Unable to back up NVRAM using FlashToolLinux - Planet Gemini PDA Themes, Apps, and Mods

I'm having some trouble backing up the NVRAM partition on my new gemini. I downloaded the latest SP Tool build and modified the udev rules according to the wiki, however when I hit 'Read Back' in the tool and restart my gemini its boot hangs and I get the following output from SPFT:
Code:
Connecting to BROM...
Scanning USB port...
Search usb, timeout set as 3600000 ms
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.0
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.0
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.1
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.0
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.0/tty/ttyACM0
vid is 0e8d
device vid = 0e8d
pid is 2000
device pid = 2000
com portName is: /dev/ttyACM0
Total wait time = -1554179156.000000
USB port is obtained. path name(/dev/ttyACM0), port name(/dev/ttyACM0)
USB port detected: /dev/ttyACM0
BROM connected
Downloading & Connecting to DA...
connect DA end stage: 2, enable DRAM in 1st DA: 0
Failed to Connect DA: STATUS_PROTOCOL_ERR
Disconnect!
BROM Exception! ( ERROR : STATUS_PROTOCOL_ERR (-1073676283) , MSP ERROE CODE : 0x00.
[HINT]:
)((ConnectDA,../SP-Flash-Tool-src/Conn/Connection.cpp,131))
I haven't found this error code in any of the SPFT docs I've found; can anyone help?
Thanks!

dopaminejunky said:
I'm having some trouble backing up the NVRAM partition on my new gemini. I downloaded the latest SP Tool build and modified the udev rules according to the wiki, however when I hit 'Read Back' in the tool and restart my gemini its boot hangs and I get the following output from SPFT:
Code:
Connecting to BROM...
Scanning USB port...
Search usb, timeout set as 3600000 ms
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.0
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.0
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.1
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.0
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.0/tty/ttyACM0
vid is 0e8d
device vid = 0e8d
pid is 2000
device pid = 2000
com portName is: /dev/ttyACM0
Total wait time = -1554179156.000000
USB port is obtained. path name(/dev/ttyACM0), port name(/dev/ttyACM0)
USB port detected: /dev/ttyACM0
BROM connected
Downloading & Connecting to DA...
connect DA end stage: 2, enable DRAM in 1st DA: 0
Failed to Connect DA: STATUS_PROTOCOL_ERR
Disconnect!
BROM Exception! ( ERROR : STATUS_PROTOCOL_ERR (-1073676283) , MSP ERROE CODE : 0x00.
[HINT]:
)((ConnectDA,../SP-Flash-Tool-src/Conn/Connection.cpp,131))
I haven't found this error code in any of the SPFT docs I've found; can anyone help?
Thanks!
Click to expand...
Click to collapse
Hey, I get similar errors when trying to perform any action related to the preloader in Linux, Just described the issue here: https://www.oesf.org/forum/index.php?showtopic=35999
Also looking for a solution, and will follow this tread.

Related

Archos 101 g9 8gb & Huawei modem E173u-1[No driver found]

Hi, I am having issues with a Huawei modem E173u-1 on my tablet Archos 101 g9 8gb
driver not found.
Can you help me, pls?
USB_ModeSwitch log from Wed Apr 09 17:50:44 PKT 2014
Raw args from udev: 1-1/1-1:1.0
Using top device dir /sys/bus/usb/devices/1-1
----------------
USB values from sysfs:
manufacturer HUAWEI
product HUAWEI Mobile
serial
----------------
bNumConfigurations is 1 - don't check for active configuration
SCSI attributes not needed, moving on
checking config: /data/data/de.draisberghof.pppwidget/app_tmp/12d1.14fe
! matched. Reading config data
devList 1:
config: TargetVendor set to 12d1
config: TargetProduct set to 1506
Driver module is "option", ID path is /sys/bus/usb-serial/drivers/option1
Logger is: /system/bin/log
Command to be run:
usb_modeswitch -I -W -D -s 20 -u -1 -b 1 -g 2 -v 12d1 -p 14fe -f $cB
Verbose debug output of usb_modeswitch and libusb follows
(Note that some USB errors are to be expected in the process)
--------------------------------
Reading long config from command line
* usb_modeswitch: handle USB devices with multiple modes
* Version 1.2.4 (C) Josua Dietze 2012
* Based on libusb0 (0.1.12 and above)
! PLEASE REPORT NEW CONFIGURATIONS !
DefaultVendor= 0x12d1
DefaultProduct= 0x14fe
TargetVendor= 0x12d1
TargetProduct= 0x1506
TargetClass= not set
TargetProductList=""
DetachStorageOnly=0
HuaweiMode=0
SierraMode=0
SonyMode=0
QisdaMode=0
GCTMode=0
KobilMode=0
SequansMode=0
MobileActionMode=0
CiscoMode=0
MessageEndpoint= not set
MessageContent="55534243123456780000000000000011062000000100000000000000000000"
NeedResponse=0
ResponseEndpoint= not set
InquireDevice disabled
Success check enabled, max. wait time 20 seconds
System integration mode enabled
Use given bus/device number: 001/002 ...
Looking for default devices ...
bus/device number matched
searching devices, found USB ID 12d1:14fe
found matching vendor ID
found matching product ID
adding device
Found device in default mode, class or configuration (1)
Skipping the check for the current configuration
Using interface number 0
Using endpoints 0x01 (out) and 0x81 (in)
USB description data (for identification)
-------------------------
Manufacturer: HUAWEI
Product: HUAWEI Mobile
Serial No.: not provided
-------------------------
Looking for active driver ...
OK, driver found; name unknown, limitation of libusb1
OK, driver "unkown" detached
Setting up communication with interface 0
Using endpoint 0x01 for message sending ...
Trying to send message 1 to endpoint 0x01 ...
OK, message successfully sent
Resetting response endpoint 0x81
Could not reset endpoint (probably harmless): -34
Resetting message endpoint 0x01
Could not reset endpoint (probably harmless): -6
Device is gone, skipping any further commands
Bus/dev search active, referring success check to wrapper. Bye.
ok:busdev
--------------------------------
(end of usb_modeswitch output)
Checking success of mode switch for max. 20 seconds ...
Waiting for device file system (1 sec.) ...
Waiting for device file system (2 sec.) ...
Waiting for device file system (3 sec.) ...
Waiting for device file system (4 sec.) ...
Waiting for device file system (5 sec.) ...
Waiting for device file system (6 sec.) ...
Waiting for device file system (7 sec.) ...
Reading attributes ...
Mode switch has completed
Mode switching was successful, found 12d1:1506 (HUAWEI: HUAWEI Mobile)
Device class of first interface is ff
Now checking for bound driver ...
No driver has bound to interface 0 yet
Module loader is /sbin/insmod
Trying to find and install main driver module "option"
Trying to find module "option"
Loading support module /lib/modules/usb_wwan.ko
Error: insmod: cannot insert '/lib/modules/usb_wwan.ko': Invalid module format (-1): Exec
format error
Loading main driver module "option"
Error: insmod: cannot insert '/lib/modules/option.ko': Invalid module format (-1): Exec
format error
Falling back to "usbserial"
Module "usb_serial" not found, can't do more here
Driver binding seems to have failed
All done, exiting
please answer!!!
i'm solved the problem by replacing the nucleus

N9006 MTK 6572 rom need have bricked device

I flashed a wrong rom, and now have phone N9006 mtk 6572 bricked, it gives this error now , dont turn on and connection takes few second,,
it gives this error now
Flash files count is :12
Action : Firmware update.
Selected Samsung Clone: Note 3 Clone(MT6572)
Phone must be off with battery inside.
Please insert USB cable now...
Detected : MTK USB Port (COM21)
Phone detected...Please wait
Sending DA agent, please wait...
Connect error: S_FT_ENABLE_DRAM_FAIL
Error connect phone, aborting.
All done.
I didnt make backup my fault, before that I read the info of phone which was stuck at logo, the info read via volcano box is this, can some one give a backup or any rom to at least revive this phone,
Version: V3.8
SN:xxxxxxxxxxx
Port:COM57
After format or Flash you have to press & hold power button for at least 1.30 mins.
Note for win7 users :
Start your Win 7 64bit with F8 key and choose 'Disable Driver Signature Enforcement'.
After that the spd drivers will have the ability to be loaded.
Available Ports:COM1 COM3 COM8 COM9 COM57
Current Port:COM57
Analysis of USB port,Please insert phone USB cable.
Connecting...
CPU TYPE:MT6572
Hardware version:CA01
Software version:0000
Boot downloading complete!
EMMC_ID:0x45010053454D3034472805A6827A513B
EMMC_PRODUCT_NAME: SAMSUNG :0x53454D303447
EMMC_BOOT1_SIZE: 0x00200000
EMMC_BOOT2_SIZE: 0x00200000
EMMC_PRMB_SIZE: 0x00200000
EMMC_GP1_SIZE: 0x00000000
EMMC_GP2_SIZE: 0x00000000
EMMC_GP3_SIZE: 0x00000000
EMMC_GP4_SIZE: 0x00000000
EMMC_USER_SIZE: 0x0EC000000(3.69 G)
Analysis of system files...
PRELOADER: addr:0x000000 --length:0x880000
MBR: addr:0x880000 --length:0x080000
EBR1: addr:0x900000 --length:0x080000
PRO_INFO: addr:0x980000 --length:0x300000
NVRAM: addr:0xC80000 --length:0x500000
PROTECT_F: addr:0x1180000 --length:0xA00000
PROTECT_S: addr:0x1B80000 --length:0xA00000
SECCFG: addr:0x2580000 --length:0x020000
UBOOT: addr:0x25A0000 --length:0x060000
BOOTIMG: addr:0x2600000 --length:0x600000
RECOVERY: addr:0x2C00000 --length:0x600000
SEC_RO: addr:0x3200000 --length:0x040000
MISC: addr:0x3240000 --length:0x080000
LOGO: addr:0x32C0000 --length:0x300000
EXPDB: addr:0x35C0000 --length:0xA00000
ANDROID: addr:0x3FC0000 --length:0x28A00000
CACHE: addr:0x2C9C0000 --length:0x17800000
USRDATA: addr:0x441C0000 --length:0x52C00000
FAT: addr:0x96DC0000 --length:0x54340000
BMTPOOL: addr:0xFFFF00A8 --length:0x000000
Format addr:0x481C0000 --Format length:0x4EC00000
>>Read phone information success.
these are the info , so please can some one help me urgently thankyou.
bcnboy

Bricked it

Hey guys
wiping a stock P9000 on Ubuntu 18.04 with the SP flash tool using the 20160315 ROM and she's dead. Complete brick, no connection log on usb and no response to buttons. Doesn't power up on plug in. Removing the battery does nothing.
Any ideas or is she dead for good?
Monkey Bum 1 said:
Hey guys
wiping a stock P9000 on Ubuntu 18.04 with the SP flash tool using the 20160315 ROM and she's dead. Complete brick, no connection log on usb and no response to buttons. Doesn't power up on plug in. Removing the battery does nothing.
Any ideas or is she dead for good?
Click to expand...
Click to collapse
Vol+ while flashing, it should detect the phone and start flashing
Ruben Craveiro said:
Vol+ while flashing, it should detect the phone and start flashing
Click to expand...
Click to collapse
Thanks man!
So only kinda helped, she's "responcive"? SP flash picked up on the phone but it blew an error trying to flash, guess there's something wrong with the RAM... this went way more over my head then I was hoping...
Gave me "ERROR : STATUS_EXT_RAM_EXCEPTION (-1073414139) , MSP ERROE CODE : 0x00"
Here's the log on standard ouput:
[email protected]:~/Downloads/SP_Flash_Tool_v5.1744_Linux$ ./flash_tool.sh
QGtkStyle was unable to detect the current GTK+ theme.
QMetaObject::connectSlotsByName: No matching signal for on_pushButton_browser_clicked()
QThread::setPriority: Cannot set priority, thread is not running
"05-09-2018"
QObject::moveToThread: Cannot move objects with a parent
Connecting to BROM...
Scanning USB port...
Search usb, timeout set as 3600000 ms
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.0
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.1
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2
[email protected]/module/cdc_acm
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.1
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.0/tty/ttyACM0
vid is 0e8d
device vid = 0e8d
pid is 0003
device pid = 0003
com portName is: /dev/ttyACM0
Total wait time = -1528518421.000000
USB port is obtained. path name(/dev/ttyACM0), port name(/dev/ttyACM0)
USB port detected: /dev/ttyACM0
BROM connected
Downloading & Connecting to DA...
connect DA end stage: 2, enable DRAM in 1st DA: 0
Failed to Connect DA: STATUS_EXT_RAM_EXCEPTION
Disconnect!
BROM Exception! ( ERROR : STATUS_EXT_RAM_EXCEPTION (-1073414139) , MSP ERROE CODE : 0x00.
[HINT]:
)((ConnectDA,../../../flashtool/Conn/Connection.cpp,131))
Monkey Bum 1 said:
Thanks man!
So only kinda helped, she's "responcive"? SP flash picked up on the phone but it blew an error trying to flash, guess there's something wrong with the RAM... this went way more over my head then I was hoping...
Gave me "ERROR : STATUS_EXT_RAM_EXCEPTION (-1073414139) , MSP ERROE CODE : 0x00"
Here's the log on standard ouput:
[email protected]:~/Downloads/SP_Flash_Tool_v5.1744_Linux$ ./flash_tool.sh
QGtkStyle was unable to detect the current GTK+ theme.
QMetaObject::connectSlotsByName: No matching signal for on_pushButton_browser_clicked()
QThread::setPriority: Cannot set priority, thread is not running
"05-09-2018"
QObject::moveToThread: Cannot move objects with a parent
Connecting to BROM...
Scanning USB port...
Search usb, timeout set as 3600000 ms
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.0
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.1
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2
[email protected]/module/cdc_acm
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.1
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.0/tty/ttyACM0
vid is 0e8d
device vid = 0e8d
pid is 0003
device pid = 0003
com portName is: /dev/ttyACM0
Total wait time = -1528518421.000000
USB port is obtained. path name(/dev/ttyACM0), port name(/dev/ttyACM0)
USB port detected: /dev/ttyACM0
BROM connected
Downloading & Connecting to DA...
connect DA end stage: 2, enable DRAM in 1st DA: 0
Failed to Connect DA: STATUS_EXT_RAM_EXCEPTION
Disconnect!
BROM Exception! ( ERROR : STATUS_EXT_RAM_EXCEPTION (-1073414139) , MSP ERROE CODE : 0x00.
[HINT]:
)((ConnectDA,../../../flashtool/Conn/Connection.cpp,131))
Click to expand...
Click to collapse
Try to flash on a windows pc, it avoids some errors such as this one.. It should detect easily if everything is well installed and should flash with no issues, from my own experience with sp flash tool, i find that i have way less issues when using it on Windows instead of linux..
Ruben Craveiro said:
Try to flash on a windows pc, it avoids some errors such as this one.. It should detect easily if everything is well installed and should flash with no issues, from my own experience with sp flash tool, i find that i have way less issues when using it on Windows instead of linux..
Click to expand...
Click to collapse
Had nothing to do with the Linux version, the scatterfile was wrong for me, put on the 20170904 official build from the elephone.hk forums, that scatter loaded properly and then the phone started responding to the writes. Could be because I'm Canadian, builds for me may turn out to be different than what's typical for the EU?
Try flashing 810's stock rom for me at this point you discribe had ever be my guardian for farer rom decision
---------- Post added at 11:40 PM ---------- Previous post was at 11:40 PM ----------

Vivo 1901 SP Flash Tools ERROR : STATUS_SHUTDOWN_CMD_EXCEPTION (-1073414142)

Hello guys,
I am trying to bring back to life a dead Vivo 1901 (V15) phone using SP Flash Tools v5.2036. The Firmware I am using comes in a file named, "Vivo_Y15_PD1901BF_MT6765_EX_A_1.12.4_11062019_(by_vivofirmware.com)",
which also provides MT6765 scatter file.
The auth file, scatter file and DA file that I am using for flashing is attached with this post. Upon selecting these files and flashing ( first tried with download only, then using format all + download, but results are same), I the following messages appear in the output of the tool.
Code:
$ sudo sh flash_tool.sh
[sudo] password for sarkar4540:
sysname:Linux
nodename:sarkar4540-X556UQK
release:5.4.0-49-generic
version:#53~18.04.1-Ubuntu SMP Mon Sep 21 14:12:39 UTC 2020
machine:x86_64
domainame:(none)
cur_kernel_version = 5.4.0
QObject::moveToThread: Cannot move objects with a parent
support_dl_cert_to_storage: 0
Application asked to unregister timer 0xc00001b which is not registered in this thread. Fix application.
Connecting to BROM...
Scanning USB port...
Search usb, timeout set as 3600000 ms
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.0
add@/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.1
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2
[email protected]/module/cdc_acm
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.1
[email protected]/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.0/tty/ttyACM0
vid is 0e8d
device vid = 0e8d
pid is 0003
device pid = 0003
com portName is: /dev/ttyACM0
Total wait time = -1601887002.000000
USB port is obtained. path name(/dev/ttyACM0), port name(/dev/ttyACM0)
USB port detected: /dev/ttyACM0
BROM connected
Downloading & Connecting to DA...
connect DA end stage: 2, enable DRAM in 1st DA: 0
Failed to Connect DA: STATUS_SHUTDOWN_CMD_EXCEPTION(-1073414142)
Disconnect!
BROM Exception! ( ERROR : STATUS_SHUTDOWN_CMD_EXCEPTION (-1073414142) , MSP ERROE CODE : 0x00.
[HINT]:
)((ConnectDA,../../../flashtool/Conn/Connection.cpp,149))
Following are the outputs of various commands in the system I am using.
Code:
$ uname -a
Linux sarkar4540-X556UQK 5.4.0-49-generic #53~18.04.1-Ubuntu SMP Mon Sep 21 14:12:39 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
Code:
$ dmesg
.
.
.
[ 324.046688] usb 1-2: new high-speed USB device number 5 using xhci_hcd
[ 324.195603] usb 1-2: New USB device found, idVendor=0e8d, idProduct=0003, bcdDevice= 1.00
[ 324.195605] usb 1-2: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 324.248243] cdc_acm 1-2:1.0: ttyACM0: USB ACM device
[ 324.249509] usbcore: registered new interface driver cdc_acm
[ 324.249510] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
[ 324.275093] usbcore: registered new interface driver usbserial_generic
[ 324.275106] usbserial: USB Serial support registered for generic
[ 324.300238] usbcore: registered new interface driver option
[ 324.300261] usbserial: USB Serial support registered for GSM modem (1-port)
I request you guys to please show me where to head. I shall always be grateful to you if you can help me out of this misery.
Regards,
A. Sarkar

Question Bootloop after C10 update

Hey,
I've recently updated my Nord 2 from A21 to C10. Phone was unlocked and rooted, so after having reflashed the original boot.img, I forced the installation of the official OTA through TWRP. I had to set ro.commonsoft.ota=OP515BL1 to make it work. After the installation, TWRP failed to mount /system, but that didn't surprised me. I checked that the boot partition has been well flashed.
Now every time I try to power on the phone, it directly tries to run into recovery mode. However it fails and start again and again...
Maybe the system tries to install the OTA using the original recovery, which of course fails, and because of an unknown reason, it doesn't reboot to system.
Because of the last update, fastboot is not accessible anymore using vol -, and BROM mode is not accessible using vol + / vol -.
I tried to crash the preloader using mtkclient but it didn't work.
I tried to use META mode to switch to fastboot, but preloader only answers "READY" (instead of "READYTOOBTSAF"), and nothing changes.
I try to reverse engineer preloader and lk but it's something new for me. META mode code is still present in the preloader, so I don't understand what's wrong with it. Maybe disabled by default on USB...
Does anyone has a solution to boot into BROM mode or make META mode work ?
Or maybe I could find DA authentication files somewhere ?
@Petitoto can you share a bit about how you got the meta command running?
I'm in a similar situation with a Nord 2T. While mtkclient can get some info out of the preloader, meta never seems to connect.
Code:
mtk gettargetconfig
Preloader - Status: Waiting for PreLoader VCOM, please connect mobile
Port - Device detected :)
Preloader - CPU: MT6893(Dimensity 1200)
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212000
Preloader - Var1: 0xa
Preloader - Disabling Watchdog...
Preloader - HW code: 0x950
Preloader - Target config: 0x5
Preloader - SBC enabled: True
Preloader - SLA enabled: False
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: False
Preloader - Mem write auth: False
Preloader - Cmd 0xC8 blocked: False
Preloader - Get Target info
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xca00
Preloader - SW Ver: 0x0
Main - Getting target info...
Preloader - Target config: 0x5
Preloader - SBC enabled: True
Preloader - SLA enabled: False
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: False
Preloader - Mem write auth: False
Preloader - Cmd 0xC8 blocked: False
Code:
mtk meta FASTBOOT
META - Status: Waiting for PreLoader VCOM, please connect mobile
META - Hint:
Power off the phone before connecting.
For preloader mode, don't press any hw button and connect usb.
...........
META - Hint:
Power off the phone before connecting.
For preloader mode, don't press any hw button and connect usb.
...........
META - Hint:
Power off the phone before connecting.
For preloader mode, don't press any hw button and connect usb.
Hey @Beanow,
I have the same gettargetconfig output, which indicates that the phone is not in BROM mode but stuck in preloader. Trying to interact with the preloader always lead to error because of the DAA (DAA_SIG_VERIFY_FAILED for example).
I have the same issue with mtkclient and meta mode. You can use the following modified mtk-bootseq.py:
py mtk-bootseq.py FASTBOOT COMXX (or python3 mtk-bootseq.py FASTBOOT /dev/ttyACMXX on linux).
Python:
import sys
import time
from serial import Serial
BOOTSEQ = bytes(sys.argv[1], "ascii")
DEVICE = sys.argv[2]
CONFIRM = b"READY" + BOOTSEQ[::-1]
while True:
try:
s = Serial(DEVICE, 115200, timeout=0.1)
print(".\n[+] Device detected")
break
except OSError as e:
sys.stdout.write("."); sys.stdout.flush()
time.sleep(0.1)
print("<-", s.read(256))
def send(bytes):
s.write(bytes)
print("->", str(bytes))
resp = s.read(256)
print("<-", str(resp))
return resp
resp = b''
while resp != CONFIRM:
resp = send(BOOTSEQ)
print("[+] Boot sequence sent")
On another device, it works and I get:
Code:
...............................
[+] Device detected
<- b'READYREADYREADYREADYREADY'
-> b'FASTBOOT'
<- b'READYTOOBTSAF'
[+] Boot sequence sent
However, on my Nord 2, I get:
Code:
...........................................
[+] Device detected
<- b'READYREADYREADYREADYREADY'
-> b'FASTBOOT'
<- b'READY'
-> b'FASTBOOT'
<- b''
-> b'FASTBOOT'
<- b''
Then the next s.write() is hanging.
I get the same result for any other boot mode. However, the code is still present in the preloader.
I unfolded my phone to try to find a test point. I tried all golden points but I only found:
- a point which loads preloader (and not BROM...) in the same way vol + / - do (in red in the picture)
- a point which boots the phone but without Android and OnePlus pictures (what's that ??) (in green)
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I don't know how test point is handled: if that's the role of preloader, it may have been disabled by the update (as the BROM and fastboot). We may need to find the DAT0 point of the eMMC to short it and prevent the BROM to find the preloader, making it to go in EDL mode. However, I think that this point isn't exposed, and I won't disassemble my phone further without beeing sure of success...
Thank you so much for the work so far!
Unfortunately I get no response at all on the Nord 2T.
Code:
.......................................
[+] Device detected
<- b''
-> b'FASTBOOT'
<- b''
-> b'FASTBOOT'
Traceback (most recent call last):
File "/media/droid-work/mtkclient/mtk-bootseq.py", line 31, in <module>
resp = send(BOOTSEQ)
File "/media/droid-work/mtkclient/mtk-bootseq.py", line 24, in send
resp = s.read(256)
File "/usr/lib/python3.10/site-packages/pyserial-3.5-py3.10.egg/serial/serialposix.py", line 595, in read
raise SerialException(
serial.serialutil.SerialException: device reports readiness to read but returned no data (device disconnected or multiple access on port?)
How did you connect to the device that you're getting these responses?
In my case, I need to use vol+, vol- and power, like mtkclient, or the ttyACM0 won't exist.
(I've got udevadm monitor up, watching for the usb/tty to be added)
Indeed, you need to run into preloader using vol +, vol -
Maybe a driver / python module issue. I've got similar issues on my linux. Try on windows or try to reinstall drivers.
It should work at least for the first answer. Else it means that your preloader doesn't send any data, which is not the case as mtkclient works.
I also tried a different baud, because a pl_lk log from oplusreserve2 partition suggested it may be used. No luck though. Note, this was a very old log I saved early on. Definitely not reflective of latest Nord 2T update.
Code:
[PLFM] boot_tag size = 0x0
BOOT_TAG_VERSION: 0
BOOT_REASON: 0
BOOT_MODE: 0
META_COM TYPE: 0
META_COM ID: 0
META_COM PORT: 285220864
META LOG DISABLE: 0
FAST META GPIO: 5906
LOG_COM PORT: 285220864
LOG_COM BAUD: 921600
LOG_COM EN: 1
LOG_COM SWITCH: 0
MEM_NUM: 2
MEM_SIZE: 0xAE7B
MEM_SIZE: 0xAE8D
I guess I'll try windows then
Code:
python mtk-bootseq.py FASTBOOT COM4
...................................................................................................................................
[+] Device detected
<- b''
-> b'FASTBOOT'
<- b''
-> b'FASTBOOT'
<- b''
-> b'FASTBOOT'
<- b''
Windows looks to behave similar. Though windows wouldn't take the MTK VCOM driver, so this is win10 default serial, in a VM over USB passthrough.
So, same result not in a VM. Though specifically with powershell I got the same output as you did.
Code:
...........................................
[+] Device detected
<- b'READYREADYREADYREADYREADY'
-> b'FASTBOOT'
<- b'READY'
-> b'FASTBOOT'
<- b''
-> b'FASTBOOT'
<- b''
This is really a helpfull post for us. I've already a oneplus nord 2 phn,from this post i know the more information about this phn.
Thank you so much.
@Beanow So same results...
It's weird that it doesn't work on Linux. Maybe an issue related to pyserial or connection settings.
What's preventing the device to be detected by mtkclient is line 54 in mtkclient/Library/meta.py: and cdc.pid == 0x2000 should be removed. So you can try to switch to fastboot using mtkclient on Linux, but with my Nord2 I get the same results as mtk-bootseq.py on Windows
Petitoto said:
@Beanow So same results...
It's weird that it doesn't work on Linux. Maybe an issue related to pyserial or connection settings.
What's preventing the device to be detected by mtkclient is line 54 in mtkclient/Library/meta.py: and cdc.pid == 0x2000 should be removed. So you can try to switch to fastboot using mtkclient on Linux, but with my Nord2 I get the same results as mtk-bootseq.py on Windows
Click to expand...
Click to collapse
Thanks for this. No need to switch to windows anymore, to use mtk client.
Petitoto said:
It's weird that it doesn't work on Linux. Maybe an issue related to pyserial or connection settings.
Click to expand...
Click to collapse
Is it 'not working' though? It's also weird to me that I had the same output as Linux using Windows' cmd, while there was READY spam in powershell. Same drivers, same python, same libraries, but different output?
I suspect that it might be a timing issue. Maybe the serial console doesn't care about or wait for input at all. And just spams READY a few times. It would be a matter of how fast the connection is established.
Perhaps as well there's a different subsystem sending commands to the 'meta' environment and the READY spam means it's processing those commands rather than whatever we're sending.
All theories, but I would find it really hard to believe there's a problem with Linux drivers / libraries for something as basic as a UART/serial console over USB.
Petitoto said:
@Beanow So same results...
It's weird that it doesn't work on Linux. Maybe an issue related to pyserial or connection settings.
What's preventing the device to be detected by mtkclient is line 54 in mtkclient/Library/meta.py: and cdc.pid == 0x2000 should be removed. So you can try to switch to fastboot using mtkclient on Linux, but with my Nord2 I get the same results as mtk-bootseq.py on Windows
Click to expand...
Click to collapse
I also suspected this PID check and tried to log the else cases, but never reaches those for me.
So removing the check didn't help for mtkclients' meta commands.
Is it 'not working' though? It's also weird to me that I had the same output as Linux using Windows' cmd, while there was READY spam in powershell. Same drivers, same python, same libraries, but different output?
Click to expand...
Click to collapse
Differents results when using cmd and powershell? There is really no reason for that. Unless it's not the same Python environment, with different pyserial for eg. I have issues to run mtk-bootseq on Linux, but always the same output on Windows' cmd.
I suspect that it might be a timing issue. Maybe the serial console doesn't care about or wait for input at all. And just spams READY a few times. It would be a matter of how fast the connection is established.
Click to expand...
Click to collapse
Maybe. On linux, I can get different results depending on baud rate, timeout (and luck?). If there is an issue related to the connection, it might explain why the preloader doesn't answer as expected. But as other commands (like mtk gettargetconfig, but also manually handshaking connections and gathering informations in pyserial) work well, I tend to think it's just disabled.
Perhaps as well there's a different subsystem sending commands to the 'meta' environment and the READY spam means it's processing those commands rather than whatever we're sending.
Click to expand...
Click to collapse
I don't really know how it works. The code is still present in the preloader. However this functionnality is not always enabled. Maybe reversing the preloader more or analysing the log you provided on Github might help to determine whether or not it is enabled. Moreover, even if we manage to switch to fastboot, if the bootloader has been fully disabled, we may face the issue of the preloader trying to run into a non existant fastboot. Maybe the FACTFACT mode may help to reset the device, but I don't really know a lot about this mode.
So removing the check didn't help for mtkclients' meta commands.
Click to expand...
Click to collapse
Once you removed this check, if you print the data sent by the preloader, you'll get the multiple "READY" like mtk-bootseq on Windows. Moreover, I can switch to fastboot using this command on another MTK device.
Dear Sir,
Do you have any method to recover my phone as the figure show?
Thank You

Categories

Resources