives me this error...
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Which I am wondering if I don't have a Recovery or it's corrupted...??
I am also failing to get those ReadBacks of either Boot.img or Recovery.img, as depsite having the Tablet off and clicking on the file names, and pointing it where to save. Nothing appears to happen, no data transfers...??
Do you think I'll be able to get those files if I root the device, and use a Root File Manager???
Also, without any official firmware from Lenovo yet... If I root it, will I be able to unroot it by just doing a simple "Factory Reset" within Android OS, or does this keep the root do you know?? Never really used Factory Reset, as always wipe the device in a custom recovery....
Cheers, Lister
Lister Of Smeg said: You know I said how I can't enter Recovery (Power & Vol Up) despite you and Lenovo saying that it should work. Well Lenovo think and said it could be faulty and return to place of purchase. Click to expand... Click to collapse That sounds quite unlikely to me. Have you tried what I wrote before? Start holding the volume up button before you turn on the tablet. Then press the power button to turn it on, release the power button again, but keep holding volume up all the time. Lister Of Smeg said: I tried the ADB commands last night, the Reboot Bootloader worked and sent me into Fastboot. However the Reboot Recovery gives me this error... Click to expand... Click to collapse That's not an error, that is in fact the stock recovery! The menu is missing, but that's normal for some devices. There's a "secret" key combination you need to press to activate the menu. Try power+volume up again (or to be more specific, hold down the power button, then "click" the volume up button, then release the power button; do not hold down the power button for 10 seconds or longer, that'll probably reboot the tablet). Lister Of Smeg said: I am also failing to get those ReadBacks of either Boot.img or Recovery.img, as depsite having the Tablet off and clicking on the file names, and pointing it where to save. Nothing appears to happen, no data transfers...?? Click to expand... Click to collapse Are you sure you're doing everything correctly? When the tablet is off and you connect it to the PC via USB, Windows should play the "USB device connected" sound effect, quickly followed by the "USB device disconnected" sound effect. Take a look at the Windows device manager - the Preloader VCOM device should appear there for this brief period, and it must not have a warning triangle (that would be a sign of missing drivers). Lister Of Smeg said: Do you think I'll be able to get those files if I root the device, and use a Root File Manager??? Click to expand... Click to collapse Yes, that should work, BUT I would not advise it. Looking at the update file, I saw it uses the newer block-based format. That means if you change the system partition in any minor way, e.g. by installing root / su binaries there, future updates will fail! Therefore, you shouldn't do anything that could modify the system partition (installing root, or even running TWRP), until you have a backup of the original state. Lister Of Smeg said: Also, without any official firmware from Lenovo yet... If I root it, will I be able to unroot it by just doing a simple "Factory Reset" within Android OS, or does this keep the root do you know?? Never really used Factory Reset, as always wipe the device in a custom recovery.... Click to expand... Click to collapse No, a factory reset will not unroot! Root is either installed on the system partition (the old way), which Android considers read-only, or it is installed in a modified boot.img (the new way), which also won't be touched by Android. A factory reset, regardless whether performed by Android or a custom recovery, just wipes the data and cache partitions.
That sounds quite unlikely to me. Have you tried what I wrote before? Start holding the volume up button before you turn on the tablet. Then press the power button to turn it on, release the power button again, but keep holding volume up all the time. Click to expand... Click to collapse Yes, I tried that... no matter what order/process I take. It each ends up in the same result. I did the holding of the Vol Up, then pressing Power (waited it for it to Vibrate, before letting go of Power... as instructed by Lenovo tech Support) and still would not get past the white screen, with Lenovo logo. That's not an error, that is in fact the stock recovery! The menu is missing, but that's normal for some devices. There's a "secret" key combination you need to press to activate the menu. Try power+volume up again (or to be more specific, hold down the power button, then "click" the volume up button, then release the power button; do not hold down the power button for 10 seconds or longer, that'll probably reboot the tablet). Click to expand... Click to collapse I thought that was recovery, as I've seen the ill looking Android collapse on other Android devices when a flash has failed, but normally I see more of a menu... Like to Apply Update (I guess official internal OS updats). I shall try that trick in a second, to see if I can get the menu to appear. May have to do it at home, as I know ADB app sends our works AV to thinking its a virus, when it's safe... lol Are you sure you're doing everything correctly? When the tablet is off and you connect it to the PC via USB, Windows should play the "USB device connected" sound effect, quickly followed by the "USB device disconnected" sound effect. Take a look at the Windows device manager - the Preloader VCOM device should appear there for this brief period, and it must not have a warning triangle (that would be a sign of missing drivers). Click to expand... Click to collapse The drivers installed correctly here (work, running Windows 10 x64), all went smoothly. When I plugged the Tablet in, it came up saying something about PreLoader driver... However at home, the drivers failed... But that could be my old screwy build of Windows 7x x64.... So gonna try again at work for that part. Yes, that should work, BUT I would not advise it. Looking at the update file, I saw it uses the newer block-based format. That means if you change the system partition in any minor way, e.g. by installing root / su binaries there, future updates will fail! Therefore, you shouldn't do anything that could modify the system partition (installing root, or even running TWRP), until you have a backup of the original state. Click to expand... Click to collapse Oh great, terrific... So I gotta be extra careful then!! lol. No rooting or mods until at least I can pull this ReadBack backup off... Oh I do love my Xposed!! So once I've got my first official ReadBack backup, with no mods or alterations. Then I'm safe to do whatever...?? Providing I've got my first ReadBack before I do anything, if we are able to get TWRP into the Recovery Partition of the Tablet. Will this TWRP Recovery affect /System and OTA updates?? or is that only the Recovery partition affected, and System will stay intact?? Also, once (or, IF) I have TWRP, could I do a full system backup there. Prior to any mods, and can fully restore to stock (with the addition of TWRP recovery and not Stock) via the TWRP Recovery then... As wonna get an as close to stock backup as poss in TWRP. And then a fully setup with all the Apps, Mods, Tweaks and root Apps setup and then back that up. I assume I can always restore to the first TWRP backup without root at a later. / If any of that ^ makes sense? lol No, a factory reset will not unroot! Root is either installed on the system partition (the old way), which Android considers read-only, or it is installed in a modified boot.img (the new way), which also won't be touched by Android. A factory reset, regardless whether performed by Android or a custom recovery, just wipes the data and cache partitions. Click to expand... Click to collapse Fair enough, I kinda assumed that a Factory Reset within the Android OS will keep the root, and only wipe user added data, such as Apps, Pictures, Music, Files... and anything added to the /System would be left behind. My old devices (N7000 and i9100) only use the old way at the moment for rooting, as in writing to the system partition. When trying to use the new Boot.img way (as in Systemless root) causes both devices to crash, as they don't have the pre-modded Boot.img yet. But assuming if I made a previous backup of the whole Tablet in TWRP before rooting (or do I need root, to push TWRP). Then go onto root the Tablet afterwards, if I then restore the Tablet to the first pre-root backup in TWRP will over write the root files back to stock?? / sorry for all the questions, and what-if's.... ? I understand Android, and fully know my Samsung models inside out... Just not sure when it comes to Lenovo, as it seems to use a different structure, and partition layout. And at moment, till I get my head around it, seem as stable/fool-proof in not making non-changeable choices, that can be corrected at a later date. Just it's my dads Tablet, and don't want to mess anything up as yet... As I'll prolly have to buy it off him lol Anyway, thanks for your continued help on this.... I'll let you know how I get on... Cheers, Lister
Lister Of Smeg said: The drivers installed correctly here (work, running Windows 10 x64), all went smoothly. When I plugged the Tablet in, it came up saying something about PreLoader driver... However at home, the drivers failed... But that could be my old screwy build of Windows 7x x64.... So gonna try again at work for that part. Click to expand... Click to collapse The driver I linked can be installed with a simple right-click in Windows 8 and later. But in Windows 7, the installation procedure is more involved, as described in the included readme. Lister Of Smeg said: Oh great, terrific... So I gotta be extra careful then!! lol. No rooting or mods until at least I can pull this ReadBack backup off... Oh I do love my Xposed!! So once I've got my first official ReadBack backup, with no mods or alterations. Then I'm safe to do whatever...?? Click to expand... Click to collapse Yes, if you get the SPFT to work with your tablet, you can make a backup and restore it anytime you want. Lister Of Smeg said: Providing I've got my first ReadBack before I do anything, if we are able to get TWRP into the Recovery Partition of the Tablet. Will this TWRP Recovery affect /System and OTA updates?? or is that only the Recovery partition affected, and System will stay intact?? Click to expand... Click to collapse The first time you run TWRP, it asks you whether or not you'd like to allow changes to the system partition. If you choose yes, TWRP will rename a certain system file on exit, and will also offer to install a SuperSU stub for root. You see, Android has a mechanism that restores the stock recovery on every Android boot! Therefore, TWRP will be automatically replaced by the stock recovery again, unless you allow TWRP to rename that file, or install SuperSU. Both these things will intentionally break that Android restore mechanism. On your tablet, you should probably forbid TWRP to make those changes. But even if you do, other things in TWRP can still change the system partition regardless. Installing the zip files for Xposed or SuperSU, for example. Or even restoring a TWRP backup of the system partition (because they are file based, but a block-based update doesn't just care about the file contents, but also about where exactly the files are located on the partition/disk, which will change with a file-based restore). That's why "systemless" Root and Xposed are a thing these days. They don't install the files to the system partition anymore like they used to, but somewhere else (the ramdisk of the boot image, as far as I know), and use some trickery to make the files appear in the filesystem where they are expected. Concerning OTA updates: they will fail if the system partition was modified. So if you want to install one, you either have to roll back to an unmodified system and stock recovery, then install the update, then install root, Xposed, etc. again (tedious). Or you can modify the updater-script inside the update, and make it work with modified systems, then install the adjusted update with TWRP. But that requires know-how and will only work with the old file-based updates, not the new block-based ones. Lister Of Smeg said: Also, once (or, IF) I have TWRP, could I do a full system backup there. Click to expand... Click to collapse No. As just mentioned, TWRP backs up the files (their content), which is not enough for block level accuracy. You need a system image backup. Which can also be made with TWRP, if it has been configured properly. Lister Of Smeg said: But assuming if I made a previous backup of the whole Tablet in TWRP before rooting (or do I need root, to push TWRP). Then go onto root the Tablet afterwards, if I then restore the Tablet to the first pre-root backup in TWRP will over write the root files back to stock?? Click to expand... Click to collapse Yes, but again, you need to backup and restore the system image (the entire partition, including "empty" space, not just the files as TWRP normally does). Lister Of Smeg said: / sorry for all the questions, and what-if's.... ? I understand Android, and fully know my Samsung models inside out... Just not sure when it comes to Lenovo, as it seems to use a different structure, and partition layout. And at moment, till I get my head around it, seem as stable/fool-proof in not making non-changeable choices, that can be corrected at a later date. Just it's my dads Tablet, and don't want to mess anything up as yet... As I'll prolly have to buy it off him lol Click to expand... Click to collapse It has nothing to do with Samsung vs. Lenovo. It's about the chipset - MediaTek in your case. A Lenovo device with a Qualcomm chip, for example, will have a different partition layout and obviously won't work with the SPFT. And most of the things I just talked about (file-based vs. block-based updates, the "sanctity" of the system partition, etc.) are general Android things and not specific to the chipset.
Hi @Tzul, Ok, slowly making progress here... Yippie!! lol Still can't enter recovery via hardware buttons... No matter how many times I try, and in whatever order and timing. I even tried holding Power & Vol Up, then when it FREEZES on white screen with Lenovo logo. Then tried releasing Vol Up also, and then holding it down again... like how to reveal 'Secret Menu'. But still nothing appears for recovery!! However, that said... I am now able to enter Recovery... via using ADB Fastboot Recovery, then using those key combo commands to reveal the secret menu. Which that all now works, and get a full list of options to choose from there... So thank you for that!! I've had another go at trying to install PreLoader driver again on my home PC (Win7 x64) and it now appears to do something, more than previously done... But errors, and still does not pull those files. Maybe you might be able to see where going wrong via the screenshot?? Yes, if you get the SPFT to work with your tablet, you can make a backup and restore it anytime you want. Click to expand... Click to collapse Once I get this App working, and working reliably... I think I'd feel a lot more comfortable and happier, knowing I have a decent back up to rely on. Just this App is new to me, and at moment (with difficulties of entering Recovery and getting this App to work). Where as comparison to Odin. Just have to put phone into Download Mode, add the Firmware File... and thats it. By the looks of things, this App is very very similar. Just with its hit/miss at moment, till I've ironed out why its not working... Just want to know I have STOCK rom to return too, in aid of firmware updates. Concerning OTA updates: they will fail if the system partition was modified. So if you want to install one, you either have to roll back to an unmodified system and stock recovery, then install the update, then install root, Xposed, etc. again (tedious). Or you can modify the updater-script inside the update, and make it work with modified systems, then install the adjusted update with TWRP. But that requires know-how and will only work with the old file-based updates, not the new block-based ones. Click to expand... Click to collapse I've seen TWRP (more specifically, TWRP 3.x) mention about allowing System modifications with my Samsung device. I think in the past, I've answered both ways... Allow / Do Not Allow when switching Roms every so often. So basically it's a toss up of whats more important...? Receiving OTA updates, or running Root on the device. As long as I can get this first initial ReadBack backup, then should be happy either way... As can always restore back to fully STOCK, run the update, then flash TWRP and Root apps again?? No. As just mentioned, TWRP backs up the files (their content), which is not enough for block level accuracy. You need a system image backup. Which can also be made with TWRP, if it has been configured properly. Click to expand... Click to collapse Will have a look on my current Samsung / TWRP about making full system based images. But that said, I still won't receive OTA updates restoring back to this way, as already modified the device/OS with TWRP... preventing this. But could be quicker/easier way to return to STOCK (minus updates). And this would be safe to do, based on the BLOCK BASED partition on this device? (Only ever been used to FILE BASED twrp backups). It has nothing to do with Samsung vs. Lenovo. It's about the chipset - MediaTek in your case. A Lenovo device with a Qualcomm chip, for example, will have a different partition layout and obviously won't work with the SPFT. And most of the things I just talked about (file-based vs. block-based updates, the "sanctity" of the system partition, etc.) are general Android things and not specific to the chipset. Click to expand... Click to collapse Yeah I hear you on Samsung vs Lenovo, being Exynos vs MediaTek... What I mean't, is I'm just more used too and comfortable with the way things work on Samsung. I know (so far... lol) that I can never really brick my Samsung devices (other than the leaked ICS kernel) as I can restore fully with STOCK rom in Odin. And that all my devices (Samsung, HP Touchpad, ZTE Blade) all use partitions one way or another... as it was a curve to learn Samsung shares Recovery with its Kernel and vice versa... Where as the Blade, they were both separated... I'll get there slowly with MediaTek devices... lol... But most of all, I thank you, for all your time, patience and support guiding me along this way... MUCH APPRECIATED!!! Edit: I am amazed that Lenovo don't have anything public on their website regarding firmware, to allow customers to restore themselves. I've downloaded their "Lenovo Smart Assistant" App which is supposed to support phones and Tablets. But does not detect mine, either alive or dead mode. When searching for it within the App, nothing shows for it either... Or the Tab2 family either..?? May try another cheeky online chat support call to them again, see if they can release anything firmware wise lol Many thanks, Lister
Lister Of Smeg said: I've had another go at trying to install PreLoader driver again on my home PC (Win7 x64) and it now appears to do something, more than previously done... But errors, and still does not pull those files. Maybe you might be able to see where going wrong via the screenshot?? Click to expand... Click to collapse That's the same error the other person on the Lenovo forum had. I have a feeling that the driver isn't installed correctly. Have you looked at the Windows device manager, Ports (Com & LPT) section? Does a new device appear there after connecting the powered-off tablet, and does that device NOT have a warning triangle? Maybe you could try the SPFT on a Windows 8 or 10 machine, where the signed driver can be installed with the simple right-click method. Otherwise, you could find an install an unsigned driver for Windows 7, and try again. Maybe this error is also caused by an incorrect scatter file, wrong download agent, or bug in the specific SPFT version. You could try an older version such as v5.1516. Here's someone who encountered the same error and "fixed" it by using this older version and a slower PC... Lister Of Smeg said: So basically it's a toss up of whats more important...? Receiving OTA updates, or running Root on the device. As long as I can get this first initial ReadBack backup, then should be happy either way... As can always restore back to fully STOCK, run the update, then flash TWRP and Root apps again?? Click to expand... Click to collapse Yes. You should probably go with systemless root on this tablet, but whether the system or boot image get modified, an OTA update will fail either way if it does integrity checks. So there's no way around making backups of the untouched partitions and restoring them when necessary. Lister Of Smeg said: Will have a look on my current Samsung / TWRP about making full system based images. But that said, I still won't receive OTA updates restoring back to this way, as already modified the device/OS with TWRP... preventing this. But could be quicker/easier way to return to STOCK (minus updates). And this would be safe to do, based on the BLOCK BASED partition on this device? (Only ever been used to FILE BASED twrp backups). Click to expand... Click to collapse That option might or might not exist in your Samsung's TWRP. Usually, newer TWRPs are configured to have a "System Image" entry in the Install -> Install Image partition list, so that it is possible to flash a system.img file easily from within TWRP. This same "System Image" entry can also be made visible in the Backup/Restore partition list, but normally it isn't. Lister Of Smeg said: I am amazed that Lenovo don't have anything public on their website regarding firmware, to allow customers to restore themselves. I've downloaded their "Lenovo Smart Assistant" App which is supposed to support phones and Tablets. But does not detect mine, either alive or dead mode. When searching for it within the App, nothing shows for it either... Or the Tab2 family either..?? May try another cheeky online chat support call to them again, see if they can release anything firmware wise lol Many thanks, Lister Click to expand... Click to collapse Well, you're not supposed to mess with these devices. Only a fraction of users install root or Xposed anyway. I've never tried the "Lenovo Smart Assistant", so I can't say anything about that. Anyway, you're welcome.
Hi @Tzul, Still not having any luck with this... Boo-hoo.... As below, is what happened and what I've tried.. Tzul said: That's the same error the other person on the Lenovo forum had. I have a feeling that the driver isn't installed correctly. Have you looked at the Windows device manager, Ports (Com & LPT) section? Does a new device appear there after connecting the powered-off tablet, and does that device NOT have a warning triangle? Maybe you could try the SPFT on a Windows 8 or 10 machine, where the signed driver can be installed with the simple right-click method. Otherwise, you could find an install an unsigned driver for Windows 7, and try again. Maybe this error is also caused by an incorrect scatter file, wrong download agent, or bug in the specific SPFT version. You could try an older version such as v5.1516. Here's someone who encountered the same error and "fixed" it by using this older version and a slower PC... Click to expand... Click to collapse Installed at home, old dual core computer running Windows 7 x64. Installed driver as per instructions (Installed to Com18 port). On first install, it shows a new device with yellow explanation mark. So I delete the device, but keep the driver software files installed. Same error... At work, Quad Core i5 running Windows 10 x64. Installed the driver using Right Click / Install option... Driver installs fine, no errors (Installed to Com15 port). Same error. Tried with the very latest version of SPFT, and with the other older version as quoted on that website. At first the older one wouldnt show the partition on ReadBack mode, even with the ScatterFile=true remark at the end. So I just copied contents out of one of the other option.ini files and then it did. But still no joy. Tried various versions of SPFT (not all of them, will do some more tonight). Tried different USB cables, including the original official one at of the box. Only thing not tried, finding a really really old computer... Tzul said: Yes. You should probably go with systemless root on this tablet, but whether the system or boot image get modified, an OTA update will fail either way if it does integrity checks. So there's no way around making backups of the untouched partitions and restoring them when necessary. Click to expand... Click to collapse I'm assuming there will never be a Systemless root for this device. As that requires someone to mod the Boot.img. And other than your good self, not seen anyone else offer support (or even use) this device, and I can't expect you to do that. Not to mention, can't even get the files off or access a firmware file for it. I was hoping if I could get a STOCK firmware of backup of this device. Then if there was news of an update coming out. I could reflash back to STOCK, loosing all my mods and changes. Just to get the update, then attempt to re-root and tweak again... Gonna be a cat-n-mouse game me thinks... If I can ever get this backup to work in the first place...?? lol Tzul said: That option might or might not exist in your Samsung's TWRP. Usually, newer TWRPs are configured to have a "System Image" entry in the Install -> Install Image partition list, so that it is possible to flash a system.img file easily from within TWRP. This same "System Image" entry can also be made visible in the Backup/Restore partition list, but normally it isn't. Click to expand... Click to collapse Didnt get chance to check TWRP last night on Samsung devices, by time I went to bed... was too knackered and straight asleep... lol. Will check tonight... Tzul said: Well, you're not supposed to mess with these devices. Only a fraction of users install root or Xposed anyway. I've never tried the "Lenovo Smart Assistant", so I can't say anything about that. Anyway, you're welcome. Click to expand... Click to collapse No, it appears your not... I tried to speak to Lenovo again today... (sob story... Need to access a backup firmware in case Tablet dies under dads use, which is not too far from the truth...) However he was under the impression I could restore fully to STOCK if I access the Recovery (which I told him only works via ADB commands. He suggested again I should take it back to shop and get it replaced). Anyway, I said... So does that mean the Lenovo Tablet has a hidden recovery image / rom / partition. And that if I was to "root the device, in order to make some Apps/Tweaks work" I could enter Recovery, and run the recovery option in the hidden menu and restore Tablet back to STOCK. To which sadly I had to go back to work, and told him this. I said if he could leave me the reply, I'd check when back. Which he then said, "If the Tablet is rooted, it will then delete the recovery partition, meaning no recovery would be possible" which to me sounds a little far fetched... that rooting will actually DELETE a hidden recovery image/partition??? I'm sadly starting to think, have I picked the wrong device for my dad?? Same as with all mine, and what I did for my mums... I was able to install custom recovery easily. Especially in the case of my mum's Tesco's Hudl, I set it all up with STOCK rom (as there are no custom roms), however there is custom recovery which I flashed, rooted, and installed all rooted Apps. However, I have since been able to reflash it back to fully STOCK without any Root, and able to go back and fourth as often as like without fear of bricking, or potentially damaging any future updates/recovery.... Gonna try a few more times to get this to recognise and accept SPFT backing/restoring... Otherwise next week, I may consider taking back to the shops. Pity, as the Tablet itself is seems really nice so far (even though barely used it yet). But just worried cannot make backup images, or can easily break Updates/Stock Restoring.... Cheers, Lister
bricked nextbook 10a, desperate for help
i recently was given an nextbook 10a and it works but is forever stuck at the boot screen "nextbook powered by android". i can get into recovery and factory wipe, etc but makes no difference. ive also gone to nextbook website but there isnt any support for this device. is there anyway to reflash entire device restore to stock rom via usb cable and software model # nx16a10132sps fcc id# s7jnx16a10132sp
ekoms420 said: i recently was given an nextbook 10a and it works but is forever stuck at the boot screen "nextbook powered by android".... Click to expand... Click to collapse I don't have this device and i can only locate 1 thread where you might be able to obtain some member guidance within that's specific to your device. https://forum.xda-developers.com/showthread.php?t=3654507 Good Luck! ~~~~~~~~~~~~~~~ I DO NOT provide support via PM unless asked/requested by myself. PLEASE keep it in the threads where everyone can share.
Do you think it could possibly be a Windows tablet and someone tried flashing Android on it I posted the model number and what not I could post a photo of the recovery because it's all good it's all like lines through the words and stuff like this just a thought I had
ekoms420 said: Do you think it could possibly be a Windows tablet and someone tried flashing..... Click to expand... Click to collapse Your question is a valid one that prompted me to perform a quick Google search using the model number and such and after looking at a little over a half dozen results, I came to the following conclusion. This came with Android 6.0 and was a budget Tablet that costs approximately $100.00 +/- brand new. It seems as though the individual who had given you the tablet may have been unsuccessfully attempted one or more actions like Unlocking, Rooting, etc... With a very limited amount of resources available for this device, there's really not much out there for help but, I'm not stating that there's no help. It's more of where to find it that's the challenge. I wish that I could be of more help... Good Luck! ~~~~~~~~~~~~~~~ I DO NOT provide support via PM unless asked/requested by myself. PLEASE keep it in the threads where everyone can share.
Thank you very much for your time and help. At least I know it was most likely someone's fuk up then faulty
Still been messing with it cuz I have hope it's just soft breaking set but I got into the recovery log files going through them I found this one section I screenshotted check it out it's the same bored as the 8a 16gig version of what not so like those other post around where is has been mentioned to use the 8a Twrp etc on the 10a because it's the same board. This tablet is like the 2nd or 3rd gen that came out 2017 which has like at all winners CPU or something instead of Intel or something like that I've read somewhere and it also has Android nougat 7. 1 out the gate. So in theory I should be able to put that 8a twrp & boot Image to match on this one and then downgrade to 5. 1 or do something like remix Os or something custom. ??!?!?!!!!?????? so how the puck do I put a picture attached of the recovery log.
ekoms420 said: i recently was given an nextbook 10a and it works but is forever stuck at the boot screen "nextbook powered by android". i can get into recovery and factory wipe, etc but makes no difference. ive also gone to nextbook website but there isnt any support for this device. is there anyway to reflash entire device restore to stock rom via usb cable and software model # nx16a10132sps fcc id# s7jnx16a10132sp Click to expand... Click to collapse I have the same tablet I think. I can turn on and off and boat into recovery(words are faced and have lines through them) but I'm its staying stuck with Nextbook showing on screen. I'm trying to find stock or something so I can flash and get it fixed. Its a Nextbook 10" Model:NX16A10132sps. FCC ID: S7JNX16A10132SPS. Ill let you know if I find anything
I have both A64 and Intel versions. The twrp for the 8a DIDN'T work on the A64 when I tried it. It DOES work on the Intel. If you can get to stock recovery and its messed up looking with the lines and stuff, that's the A64 version. Don't hesitate to ask if anyone needs help if it's Intel. My A64's are both bricked still so i'd be useless there. Here are my backups from the Intel version. Ares10a_NXM1021CAP_ES-IntelAtom-[NX16A10132SP-S] - Google Drive drive.google.com And how to tell exactly which you have.
Trying to help a friend fix a Nextbook NX16A10132S/NXM1021CAP that is caught in a boot loop. This is an Intel Atom based unit. FTM mode is accessible (limited adb command support). DNX mode is accessible (limited fastboot command support). Based on the information in the build.prop file, it would appear to be an Android 6.0.1 system: ro.build.description=NXM1021CAP-user 6.0.1 MMB29M 20160919.050843 release-keys. I cannot find any ROM, Update or image files for Android 6. I would attempt re-flashing the unit to Android 5, but the image files linked to your post do not include the android_system or android_data partitions. As I understand it, the android_data partition only holds user data and consequently does not need to be flashed, it only needs to be wiped, but the android_system partition is a must. Do you know if stock Android 6 firmware is available anywhere? If not, do you have a stock Android 5 image of the android_system partition? Or, if I am completely off course, can you please advise? Any help would be greatly appreciated. Thanks in advance.
[HELP] New LG phones not booting into recovery or fadtboot[HELP]
Hi I just got a third LMX210 today to add to my collection. Lol really im just trying to solve a problem. I bought a ulma to replace cm and i came across a ulm model and decided to just replace my cm today. The problem is that all three of these phone which normally have easily unlockable bootloaders will not boot into fastboot. The fortune 2 will not even boot into recovery. They all will boot into a blank screen with the android robot and will boot into download mode. The natural solution would be to install an older or even plain stock firmware. But say you dont have a windows 10 or Mac computer. I havent found a way to flash lg firmware using a linux distribution yet. On the other phones i tried removing the laff partition to force the phone into fastboot by plugging into pc while holding the volume up button. This did nothing but repeat the logo until the button released. Yes usb debugging was enabled and adb was used to try these procedures. The drones at lg know nothing and ask to send the phones in for repair. Short of re-installing the stock firmware there has to be way to get past this. And to tell you the truth i dont have a way to flash the stock firmware so i dont even know if that will work. Ok guys got any ideas?
Update. Ok spent 4 hours on a windows pc today trying to flash firmware and install qcom drivers thinking the download errors were due to the drivers. Then at the last moments went to Tecknights page and downloaded and installed the lgup dual mode program. So the bastitches of higher android office decided to screw everyone out of bootloader unlocking. The ARB numbers have recently (like in the past 3 months) been changed to 003. Meaning you cannot flash firmware with an ARB number lower than 003. But that doesnt stop us completely. Two ideas initially popped into my head. Hex edit the .kdz so that the ARB number matches the phone. Or lol split the .kdz into its seperate partition images then wipe the partitions and use qdl or lgup to repair the now bricked phone. No device data no ARB no problem. Im hoping the former works over the latter but ill keep you informed. But really guys thats extreme and i cant see too many folks going through the wipe process to enable fastboot. So we have to find an easier way.
Is there any way to know what partition the ARB protection resides in? If those parts could be wiped im thinking it might fool the flashtool into thinking that there isnt any protection.
one of your devices is MTK isn't it? can't you use SP Flash Tool like for other Mediatek devices? you should be able to flash images to emmc_user with locked bootloader, for example boot, recovery, system, ... all you need is a correct scatter file (which you could create with WwR MTK)
So your saying finish porting my recovery and use sp flash tools to install it. See i have been curious about that procedure and how not having an unlocked bootloader would effect flAshing from recovery. I was thinking brick. But its worth a try if it wont brick and i get full Root with magisk. Ty
Btw when i was porting my recovery i ran into a rather large well too large problem. When i went repack using abdroid image studio which i have used in the past with out problem, it would not shrink the image back down even though i was only trading a few files. How do i fix that
start with readback boot / recovery. then try to unpack, so you will know the scatter is right (at least, for this partitions) or compare files with your already existing backup files no problems here with unpacking/ repacking with AIK
IDEA:::: ok so for the Qcom boards i have a solution possibly. I know that the older software versions have working fastboot and recovery going and can be boot loader unlocked. That tells me that a fota uodate is screwing things up. PROBLEM:::: ARB my fortune 2 will not let me install at all anything before ARB3. ARB_location:::: bootloader Solution:::: download and extract the stock .kdz for device with working features. Wipe parts bootloader and laf using qpst and reinstall. Solves two problems in one go. Allows fastboot and and bootloader unlock and future re-install of stock firmware
may work but remember your bootloader is locked and you need to by-pass this via testpoint (or at least previously enabled oem unlocking and don't lost these setting) otherwise sahara will fail
well it was an idea. I just did some fact checking and also looked at the files dumped from the .dz dump of the fortune 2 stock rom. PBL or primary bootloader cannot be removed or flashed according to a thread it is a pernanent installation. But upon more reading i can flash my recovery and boot.img using qfil in qpst along witn every thing else. But i need to know wether qfil reads ARB info and if so where i can find it in the firmware so i dont flash that img but instead pull it from phone as is.
i would really like to know what the twitterpating deal is with these LMX210 phones. ok when i firsr got my fortune 2 i bought it for two reasons the rootability of the device and the fact that tje msm8937 board came pre-installed with otg software by default which in my eyes meant no more freaking computer to use adb. Well it is all there the drivers the software. but guess what. it doesnt work. i have no idea whats stopping it all from working but even lsusb doesnt bring a twitch or hint of reading any thing over the usb. does any one know how to fix this
Yo. There is definitely ways to flash on linux using virtual machines, wine etc to run windows apps but you got ahold of a windows box to use. IF it is in EDL mode (Qualcomm mode with a driver saying 9008 in it..) then there is still faith you can revive it. You will need the firmware dumped from someone then youll need to run a program creating XML files for the phones firmware parition files. Youll next need a firehose which is what they call the programmers for EDL that send through the commands and firmware in a low low level that these programs like LGUP just do not do yet (don't know why..... Im waiting for someone to program the LGUP dev version with an EDL mode using emmcdl along with a way to create XML files too. Who knows maybe it will happen if we bring it up enough. The hardest problem youll have is getting a proper emmc programmer for the phone. I can source a lot so if teknight doesnt have something to help with EDL just get ahold of me and ill see what I have and send you some stuff.
Man i have been trying to unbrick the LMX-210 CV1 devices since last year. Tek has nothing but supports the work in hope of finding a solution. I have a ton of fire hoses and saharas all of which have cost me nothing but frustration. I have almost every qpst made and have tried them all with my firehose and saharas. Thr only thing i havent done is pull the mbns off my phones and try them. Trust me system dumps are crap. The only sign of life i came by was flashing an sd card with the gpt and then flashing each partition manually using ubuntu. In return i got the battery logo but thats it. Would love to figure it out though By the way I have been compiling kernels. I call it the jokerfish kernel. Its packed full of drivers and debugging features plus gpu idlers boosters and all those crazy fishy thIngs. Its got governors and wire guard. Otg support. Io schedulars and overclocks. Cpu hotplugging and fast charge. Now i cant figure out how to get fast charge to work but its set up for msm-otg phy-msm-otg qpnp-smbcharger and smb135x. All that and not a single panic to reboot in over a week and 1/2 which is how long its been compiled. I used tweaks from the dragonheart kernel source and ported them over and did a lil c++ magic. It has kcal too but n0 app supports it. All kinds of media and sound codecs as well. You think it would be slow but my compiling and coding skills are as mad as me. Hahahaha.' But dont Take my word for as the gentle over there on your couch. See that smile? Hes as happy as fish in a pond. Just remember Duhjoker is in no way responsible for bricked devices so try it at the risk to yourself. This particular fishy thingy works for msm8917 cv1 devices like aristo 2 and k8+ which have been tested by the madman himself. If you like you could thank me but the permanent smiles on your faces will be just as loved.
lol so fast_charge is working on the kernel but you have to add a custom tunable to a kernel app to get it going. Just add the path /sys/class/power_supply/usb/uevent Then you will get a choice of values to manipulate
Question EDL tool for Tensor?
Hi there. Longtime XDAer (back to the OG Moto Droid) but new account. I am a OnePlus devotee that has converted to Pixel 6. I have used Qualcomm's EDL mode with the MsmDownloadTool in the past, is there an equivalent for the Tensor chip? I have no current need for it, but I like to have the appropriate tools ready for future issues, especially in light of the dumb Android 13 bootloader rollback issue some people seem to have.
FWIW, before posting I searched for EDL but that did not return anything. And the PixelFlasher appears to just be a adb/fastboot GUI, is that correct?
There's none afaik, and yes, PixelFlasher is just an GUI for easier operation
Can someone please tell me what EDL is
taanh1412 said: There's none afaik, and yes, PixelFlasher is just an GUI for easier operation Click to expand... Click to collapse Thank you for your reply! Bummer, I hope someone updates the forum if/when it gets released. As of right now, there'd be no way to fix a real brick if we don't have a EDL type of mode other than sending back to Google. Maybe one of their engineers could leak a version of it someday
bush911 said: Can someone please tell me what EDL is Click to expand... Click to collapse A very small embedded OS on Qualcomm chips, think of it kind of like a motherboard controller. Very handy when you have completely FUBAR'd the storage OS or bootloader, essentially bricking the device. EDL allows you to gain very low level SoC access to reflash stock images, thus unbricking. It has no printed screen, it just stays black. You have to use a PC tool to flash
centifanto said: A very small embedded OS on Qualcomm chips, think of it kind of like a motherboard controller. Very handy when you have completely FUBAR'd the storage OS or bootloader, essentially bricking the device. EDL allows you to gain very low level SoC access to reflash stock images, thus unbricking. It has no printed screen, it just stays black. You have to use a PC tool to flash Click to expand... Click to collapse And since Tensor is a modified Exynos (Samsung) processor there almost certainly is no EDL mode. How Google restores bricked units is anyone's guess, but Samsung does have a dedicated download mode that, combined with Odin / Heimdall on a PC / Mac, allows for flashing of stock images.
EDL is Emergency DownLoad mode on Qualcomm processors. There's a ROM in Qualcomm processors that is always present and is the first step to booting. In normal operation it will load the SBL/XBL (secondary bootloader) which will load the aboot (Android application bootloader). If something goes wrong in booting (or if you configure it by test points or boot config) it can load a diagnostic program which is basically a replacement for the SBL/XBL. That program (which in Qualcomm parlance is called a "loader") allows you to read/write partitions and even memory. The difficulty comes that a lot of this is securely signed so there can be problems finding a loader that works. Other brands have ROMs built in which do the same thing but are all incompatible with each other. MediaTek has MTK mode, Allwinner has FEL mode... Note: By "ROM" I mean truly read-only memory built into the processor chip itself. (I think the casual usage of "ROM" to mean an OS loaded onto R/W flash is misleading.)
Strephon Alkhalikoi said: And since Tensor is a modified Exynos (Samsung) processor there almost certainly is no EDL mode. How Google restores bricked units is anyone's guess, but Samsung does have a dedicated download mode that, combined with Odin / Heimdall on a PC / Mac, allows for flashing of stock images. Click to expand... Click to collapse Interesting. The only Samsung I have messed with was the old Galaxy S5 that luckily had a bootloader exploit. Was a PIA to root though and after that I swore I'd never buy their junk. Nowadays they are impossible unlock and modify, as Exynos versions don't fully work in the US so you have to buy their Snapdragon variants which are locked down like crazy. Maybe Google will release the download mode procedures and tooling
Renate said: EDL is Emergency DownLoad mode on Qualcomm processors. There's a ROM in Qualcomm processors that is always present and is the first step to booting. In normal operation it will load the SBL/XBL (secondary bootloader) which will load the aboot (Android application bootloader). If something goes wrong in booting (or if you configure it by test points or boot config) it can load a diagnostic program which is basically a replacement for the SBL/XBL. That program (which in Qualcomm parlance is called a "loader") allows you to read/write partitions and even memory. The difficulty comes that a lot of this is securely signed so there can be problems finding a loader that works. Other brands have ROMs built in which do the same thing but are all incompatible with each other. MediaTek has MTK mode, Allwinner has FEL mode... Note: By "ROM" I mean truly read-only memory built into the processor chip itself. (I think the casual usage of "ROM" to mean an OS loaded onto R/W flash is misleading.) Click to expand... Click to collapse Wow, this is an amazing reply! Thank you! So much detailed and insightful information I didn't know. This is what makes the XDA forums amazing. And yes, I have always been confused why the word ROM become the standard for the OS installed on Android phones, precisely for the reason you pointed out. Android ROMs are anything but read only
centifanto said: Interesting. The only Samsung I have messed with was the old Galaxy S5 that luckily had a bootloader exploit. Was a PIA to root though and after that I swore I'd never buy their junk. Nowadays they are impossible unlock and modify, as Exynos versions don't fully work in the US so you have to buy their Snapdragon variants which are locked down like crazy. Maybe Google will release the download mode procedures and tooling Click to expand... Click to collapse Yeah, Google won't do that. As for Samsung, the Galaxy S4 I own did have a locked bootloader until I used Chainfire's RegionLock Away to permanently unlock the bootloader. The root process for that device was relatively painless, requiring Odin and - at the time - a specialized recovery payload that would root the device as there was no TWRP.
Well for one y'all are missing the fact that since the chip has an exposed serial unit, we can do some reverse engineering on the bootrom and find jump points to certain addresses in memory. Such as the recovery mode. Google host the gs101 and oriel kernel repositories in its open source git repositories. I've found a tone of useful information in there. Ghirda is a good program for reverse engineering. EDL for Exynos uses Exynos Dead Boot Mode. After changing the USB mode and using dwusb3 drivers we should have enough range to write/send bytes to chipset
NonStickAtom785 said: Well for one y'all are missing the fact that since the chip has an exposed serial unit, we can do some reverse engineering on the bootrom and find jump points to certain addresses in memory. Such as the recovery mode. Google host the gs101 and oriel kernel repositories in its open source git repositories. I've found a tone of useful information in there. Ghirda is a good program for reverse engineering. EDL for Exynos uses Exynos Dead Boot Mode. After changing the USB mode and using dwusb3 drivers we should have enough range to write/send bytes to chipset Click to expand... Click to collapse Wow, this is amazing info! Thanks for sharing, I had no idea about this boot mode. I found these comments in this link: USB download mode is only accessible if first boot method has failed...Once the first boot method fails, USB download mode can be accessed by pressing and holding power button. This link also looks interesting. All of this sounds like only someone with advanced knowledge would be able to figure it out, and with the high risk of truly bricking their device.