Question Surface Duo2 can't get into reC to save bricks - Microsoft Surface Duo 2

微软表面DuO2 Fastboot权限有限,无法写入系统分区,目前的计划是卸下机器,写入硬盘数据,能否提供这台机器的9008启动相关文件
Mod translation via GT: Microsoft Surface DuO2 Fastboot has limited permissions and cannot write to the system partition. The current plan is to unload the machine and write the hard disk data. Can you provide the 9008 boot related files for this machine?

I'm assuming you want to modify the system that's currently on it, or get the system images. You can do two things:
Use a google account (if possible) to backup your data. It does a good job of retaining all your apps and messages. Then mess around with the system data. You can always flash an OTA zip via recovery to restore the phone from the Microsoft support page.
Use the OTA zip found on the Microsoft Support page to get images with LineageOS's payload extractor. Follow the directions until the extract.py command. Then install Magisk and follow the patch img method on the app. Finally, boot into fastboot mode and boot using the magisk patched boot image. With thtat, you have both the OTA and the system image files to mess around with, while having rooted your phone.
NEITHER of these options back up data on the internal storage. You will have to do that manually.

JengaMasterG said:
我假设您要修改当前在其上的系统,或获取系统映像。您可以执行两项操作:
使用Google帐户(如果可能)来备份您的数据。它可以很好地保留所有应用程序和消息。然后弄乱系统数据。您可以随时通过恢复来刷新OTA zip,以从Microsoft支持页面恢复手机。
使用 Microsoft 支持页面上的 OTA zip 获取带有 LineageOS 有效负载提取器的图像。按照说明操作,直到 extract.py 命令。然后安装Magisk并按照应用程序上的补丁img方法进行操作。最后,启动到
Click to expand...
Click to collapse
I have successfully recovered the image by booting from the REc partition in the BOOT file

JengaMasterG said:
I'm assuming you want to modify the system that's currently on it, or get the system images. You can do two things:
Use a google account (if possible) to backup your data. It does a good job of retaining all your apps and messages. Then mess around with the system data. You can always flash an OTA zip via recovery to restore the phone from the Microsoft support page.
Use the OTA zip found on the Microsoft Support page to get images with LineageOS's payload extractor. Follow the directions until the extract.py command. Then install Magisk and follow the patch img method on the app. Finally, boot into fastboot mode and boot using the magisk patched boot image. With thtat, you have both the OTA and the system image files to mess around with, while having rooted your phone.
NEITHER of these options back up data on the internal storage. You will have to do that manually.
Click to expand...
Click to collapse
you can root the duo 2?

carortruck80 said:
you can root the duo 2?
Click to expand...
Click to collapse
I have received that this model has unlocked the BL lock and I have done ROOT on this model

carortruck80 said:
you can root the duo 2?
Click to expand...
Click to collapse
If you follow a guide on patching the boot.img through the Magisk App it is possible to root.

aiqi said:
微软表面DuO2 Fastboot权限有限,无法写入系统分区,目前的计划是卸下机器,写入硬盘数据,能否提供这台机器的9008启动相关文件
Mod translation via GT: Microsoft Surface DuO2 Fastboot has limited permissions and cannot write to the system partition. The current plan is to unload the machine and write the hard disk data. Can you provide the 9008 boot related files for this machine?
Click to expand...
Click to collapse
When the surface duo1 is turned off, press and hold 3 buttons for 30 seconds (volume buttons + and - and power button), and the 9008 port will appear.
surface duo1 在关机的状态下,长按3个按键30秒(音量键+和-和电源键),会出现9008端口。

There is port 9008 but no associated boot file

Related

[GUIDE] Modify your System partition WITHOUT Root

Intro
This is a guide for people who want to make some modifications to config files, or other files, on System partition but do not want to root their phone or install custom recovery in order to keep OTAs and some apps, which don't play nicely with rooted phones, working. Examples of those config mods could be changing DPI or changing volume levels etc, which you would only do once and forget about it.
While root allows you to do those kinds of changes from within android, this methods would require a PC.
If you are familiar with temporary booting into a custom recovery, skip to step 5.
The usual i am not responsible for any of your actions / bricked phones disclaimer applies.
Prerequisites
- A working adb / fastboot environment. Please use Android SDK, if you installed your adb and fastboot using other tools, things might not work, so please just install SDK, install Google USB Driver from SDK manager, install Platform-Tools from SDK manager (should be installed by default) and then add your sdk platform-tools path to your PATH environment variable to have it available in cmd in every path.
- Unlocked bootloader
- TWRP image for you phone (.img) https://twrp.me/devices/huaweinexus6p.html
Follow the [GUIDE] Unlock/Root/Flash for Nexus 6P for that.
Instructions
Here is an example of modifying DPI. I prefer build.prop method of modifying DPI because using the adb wm density command usually caused some issues for me, but modifying via build.prop didn't.
1 - With you phone ON, connect it to the PC and make sure adb is working by running
Code:
adb devices
and making sure that device is listed
2 - Reboot into bootloader. and make sure fastboot is good to go too. Run commands one at a time:
Code:
adb reboot bootloader
fastboot devices
3 - Place your TWRP image file in some easily accessible folder, for the sake of this example i will use C:\Mods.
4 - Temporary boot into TWRP (we are not flashing it here at all).
Code:
fastboot boot c:\Mods\twrp-2.8.7.0-angler.img
Here is where things may not work. If you don't see your phone boot into TWRP then either your adb / fastboot environment not setup correctly (installed via a tool instead of SDK) or your img file is corrupt.
One thing that works for me when TWRP refuses to boot is to restart cmd and issue the command again this closes and reopens adb/fastboot daemon.
5 - Once TWRP is up on your phone it may display a warning saying "TWRP has detected an unmounted system partition". Swipe to allow modifications at the bottom. This screen may not come up at all.
6 - Go to Mount >>> Tick System >>> Make sure "Only Mount System Read Only" is unticked >>> Press Back button
7 - Back on your PC check if your device is listed
Code:
adb devices
8 - Pull the file you need to modify from system partition to your PC. Please note the direction of the slashes:
Code:
adb pull /system/build.prop c:/Mods
9 - Now you should see build.prop in your c:\Mods folder. Use Notepad++ or something like that to edit the file. Find the line with lcd_density= and change it's value to whatever you need and save the file.
10 - Push the file back to your phone:
Code:
adb push c:/Mods/build.prop /system
11 - Reboot
Code:
adb reboot
12 - Profit.
Hope this will help anyone who is looking to do some mods without installing custom recovery and rooting your phone.
Cheers.
Would this work for adding the tethering bypass line in the build prop?
Yes it will. What's the line again I was looking for it the other day and couldn't find it...
Works are per OP's original post, tested and boosted the headphone volume without a problem.
Headphone path is /system/etc/mixer_paths.xml
So as per OP's example to pull: adb pull /system/etc/mixer_paths.xml c:/Mods
push: adb push c:/Mods/mixer_paths.xml /system/etc
I'm using the OP's "Mods" folder to demonstrate the file path but this may vary on your PC.
Can I use this to push SuperSU / etc to my device without having to permanently flash TWRP?
skrowl said:
Can I use this to push SuperSU / etc to my device without having to permanently flash TWRP?
Click to expand...
Click to collapse
You can certainly push the files to system partition and they will retain there after reboot. So if you know which files have to be pushed for SuperSU then give that a go. It shouldn't break anything.
I haven't tried pushing SuperSU files to system partition before so I can't guarantee that OTAs will work after this. The only way to find out is to try it i guess...
Can you run nandroids?
not sure if it's allowed or not.. but with this can i push hosts file onto the phone as well for ad-blocking...?????
I will say thanks now and try it later. These are the type of tweaks I would like to make to my phone. Do you know if changing the DPI cause any stock applications to show up broken like they do on the Samsung phones?
NCguy said:
Can you run nandroids?
Click to expand...
Click to collapse
Im not sure what you mean?
rohit25 said:
not sure if it's allowed or not.. but with this can i push hosts file onto the phone as well for ad-blocking...?????
Click to expand...
Click to collapse
If it's on the system partition then I yes you can.
locolbd said:
I will say thanks now and try it later. These are the type of tweaks I would like to make to my phone. Do you know if changing the DPI cause any stock applications to show up broken like they do on the Samsung phones?
Click to expand...
Click to collapse
I've never had a problem with changing DPI using this method on a nexus phone if that helps.
denk said:
Im not sure what you mean?
Click to expand...
Click to collapse
Can you run nandroids backups from TWRP by just booting into it?
okay so after i did this i get the following during boot up
"Your device is corrupt. It can't be trusted and may not work properly". Does this mean i will not get Securty Updates any more? I saw i had an update before i performed this however, now i do not see that update notifications any more.
locolbd said:
okay so after i did this i get the following during boot up
"Your device is corrupt. It can't be trusted and may not work properly". Does this mean i will not get Securty Updates any more? I saw i had an update before i performed this however, now i do not see that update notifications any more.
Click to expand...
Click to collapse
I got this too when I flashed MOAB via adb sideload. I'm just wondering if the same warning appears with the adb push method. Also, the file's permissions don't need to be set after adb push?
My main concern is if Android Pay still works with the red triangle warning. Anyone?
FYI Flashing back to stock is no issue for me.
NCguy said:
Can you run nandroids backups from TWRP by just booting into it?
Click to expand...
Click to collapse
I think if you get the latest TWRP which supports decryption of data partition (where all your stuff is) you should be able to back it up.
Edit: backup works on nexus 5 with temporary TWRP boot. Sorry I'm still waiting for my 6p to arrive.
locolbd said:
okay so after i did this i get the following during boot up
"Your device is corrupt. It can't be trusted and may not work properly". Does this mean i will not get Securty Updates any more? I saw i had an update before i performed this however, now i do not see that update notifications any more.
Click to expand...
Click to collapse
Thanks for trying it out! Sometimes OTA notifications take a little while to come up after reboot. But based on the warning Im afraid that they might be disabled now. It looks like it runs some sort of a check on the system partition to verify its legitimacy. So modifying files would be fine on it using this method but looks like adding them won't work.
TWRP just released their recovery with decryption support so you can just follow the standard procedure or just temporary booting into TWRP and rooting from there which works as well.
denk said:
I think if you get the latest TWRP which supports decryption of data partition (where all your stuff is) you should be able to back it up.
Edit: backup works on nexus 5 with temporary TWRP boot. Sorry I'm still waiting for my 6p to arrive.
Click to expand...
Click to collapse
On your Nexus5 I assume you are also unrooted? And have you tried a Nandroid restore, booted TWRP, no root?
NCguy said:
On your Nexus5 I assume you are also unrooted? And have you tried a Nandroid restore, booted TWRP, no root?
Click to expand...
Click to collapse
Just ran a restore to test it for you. Works fine as well.
My N5 is unrooted.
.
denk said:
Just ran a restore to test it for you. Works fine as well.
My N5 is unrooted.
.
Click to expand...
Click to collapse
Thanks a lot for that. I didn't unlock the bootloader. Ugh. Time to start over. To me nandroids alone make it worth the effort.

[Hisense A5] Info-Thread

Maybe helpful to have some basic information about this great device in one posting:
Device Specs
https://www.mobosdata.com/phone/hisense-a5/
How to reflash Firmware directly from microSD (Tfmode)
Thanks to Anghirrim !!!
https://forum.xda-developers.com/showpost.php?p=82575517&postcount=21
Edl mode (in General)
Thanks to Anghirrim !!!
https://forum.xda-developers.com/showpost.php?p=82654769&postcount=79
Rooting for Firmware Version 6.09.06.00
Thanks to joygram !!!
https://forum.xda-developers.com/android/general/hisense-a5-root-gapps-customizer-t4097951
QFIL Firmware 6.03.02 for unbricking in Edl-Mode
Thanks to gowin132 !!!
https://drive.google.com/file/d/1LqcR6NVlSqL6gT6y1y1x9r58_LAKBBjd/view?usp=sharing
QFIL Firmware 6.09.06 for flashing in Edl-Mode
Thanks to gowin132 !!!
https://forum.xda-developers.com/showpost.php?p=82727173&postcount=8
Rom Download Links for flashing in TF-Mode (microSD)
6.09.06.00 Thanks to giuseppemag !!!
https://forum.xda-developers.com/showpost.php?p=82583733&postcount=28
https://drive.google.com/open?id=1JBzsFrtGtIXLYTPTMA2cc9spp_dxF_WX
Debloating help and blocking IP (Updated)
https://forum.xda-developers.com/showpost.php?p=82795057&postcount=4
Do you have an unlocked Bootloader? ( Hisense always locked!)
https://forum.xda-developers.com/showpost.php?p=82634399&postcount=117
How to enter hardware Edl mode
Thanks to joygram !!!
https://forum.xda-developers.com/android/general/hisense-a5-how-to-enter-hardware-edl-t4103929
There are a lot reviews about the device and a thread at MobileRead.
Unbricking in Detail
Unbricking the Device in Detail
Before you step forward I would recommend taking out the Sim-Card
stay offline until the device is debloated
Some general information:
Bricked, but you have an unlocked Boolader
just flash Image in fastboot or if available in twrp
*** All bootloaders of Hisense devices are locked and there's no way to unlock !!! ***
Bricked & you haven't got an unlocked Boolader
TF-Mode (microSD)
https://forum.xda-developers.com/showpost.php?p=82575517&postcount=21
download latest TF-Firmware i.e.
https://forum.xda-developers.com/showpost.php?p=82583733&postcount=28
how to enter TF Mode?
https://forum.xda-developers.com/showpost.php?p=82650955&postcount=72
shutdown the device
press both volume buttons and then power button together
release power button and wait 10s until the update screen comes up
alternative1
shutdown device
holding volume +- and power buttons together
alternative2
shutdown while holding volume +-
press+- buttons and then power button
release power button but holding +-
wait 10sec
release +- buttons
Hisense powered by Android
wait 10sec
press power button just short
If this above won't work, then the bootloader is damaged you will need to flash the Firmware in Edl-Mode with Qfil. This always works if not hardbricked!!! So relax
General Info about EDL Mode (You need to get a Qfil-Firmaware-Image)
https://forum.xda-developers.com/showpost.php?p=82654769&postcount=79
https://forum.hovatek.com/thread-21791.html
Files needed:
Edl-Mode Firmware files 6.03.02 for unbricking
https://drive.google.com/file/d/1LqcR6NVlSqL6gT6y1y1x9r58_LAKBBjd/view?usp=sharing
prog_emmc_firehose_8937_ddr_000bf0e1.mbn from joygram Root-package
attachement inside "RootKit R03"
https://forum.xda-developers.com/android/general/hisense-a5-root-gapps-customizer-t4097951
Qualcomm drivers i.e. 64bit for Windows 10
i.e.
https://www.getdroidtips.com/download-qualcomm-qdloader-hs-usb-driver/
actual Qpst software incl. Qfil
https://www.qpstflash.com/
Before installing drivers please read this
Obey these steps before installing unsigned drivers and prevent Sahara errors
https://forum.xda-developers.com/showpost.php?p=77229641
Installing Instructions details for drivers
https://forum.hovatek.com/thread-16965.html
Installing Qpst instructions details
https://forum.hovatek.com/thread-31475.html
Start Qfil from the startmenu (inside "Qpst")
check the setup Qfil before entering edl-mode
steps 1-4. from instructions here
https://forum.hovatek.com/thread-31475.html
-> then go back and tick "flat build"
-> select Programmer and browse
-> select the "prog_emmc_firehose_8937_ddr_000bf0e1.mbn"
Now it's time to enter the edl-mode with your smartphone
How to enter edl mode
a)Soft edl mode per adb
adb reboot edl
flush image with QFIL
b) )Soft edl mode per fastboot
fastboot oem edl
fastboot reboot-edl
fastboot reboot edl
(may not work for Hisense)
c)hard edl mode
https://www.oxygen-forensic.com/upl...s_based_on_Qualcomm_chipsets_via_EDL_mode.pdf
using a hardware cable (working 100% - preferred method!!!)
https://www.magnetforensics.com/blog/qualcomm-phone-edl-mode/
(working with Hisense A5)
by shortening the pins [not recommended!!!! Don't do this!!!!]
*** you need to open the device ***
https://forum.xda-developers.com/android/general/hisense-a5-how-to-enter-hardware-edl-t4103929
If you entered the edl-mode your Qfil screen should show
"Qualcomm HS-USB QDLoader 9008" (Com-Port)
like step 5 from here
https://forum.hovatek.com/thread-31475.html
Then Click Tools -> Partition Manager
step 9
https://forum.hovatek.com/thread-31475.html
confirm ok
step 10
https://forum.hovatek.com/thread-31475.html
select boot partition and right mouse click
manage Partition Data
we won't backup, we want to restore the boot-image
press Load Image and browse the boot.img from the edl-Firmware above, flash it and wait until it successful is flashed
if there's a Sahara error check again here
https://forum.xda-developers.com/showpost.php?p=77229641
Then flash recover.img and vbmeta.img
After that reboot your phone and it must boot the system.
Then Update in TF-mode to Firmware 6.09.06 (see above)
You successfully restored your bricked phone and updated the Firmware!
Thanks to joygram, Anghirrim, gowin132, giuseppemag
and all other sources of knowledge mentioned above!
Rooting your Smartphone Firmware 6.09.06
The Sim-Card still shouldn't be attached to the device
Files needed:
latest ADB-Drivers
https://forum.xda-developers.com/showthread.php?t=2588979
joygram Root-package for 6.09.06
attached files "RootKit R03"
https://forum.xda-developers.com/android/general/hisense-a5-root-gapps-customizer-t4097951
Magisk Manager latest apk
https://github.com/topjohnwu/Magisk/releases
open developer mode in system settings
search settings `kernel version' and go
tab 7 or more : developer options enabled
* enable usb debugging
enter developer mode in system settings -> "other settings"
change USB computer connection to Transfer files(MTP)
Install the adb-drivers
Start Qfil-Software in Windows
Enter Edl-Mode while connectd phone to USB
->adb devices
use adb command
-> adb reboot edl
In Qfil
* flush ROOT files with QFIL : QFIL_6.09.06
-> Select Build Type : Flat Build
-Y Select Programmer : select
prog_emmc_firehose_8937_ddr_000bf0e1.mbn
->LoadXML:
rawprogram_000bf0e1_joygram
-> Download
when complete please reboot the device.
After install in system
* magisk manager
MagiskManager-v7.5.1.apk
Finally you have root!
Thanks to joygram!!!
https://forum.xda-developers.com/android/general/hisense-a5-root-gapps-customizer-t4097951
Debloating the Device privacy friendly
You restored your Firmware and have the latest Chinese Firmware 6.09.06 without Google Playstore installed
The Sim-Card isn't attached to the device
You're offline, no WiFi
You're rooted with Magisk Manager(but the bootloader is locked)
General Information
There are many ways to debloat the device.
This is only a description how I did this.
It doesn't mean that it's working for you. Please be careful. I am not responsible if oyu brick your phone. If this happened you should easily unbrick it.
So read it carefully and always check if you need the programs or not.
I debloated all system programs which I don't need and install alternatives from F-Droid Store which just need user rights
i.e.
AfWall+ as a Firewall (Root)
Calculator (SimpleMobileTools)
Calendar (SimpleMobileTools)
Clock (SimpleMobileTools)
Contacts (SimpleMobileTools)
Conversations
Dialer (SimpleMobileTools)
Editor
Essential Launcher
F-Droid
FairEmail
Foss Weather
Gallery (SimpleMobileTools)
Net Monitor for checking Net-Traffic
Open Camera
OSMAnd+
PrivacyBrowser
QuickDic
beside that:
TitaniumBackup Donate (Root) Backup & Freezing System-Apps
Total Commander (Root) file manager
VocalizerEx2 TTS
https://forum.xda-developers.com/showthread.php?t=2566795
I debloated everything that the main features of a smartphone still works:
Phone using a Sim-Card (incl. LTE, depends on your region)
TextMessages (SMS)
Internet data
WiFi (2.4 MHz, no 5Ghz)
Bluetooth
GPS
Doing backups from all system files you want to debloat with Total Commander
create directories with permissions 755
i.e.
system/_keepsave/
system/_keepsave/system
system/_keepsave/system/app
system/_keepsave/system/preload
system/_keepsave/system/priv-app
system/_keepsave/system/vendor
system/_keepsave/system/vendor/app
system/_keepsave/system/vendor/overlay
Then backup all directories to the keepsave dirs
system/app
system/preload
system/priv-app
system/vendor
system/vendor/app
system/vendor/overlay
Then setup the system settings
I disabled everything I don't need (location only Gps, automatic System Updates/Accounts, App shadow,...)
setting up Afwall to your needs
disabling captive portal login with some alternative url
disabling ipv6 in Afwall if you don't need it
Then you can try freezing system apps with Titanium Backup
Or just delete all the bloat you don't need.
I deleted in TotalCommander
system/preload
system/vendor/app
system/vendor/overlay
in system/app are only:
Code:
/system/app/CertInstaller don't remove
/system/app/CtRoamingSettings don't remove / freeze & use only if roaming
/system/app/Eink_Settings don't remove / Settings Clearview per App!!!
/system/app/ExtShared don't remove
/system/app/HardwareDetection don't remove
/system/app/NetworkSelect don't remove
/system/app/QtiTelephonyService don't remove
/system/app/SimSettings don't remove
/system/app/Vision_AutoRunManager don't remove
/system/app/Vision_Bluetooth don't remove
/system/app/Vision_CalendarProvider don't remove
/system/app/Vision_WifiDetector don't remove
/system/app/WeatherWidget don't remove / just freeze / navigation bar flickering! com.hmct.clock.systemwidget
/system/app/WebViewGoogle don't remove
in system/priv-app are only:
Code:
/system/priv-app/CarrierConfig don't remove
/system/priv-app/com.qualcomm.location don't remove / GPS
/system/priv-app/DefaultContainerService don't remove
/system/priv-app/ExtServices don't remove
/system/priv-app/ExternalStorageProvider don't remove
/system/priv-app/FusedLocation don't remove /GPS
/system/priv-app/InputDevices don't remove
/system/priv-app/MmsService don't remove
/system/priv-app/MtpDocumentsProvider don't remove / MTP
/system/priv-app/ProxyHandler don't remove
/system/priv-app/QcomMediaProvider don't remove
/system/priv-app/SettingsIntelligence don't remove / settings needed
/system/priv-app/SettingsProvider don't remove
/system/priv-app/Shell don't remove
/system/priv-app/StatementService don't remove
/system/priv-app/StorageManager don't remove
/system/priv-app/TelephonyProvider don't remove
/system/priv-app/TeleService don't remove
/system/priv-app/Vision_CallSettings don't remove
/system/priv-app/Vision_ContactsProvider don't remove
/system/priv-app/Vision_DocumentsUI don't remove
/system/priv-app/Vision_DownloadProvider don't remove just freeze
/system/priv-app/Vision_DownloadProviderUi don't remove
/system/priv-app/Vision_MmsProvider don't remove
/system/priv-app/Vision_NetworkSetting don't remove
/system/priv-app/Vision_PackageInstaller don't remove
/system/priv-app/Vision_PermissionManager don't remove
/system/priv-app/Vision_RecentsService don't remove
/system/priv-app/Vision_ScreenOffGesture don't remove
/system/priv-app/Vision_Settings don't remove
/system/priv-app/Vision_SystemUI don't remove
/system/priv-app/Vision_Telecom don't remove
After successful debloating the system to your needs, test with Afwall log and Net Monitor if there are outgoing system apps calling home
if so freeze or delete them or let Afwall just block them.
This setup works 100% for my needs, but that doesn't mean it works in the same way for you. Please be careful. I am not responsible if oyu brick your phone. If this happened you should easily unbrick it (see above).
Have fun with a debloated chinese Firmware
For the A5C version, the chinese stock rom if someone wants it (first seed, so it will take a while until there are more seeders).
HLTE202N_L1657.6.01.04.B5.zip.torrent
Shared with Dropbox
www.dropbox.com
danielvelezbravo said:
For the A5C version, the chinese stock rom if someone wants it (first seed, so it will take a while until there are more seeders).
HLTE202N_L1657.6.01.04.B5.zip.torrent
Shared with Dropbox
www.dropbox.com
Click to expand...
Click to collapse
Hi, Daniel!
Do you have the chinese sotock rom for Hisense A5 Pro (not CC)? My cell model is HLTE203T and i never can't update...
carlo.z.du4rdo said:
Hi, Daniel!
Do you have the chinese sotock rom for Hisense A5 Pro (not CC)? My cell model is HLTE203T and i never can't update...
Click to expand...
Click to collapse
Ahhh... Nope. I only got my hands into the A5C stock as it is what i got.
Hi, I'm leaving a mirror link for all Hisense A5 stuff that may be helpful in the future when original links will be dead. As a bonus there are offline OTA zip files for L1657.6.10.04.00, L1657.6.11.01.00 and L1657.6.12.01.00. When Software update downloads OTA it saves in /data/media/
Remember that OTA updates need to go in order like L1657.6.09.06.00 -> L1657.6.10.04.00 -> L1657.6.11.01.00 -> L1657.6.12.01.00. DO NOT UPGRADE from L1657.6.09.06.00 to L1657.6.12.01.00 directly.
OTA manual install:
0. Prepare at least 2 GB SD card and format it as FAT32
1. Rename desired OTA file to update.zip
2. Copy update.zip to the root of the SD card and after that insert the card into the phone
3. Go into recovery mode on the phone (I used ADB for that, if you want you can use key combination) 4. Connect it to pc via ADB (I'm assuming that you enabled USB debugging in developer options after clicking on kernel version 8 times in phone info)
4. Run `adb devices` and make sure that you allowed debugging on the phone
5. Run `adb reboot recovery` to boot into recovery mode
6. You will see 2 options on the screen - Choose 1st one
7. Now you will see 3 options - Choose 3rd
8. Now there will be 2 options - Choose 1st
9. Phone should update and reboot
Mirrored content:
Rom and OTA:
Hisense_A5_L1657.6.03.02.00_Full_Backup.7z (Backup using QFIL, every partition, official with GAPPS, flash using QFIL)
Hisense_A5_HLTE202N_L1657.6.03.02.00.7z (for debricking)
Hisense_A5_LA592C(HLTE202N)_L1657.6.09.06.00_TFDownload_202004090105_user.zip
Hisense_A5_L1657.6.10.04.00_OTA.zip
Hisense_A5_L1657.6.11.01.00_OTA.zip
Hisense_A5_L1657.6.12.01.00_OTA.zip
Root tools:
Hisense_A5_customizer-R04.7z
Hisense_A5_customizer-R05-06.10.04.00.7z
Hisense_A5_L1657.6.12.01.00_Magisk22.1_Root_by_Sillage.7z
FireHose_HiSenseA5.mbn
Hisense_A5_debloat.txt
Hisense_A5_block_hisense.sh
Hisense_A5_EDL_PINS_1.jpg
Hisense_A5_EDL_PINS_2.jpg
Hisense_A5_boot_recovery_vbmeta_6.03.02.zip
LINK: https://mega.nz/folder/QkVXUDLS#LWYIHVvuiOFxxeZpWruTlg
.
@gowings23
@JLowe
Would be possible to share:
- Stock ROM 6.12 Full QFIL Backup
- EFS/QCN backup files
- TWRP recovery (if you managed to get one)

Doogee N20 TWRP

How I can install twrp and flash gsi rom on Doogee N20?
I found this but I'm doesnt know Russian: pda.ru/forum/index.php?showtopic=955032&st=1220#entry89836105 (I cant post URL because I'm new user, so I delete the "4" from "4pda")
Sorry for my bad English.
צבי זלצברג said:
How I can install twrp and flash gsi rom on Doogee N20?
I found this but I'm doesnt know Russian: pda.ru/forum/index.php?showtopic=955032&st=1220#entry89836105 (I cant post URL because I'm new user, so I delete the "4" from "4pda")
Click to expand...
Click to collapse
That's the Google translation:
A little instruction on how to get RooT. And so, everything that you do, as always, is at your own peril and risk! All data is erased when unlocked! Make BACKUP !!! Is always!!!! I. Unlocking Boorloder-a (required for flashing the phone and everything connected with it): 1. Go to settings -> system -> About phone -> Build number (7 clicks) (Congratulations !!!! You are a developer!) < - About phone -> For developers: Enable USB debugging and OEM unlocking. 2. We connect the phone to the computer and install the ADB usb driver (on the Internet), a connection request should appear on the phone, you need to allow it. 3. Extract files from the N20_utils.rar archive (10.87 MB) (preferably not very far, the root of the disk or the created folder N20 will be there). Go to the Unlocked Bootloader folder and run the bat file, the phone will reboot and display the request "unlock? Yes / no" rocker up - yes / rocker down - no. Naturally, you need to press the volume up, otherwise there were so many actions)) 4. Congratulations! Now, with each reboot, you will have an Orange state (5-second inscription), and the ability to do whatever you want with your phone. II. We sew! 1. For the lazy (who value their time). Download the SP Flash tool (Internet), from the N20_utils.rar archive (10.87 MB) select MT6763_Android_scatter and boot_magisk_20 files for the boot partition, lk_pached for lk, etc. you can even twrp instead of native recovery. Turn off the phone, connect it to the computer and click Download in the SP Flash programs. After the OK circle appears, disconnect and reconnect the cable (easier than a forced reboot). We turn on the phone and put the magisk manager (internet). Congratulations!!! You have a root and no Orange State label! 2. Who wants more and himself: phone to computer -> go to the Unlocked Bootloader folder -> run CMD -> write "fastboot flash recovery" put a space and move the TWRP file with the mouse to the window (fast path to the file) and press ENTER -> reboot the phone to fastboot. Congratulations!!! you have TWRP. Boot into TWRP, skip the encrypted DATE message, go to formatting and format the DATE. Go to mount and connect MTP. A phone will appear on my computer, we drop the files DisableForceEncryption_Treble (disable date encryption), orange_state_disabler_v0.3 (remove orange_state) and magisk.zip (internet) into the memory section. In TWRP, click install all this and rejoice! 3. Who has nothing to do at all: go to the forum thread Development and porting of GSI firmware (Post bullik01 # 71222655) and try what catches your eye. Not all are loaded, but .... (although we do not seem to have an A / B structure, but only "arm64 A / B" were launched) PS: look for additional information here on the forum and for brotherly devices UMiDIGI A5 Pro - Firmware ( Post Xakep1993 # 86772223) Attached files recovery-TWRP_3.3-20191015-1714.img (22.81 MB) DisableForceEncryption_Treble.zip (4.24 MB)
jwoegerbauer said:
That's the Google translation:
A little instruction on how to get RooT. And so, everything that you do, as always, is at your own peril and risk! All data is erased when unlocked! Make BACKUP !!! Is always!!!! I. Unlocking Boorloder-a (required for flashing the phone and everything connected with it): 1. Go to settings -> system -> About phone -> Build number (7 clicks) (Congratulations !!!! You are a developer!) < - About phone -> For developers: Enable USB debugging and OEM unlocking. 2. We connect the phone to the computer and install the ADB usb driver (on the Internet), a connection request should appear on the phone, you need to allow it. 3. Extract files from the N20_utils.rar archive (10.87 MB) (preferably not very far, the root of the disk or the created folder N20 will be there). Go to the Unlocked Bootloader folder and run the bat file, the phone will reboot and display the request "unlock? Yes / no" rocker up - yes / rocker down - no. Naturally, you need to press the volume up, otherwise there were so many actions)) 4. Congratulations! Now, with each reboot, you will have an Orange state (5-second inscription), and the ability to do whatever you want with your phone. II. We sew! 1. For the lazy (who value their time). Download the SP Flash tool (Internet), from the N20_utils.rar archive (10.87 MB) select MT6763_Android_scatter and boot_magisk_20 files for the boot partition, lk_pached for lk, etc. you can even twrp instead of native recovery. Turn off the phone, connect it to the computer and click Download in the SP Flash programs. After the OK circle appears, disconnect and reconnect the cable (easier than a forced reboot). We turn on the phone and put the magisk manager (internet). Congratulations!!! You have a root and no Orange State label! 2. Who wants more and himself: phone to computer -> go to the Unlocked Bootloader folder -> run CMD -> write "fastboot flash recovery" put a space and move the TWRP file with the mouse to the window (fast path to the file) and press ENTER -> reboot the phone to fastboot. Congratulations!!! you have TWRP. Boot into TWRP, skip the encrypted DATE message, go to formatting and format the DATE. Go to mount and connect MTP. A phone will appear on my computer, we drop the files DisableForceEncryption_Treble (disable date encryption), orange_state_disabler_v0.3 (remove orange_state) and magisk.zip (internet) into the memory section. In TWRP, click install all this and rejoice! 3. Who has nothing to do at all: go to the forum thread Development and porting of GSI firmware (Post bullik01 # 71222655) and try what catches your eye. Not all are loaded, but .... (although we do not seem to have an A / B structure, but only "arm64 A / B" were launched) PS: look for additional information here on the forum and for brotherly devices UMiDIGI A5 Pro - Firmware ( Post Xakep1993 # 86772223) Attached files recovery-TWRP_3.3-20191015-1714.img (22.81 MB) DisableForceEncryption_Treble.zip (4.24 MB)
Click to expand...
Click to collapse
Hi, were you by any chance able to get a copy of these files ,Please upload if posssible
The original links are broken and the internet seemed to wipe all traces out, I'm looking for the N20_utils and possibly the Disable force encryption one
Good day
Had the same problem, (English not so good but I know you'll understand). What I did was just installing Corvus OS rom, the 11th version. It's been quite a while since i installed it.
Tried Lineage 18.1 and adding the smallest gapps available, but everytime i get code error 1. I guess it was the twrp 3.3 version i used cause some roms requer the latest TWRP versions. The lineage is installing just right nd can reboot to system with no hiccups.
None of Android 12 gsi versions has ever been able to installed. Cause when i try to install, i get the error of "file too large for the target partition. Tried everything from the net to increase the system partition to at-least 3gig. No success.....
Is anyone who can help to install android 12 even beta version will be ok for my N20 Doogee??
Thanx
flairepathos.info said:
Hi, were you by any chance able to get a copy of these files ,Please upload if posssible
The original links are broken and the internet seemed to wipe all traces out, I'm looking for the N20_utils and possibly the Disable force encryption one
Click to expand...
Click to collapse
The file is in the forum. But to make your life easier here are the link.
https://drive.google.com/drive/folders/18B-srDVia_H4aDt7uvCDUxg2e4R5kVVY?usp=sharing The file is of type .exe and that extracts when you run on the pc, the problem is that I was suspicious about the virus so I threw the file in the total virus (if you don't know what it is, just search) and 6 programs pointed it out as malware but many others didn't find anything including karpersky and bit defender, there to make sure the files were there i renown they from .exe to .zip and I looked and the files really were there but as I don't want to take the risk I didn't extract and I didn't even try anything. The file that fix the encryption are inside doogee n20.exe, the guy said it will be in .exe and when you run it extracts the file in the C folder of the computer I recommend you to rename it from .exe to .zip because if the file have a virus you can screw your pc when running
Da-Judges said:
Good day
Had the same problem, (English not so good but I know you'll understand). What I did was just installing Corvus OS rom, the 11th version. It's been quite a while since i installed it.
Tried Lineage 18.1 and adding the smallest gapps available, but everytime i get code error 1. I guess it was the twrp 3.3 version i used cause some roms requer the latest TWRP versions. The lineage is installing just right nd can reboot to system with no hiccups.
None of Android 12 gsi versions has ever been able to installed. Cause when i try to install, i get the error of "file too large for the target partition. Tried everything from the net to increase the system partition to at-least 3gig. No success.....
Is anyone who can help to install android 12 even beta version will be ok for my N20 Doogee??
Thanx
Click to expand...
Click to collapse
you can use the pixel experience lite https://github.com/ponces/treble_build_pe/releases ( remenber the lite version, because is 2,5 gig) i try and instal in my phone and worked but i cant access my storage so i search and here are the solution https://forum.xda-developers.com/t/...loop-after-any-custom-rom-doogee-n20.4357313/ i dont try it but if you want here are the solution
flairepathos.info said:
Hi, were you by any chance able to get a copy of these files ,Please upload if posssible
The original links are broken and the internet seemed to wipe all traces out, I'm looking for the N20_utils and possibly the Disable force encryption one
Click to expand...
Click to collapse
Hi, did you find N20_utils?

Axon 10 Pro (Non-5G) Expanded EDL Tools / New Fixes / General Tips

WARNING - THESE TOOLS WRITE TO THE DEVICE PARTITIONS DIRECTLY
If you don't know what that means...
THIS CAN REALLY SCREW UP YOUR ---
I HAVE ONLY TESTED THESE ON THE A2020U (NON-5G) - I CANNOT SAY THEY ARE SAFE ON ANY OTHER VERSION OF THE PHONE (YET)​(If you want to test it on a specific model you own, send a PM or post and I can tell you to run a few (safe) things from these tools to make them compatible your phone.)
See my next post down for some more "beginner friendly" general tips and tricks for this phone, including some fixes for common problems and a quick guide for installing Magisk!​
If you can't afford to brick your phone, these tools aren't made for you.
There aren't really any protections from doing damage. I made them for myself because doing them on a command line constantly is a pain. I'm just sharing them for two reasons:
1) So myself or other people have tools available to make it easier when advising someone on how to fix their phone.
2) For tinkerers who are okay taking the risk that they'll mess something up.
Thanks to @djkuz / @Unjustified Dev for the EDL tool. These scripts really just expand the use of fh_loader commands in that tool. If you are able to read C++ and want to understand fh_loader I suggest searching on google, the source code is available and from that you can better understand what the tool does / what the command line options do. Feel free to ask here too, I'll do my best to share what I know.
Anyway - below I'll go into plenty of detail of what each "tool" does and some helpful information about using them.
I write in a kind of permanent verbose mode, so if you're impatient and need a TL;DR for these... tough. =)
CURRENT VERSION: Version 1.1d​
Changelog:
Version 1.1d:
- Fixed reset scripts
Version 1.1c:
- Fixed a typo in backup_GPT ¯\_(ツ)_/¯
Version 1.1b:
- Fixed errors in GPT_Tools - apparently these existed since v1.0 DO NOT USE PREVIOUS VERSIONS
- Removed the v1.1a download (use 1.1b)
Version 1.1a:
- Added script to find the COM port automatically
- Updated all scripts to use the COM port in the file COMPort (created by the above script)
- Added the missing AB Partition manipulation files (accidentally left out of v1.0)
- Added script to run the phone reset EDL command
- Fixed all the filename inconsistency in the XML files - HOPEFULLY. Please post any errors you find. Unfortunately this will make this version incompatible with v1.0 backups without some work - either rename your backup files to match the new format or use the old XML files included.
-- Especially fixed the XML typo of "uefi_sec.mbn" being backed up from both A and B to the same file (overwriting the A copy with B during an ALL backup).
- Added support for installing firmware packages created for this tool. Put them in the Firmware_Package_Restore directory and use the scripts included with them.
Basic Instructions:
1) Download zip (See attachment at the bottom, or here - Download from AndroidFileHost)
2) Unpack zip
3) Move folder to the root directory, or inside any chain of directories that do NOT have spaces in any of the names
4) Right-click on scripts and select "Run with Powershell" to run
5) If running scripts fails due to permissions, see these instructions: https://superuser.com/questions/106360/how-to-enable-execution-of-powershell-scripts
Make a "Complete Backup" (minus userdata):
1) Run Load Programmer
2) Run "backup_all"
3) Check the backup directory and verify the files were backed up and sizes make sense - a full backup should be 10,387,202,048 bytes / 39 files for the critical files and 1,626,697,728 bytes / 64 files for the non-critical (Don't include the port_trace log file when checking size)
Note: You will see a lot of "warnings" before the files begin to download, the program checking if the files already exist.
How to Use These Tools:
Important:
When the scripts run there will be a lot of information dumped to the console. It's not necessary to read all of that BUT - IF YOU DO NOT SEE THE ASCII ART "DONE" AT THE END of running any of these scripts it is likely the script encountered a serious issue. "WARNING" art is normal for some scripts, but "ERROR" means something went wrong.
None of these find the COM port automatically. It is possible (the EDL tool does) but it's just extra work I'm not paid to do =P
You will need to edit each program and change the variable at the top (usually $COMPort = "6") to whatever port number your phone shows up on.
Sorry that's inconvenient, but it should just be once per script - my port number never changes so it wasn't worth implementing automatic port finding.
This is no longer needed after v1.1a.
1. Load Programmer
This is a simple but extremely important tool! You need to run this before running anything else. This script will open a window that runs a command to open a connection to the phone (when it is in EDL / "9008" mode). The window will stay open until you close it. When working on backups I often need to re-connect the programmer, so this makes that easy - just alt-tab to it and hit enter. If you look at the script, it's fairly straightforward - just read the instructions on the screen after running it. The "secret sauce" for this is really the firehose protocol for our chipset that Unjustified Dev provided in the EDL tool.​
2. Backup / Restore:
backup_all: This will backup everything on the phone EXCEPT for the huge userdata partition. It will create a backup in two directories, which I'll explain..​​"critical" / "non-critical": You can see that I have scripts to run these two "types" of backups. Non-critical DOES NOT MEAN NOT IMPORTANT. It means that it is not critical TO ME to back up those files EVERY time I do a backup, because they rarely change. They're EXTREMELY important to have at least one backup of for your phone. The "critical" backup files are files that change often, although some of them are extreme non-critical (cache for example). Use a different name than "critical" if you like, but the point is that only with BOTH backups run (which is what backup_all does) will you have a complete backup.​​restore_all: This will restore a full (both critical and non-critical) backup set. The backup files have to be in the "restore_critical" and "restore_non-critical" directories respectively. If you didn't make the backup you're trying to restore with this tool CHECK THE FILENAMES, e.g. if you used Unjustified's EDL tool you have to rename the "abl.elf" file his backup generates to "abl_a.elf" for mine. I put _a and _b on every partition that has an a/b version because I got tired of getting them confused. Of course you can always install a backup to either slot.​Files moved to the "restore_" directories won't be changed at all by the restore process so you can cut/paste the files from your backup into the directory instead of copying them.​
3. A/B Partition Manipulation
These are no more complicated than the backup/restore tools. But they are written to make manipulations of the A/B partitions easier.​My main use for these is when I know I have a good, working ROM setup on slot A, I run A2B copy. Then no matter which slot I end up booting I'm sure it will work. (That is, if you have a working, booting slot, copying all the files from that slot to the other slot using this tool will make both slots the same.)​​Backup/Copy:​​run_AB-partition-backup: As it says, it will backup both the A/B partition files - WARNING this is NOT a full backup of the phone.​​run_AB-partition-swap: This will backup all the A/B partition files, then it will write the B files to A and A to B, effectively swapping the partitions and leaving you with a backup in case it screwed up. This backup is ONLY OF THE A/B FILES.. NOT the whole device!​​run_A2B-partition-copy (and run_B2A-partition-copy): These will do a backup of both A/B partition files, then write the A partition onto the B partition (A2B) or vice versa (B2A), effectively mirroring that partition.​
​Write/Restore:​​All the restore scripts try to find their files in the "restore_Partitions" directory - place the files from one of the backups to be restored there.​​restore_AB-partition-backup: Restore a backup of both the A and B partition files.​​restore_A-partition-backup (and B): Restore just the backup of one partition to the same partition it was taken from (A to A and B to B).​​restore_A2B-partition-backup (and B2A): These write from one partition backup to the other partition as the name suggests.​
4. GPT Tools
These are some basic tools to directly interact with the partition tables - these are not going to be of any use to 99% of people, so just ignore them if you don't know what they do.​​run_fixGPT: This issues the --fixgpt command to each of the LUNs. USE AT YOUR OWN RISK. As I understand it, this will use the onboard device configuration information from each LUN (e.g. logical size) and try to rebuild the GPTs. It's similar to running patch XMLs, it can clean up flashing messes. It isn't magic and won't fix everything.​Rarely will anyone need it unless they've been messing around with the flash tools recklessly... I certainly don't know anyone who would do something that dumb ​​backup_GPT: Backup all of the header and footer (main/backup) GPTs for all the partitions (lun 0-5). I am not aware of whether any other models of the phone have more LUNs, so be careful if you're using this on a non A2020U phone.​​restore_GPT: Simply write an entire GPT backup set (both main and backup 0-5) onto the phone. The backups must be in the restore_GPT folder. This DOES NOT BACKUP before it runs so make sure you did your backup.​​
6. Set Bootable Partition:
Alright this one is important for everyone. There are two scripts here - one for slot A and one for slot B. These just run a simple command, but they will fix a common problem I (and probably others) have - when the ROM active-slot information does NOT match the partition (hard drive) bootable flag, the phone will bootloop EVEN THOUGH EVERYTHING IS GOOD.​​So when you flash an EDL backup (depending on which files you flash, I believe this happens because of either the bootloader or the GPT files) there is a chance the backup you're flashing was originally from a different slot than the one you're restoring it to. The config thinks it should be on slot A while the hardware thinks slot B should be booting.​This will result in a fast ~3 second bootloop as the two disagree and reset.​​This tool changes which partition is expecting to boot - "1" for slot A and "2" for slot B.​​This does NOT change the active slot - the phone will continue to boot the same slot it's trying to boot. You just need to make the partition that it is trying to boot has a bootable flag.​AFAIK there is no way to change the active slot (the one XBL (I think) is trying to boot), except through fastboot or when the phone fails to load the OS 8 times in a row (note - if it fail to load the OS - if the phone bootloops before "boot" is called it won't ever switch slots on its own).​​This was a common cause of fast bootloops for me before I figured this fix out. ​
It does no harm to try this as you can always switch again. If neither one works for you, then it's something wrong with the files you're flashing. If you know which slot the phone is trying to boot (the one it was on last), run the script that matches that slot.​
7. Write "Unlocked" Bootloader and FRP:
Just like the original EDL tool, these very simply overwrite your existing (probably stock) bootloader (abl) files with the fastboot enabled version, and/or your FRP with the "unlocked" flag on (see description below). This will allow you to enter the bootloader menu (Vol+/- on booting) and use fastboot to unlock the bootloader.​​backup_FRP-and-bootloaders: As it says, this will make backups of both the FRP file and current bootloader files (ABLs).​​run_all: Literally just runs both of the below scripts *shrug*​​write_UD-bootloader: This automatically backs up both your existing A/B bootloaders before overwriting them (BOTH) with the unlocked/fastboot bootloader.​WARNING - an unfortunate fact is that if you're using the stock ROM and you have this bootloader installed, it borks the USB mode so it's stuck in charge only. There's a way to fix it temporarily, I'll post it in my "tips" thread, but you have to do it every time you boot, very annoying. I can't fix it permanently because I don't know how the bootloader file was built!​WARNING 2 - Android 10 will NOT BOOT with this bootloader installed. You can still install it, trying to boot will bootloop, but you can get into the bootloader menu and use fastboot - but there are no recoveries I know of that work with Android 10 right now, so there's very limited use to having fastboot right now. Hopefully we can get a port of TWRP 3.4 going for this phone..​​write_unlock-frp: This is also in the EDL tool, but maybe poorly explained - the FRP file holds the flag you change in the OS Developer Options to designate "allow bootloader unlock". If you FORGOT to switch that flag on and unlock, as I understand it, you get bootlooped. This can fix that for you without having to go through all the work of undoing that mess.​WARNING - I have only tested this with a brand new factory reset OS WITHOUT any fingerprint/code set. It may not work if you set one. I warn against using this if you are not ready to lose your data. It's convenient if you just forgot, but if you set a pattern/fingerprint security and encrypted the filesystem overwriting the FRP might remove your ability to decrypt which would force you to factory reset. Again, I haven't tested it for that so it may work, but be careful.​If you already screwed up and ran this to set the flag - the script runs a quick backup of your old FRP just in case. So you can try to restore that FRP and pray lol)​
8. Specific Files:
This is just a generic program to backup/write(restore) "specific files".​​I include a "Reference.XML" which has a full <program> line for every partition you might want to write/read on the phone. To use this, you need to copy the lines from the reference XML into "rawprogram-specific-files.xml" for the files you want to read/write.​​As an example I already set up "rawprogram-specific-files.xml" with the two lines for "abl_a" and "abl_b" in it. So the script will backup or restore those files (provided you put the abl's you want to restore in the restore_files directory).​​I personally use this template a lot - I have one for ABLs, one for AOPs, one for BOOTs, and so on. If you are trying to fix a specific file(s) it's convenient.​
9. Userdata Backup:
I put this last because, to be honest, I'm not sure how good of an idea including this even is.​​VERY IMPORTANT - DO NOT USE THIS USERDATA TOOL IF YOUR PHONE IS NOT THE 256GB VERSION!!!!!​​I will need someone with the 128GB version to send me their GPT files if they want me to make an XML that works for them. Because the userdata size for SURE depends on your phone version.​​Also, I wrote a script that breaks up the file into download slices (and can be written back to the phone in slices, of course) - one, to see if I could do it and if it would work (it does)... and two, so that in the horrible case that something goes wrong during the... nearly 2hrs of transfer time, for my 256gb image ... that I can at least not have to start all over. If something happens, you should be able to remove the entries in the XML for what you already have and start again.​​Finally - is it even worth doing? Is backing up the userdata even useful?​​I don't know yet.​​For an unecrypted pre-A10 phone I do know it works to fully flash ALL the files on the phone + the userdata all at the same time to return the phone to the exact "state" it was backed up in - all the apps and settings and everything, exactly as they were.​​But A10 is encryption enabled always, and it uses file encryption which sounds even worse for this idea.. and I don't know if the crypto keys change and when. So flashing an entire encrypted partition might just leave you unable to decrypt all, some, or none and you lose everything.​OR it might just work - you throw the whole image on there and the decrypt key is the same, boom, easy backup.​​If anyone tries it, let me know how it goes (or doesn't). I'll update with any results I find.​​Update 1: I have confirmed that for the 256gb A2020U backing up the full phone and userdata allows you to restore the phone to that exact state. Doesn't matter if it's encrypted, password set or not, etc. If you backup the entire userdata image and reflash it that is where the phone will be. In most cases you also need all the other partitions too, but if they have not changed they don't have to be reflashed. (I confirmed going from encrypted with password -> encrypted with no password -> back up encrypted with password.. This is on Android 10 with its more complicated encryption).​Another nice thing to note - of course the image of the phone will be the size of the partition (ie. 256gb for mine, 128gb for others). But if your phone storage is largely empty, you compress the backup using something like 7z once the image has been backed up. It won't take up so much space then. How much less? My 256gb image compressed is 4.5gb. lol.... it makes sense, the phone is new and there's basically no information on the userdata. Many of the pieces of my userdata backup have the same exacty hashes - meaning they are literally just all 0's... 260gb of zeros. Unfortunately you can't get away with just backing up part of the image as data could be anywhere. And over time as the sectors get written to, it will get more difficult to compress.​​Anyway, if anyone has a 128GB version they want to donate to science (kidding - I just need backups of the GPT) I can make the XML file to use for backing those up too.​
Extra Note: All the programs automatically build a log of the console window, so if something goes by too fast just check the log. The fh_loader also creates a log and dumps it somewhat randomly about... lol.. the filename is port_trace.txt. This tends to get deleted and overwritten easily so if you want to keep it, move it when the script finishes,. it does often contain more information than the console shows - it can be useful understanding what's going on.
Extra Note 2: You'll notice a script "Create Hash List" in practically every directory. That's to strongly hint that using that script is super useful. All the files backed up through these tools, by definition, have the exact same size. If you hash your files though, you can tell if they have changed at all. This is extremely useful in troubleshooting problems.
How to install an EDL firmware package:
Note: This tool is specifically made for the firmware packages I posted. It won't work with any other package (although it can, with a little work).
1. Install the EDL tools
2. Run a backup of your phone! Even if it isn't booting.
3. Download a firmware package from this thread: [ROM][STOCK] Stock Firmware Packages (For Expanded EDL Tools)
4. Unpack the firmware archive into the tool directory "Firmware_Package_Restore"
5. Put phone in EDL mode and run Load Programmer
6. Run whichever "Write Firmware vX to Y.ps1" you want (X = firmware version, Y = A or B partition) (If you don't know which partition is currently booting, just install both.)
7. Wait for the install to finish ("done"), then reset the phone with either the power button or the reset tool
8. You might see a few bootloops and then the phone ask you to do a factory reset / system wipe.
9. Done.
PLEASE POST IN THE FIRMWARE THREAD _NOT HERE_ IF YOU RUN INTO ANY ISSUES!
Enjoy!
Also, while I'm here... some other helpful notes for this phone:
-------------------------------
General Information:
As of right now there are a lot of working options for Android 9 and quickly expanding thanks to work @Unjustified Dev did and work @rafyvitto is continuing to do! Check out some of his sGSI ROMs, lots of options!
Thanks to Unjustified LOS 16 is available for Android 9 also, and is the base install for most ROMs. See his threads for that. I may write up an install guide here that's a little more in depth than his.. not today though.
Upgrading to Android 10 with the bootloader unlocked is possible but requires a workaround:
You must unlock on Android 9 then use recovery to side-load the Android 10 update available from ZTE USA (HERE).
This will remove the fastboot enabled bootloader and requires a complete system wipe.
You will retain bootloader unlock.
Once you have updated to A10 you can run OTA updates to get up to the latest version.
Downsides to A10 include - NO RECOVERY (yet), NO CUSTOM ROMs (yet), and if you flash the fastboot enabled bootloader you CAN use fastboot, but you cannot boot- the phone will be in a bootloop until you restore the stock A10 bootloader.
-------------------------------
Resetting the phone manually:
In EDL Loop - Hold power for 20 seconds
In EDL Not-Looped - Hold power for 5 seconds
In System (booted after ZTE logo) - Hold power for 10 seconds
----------------------------------
Entering Modes:
All of these start by using reset above, THEN the button(s) below - in all except one case (EDL), when the phone resets it will vibrate and then show the blue ZTE logo.
When you feel the vibration you want to immediately release the power button and press the mode buttons.
This can be confusing and tricky - most people say "hold power + button" - that is incorrect. Most cases if you hold any button other than power the phone will not finish resetting until you release that button.
What you want to do is right before or as the phone vibrates, then you hold the button. Once the ZTE screen is up it is probably too late if you missed it. So hold power for your reset and be ready to push the button you want when you feel the vibration.
The one exception - EDL mode. For EDL mode you can (and must) hold the key combo just before/during the restart.
Recovery Mode: Vol+ Button
Factory Test Mode: Vol- Button
Bootloader/Fastboot Mode: Vol+/- Button (both) when phone is NOT plugged into USB (if you are too early pressing the combo, even with the USB unplugged, you will get EDL mode)
Emergency Download Mode: Vol+/- Button (both) when phone IS plugged into USB
--------------------------------
EDL Flash Errors (esp. when EDL looped):
There is NO indication the phone is even ON when you are EDL stuck/looped. Other than when you plug into the computer with the right drivers it shows up as a 9008 device (9008 mode is EDL for Qualcomm).
Even when you can see the phone on your computer, it can often "freeze" in EDL if it is left idle for too long (not connected to and being used by a Sahara programmer).
If you try the EDL tool or another flash tool and they give you errors related to the Sahara programmer not loading or no "hello", do this:
Reset the phone - use a clock to count if you need, has to be accurate since there's no indication of when it resets. Press down Vol+/- and the power button, count to 20sec, then release JUST the power button. Keep holding both of the volumes for another 5 sec, then release them. That will get you back into a fresh EDL. You can watch your Device Manager to see the phone disconnect as an indicator when to let go of the power button. If you mess up the timing, wait a bit before trying again so the phone isn't in the middle of rebooting.
Easiest way to tell if you're in EDL is to watch the Device Manager while you do it. Otherwise there is just a lot of guess work, since there's no logo or vibration when you get it right, phone just appears off.
--------------------------------
USB Mode Stuck After Unlocking:
Something about the fastboot/"unlocked" bootloader causes the USB mode when you boot in the OS to be stuck on "Charge Only" mode.
Luckily I found @meow sir 's comment tucked away in this thread, and he knew a way to fix it (thanks!):
1. Open the phone dialer
2. Dial in "*#*#DEBUG#*#*" (debug = 33284)
(Sometimes takes a little bit to open, but a debugger menu will open)
3. Select the 2nd option for USB
4. Pick the only option - this will unset some strange "testing" mode and you can use MPT again.
Unfortunately this fix doesn't stick, you have to do it every time unless you switch back to the stock ABL. =(
--------------------------------
Installing Magisk, Quick Guide:
- You must have your bootloader unlocked already! This works on both A9 and A10.
1. Use this tool to create a full backup! (backup_all)
2. Go into the "critical" directory created by the backup and find the files for boot_a.img and boot_b.img - rename them to boot_a_bak.img and boot_b_bak.img and keep that window open, need them in a second
2. Boot into the OS. Download the Magisk Manager APK from HERE
3. Copy the APK and both of those boot files to your phone, open a file manager and install the APK
4. Open Magisk Manager and click on "Install" for Magisk (upper right)
5. Select "Patch Boot ROM" (or whatever it says.. something like that..)
6. Navigate to boot_a_bak.img and patch it.
7. Go to your Downloads directory (where Magisk dumps the patched file) and rename it to boot_a_magisk
8. Go back to Magisk and repeat those steps for boot_b
9. Copy the two patched Magisk boot files to your computer, into the folder with your "critical" files backup.
10. Rename the Magisk files to "boot_a.img" and "boot_b.img"
11. Move all the files from the "Backup\backup_all-critical-(...)" directory to the "Restore\restore_critical" directory in my tools
12. Finally, reboot into EDL.. almost there!
13. Run "restore_all-critical" (don't forget to run Load Programmer first..)
14. It will restore all you files, kinda a waste of time - if you know how to use the "Specific Files" tool this is a perfect time to use it to flash JUST the boot files. But anyway - this will get it done.
15. When done flashing, reboot the phone and open Magisk Manager to confirm it is installed!
The Magisk team recommend you DO NOT FLASH your stock boot files back to uninstall it, instead they say you should run their uninstaller.zip. However, I am not sure how to uninstall it if you're on A10 since we don't have a recovery that can flash zips? (Unless the stock recovery works for that, I don't think it would..)
I suspect (but have not tried) that on our phone flashing the boot files back over Magisk will not really be a problem since the recovery and ramdisk are all wrapped up into the boot image. But I don't recommend trying it if you value your data! Fair warning.
---------------------------
Alright that's everything. Good luck!​
This will be useful for a lot of folks on here, thanks for taking the time to look for a work around.
rafyvitto said:
This will be useful for a lot of folks on here, thanks for taking the time to look for a work around.
Click to expand...
Click to collapse
Glad to be helpful! Usually I lurk the forums getting information I need to unlock/root/etc lol.. but I saw I actually could contribute something to this forum so hopefully it encourages people to get interested in this phone. It's looking pretty sweet now that I'm not spending days fighting with bootloops!
Indeed,on the note of attracting more users. im going to be releasing something for the pixel lovers very soon ?
Thanks Bob!
I'm on A10 with unlocked bootloader. I made all EDL tool backups when on A9 but these were done before correcting the typos as suggested. So I am not confident of successfully flashing back to A9 (preference).
Therefore I will likely flash the magisk-patched boot files to attempt root and report my experience...
Sent from my ZTE A2020U Pro using Tapatalk
big thx, glad to see some life to this almost dev-dead device
Hey thanks for the post. I'm thinking about buying the phone but have a quick question. Can I update to the latest version of Android 9 before unlocking or will the OTA be Android 10. How would I go about updating to the latest version version of Android 9 and not go to Android 10. Can I download the Android 9 OTA from somewhere and flash that one? Thanks in advance for the help!
Crackass said:
Hey thanks for the post. I'm thinking about buying the phone but have a quick question. Can I update to the latest version of Android 9 before unlocking or will the OTA be Android 10. How would I go about updating to the latest version version of Android 9 and not go to Android 10. Can I download the Android 9 OTA from somewhere and flash that one? Thanks in advance for the help!
Click to expand...
Click to collapse
:good: I think your question borderlines on needing its own thread in the Q&A section but I'll answer you anyway...
Currently as long as you are on A9 when you get the phone you can just do OTA updates from firmware version 1.10 to 1.11 to 1.13 (not sure what android security update that is), after 1.13 it goes to A10.
There is an A10 firmware available from ZTE to SD card sideload. Once installed it has to be updated to the latest A10 via a couple OTA updates.
Going directly from A9 to A10 via OTA goes directly to the latest version.
You cannot flash the A9 OTA... because flashing an OTA is an oxymoron... but I guess you mean can you download the A9 firmware and flash them. The answer is... maybe. ZTE does not offer official downloads any A9 firmware for A2002U (USA version), only A10.
They do offer A9 firmware for A2020G (european) and I think other foreign versions (RU, CN). These cannot be interchanged, if you have the US or EU or CN phone you need to use that firmware... from what I have read. I could be wrong, I don't have those phones.
But there is an unofficial stock A9 firmware for the A2020U here on the forums, uploaded by @rafyvitto . That will get you to.. I forget.. 1.11? That can be flashed using the original EDL tool or, with a little modification, the EDL tools in this thread.
Additionally.. if I ever get around to it... I plan to upload all three A9 firmware packages for the US version which can be flashed with the EDL tools in this thread. Not sure if it's really necessary, but I have them.. it's just a matter of figuring out hosting them and spending the time to upload them.
bobthenormal said:
:good: I think your question borderlines on needing its own thread in the Q&A section but I'll answer you anyway...
Currently as long as you are on A9 when you get the phone you can just do OTA updates from firmware version 1.10 to 1.11 to 1.13 (not sure what android security update that is), after 1.13 it goes to A10.
There is an A10 firmware available from ZTE to SD card sideload. Once installed it has to be updated to the latest A10 via a couple OTA updates.
Going directly from A9 to A10 via OTA goes directly to the latest version.
You cannot flash the A9 OTA... because flashing an OTA is an oxymoron... but I guess you mean can you download the A9 firmware and flash them. The answer is... maybe. ZTE does not offer official downloads any A9 firmware for A2002U (USA version), only A10.
They do offer A9 firmware for A2020G (european) and I think other foreign versions (RU, CN). These cannot be interchanged, if you have the US or EU or CN phone you need to use that firmware... from what I have read. I could be wrong, I don't have those phones.
But there is an unofficial stock A9 firmware for the A2020U here on the forums, uploaded by @rafyvitto . That will get you to.. I forget.. 1.11? That can be flashed using the original EDL tool or, with a little modification, the EDL tools in this thread.
Additionally.. if I ever get around to it... I plan to upload all three A9 firmware packages for the US version which can be flashed with the EDL tools in this thread. Not sure if it's really necessary, but I have them.. it's just a matter of figuring out hosting them and spending the time to upload them.
Click to expand...
Click to collapse
Just wanted to chime in, interchanging firmware between each model is possible, you would only need to reflash your model/nonhos/tz partitions to the ones of your variant to have working ril/fod fp/sensors.
Ok Bob I gave it a go and successfully rooted my A2020U running stock A10 v2.09. This is my experience...
Firstly, my A2020U could not connect so I used the @Unjustified Dev Tool ("original tool") to easily determine my com port (i.e. 3). I edited the your scripts accordingly (using Notepad++) and got connected.
I'd rather not fiddle with the hardware buttons to change modes so I used the CLI to "adb reboot edl" to get into EDL mode.
I executed the backup_all.ps1 script.
It echoed several "warnings" indicating that it could not find files. However, the created backup folders did in fact include those files.
I noted that none of the "A" slot files include the "_a" postfix; the "B" slot files did include "_b".
Now I needed to transfer those boot files to my device by first rebooting my device and connecting via MTP.
I noted that the original tool offered a reboot menu option (but sadly only after executing a successful operation). So, not wanting to fiddle, I used the original tool to backup my boot files, then used the menu option to reboot; On my device I then manually selected it to connect via MTP.
After transferring the "boot.img" and "boot_b.img" files to my device, and installing Magisk Manager. I patched them and transferred them back to my PC.
To "flash" (restore) the patched files I decided to cut 'n' paste the two lines regarding them from your Reference.xml file into your rawprogram-specific-files.xml file, replacing your example lines.
I executed your run_write-files.ps1 script and it completed successfully.
Not wanting to fiddle again with the hardware buttons (just so that I can get the reboot option), I backed up the patched files using the original tool and rebooted. Now my device is successfully rooted.
Thank you!
Additional notes and suggestions:
1. Can you please investigate the "false" warnings? See my (redacted) log file attached;
2. It would be great if you could create/duplicate a script within your expanded tool set (or main program) to determine and set the appropriate COMPort (and teach us non-coders the actual commands);
3. Would you also consider investigating and including a reboot device script? (It looks like the original tool calls reset.xml);
4. Note that, at the time of reporting this, the latest versions for the Manager and Magsk are 8.02 (307) and 21.0 (21000) respectively, and that I had to switch the update channel to "beta" for the patched files to pass SafetyNet;
5. Because rooting is a likely use of your tool I am attaching my modified rawprogram-specific-files.xml file which targets the boot files for convenience.
bobthenormal said:
...
Additionally.. if I ever get around to it... I plan to upload all three A9 firmware packages for the US version which can be flashed with the EDL tools in this thread....
Click to expand...
Click to collapse
If this can help me get my A10 device to a state where I can install a custom recovery and cutom ROMs, I would appreciate it!
eKeith said:
Ok Bob I gave it a go and successfully rooted my A2020U running stock A10 v2.09. This is my experience...
Firstly, my A2020U could not connect so I used the @Unjustified Dev Tool ("original tool") to easily determine my com port (i.e. 3). I edited the your scripts accordingly (using Notepad++) and got connected.
I'd rather not fiddle with the hardware buttons to change modes so I used the CLI to "adb reboot edl" to get into EDL mode.
I executed the backup_all.ps1 script.
It echoed several "warnings" indicating that it could not find files. However, the created backup folders did in fact include those files.
I noted that none of the "A" slot files include the "_a" postfix; the "B" slot files did include "_b".
Now I needed to transfer those boot files to my device by first rebooting my device and connecting via MTP.
I noted that the original tool offered a reboot menu option (but sadly only after executing a successful operation). So, not wanting to fiddle, I used the original tool to backup my boot files, then used the menu option to reboot; On my device I then manually selected it to connect via MTP.
After transferring the "boot.img" and "boot_b.img" files to my device, and installing Magisk Manager. I patched them and transferred them back to my PC.
To "flash" (restore) the patched files I decided to cut 'n' paste the two lines regarding them from your Reference.xml file into your rawprogram-specific-files.xml file, replacing your example lines.
I executed your run_write-files.ps1 script and it completed successfully.
Not wanting to fiddle again with the hardware buttons (just so that I can get the reboot option), I backed up the patched files using the original tool and rebooted. Now my device is successfully rooted.
Thank you!
Additional notes and suggestions:
1. Can you please investigate the "false" warnings? See my (redacted) log file attached;
2. It would be great if you could create/duplicate a script within your expanded tool set (or main program) to determine and set the appropriate COMPort (and teach us non-coders the actual commands);
3. Would you also consider investigating and including a reboot device script? (It looks like the original tool calls reset.xml);
4. Note that, at the time of reporting this, the latest versions for the Manager and Magsk are 8.02 (307) and 21.0 (21000) respectively, and that I had to switch the update channel to "beta" for the patched files to pass SafetyNet;
5. Because rooting is a likely use of your tool I am attaching my modified rawprogram-specific-files.xml file which targets the boot files for convenience.
Click to expand...
Click to collapse
Nice! :good:
For the questions..
0. Thanks for the heads up on filenames! I completely missed that the _a files don't have the labels... As you probably noticed all the files are backed up correctly still (no missing/overwritten files), but I removed the _a from all the A slot files. That was my original "fix", so I guess I started building this package before I got annoyed by not having the _a/_b consistency. I'll update the correct XML file and upload it as a new version.
1. Don't worry about those! They're part of using the fh_loader interface. Warnings are usually just fine, ERRORS are bad. I'll add a note to the post when I get a chance so people don't get scared by that.
It's only when you do a backup the program is really only designed in the "writing" sense, for backups you literally run an identical XML to writing but you send a flag that reverses the process. So it weirdly checks if the files it is going to copy (which of course don't exist) exist, and it throws the standard warning, but then it just creates them (of course).
I can't turn those off without lowering the verbosity setting for that tool. I decided to leave it set to high because if someone has a problem and they post their log file (like so!) it's very useful to troubleshoot.
2. I'll think about it / try. Not very hard to program but a little time consuming.
I'll throw a copy of lsusb.exe in the next version. Windows port of the linux command. People can simply run that on a command prompt and it will list all the active COM ports/devices. If you're not familiar with it - you can also find out by clicking on the windows start bar or pressing the windows key and typing in "Device Manager". In the hardware list there is a category for COM ports where it lists them.
3. Yeah that's very easy I'll put one in the next version as well.
4. Helpful to know. Interesting that you needed beta to pass... I didn't think to mention I use the canary builds (not really recommended... the current one crashes when I try to hide Magisk Manager lol)
5. Thanks! Maybe I should make a directory specific to boot backup/write... but I do think anyone not comfortable doing the change you did might not want to be flashing their boot files anyway haha.. things to consider I guess.
As for getting you back from A10, definitely. I'll figure out how to upload them to one of those file sharing sites in a week or two.
In the mean time, with a backup from this tool you're safe (as far as bricking goes, you'll have to system wipe) to try rafy's EDL backup to revert to A9. I'll find the actual post... I should have been less lazy and linked it in my post lol... HERE - rafyvitto's EDL.
If flashing his backup doesn't boot right away try the tool I included to fix the bootable partition. If it still doesn't work after that (maybe mention here what happened) then just restore your backup.
Do you have the 128gb phone by chance?
Thanks much, especially for your detailed clarifications and convenient link!
I have the 8/256GB (P855A03_NA) model.
PS
I want to spend more time on ensuring I have a complete device backup before nuking with another EDL; will dedicate some time this week...
Sent from my ZTE A2020U Pro using Tapatalk
eKeith said:
Thanks much, especially for your detailed clarifications and convenient link!
I have the 8/256GB (P855A03_NA) model.
PS
I want to spend more time on ensuring I have a complete device backup before nuking with another EDL; will dedicate some time this week...
Sent from my ZTE A2020U Pro using Tapatalk
Click to expand...
Click to collapse
Oh nice, with the 256gb model you're good to use the userdata backup program too. Sounds ideal for you since, like me, you want a really bulletproof backup. If you run a full backup and then run the userdata backup you literally have a "phone state" so you can return your phone back to exactly where it was, not have to wipe system or anything.
Of course I'd hate to be wrong so as usual, do at your own risk! Lol. But I am using that method and it has worked great. The downside being over an hour of waiting for the userdata to download or upload... and having to store 256gb (for long term storage you can compress it down to literally a few gb).
I've been kinda busy, but working on getting some of those things from my last post done hopefully this week.
bobthenormal said:
Oh nice, with the 256gb model you're good to use the userdata backup program too. Sounds ideal for you since, like me, you want a really bulletproof backup. If you run a full backup and then run the userdata backup you literally have a "phone state" so you can return your phone back to exactly where it was, not have to wipe system or anything.
Of course I'd hate to be wrong so as usual, do at your own risk! Lol. But I am using that method and it has worked great. The downside being over an hour of waiting for the userdata to download or upload... and having to store 256gb (for long term storage you can compress it down to literally a few gb).
I've been kinda busy, but working on getting some of those things from my last post done hopefully this week.
Click to expand...
Click to collapse
That's great to know! Your user data backup option has simplified my life.
I will wait for your next revision to do a full backup plus user data before nuking.
I am looking forward to moving on from ZTE's A10 to one of Ray's ROMs...
Sent from my PH-1 using Tapatalk
Updated to 1.1a - kind of had to rush on some things so keep an eye out for mistakes, especially in the XML files, and let me know if you find any.
Should have an 1.09 (A9) firmware package up "Soon(TM)", just have to make the xml files then upload the file somewhere.
EDIT: Already needed to update to 1.1b - I found that the GPT_Tools had a big error that probably was there since 1.0 and no one noticed! Backups of the GPT should now actually work...
Thank you @bobthenormal !
Looking forward to your A9 EDL backup...
Sent from my PH-1 using Tapatalk
eKeith said:
Thank you @bobthenormal !
Looking forward to your A9 EDL backup...
Sent from my PH-1 using Tapatalk
Click to expand...
Click to collapse
It's up -- see the new thread.
I didn't have time to test it so make sure you backup but I'm 99,99% sure it will work. I tested it several times in the past, but to make the firmware package I took out all the (I hope) unnecessary files.
There's one thing I'm not sure of - whether you'll need to use the Fix Bootable tool after installing it. IF you need to, then I believe you will have to install it to partition B and then run fix bootable B. (The 1.10 backup was taken originally from the B partition).
If you find that it works without having to do that, let me know... it may not be necessary if wherever that bootable flag is stored didn't get included in the firmware package.
bobthenormal said:
It's up -- see the new thread.
I didn't have time to test it so make sure you backup but I'm 99,99% sure it will work. I tested it several times in the past, but to make the firmware package I took out all the (I hope) unnecessary files.
There's one thing I'm not sure of - whether you'll need to use the Fix Bootable tool after installing it. IF you need to, then I believe you will have to install it to partition B and then run fix bootable B. (The 1.10 backup was taken originally from the B partition).
If you find that it works without having to do that, let me know... it may not be necessary if wherever that bootable flag is stored didn't get included in the firmware package.
Click to expand...
Click to collapse
Thank you @bobthenormal !
I should be able to give it a go this weekend and inform...
Sent from my PH-1 using Tapatalk

SP Flash tool - How to open ROM_0 file created with SP Flash tool

Hi everyone and Happy New Year,
I am trying to open ROM_0 file created with SP Flash tool. I have tried ROM explorer 0.9.1, I have tried various option converting with simg2img and opening with 7zip but nothing has worked so far.
The file is about 100GB and it is a SP Flash tool backup of my userdata on which I have a lot of images which i need to save.
I was using Dot OS 5.2 general image and a message popped up about trying Android 12 and I have clicked on it just to get rid of it but I assume it has triggered a download. My phone crashed yesterday evening when I started the cmera app and once restarted it was in a boot loop mode stuck on the dot os logo.
So far I have tried various options unsuccessful - I have reflashed the image which I originally flashed, I have set the partitions active - a and b and reverted to the initial active one which was "a".
I have also flashed system.img (with the treble general image) but still it is in a boot loop mode.
I have just decided to flash back the super.img image from the stock and guess what - still stuck.
Flashed the stock boot.img again thinking there might be an issue with the kernel but that didn't help.
I understand that it is the case of fully flashing back the stock ROM which will lock the bootloader and delete all my userdata in order to have the phone back.
However the phone IS NOT important, the ONLY IMPORTANT thing are the images in the userdata.
I have created the backup of it straight after the boot loop appeared. Tried to read here on XDA but it is not clear what format is that file and how I can access the data on it.
Looked for a recovery partition but there is none. Potentially hidden as you can get into stock recovery via fastbootd. But the options there are only to wipe the partitions/reset.
The phone is Umidigi Bison Pro and I have been having all but troubles with it.
Any help greatly appreciated it.
Regards
s80_gad said:
Hi everyone and Happy New Year,
I am trying to open ROM_0 file created with SP Flash tool. I have tried ROM explorer 0.9.1, I have tried various option converting with simg2img and opening with 7zip but nothing has worked so far.
The file is about 100GB and it is a SP Flash tool backup of my userdata on which I have a lot of images which i need to save.
I was using Dot OS 5.2 general image and a message popped up about trying Android 12 and I have clicked on it just to get rid of it but I assume it has triggered a download. My phone crashed yesterday evening when I started the cmera app and once restarted it was in a boot loop mode stuck on the dot os logo.
So far I have tried various options unsuccessful - I have reflashed the image which I originally flashed, I have set the partitions active - a and b and reverted to the initial active one which was "a".
I have also flashed system.img (with the treble general image) but still it is in a boot loop mode.
I have just decided to flash back the super.img image from the stock and guess what - still stuck.
Flashed the stock boot.img again thinking there might be an issue with the kernel but that didn't help.
I understand that it is the case of fully flashing back the stock ROM which will lock the bootloader and delete all my userdata in order to have the phone back.
However the phone IS NOT important, the ONLY IMPORTANT thing are the images in the userdata.
I have created the backup of it straight after the boot loop appeared. Tried to read here on XDA but it is not clear what format is that file and how I can access the data on it.
Looked for a recovery partition but there is none. Potentially hidden as you can get into stock recovery via fastbootd. But the options there are only to wipe the partitions/reset.
The phone is Umidigi Bison Pro and I have been having all but troubles with it.
Any help greatly appreciated it.
Regards
Click to expand...
Click to collapse
May I'm wrong, but I guess that if you didn't give it an extension then the file doesn't have a format; when you make a backup of a partition using SP Flash tool you should give it an extension, for example userdata_backup.img will work, in some devices, for some partition the .bin extension is used.
And to restore the device to a working state without losing data you could flash the stock ROM unchecking the userdata partition and using Download only option won't re-lock your bootloader.
If actually your userdata was not overwritten you still can try a second attempt to preserve it using mtk-client, search for it in GitHub, also consider what I stated about re-flash your original ROM preserving the userdata partition.
Thanks SubwayChamp, I appreciate your comment.
I have tried .img, .bin, ext4 etc but cannot open it - I am not sure if there is another application that can convert it in a readable format or maybe if we can mount it and access the files.
I had the impression that if you flash the stock rom the bootloader is locked and you loose everything.
But thanks for your advice - I will flash everything apart from the userdata partition which is last in the order anyway. Should I select or deselect the preloader partition- will that make a difference?
Regards
Just flashed the full stock rom without the userdata partition - still stuck on the logo in a boot loop . I really need to open the userdata backup file from SP flash tool as I feel I have to do a full reset/wipe.
Any other suggestions about explorer for the sp flash dump file, please?
Regards
s80_gad said:
Just flashed the full stock rom without the userdata partition - still stuck on the logo in a boot loop . I really need to open the userdata backup file from SP flash tool as I feel I have to do a full reset/wipe.
Any other suggestions about explorer for the sp flash dump file, please?
Regards
Click to expand...
Click to collapse
No, I didn't say to change the extension now and try it in various format, unfortunately I feel that if you didn't give you the extension at the time to make a backup then the file is unreadable, what I mean is that when you make the dump through SP Flash tool you have to give to the file a name and an extension, not letting it as is offered by SP Flash tool, for example you did see the name ROM_0 or similar, but you have to give it a name and an extension, in this case userdata_backup.img would work.
Did you check mtk-client?, you can read (dump) the userdata partition through this CLI tool, and after that you can restore it at any time.
Using the download option (only) you never re-lock your bootloader.
But wait a minute, keep in mind that your device is A/b, so you have to double-try all the things, for example, if you want to flash a specific partition like boot you have to be sure in which partition you are right now BUT unfortunately you don't know which partition is the working one, so better use fastboot to flash the missed partition, target to both slots.
And what about the option to get to a custom recovery? (I guess you had it previously to flash CR Droid) either taking a backup of userdata or re-flashing the same CR Droid that was functional previously.
Thanks SubwayChamp for your reply.
So I will try to dump the userdata again then - I still haven't touched it so I hope the partition and the data on it is fine.
I assume it is that mtkclient you are referring to. Will see if I can get some time today to try the live cd first as I am on Windows at this moment.
So my device is indeed A/B - the system is on "a" and I have flashed dot os using fastbootd and overwriting the system.img within the super.img. It worked fine for about 20 days until that crash (I only assume it is due to the update - nothing else has happened that could create trouble).
Also tried to set the b partition active but didn't help so switched back to "a".
Unfortunately there is no recovery partition, from what I learned the recovery is within the boot img. I have tried to load temporary unofficial twrp - fastboot boot twrp.img - and the first step is ok, but then it crashes. so no luck to load custom recovery even temporary in order to save the userdata on sdcard.
Tried to get to the contents trough adb shell but while some directories are listed, I get access denied to the userdata - I think maybe the links are broken?
I will try with the mtk to see if I can back it up - and what I'll do is I'll flash the full stock rom including the userdata and potentially will try to flash the old userdata through fastboot or sp flash or mtk.
TBH I don't understand why the phone is still in a bootloop - can't be only because I haven't cleared the userdata?
Regards
s80_gad said:
Thanks SubwayChamp for your reply.
So I will try to dump the userdata again then - I still haven't touched it so I hope the partition and the data on it is fine.
I assume it is that mtkclient you are referring to. Will see if I can get some time today to try the live cd first as I am on Windows at this moment.
Click to expand...
Click to collapse
It works on Windows though.
s80_gad said:
So my device is indeed A/B - the system is on "a" and I have flashed dot os using fastbootd and overwriting the system.img within the super.img. It worked fine for about 20 days until that crash (I only assume it is due to the update - nothing else has happened that could create trouble).
Click to expand...
Click to collapse
The issue was originated due to the lack of the other system files that also occupy this space; vendor, odm, product (may vary depending on the device), can be fixed flashing the super.img using fastbootd again.
s80_gad said:
Also tried to set the b partition active but didn't help so switched back to "a".
Unfortunately there is no recovery partition, from what I learned the recovery is within the boot img. I have tried to load temporary unofficial twrp - fastboot boot twrp.img - and the first step is ok, but then it crashes. so no luck to load custom recovery even temporary in order to save the userdata on sdcard.
Click to expand...
Click to collapse
Yes, this device doesn't have a dedicated recovery partition, but it is placed in a tiny portion of the boot image (usually the ramdisk) you can try by flashing the TWRP image onto the boot partition (flashing, not booting only) then boot to it, do the stuff you need through TWRP, from there you could solve the bootloop. To can boot to Android again you should need to flash a boot image.
s80_gad said:
Tried to get to the contents trough adb shell but while some directories are listed, I get access denied to the userdata - I think maybe the links are broken?
Click to expand...
Click to collapse
No, it's encrypted.
s80_gad said:
I will try with the mtk to see if I can back it up - and what I'll do is I'll flash the full stock rom including the userdata and potentially will try to flash the old userdata through fastboot or sp flash or mtk.
TBH I don't understand why the phone is still in a bootloop - can't be only because I haven't cleared the userdata?
Regards
Click to expand...
Click to collapse
When you flashed a system image onto the super partition the other partitions that are set dynamically didn't find a place to be recreated or couldn't play its role, added to this, a different system image that which is contained in the super image can differ in sizes either logical and/or dynamical (virtual sized).
SubwayChamp said:
The issue was originated due to the lack of the other system files that also occupy this space; vendor, odm, product (may vary depending on the device), can be fixed flashing the super.img using fastbootd again.
Click to expand...
Click to collapse
Flashed already the original stock rom super. img and everything else apart from userdata - it doesn't work.
see below
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
SubwayChamp said:
Yes, this device doesn't have a dedicated recovery partition, but it is placed in a tiny portion of the boot image (usually the ramdisk) you can try by flashing the TWRP image onto the boot partition (flashing, not booting only) then boot to it, do the stuff you need through TWRP, from there you could solve the bootloop. To can boot to Android again you should need to flash a boot image.
Click to expand...
Click to collapse
Tried to flash it - it just restarts the phone straight away - in fact replaced it with sp flash tool as well which recognises only the "a" partition and flashes it there.
SubwayChamp said:
No, it's encrypted.
Click to expand...
Click to collapse
I see
SubwayChamp said:
When you flashed a system image onto the super partition the other partitions that are set dynamically didn't find a place to be recreated or couldn't play its role, added to this, a different system image that which is contained in the super image can differ in sizes either logical and/or dynamical (virtual sized).
Click to expand...
Click to collapse
I am guessing this is why I have to reflash the whole rom incl userdata in order to make the phone usable.
What I'll do is I'll try to dump userdata with mtk and then will reflash everything with the stock rom ()hopefully the phone will boot) and then will flash the dumped userdata with mtk. Hopefully that will work.
I'll see if I can somehow mount the mtk .bin file to see if I can get to the contents of it
Will have to use the live dvd as I have win 7 and python 3.9 cannot run on win 7.
EDIT: Can't start anything through the live dvd - is there any workaround for win 7 or is there a direct executable file which I can get to start the mtkclient?
Regards
Hello,
I also have an Umidigi Bison Pro that I am going to use as a daily driver. (It's a pity that it's unpopular it would be a great device for modding, it's cheap, rugged and has source code availability of the official ROM and kernel). I created a Telegram group about this phone if you want to join is https://t.me/UmidigiBisonPro
About your problem you can read this guide (it describes how to backup and extract from the file created by SP Flash Tool even the partitions that not visible such as the b slots) https://www.hovatek.com/forum/thread-21970.html
To give you an idea on my Bison Pro a total of 52 partitions were extracted.
If you have the full backup from before the bootloop (before the upgrade, when it was still working) my advice is to restore all partitions.
I consider myself a novice regarding modding but it is likely that after the upgrade the userdata partition is no longer readable.
I have read that you should not update the GSI ROMs but repeat the whole flash sequence.
I also recommend removing the forced encryption of the userdata partition (you can do this when rooting) to avoid exactly these problems where you have the partition backup but not the decryption key.
s80_gad said:
Flashed already the original stock rom super. img and everything else apart from userdata - it doesn't work.
see below
View attachment 5499133
Tried to flash it - it just restarts the phone straight away - in fact replaced it with sp flash tool as well which recognises only the "a" partition and flashes it there.
I see
I am guessing this is why I have to reflash the whole rom incl userdata in order to make the phone usable.
What I'll do is I'll try to dump userdata with mtk and then will reflash everything with the stock rom ()hopefully the phone will boot) and then will flash the dumped userdata with mtk. Hopefully that will work.
I'll see if I can somehow mount the mtk .bin file to see if I can get to the contents of it
Will have to use the live dvd as I have win 7 and python 3.9 cannot run on win 7.
EDIT: Can't start anything through the live dvd - is there any workaround for win 7 or is there a direct executable file which I can get to start the mtkclient?
Regards
Click to expand...
Click to collapse
Sorry for delay, I didn't receive any notification on this (or I didn't notice it), I hope you sorted out your issue, if not, let me know.
SubwayChamp said:
Sorry for delay, I didn't receive any notification on this (or I didn't notice it), I hope you sorted out your issue, if not, let me know.
Click to expand...
Click to collapse
I didn't received notification too on your message and I found out on profile account that the notification for new message on a thread are default disabled.
I recently had some problems and experimented with partitions.
Reducing the possible cases I think the decryption key for the userdata partition might be in these partitions: super , misc , nvdata , nvcfg , md_udc
and I noticed that if one of them is corrupted/different version the dm-verity check fails (in my case it is written on the screen) and it was necessary to reflash all partitions except userdata (I don't know if there is a faster combination, from the few tests done in this case I didn't find any)
Do you have more information about where the decryption key might be between those partitions?
I have made a brief description of the role of all the partitions encountered but I still don't know some of them:
boot_para
gz_a (/ gz_b)
md_udc
otp
spmfw_a (/ spmfw_b)
sspm_a (/ sspm_b)
teksunhw_a (/ teksunhw_b)
Werve said:
I didn't received notification too on your message and I found out on profile account that the notification for new message on a thread are default disabled.
I recently had some problems and experimented with partitions.
Reducing the possible cases I think the decryption key for the userdata partition might be in these partitions: super , misc , nvdata , nvcfg , md_udc
and I noticed that if one of them is corrupted/different version the dm-verity check fails (in my case it is written on the screen) and it was necessary to reflash all partitions except userdata (I don't know if there is a faster combination, from the few tests done in this case I didn't find any)
Do you have more information about where the decryption key might be between those partitions?
I have made a brief description of the role of all the partitions encountered but I still don't know some of them:
boot_para
gz_a (/ gz_b)
md_udc
otp
spmfw_a (/ spmfw_b)
sspm_a (/ sspm_b)
teksunhw_a (/ teksunhw_b)
Click to expand...
Click to collapse
Why do you think userdata has a decryption key? Unless the user set it in a backup done through a custom recovery or through the device itself, I don't think so, may I'm wrong, but which is your scenario?
SubwayChamp said:
Why do you think userdata has a decryption key? Unless the user set it in a backup done through a custom recovery or through the device itself, I don't think so, may I'm wrong, but which is your scenario?
Click to expand...
Click to collapse
Since the userdata partition is now usually encrypted either with FBE or FDE but once the system loads the files are readable and moveable even externally then it is clear that somehow the data has been decrypted precisely using the relevant decryption key, AES encryption usually.
So if the user has not specified any key this must be derived from the information already in the partitions from the factory.
Then by restoring the right combination of partitions the system can boot correctly by decrypting the userdata partition. Hence the tests and the report I wrote in my last post.
At the moment I was able to remove the forced encryption of the userdata partition by modifying super (specifically fstab present in the /vendor sub partition) but I would like to achieve the same systemless modification using Magisk (to be OTA compatible). Unfortunately, the options to remove dm-verity and forceencrypt have been hidden in the latest versions of Magisk to avoid problems with inexperienced uses.
Since I don't have a custom recovery on the Umidigi Bison Pro I can't force flag those options in the .magisk file so I have to find another way.
Werve said:
Since the userdata partition is now usually encrypted either with FBE or FDE but once the system loads the files are readable and moveable even externally then it is clear that somehow the data has been decrypted precisely using the relevant decryption key, AES encryption usually.
So if the user has not specified any key this must be derived from the information already in the partitions from the factory.
Then by restoring the right combination of partitions the system can boot correctly by decrypting the userdata partition. Hence the tests and the report I wrote in my last post.
At the moment I was able to remove the forced encryption of the userdata partition by modifying syper (specifically fstab present in the /vendor sub partition) but I would like to achieve the same systemless modification using Magisk (to be OTA compatible). Unfortunately, the options to remove dm-verity and forceencrypt have been hidden in the latest versions of Magisk to avoid problems with inexperienced uses.
Since I don't have a custom recovery on the Umidigi Bison Pro I can't force flag those options in the .magisk file so I have to find another way
Click to expand...
Click to collapse
Well, what I said is a different thing, the other user had a different interest than this. They did want to access to some data from a backup in a non-booting device, I referred to that, the userdata image backed up doesn't have an encryption by default, unless the user set one through a custom recovery, suppose that someone did take a backup from the userdata partition, this userdata image can be opened/readable for anyone with minimum skills and the appropriate tool.
In regard to your issue, I don't think, the userdata partition has any kind of restrictions to take OTA updates, most likely this resides in the bootloader, kernel or even a "silent/hidden" partition with no more functions than that.
As a side note, you should check some custom recoveries, specially in Xiaomi devices that easily allow taking OTA updates, for example I always can take OTA, when I use Orange Fox recovery, although I'm not interested, so I make updates manually, to be sure that all run fine.
SubwayChamp said:
Well, what I said is a different thing, the other user had a different interest than this. They did want to access to some data from a backup in a non-booting device, I referred to that, the userdata image backed up doesn't have an encryption by default, unless the user set one through a custom recovery, suppose that someone did take a backup from the userdata partition, this userdata image can be opened/readable for anyone with minimum skills and the appropriate tool.
In regard to your issue, I don't think, the userdata partition has any kind of restrictions to take OTA updates, most likely this resides in the bootloader, kernel or even a "silent/hidden" partition with no more functions than that.
As a side note, you should check some custom recoveries, specially in Xiaomi devices that easily allow taking OTA updates, for example I always can take OTA, when I use Orange Fox recovery, although I'm not interested, so I make updates manually, to be sure that all run fine.
Click to expand...
Click to collapse
The methodology I was referring to that is not OTA supported is to modify the super partition (the dynamic partition that from Android 8? contains system, vendor, product--for Project Treble) to disable the forced encryption of the userdata partition. In my case FBE (File Based Encryption) Android 11 encryption.
Even having disabled the dm-verity if you apply an OTA update the super partition is replaced with the one that does not have the modification to remove the forced encryption and from the tests I have done this refuses to read unencrypted partitions and asks to do a factory reset.
So, the userdata partition makes the OTA update problematic (it doesn't block it, but you lose your personal data).
I am sure that instead of modifying the super partition to disable encryption you can achieve the same result via Magisk and a modified boot partition.
Unfortunately despite many trials due to my inexperience with Magisk I could not do it.
I wanted to do all this to avoid problems as described in the case of this thread that is, have the userdata partition intact but not the rest to be able to describe it. But seems I must let the encryption and do a backup after every OTA update.
Werve said:
The methodology I was referring to that is not OTA supported is to modify the super partition (the dynamic partition that from Android 8? contains system, vendor, product--for Project Treble) to disable the forced encryption of the userdata partition. In my case FBE (File Based Encryption) Android 11 encryption.
Even having disabled the dm-verity if you apply an OTA update the super partition is replaced with the one that does not have the modification to remove the forced encryption and from the tests I have done this refuses to read unencrypted partitions and asks to do a factory reset.
So, the userdata partition makes the OTA update problematic (it doesn't block it, but you lose your personal data).
I am sure that instead of modifying the super partition to disable encryption you can achieve the same result via Magisk and a modified boot partition.
Unfortunately despite many trials due to my inexperience with Magisk I could not do it.
I wanted to do all this to avoid problems as described in the case of this thread that is, have the userdata partition intact but not the rest to be able to describe it. But seems I must let the encryption and do a backup after every OTA update.
Click to expand...
Click to collapse
If you want to apply an OEM vendor stock update then it is a restriction from the OEM itself, and if you want to apply a GSI based update, it's a different approach, not sure if the restriction is FBE related or if the userdata is encrypted or not but probably related to AVB.
There are some tools/scripts you should search for, that can unpack and repack super partition, maybe you find something in the ODM or product image, this is assuming that the super partition it is the culprit.
Just know that it's a nonsense that an order (script) to restore a specific partition, be placed just there, but in other partition.
You should check what the OTA update contains, try to catch the OTA update through some ADB script, then unpack it, and see inside.
Also, you can try backing up every partition, and restoring them one by one, seeing if it boots.
SubwayChamp said:
If you want to apply an OEM vendor stock update then it is a restriction from the OEM itself, and if you want to apply a GSI based update, it's a different approach, not sure if the restriction is FBE related or if the userdata is encrypted or not but probably related to AVB.
There are some tools/scripts you should search for, that can unpack and repack super partition, maybe you find something in the ODM or product image, this is assuming that the super partition it is the culprit.
Just know that it's a nonsense that an order (script) to restore a specific partition, be placed just there, but in other partition.
You should check what the OTA update contains, try to catch the OTA update through some ADB script, then unpack it, and see inside.
Also, you can try backing up every partition, and restoring them one by one, seeing if it boots.
Click to expand...
Click to collapse
I have already done these tests, not with an OTA update but with a different version of the firmware for all partitions, and set out the conclusions.
Obviously it's an OEM restriction since it left the forced FBE encryption on and the way it was created (so I guess also from AOSP) it refuses to read the userdata partition if it doesn't find it encrypted.

Categories

Resources