Related
These tablets were sold with certain Vizio TVs in mid-2016 into 2017, primarily used for Smartcast to the TV.
They are now obsolete since Vizio released firmware for their TVs turning them into normal Smart TVs, requiring the owners of these TVs to get new remotes and the tablets stopped being useful for this function.
Here in 2019, one can buy these tablets, at the low price end, in working condition, for $25 (for the M series) to $40 (for the P series) shipped.
The specs are as follows:
XR6M10:
Snapdragon 410 1.2GHz quadcore APQ8016
2GB RAM
8GB Storage
1280x720 IPS display
802.11n, Bluetooth 4.0
2740mAh battery
MicroUSB for charging, Qi Charging built-in for bundled charge pad or any compatible charging solution
XR6P10:
Snapdragon 615 1.45GHz octocore APQ8039
2GB RAM
16GB Storage
1920x1080 IPS display
802.11n, Bluetooth 4.0
2740mAh battery
MicroUSB for charging, Qi Charging built-in for bundled charge pad or any compatible charging solution
Both tablets feature side-firing stereo speakers, a headphone jack, and NO cameras. The size of the tablet is comparable to the size of a Galaxy Note 9, give or take.
Both tablets came with Android 5.1.1, and OTA updates upgraded them to 6.0.1. There are ZERO available stock ROM files available for the tablets. I've tried sniffing the updater and they seem to go to a dead website.
The stock ROM is fairly clean, and only has the Vizio Smartcast app which needs disabling upon setting up. Aside from this, there is no other bloatware on the tablet to speak of after running a fine-tooth comb through the system apps. You get a clean and snappy tablet.
The problem:
There's no stock ROM file available, neither for Android 5.1.1 or for 6.0.1. Vizio does not have any sort of download for either on their site, nor did in the past. The updater checked a third-party website affiliated with Vizio to manage the tablet's updates, as it does with their TVs. Since the website is inert, it can be safely said that Vizio is no longer interested in their existence at all, especially since the warranty on every single one of these tablets is now up.
The tablet seems it can have the bootloader unlocked, the developer options has the toggle for that, but there's no way to get into fastboot. Holding VOL UP+DOWN+POWER at boot or sending the "adb reboot bootloader" command sends it into a "Qualcomm HS-USB QDLoader 9008" mode under USB. This, from what I understand, is behavior persistent with the locked bootloader, but I have no idea of how to get it out of this and just into fastboot. Stock recovery does not have a fastboot option either.
The desires list:
Have someone that knows the intricacies of the MSM8916 platform and the APQ8016/APQ8039 get their hands on these tablets
Get a ROM dump of both tablets in stock form so people with bricked tablets can flash them with it
Get Root (Patch level on the 6.0.1 stock ROM is from October 2016, shouldn't be hard)
Get the bootloader unlocked, somehow, and if not, figure a way to get something like Safestrap running on it if the out-of-the-box kernel allows for it
Custom ROMs? LineageOS would be sweet, especially with some of the tablet-specific fixes that have dropped in the past couple months overall.
so I ask: is there any interest in the freeing of these super cheap tablets? The price to spec ratio is not bad (once again, I got my 6M10 for $25 shipped, and the seller has like 7 more as of the time of this writing), and it doesn't seem like it would be all too hard to unlock the bootloader and get it rooted (at least, from my perspective, that of a novice in this specific hardware field). There are plenty of these in the wild in the hands of people that bought the TVs and plenty in the hands that bought them from ebay when the tablets became obsolete.
This link contains screenshots of CPU-Z and the About Tablet settings section from the tablet, uploaded to imgur. If anyone needs more information on this tablet that needs an app or adb command, I can make this happen.
Board Pic of the XR6M10, XR6P10 should be the same inside:
(click for larger image)
Update: I have temp root.
I have temp root!-the latest kingroot (NOT Kingoroot) APK seemed to have done the trick. I was able to fire up adaway and get the hosts file set up with adblocks to keep the thing safer.
The root is still temporary so it goes away after a reboot. The rooting process involves it doing the root process once, then rebooting, then failing, then you reboot once more, and then retry rooting from the app. From here, 80% of the time, it works and you're able to get temporary root for that boot session.
Once you're done with anything you need root for, you should reboot and then uninstall Kingroot, which you then need to deactivate the device administrator priveleges for, before it will allow you to cleanly uninstall it.
I also made a huge discovery that may turn out better for anyone that can help getting this thing properly rooted and the bootloader unlocked... it seems the file manager included in the stock ROM is v3.0.0 from Cyanogenmod 12.1.
This makes me think that the ROM creator either used that since it was opensource and readily available than come up with their own solution, or that this ROM has some cyanogenmod roots.
I also found this post from another Q&A thread in this section:
TheDrive said:
This device have made by Chinese/Indian company Borqs. The code name Bennu-M. Platform is Qualcomm APQ8016 (MSM8916 w/o modem). There should work standard method to bring EDL mode. Hold Vol+ and Vol- at power on (press power). Then connect to the PC. Thus device will stay look dead, however should be detected as Qualcomm QDLoader 9008 on the PC side. This is the factory described method.
You can flash factory firmware from this mode using external bootloader (programmer) for MSM8916 firehose protocol. This procedure is described in the thousands of manuals around the net. Qualcomm tools like QPST or QFIL can be used as good as many 3rd party utils to flash and manage any another available way. Many professional 'box' tools should support this device too but only as 'generic' msm8916 (if applicable).
However I can't find the firmware package for this device anywhere. You should ask and require the manufacturer/distributor to publish firmware, the source code and all the corresponding matherials to be able to flash and rebuild firmware from sources in any manner you want without any limitations as required by GNU/GPL free open source software licenses this firmware is obligated to.
Everyone who have the device working or software dead, can try to dump the current firmware and data, stored on the internal eMMC memory module in part(s) or in whole image using free QTools project utilities and suitable external bootloader with ability to dump eMMC, not only to flash as many factory supplied programmers do. There are programmer(s) for MSM8916 available in the project repo. Read and understand manuals carefully before trying anything!
There is definitely another ways to root, dump, flash, manage the device in any manner YOU WANT, not only the way you are "allowed" to use your own device by manufacturer/distributor. FTA!
You can root the device then dump all the multiple partition images manually (dd if=/dev/block/mmbblk0...... of=/sdcard/......) or using built custom recovery like CWM/TWRP for your device. Please note, kernel sources are important but not mandatory to build e.g. CWM. You can build one using CWM image from the similar device and the kernel (boot/recovery) image binaries from your device. There are good manuals and image repacking utils available around like e.g. AndImgTool.
There are the way to produce factory image from the eMMC/partitions dump(s). Use utils like R-Studio to dump particular partition images from the eMMC dump (it's like whole HDD or UFD image with all the sectors raw, one by one, w/o any modifications/compression/etc) Manuals / utils are avavailable to make e.g. sparse and xml scripts set which is flashable by the programmer in the EDL mode (i.e. from any damaged state, because EDL is built in to the PBL and masked to the internal CPU ROM, thus can not be damaged in any manner, except firing the CPU up).
You can also flash partition images from the more common Fastboot mode, unless eMMC GPT and bootloaders (SBL/RPM/TZ/ABoot) stay intact (logo showed). You can't dump from fastboot, which is common due to the (foolish) 'safety' requirements. It's security by obscurity and is definitely not for your favor, but for the corps control over you and force to send valuable private data to foreign clouds.
Please share eMMC full and/or partitions dumps using reliable 'neverending' file cloud/hosting since there is no factory firmware available yet (ever). I do not own this device and never seen being overseas, so I can't share.
Click to expand...
Click to collapse
This gives a little bit more information but seems to be more waffle than helpful. Still need someone, or some individuals, that can get one of these devices into their hands and work on a way to get the bootloader unlocked, the eMMC dumped, and ROMs going.
Update file?
I THINK I have the update file for 6.0.1. I did a packet sniff on a 5.1.1 tablet using a mitm packet sniffer and I ran the system updater, and was able to get this URL:
http://updatev.vo.llnwd.net/v1/idownload/64821.bin
The filesize is 570MB or so, and it looks like it might be the real deal. since it's a .bin file and 7zip can't read it, I won't be able to see what it really is without going over to the box that has a copy of universal extractor installed.
I'll be doing this momentarily and editing this post once I figure out what the contents are or if it's even readable to that extent. Knowing vizio, it could very well be encrypted and need decrypting by the updater application.
Update: it seems to be encrypted. oh joy.
Update 2: I got together with a friend on discord and we successfully decompiled the updater app to a point.
This MEGA link contains all the files thus far and a copy of the tablet's /system/framework folder for decompiling purposes.
However, it doesn't seem we're getting anywhere. the file is still encrypted and I still can't figure out what's needed to decrypt it. Hopefully someone with more knowledge on this can lend a hand.
Sudosftw said:
I THINK I have the update file for 6.0.1. I did a packet sniff on a 5.1.1 tablet using a mitm packet sniffer and I ran the system updater, and was able to get this URL:
http://updatev.vo.llnwd.net/v1/idownload/64821.bin
The filesize is 570MB or so, and it looks like it might be the real deal. since it's a .bin file and 7zip can't read it, I won't be able to see what it really is without going over to the box that has a copy of universal extractor installed.
I'll be doing this momentarily and editing this post once I figure out what the contents are or if it's even readable to that extent. Knowing vizio, it could very well be encrypted and need decrypting by the updater application.
Update: it seems to be encrypted. oh joy.
Update 2: I got together with a friend on discord and we successfully decompiled the updater app to a point.
This MEGA link contains all the files thus far and a copy of the tablet's /system/framework folder for decompiling purposes.
However, it doesn't seem we're getting anywhere. the file is still encrypted and I still can't figure out what's needed to decrypt it. Hopefully someone with more knowledge on this can lend a hand.
Click to expand...
Click to collapse
Just out of curiosity, with the temp root, have you tried using dd to get the recovery image off? If we can do that, we might be able to work on getting a custom recovery built.
Qiangong2 said:
Just out of curiosity, with the temp root, have you tried using dd to get the recovery image off? If we can do that, we might be able to work on getting a custom recovery built.
Click to expand...
Click to collapse
It's not possible to get a proper recovery image from within the system files so far as I know, but my take so far has been that there is no proper way to get that at this time without decrypting that file grabbed from the update server. I'd do it on a 5.x ROM since that will get me permaroot, but the issue is getting and keeping root on a 6.x ROM.
Although encrypted (so far as I can tell) the image linked above is the real deal, and I've given all I can to get it decrypted. A proper exploit to take care of this tablet's vulnerabilities and get temp root (on 6.x) that isn't kingo is what is really needed at this point so to not hinder going around the system with crudware and shady background apps, shouldn't be hard since the security patch level for the 6.x ROM is 2016-10-01.
Even if the ROM is extracted or a recovery image found, custom recovery won't be possible until the bootloader is unlocked, and this isn't doable until someone figures out how the qualcomm qdloader9008 stuff works with this specific tablet. Fastboot is unreachable and I'm almost sure I'm doing something wrong.
I'll get temp root and see about dd'ing stuff later on. What exactly would be needed for me to dd off? Whole disk and then go through it elsewhere? I could definitely see if rsync exists and dd over rsync to another box.
Sudosftw said:
It's not possible to get a proper recovery image from within the system files so far as I know, but my take so far has been that there is no proper way to get that at this time without decrypting that file grabbed from the update server. I'd do it on a 5.x ROM since that will get me permaroot, but the issue is getting and keeping root on a 6.x ROM.
Although encrypted (so far as I can tell) the image linked above is the real deal, and I've given all I can to get it decrypted. A proper exploit to take care of this tablet's vulnerabilities and get temp root (on 6.x) that isn't kingo is what is really needed at this point so to not hinder going around the system with crudware and shady background apps, shouldn't be hard since the security patch level for the 6.x ROM is 2016-10-01.
Even if the ROM is extracted or a recovery image found, custom recovery won't be possible until the bootloader is unlocked, and this isn't doable until someone figures out how the qualcomm qdloader9008 stuff works with this specific tablet. Fastboot is unreachable and I'm almost sure I'm doing something wrong.
I'll get temp root and see about dd'ing stuff later on. What exactly would be needed for me to dd off? Whole disk and then go through it elsewhere? I could definitely see if rsync exists and dd over rsync to another box.
Click to expand...
Click to collapse
I found this today: https://forum.xda-developers.com/axon-7/development/edl-emergency-dl-mode-twrp-unlock-t3553514
The miflash tool seems promising (it works with nearly any device)
For the dd stuff, you can usually figure out the partitions easily with the fstab file in /. However, getting a raw dump is always useful.
Really, the big 3 would be the recovery.img, the boot.img, and the system.img. We can work from there
Qiangong2 said:
I found this today: https://forum.xda-developers.com/axon-7/development/edl-emergency-dl-mode-twrp-unlock-t3553514
The miflash tool seems promising (it works with nearly any device)
For the dd stuff, you can usually figure out the partitions easily with the fstab file in /. However, getting a raw dump is always useful.
Really, the big 3 would be the recovery.img, the boot.img, and the system.img. We can work from there
Click to expand...
Click to collapse
I've had that installed whilst trying to figure the image out and the qdloader stuff, it doesn't do anything for this tablet sadly :/
Sudosftw said:
I've had that installed whilst trying to figure the image out and the qdloader stuff, it doesn't do anything for this tablet sadly :/
Click to expand...
Click to collapse
Hmmm. Which tablet do you have? The M or the P?
Qiangong2 said:
Hmmm. Which tablet do you have? The M or the P?
Click to expand...
Click to collapse
this is the M. the P was out of my price range ($40 shipped over $25 shipped) when I was looking at them, but now the Ms are going for around 25 bucks but 15 shipping from another seller, bringing the price up to 40 bucks where the P was. ended up buying the other Ms from the one seller and gave them out to family members because I was so impressed... but I really should have set some money aside for one of the Ps as well and didn't.
Sudosftw said:
this is the M. the P was out of my price range ($40 shipped over $25 shipped) when I was looking at them, but now the Ms are going for around 25 bucks but 15 shipping from another seller, bringing the price up to 40 bucks where the P was. ended up buying the other Ms from the one seller and gave them out to family members because I was so impressed... but I really should have set some money aside for one of the Ps as well and didn't.
Click to expand...
Click to collapse
Okay. You said miflash doesn't do anything, does the device show up in the application and not function? Or does it not show up at all?
Qiangong2 said:
Okay. You said miflash doesn't do anything, does the device show up in the application and not function? Or does it not show up at all?
Click to expand...
Click to collapse
just doesn't show up at all. and yet installing the qualcomm qdloader drivers says it's connected in device manager, so something's up. tried on two different boxes, different cables, no dice.
Sudosftw said:
just doesn't show up at all. and yet installing the qualcomm qdloader drivers says it's connected in device manager, so something's up. tried on two different boxes, different cables, no dice.
Click to expand...
Click to collapse
Hmmm. That's unusual. Are you running it in win 7 compatibility mode?
It would be nice to see community roms for these devices. I have the XR6P. If you need any info from this device, just tell me what to do.
I'm very interested in this as I have one of these tablets that I would like to use in my vehicle as a display for my piggyback ECU tuner. It doesn't currently support USB OTG, but I read that if I can gain root access I can add the file to give it USB Host functionality. Can anyone confirm this? I have tried several apps to get it rooted including Kingroot as you were able to get a temp root with that. Unfortunately Kingroot, as all the others I have tried, won't even install on the tablet. Again, I'm only looking to get this thing to be OTG capable. If anyone here has any suggestions, I would be very grateful! Thanks all!
I just bought an M remote to replace my broken P remote. My P remote had Android 6. My M remote has Android 5, and the OTA updater says there's no update. Any way to get Android 6 on this?
I have factory firmware for Bennu P and Bennu M , but take some time to upload the file.
ALANCHONG said:
I have factory firmware for Bennu P and Bennu M , but take some time to upload the file.
Click to expand...
Click to collapse
Hey. You can lay out the firmware for XR6M10
XR6M10 and XR6P10 firmware
konog said:
Hey. You can lay out the firmware for XR6M10
Click to expand...
Click to collapse
Mega Link: mega.nz/#F!n65kVYIT!PKH8A1WoD_Nc4DU_-9dbiQ
ALANCHONG said:
Mega Link: mega.nz/#F!n65kVYIT!PKH8A1WoD_Nc4DU_-9dbiQ
Click to expand...
Click to collapse
All the time, an error pops up at 12 seconds
Flash fail (-4002)
Log:
21:59:03.576 Arrival: \\?\USB#VID_05C6&PID_9008#5&13a74b18&0&11#{86e0d1e0-8089-11d0-9ce4-08003e301f73}
21:59:03.591 Thread '_PortDownloadThread' started
21:59:04.610 Get Port ...
21:59:04.610 _GetDevicePortName (0): COM5
21:59:04.630 _ComPort: COM5
21:59:04.640 Get Port (0)
21:59:04.650 Flash ...
21:59:09.668 _Connect (0)
21:59:09.668 Downloading flash programmer: C:\_qcMUP\v8016-SIGNED-VIZIO-user-IMAGES\v8016-SIGNED-VIZIO-user-IMAGES\prog_emmc_firehose_8916.mbn
21:59:14.669 Failed to read the command from the opened port
21:59:14.669 _FlashProgrammer (-4002)
21:59:15.700 Flash (-4002)
21:59:15.700 Flash fail (-4002)
21:59:15.731 Download ended: -4002
21:59:15.763 Thread '_PortDownloadThread' ended
konog said:
All the time, an error pops up at 12 seconds
Flash fail (-4002)
Log:
21:59:03.576 Arrival: \\?\USB#VID_05C6&PID_9008#5&13a74b18&0&11#{86e0d1e0-8089-11d0-9ce4-08003e301f73}
21:59:03.591 Thread '_PortDownloadThread' started
21:59:04.610 Get Port ...
21:59:04.610 _GetDevicePortName (0): COM5
21:59:04.630 _ComPort: COM5
21:59:04.640 Get Port (0)
21:59:04.650 Flash ...
21:59:09.668 _Connect (0)
21:59:09.668 Downloading flash programmer: C:\_qcMUP\v8016-SIGNED-VIZIO-user-IMAGES\v8016-SIGNED-VIZIO-user-IMAGES\prog_emmc_firehose_8916.mbn
21:59:14.669 Failed to read the command from the opened port
21:59:14.669 _FlashProgrammer (-4002)
21:59:15.700 Flash (-4002)
21:59:15.700 Flash fail (-4002)
21:59:15.731 Download ended: -4002
21:59:15.763 Thread '_PortDownloadThread' ended
Click to expand...
Click to collapse
Please check if the driver is installed
Disclaimer: By attempting any of the processes listed in this thread you accept full responsibility for your actions. I will not be held responsible if your device stops working, catches fire, or turns into a hipster and claims to have been modified before it was cool.
Hi everyone, similar to the previous threads for
OP3, OP3T, OP5, OP5T, OP6, OP6T, OP7, OP7PRO, regular OP7T, T-Mobile OP7T, regular OP7TPRO, T-Mobile OP7TPro 5G, regular OP8, T-Mobile OP8 and OP8Pro here are the EDL packages (also known as MSM tools or unbrick tools) that can revive a bricked OnePlus Nord.
You can also rollback your phone to a previous release of OOS with them if for some reason you would like to go back to an older firmware
You can download the following versions:
AC01AA tools (global firmware):
ANDROID 10:
OOS 10.5.2
OOS 10.5.3
OOS 10.5.4
OOS 10.5.5
OOS 10.5.7
OOS 10.5.8
OOS 10.5.9
OOS 10.5.10
OOS 10.5.11
Mirror for first and last MSMs: https://onepluscommunityserver.com/
AC01BA tools (european firmware):
ANDROID 10:
OOS 10.5.2
OOS 10.5.3
OOS 10.5.4
OOS 10.5.7
OOS 10.5.8
OOS 10.5.9
OOS 10.5.10
OOS 10.5.11
Mirror for first and last MSMs: https://onepluscommunityserver.com/
AC01DA tools (indian firmware):
ANDROID 10:
OOS 10.5.2
OOS 10.5.3
OOS 10.5.4
OOS 10.5.7
OOS 10.5.8
OOS 10.5.9
OOS 10.5.10
OOS 10.5.11
Mirror for first and last MSMs: https://onepluscommunityserver.com/
Warning:
As this happened on OnePlus 8 and OnePlus 8 Pro Pro, it is advised to take backup of /persist partition before crossflashing (eg going from European to Indian build) as fingerprint reader may give an error related to enrollment issue. You can do so by using dd if=/dev/block/bootdevice/by-name/persist of=/sdcard/persist.img (you must have root access, see https://forum.xda-developers.com/oneplus-nord/how-to/guide-how-to-root-oneplus-nord-t4139411 for that) and moving it to your computer/cloud.
Instructions:
Launch MsmDownloadTool V4.0.exe.
On the login prompt select "Other" in the dropdown menu and click on Next.
Wait a few seconds until main window shows up.
Click on Target button and select O2 while using global tool or India while using indian tool or EU when using european tool.
Press Start button (this is done so that device will be "captured" automatically by tool instead of going back to normal boot after 10 seconds)
Power your device off.
Let it cool down for one minute.
Maintain volume up and volume down keys for at least 40 seconds to get into Qualcomm EDL mode.
Plug your device to your computer using stock OnePlus cable. (You may let volume keys go once done.)
Wait ~300 seconds.
Enjoy your brand new device.
FAQ:
Does this work on Mac or on Linux?
Unfortunately no, tool is Windows only. You should need at least Windows 7.
Why is my antivirus freaking out when unzipping the archive or running the tool?
In an effort to protect reverse engineering from being done (and by extension prevent conversion process like it was done on 6T and 7Pro), OnePlus now use VM Protect V3 in their MSM tools. As this tries to detect debug environment, this is seen as malicious behaviour by some antivirus.
My device isn't detected
Go to device manager and make sure your phone shows up as QDLOADER 9008.
If it shows up as QHUSB_BULK, it means Qualcomm driver wasn't installed automatically by Windows Update. Download the latest one from Microsoft website at http://download.windowsupdate.com/c..._fba473728483260906ba044af3c063e309e6259d.cab (source https://www.catalog.update.microsoft.com/Search.aspx?q=qualcomm hs usb 9008 ) and install it manually by right clicking on QHUSB_BULK and selecting "Update driver software" and "Browse my computer for driver software" to where you downloaded CAB file.
MSM tool is stuck on "Param pre-processing"
Ensure you're using the Qualcomm drivers linked above.
MSM tool is stuck on "Sahara communication failed"
Unplug your phone, get in fastboot mode, turn off phone, wait 15 secondes and get back in Qualcomm EDL mode. You can also try using a USB 2.0 port instead of a 3.0 one.
What is SMT Download mode?
Just don't try to unlock that mode, it will wipe your IMEI and your Widevine certificate if you use it.
How can I fix "SMT config not found" error?
Please refer to https://forum.xda-developers.com/showpost.php?p=83448961&postcount=61, all credits to @Shadow12347 for finding it out.
Credits:
@Lord Ace for testing 10.5.2 Indian tool on his device.
OnePlus for the device and OS
Related: [OnePlus Nord][ROM][OTA][Oxygen OS] Repo of Oxygen OS Builds
It worked for me,
After unlocking and locking bootloader and ended with corrupted device on locked bootloader
This method helped to solve it.
Thank You
Big thank you!
Thank you very much, just what I'm looking for
Thanks a lot
Good stuff man. Appreciate it!
Does anyone have a persist.img for Global firmware.
I have a different issue which I'd like to try resolve with persist.img
https://forum.xda-developers.com/oneplus-nord/help/nv-backup-warning-t4148599
Big thanks, fixed my semibricked Nord, time to try an GSI again
Small token for the help: Transaction ID: 5NF52401AU895305W
NisseGurra said:
Small token for the help: Transaction ID: 5NF52401AU895305W
Click to expand...
Click to collapse
Thanks for your donation, appreciate
@ Some_Random_Username
I have a NVBackupUI(thread here) error msg that refuses to go away.
I have used your guide to reflash OOS 10.5.2 but the error message is still there.
Do you by any chance have any idea on a way to resolve this?
norder said:
@ Some_Random_Username
I have a NVBackupUI(thread here) error msg that refuses to go away.
I have used your guide to reflash OOS 10.5.2 but the error message is still there.
Do you by any chance have any idea on a way to resolve this?
Click to expand...
Click to collapse
How you got this error..
And is this affecting your phone functionality?
cultofluna said:
How you got this error..
And is this affecting your phone functionality?
Click to expand...
Click to collapse
This is a brand new set and I first noticed it after I set up my phone. The usual data transfers, reinstalling apps etc. But now, it will not go away. Im thinking it's like that out of the box, just that I did not notice it earlier.
So far I have not had any issues functionality wise and my local OP support tells me to ignore it and a future update will fix it. They're not sure of the cause either and could not fix it.
This message keeps coming back even after multiple factory resets + a ROM reflash. I'm trying to rule out a hardware issue.
I did notice that this app is one of those that you remove when you debloat your OP set. I'm sure it would go away if I did that but if theres an underlying issue I might just be setting myself up for a catastrophic failure in future.
Hi, my friend really messed up with his phone. Phone currently have encrypted data partition. Problem is that msmtool doesn't detect phone at all, also device manager doesn't show it while its in msmtool. Anything he can do?
norder said:
This is a brand new set and I first noticed it after I set up my phone. The usual data transfers, reinstalling apps etc. But now, it will not go away. Im thinking it's like that out of the box, just that I did not notice it earlier.
So far I have not had any issues functionality wise and my local OP support tells me to ignore it and a future update will fix it. They're not sure of the cause either and could not fix it.
This message keeps coming back even after multiple factory resets + a ROM reflash. I'm trying to rule out a hardware issue.
I did notice that this app is one of those that you remove when you debloat your OP set. I'm sure it would go away if I did that but if theres an underlying issue I might just be setting myself up for a catastrophic failure in future.
Click to expand...
Click to collapse
norder said:
@ Some_Random_Username
I have a NVBackupUI(thread here) error msg that refuses to go away.
I have used your guide to reflash OOS 10.5.2 but the error message is still there.
Do you by any chance have any idea on a way to resolve this?
Click to expand...
Click to collapse
Unfortunately no idea, MSM tool in upgrade mode doesn't touch to NV items.
Either wait a new OOS build after 10.5.4 or RMA your device.
skayii said:
Hi, my friend really messed up with his phone. Phone currently have encrypted data partition. Problem is that msmtool doesn't detect phone at all, also device manager doesn't show it while its in msmtool. Anything he can do?
Click to expand...
Click to collapse
Make sure his device is off before trying to get in Qualcomm HS-USB 9008 mode, that was something we ran into during testing.
Also as a sidenote encryption state of the phone doesn't matter to use this tool.
Thanks a lot for the unbrick tool!
Some_Random_Username said:
Unfortunately no idea, MSM tool in upgrade mode doesn't touch to NV items.
Either wait a new OOS build after 10.5.4 or RMA your device.
Click to expand...
Click to collapse
Understood. Thank you
Works great thanks a lot for the links i had to install the driver and your post was well made to avoid me any hassles
By the way, it re-locks the bootloader
@ Some_Random_Username
can you tell me how you got this tool?
i could try getting the tool with oxygen os 10.55
thanks for this.
I'm might be in wrong place but im Looking for any info on g8 power lite variant of g8 power. UK unlocked regards retail. Looking like It is a oddball as I cannot find anything. I don't think there will be much support but if anybody knows if this similar enough to any other variant ?? Android pie out the box no update. Not even Moto app to enable one button navbar. Any help thanks
Hello
I just got the LATAM version of that same phone, and i can tell you that it's gonna take some time to get information, but it will appear in some time.
Indeed, this is the right place, but it seems to be that similar models have variants around the globe, and the Moto G8 Power Lite it's not a priority right now.
I'm waiting the same for my version (XT2055-2), but it's just a matter of patience.
Keep looking on the forum and eventually it will appear some information
Kiffo said:
Hello
I just got the LATAM version of that same phone, and i can tell you that it's gonna take some time to get information, but it will appear in some time.
Indeed, this is the right place, but it seems to be that similar models have variants around the globe, and the Moto G8 Power Lite it's not a priority right now.
I'm waiting the same for my version (XT2055-2), but it's just a matter of patience.
Keep looking on the forum and eventually it will appear some information
Click to expand...
Click to collapse
Yea I thought as much, motorola seems to be putting out lots of versions of every device. This is by far the worst device I have had in recent memory, seems be missing quite a bit of the usual options available on other recent moto devices. I would have a go at bits myself but it also seems my version of this device has a Chinese bootloader installed, I don't think I will still have this device by the time any work is done I need to change phones quite often for work. Good luck.
bukata said:
Yea I thought as much, motorola seems to be putting out lots of versions of every device. This is by far the worst device I have had in recent memory, seems be missing quite a bit of the usual options available on other recent moto devices. I would have a go at bits myself but it also seems my version of this device has a Chinese bootloader installed, I don't think I will still have this device by the time any work is done I need to change phones quite often for work. Good luck.
Click to expand...
Click to collapse
The chinese bootloader is something common on Motorola, even i have the same thing. But i guess they gonna come up with something. As per today, the Brazil version of this smartphone started getting Android 10 (with some bugs tho) so i guess Motorola gonna start moving things in the coming weeks
Hi, I've got g8 power lite and would like some modding but how can I recon which version have I got?
islandman75 said:
Hi, I've got g8 power lite and would like some modding but how can I recon which version have I got?
Click to expand...
Click to collapse
Go to Settings > About Phone > Model & hardware
and it will show you the Model, Serial number and Model(SKU) of the device. Ithing what you are after is the SKU.
Tip: Under the title "Model & Hardware" you should see "Model: moto g8 power lite" in a gray(er) font.
{This may vary between models and versions}
Hope this helps.
lennonhorrocks said:
Go to Settings > About Phone > Model & hardware
and it will show you the Model, Serial number and Model(SKU) of the device. Ithing what you are after is the SKU.
Tip: Under the title "Model & Hardware" you should see "Model: moto g8 power lite" in a gray(er) font.
{This may vary between models and versions}
Hope this helps.
Click to expand...
Click to collapse
found it, thank you. I've got XT2055-1
It's not possible to unlock the bootloader on the G8 power lite, only the G8/G8 power.
It cannot be done using fastboot but it is certainly possible using the Realtek VCOM USB protocol
Rooting Moto G8 Power Lite
Does anyone know where I can find a decent guide to rooting the G8 Power Lite (if one exists - I know it's only been out a few months)? I've had a Google around and looked on this forum and on reddit but I can't find anything. I haven't done...
forum.xda-developers.com
This video sums it up well
Essentially you need to:
1. download MTKCLIENT from github, works best on Linux IMHO but Windows works too - on Windows you need additional USB drivers and MTK Drivers, which i attached. Use PIP to install the requirements by going into the MTKCLIENT directory and typing into CMD/Terminal: python3 pip install -r requirements.txt
2. Copy the G8 power Lite specific script to the root folder of the MTKCLIENT
3. Open up the phone, remove the plastic covering the cameras and motherboard. Unplug the battery. Short these two pins either by soldering them together or just using something metal - this is only necessary during the flash and then should be removed.
View attachment 5889467
4. Plug in usb cable to the phone but dont connect it to the pc yet. Start the program either by CD-ing to the MTKCLIENT directory and running it via CLI (on Linux: python3 mtk w proinfo,seccfg proinfo.bin,seccfg.bin, If it wont unlock using the custom G8 script, just run this generic command: python mtk da seccfg unlock) or doubleclicking the desbloq_bootloader.bat on Windows. Then short the two pins, keep them shorted and connect the USB cable to the PC. You should see a bunch of code scroling, it will automatically close/end.
5. Unplug USB, remove short circuit from two pins, plug in battery, turn on phone, you should see lines of text during the boot like this:
View attachment 5889471
Bootloader unlocked. Now the only use is ROOT, no custom ROMs or Recoveries available as its vastly different from normal G8 power, which has a Snapdragon CPU and totally different screen. You'll also get a big "CARRIER INVALID" message on the home screen, so after you ROOT make sure to relock the bootloader using the same method but the command is python3 mtk da seccfg lock
I'm almost sure that what I got it's a - Moto g8 Power lite - XT2055-1
So I got the phone long ago and it's been mostly at home and used as a backup by some of my friends.. I can't even remember which person had it last time.
Thing is that I completely forgot about the Motorola protection and after factory reset it keeps on asking for the last used google account which I got no clue which one would be. To make things worst I have no way to find out the IMEI's so that I can use Motorola RSA.
It looks like to me that I can't enter BootRom mode and I can only access preloader mode even tho, I got access to recovery mode and meta mode. I have tried all the key combos I can imagine by now.
I have also tried sp flash tools but I'm getting an error when the process is starting.
I'll drop some more details soon.. thank you.
BadChoices said:
I'm almost sure that what I got it's a - Moto g8 Power lite - XT2055-2
So I got the phone long ago and it's been mostly at home and used as a backup by some of my friends.. I can't even remember which person had it last time.
Thing is that I completely forgot about the Motorola protection and after factory reset it keeps on asking for the last used google account which I got no clue which one would be. To make things worst I have no way to find out the IMEI's so that I can use Motorola RSA.
It looks like to me that I can't enter Boot mode and I can only access Preload mode even tho, I got access to recovery mode. I have tried all the key combos I can imagine.
I have also tried sp flash tools but I'm getting an error when the process is starting.
I'll drop some more details soon.. thank you.
Click to expand...
Click to collapse
have you tried using mtkclient? unlock the bootloader and then remove frp
aryanhington said:
have you tried using mtkclient? unlock the bootloader and then remove frp
Click to expand...
Click to collapse
I did before as far as I recall but I gave up on it I think 'cus I ran into some issues as well.. I'm a bit rusty when it comes to this kind of stuff.. now that I'm reading all again about the tools etc I'm gonna give mtkclient a go and keep you all posted. Thank you again.
First off some questions please.. and I'm running win 11 pro.
What am I suppose to see on the screen when on Brom mode ? or how do I know that I'm on that mode.. obviously that if I'm not the operations just fail.
cant run mtk_gui atm for some reason trying to clear that out.. 'C:\Users\Q\AppData\Local\Programs\Python\Python311\Lib\site-packages\shiboken6\libshiboken does not exist'
Also tried bypass_utility_v1.4.2 using dif. key combos always returns 'device in preloader mode, trying to crash..'
mtkclient handshake returns failed 'Preloader - [LIB]: status: handshake failed, retrying..'
I'll keep on trying to understand all this just need my time.. all help appreciated.
BadChoices said:
First off some questions please.. and I'm running win 11 pro.
What am I suppose to see on the screen when on Brom mode ? or how do I know that I'm on that mode.. obviously that if I'm not the operations just fail.
cant run mtk_gui atm for some reason trying to clear that out.. 'C:\Users\Q\AppData\Local\Programs\Python\Python311\Lib\site-packages\shiboken6\libshiboken does not exist'
Also tried bypass_utility_v1.4.2 using dif. key combos always returns 'device in preloader mode, trying to crash..'
mtkclient handshake returns failed 'Preloader - [LIB]: status: handshake failed, retrying..'
I'll keep on trying to understand all this just need my time.. all help appreciated.
Click to expand...
Click to collapse
for brom/preloader mode you will need to use the shorting method shown in the previously mentioned youtube video, not sure why you're trying mtk_gui and bypass_utility_v1.4.2 , what are you trying to achieve by using them?
Well reading from github where you get the mtkclient I thought that I could unlock the bootloader using the bypass_utility_v1.4.2 just like that.. guess ain't that easy and tbh after reading your previous words also thought that I could try using the mtkclient regardless being via the gui or the terminal.
I have seen some posts about the Brasilian fella and more shorting method but thought that by now wouldn't be needed anymore.. I did have my phone open before 'cause of that.. guess I'll have to have a look again.. my bad.
Thanks again.
BadChoices said:
Well reading from github where you get the mtkclient I thought that I could unlock the bootloader using the bypass_utility_v1.4.2 just like that.. guess ain't that easy and tbh after reading your previous words also thought that I could try using the mtkclient regardless being via the gui or the terminal.
I have seen some posts about the Brasilian fella and more shorting method but thought that by now wouldn't be needed anymore.. I did have my phone open before 'cause of that.. guess I'll have to have a look again.. my bad.
Thanks again.
Click to expand...
Click to collapse
you might be able to get into brom/preloader mode by holding volume down button while it is booting but shorting also brings the same result
aryanhington said:
you might be able to get into brom/preloader mode by holding volume down button while it is booting but shorting also brings the same result
Click to expand...
Click to collapse
I still can't believe what is that I ran into.. so was about to disassemble the motherboard/cameras cover that doesn't look that straight forward but went on checking again some bits on the vid.. meanwhile made a search for moto g8 power lite disassembling when got the suggestion moto g8 power lite frp bypass.. the first vid solved my issue.. I just died 'cus I have been wondering about an hack like this for ages now.
I'll come back for some further assistance on some other devices when I get the... brains.
Thanks for the support @aryanhington
BadChoices said:
I still can't believe what is that I ran into.. so was about to disassemble the motherboard/cameras cover that doesn't look that straight forward but went on checking again some bits on the vid.. meanwhile made a search for moto g8 power lite disassembling when got the suggestion moto g8 power lite frp bypass.. the first vid solved my issue.. I just died 'cus I have been wondering about an hack like this for ages now.
I'll come back for some further assistance on some other devices when I get the... brains.
Thanks for the support @aryanhington
Click to expand...
Click to collapse
care to share what you did so we can know?
I do care.. I also care the way some people talk to others behind screens.
Now if you read what I have just said on my previous post and the first post so to get what you/I'm dealing with you will realize that I was stuck on welcome screen, after soft reset, 'cus of FRP, once the last google account used was still active and I had no clue. Just use the search string on youtube that I have mentioned and on the first vid follow the 20k steps to be able to bypass google/android FRP.
Farewell.
Would someone please point me out their fav XT2055-1 roms ?
Thank you.
Is there any way to unbrick my hard bricked Motorola Edge 20 fusion?
I tried to flash stock rom via lmsa tool and it failed.
Whenever it is connected to pc / is charging, only response is the white led blinking light.
It is also not detected by pc too.
Edit : Changed the board under warranty and is working fine!!
I don't have a solution but... it's been 11 days now. Have you had any luck getting this device to work?
Asking 'cause I own one and plan to root it.
If you are able to power your device into the bootloader (usually to hold power button and a volume key when powering on), and you are able to scroll down to "unlock bootloader", that will then allow your device to be able to post into fastboot mode.
You will just need the fastboot drivers from google https://developer.android.com/studio/run/win-usb installed on your pc, then you will be able to send fastboot commands to your device.
Your options at this stage would be to find the stock images for your device, or just download TWRP and Lineage.
LineageOS Downloads
download.lineageos.org
Motorola Moto Edge
Disclaimer:Team Win strives to provide a quality product. However, it is your decision to install our software on your device. Team Win takes no ...
twrp.me
This video below is for the Shield, but the process is all the same for android, minus how you power into the bootloader.
The shieldroot tools will not work for phones, but you can dl them and ammend the code to flash your OS.
This video will just teach how to unlock the bootloader, how to install the fastboot driver, and some TWRP knowledge if you are unfamiliar. Starting it at 1:08 would skip the shield stuff
sinandredemption said:
I don't have a solution but... it's been 11 days now. Have you had any luck getting this device to work?
Asking 'cause I own one and plan to root it.
Click to expand...
Click to collapse
Changed the phones board on warranty and is working fine now.
I just came to know that edge 20 lite and edge 20 fusion have different hardware. Mine's edge 20 fusion(Indian variant) and I accidently flashed lites rom which resulted in hardbricking the phone. I searched for edge 20 fusions rom and it is nowhere to be found. The Motorola's flashing software (lmsa) also downloaded the wrong rom for my phone as both the phones model number are same. So I recommend you to wait a bit longer if you have edge 20 fusion.
jenneh said:
If you are able to power your device into the bootloader (usually to hold power button and a volume key when powering on), and you are able to scroll down to "unlock bootloader", that will then allow your device to be able to post into fastboot mode.
You will just need the fastboot drivers from google https://developer.android.com/studio/run/win-usb installed on your pc, then you will be able to send fastboot commands to your device.
Your options at this stage would be to find the stock images for your device, or just download TWRP and Lineage.
LineageOS Downloads
download.lineageos.org
Motorola Moto Edge
Disclaimer:Team Win strives to provide a quality product. However, it is your decision to install our software on your device. Team Win takes no ...
twrp.me
This video below is for the Shield, but the process is all the same for android, minus how you power into the bootloader.
The shieldroot tools will not work for phones, but you can dl them and ammend the code to flash your OS.
This video will just teach how to unlock the bootloader, how to install the fastboot driver, and some TWRP knowledge if you are unfamiliar. Starting it at 1:08 would skip the shield stuff
Click to expand...
Click to collapse
Thank you very much for your help but my phone is working fine now!!. I hope this post will help others.
As for my phone, It was totally a hard brick and the only solution to it was to change the phones board.
Whoa, thanks for the heads-up! There should be a separate forum thread for Edge 20 Fusion since it runs different hardware.
BDW, if you don't mind answering, how is the Motorola warranty and service in India? Did they charge you for the replacement? Was it a good experience?
sinandredemption said:
Whoa, thanks for the heads-up! There should be a separate forum thread for Edge 20 Fusion since it runs different hardware.
BDW, if you don't mind answering, how is the Motorola warranty and service in India? Did they charge you for the replacement? Was it a good experience?
Click to expand...
Click to collapse
The service is good. If the phone is under warranty, then there is nothing to worry. I've got my phone repaired completely free of cost.
Albert pallam said:
I just came to know that edge 20 lite and edge 20 fusion have different hardware. Mine's edge 20 fusion(Indian variant) and I accidently flashed lites rom which resulted in hardbricking the phone. I searched for edge 20 fusions rom and it is nowhere to be found. The Motorola's flashing software (lmsa) also downloaded the wrong rom for my phone as both the phones model number are same. So I recommend you to wait a bit longer if you have edge 20 fusion.
Click to expand...
Click to collapse
i just recently purchased an edge 20 fusion (australian variant) and am currently in the 3 day waiting period for OEM unlocking to become available.
i'm still mostly a novice at all of this, however hopefully someone can confirm for me or correct me:
does unlocking the bootloader, and then rooting the phone (install magisk, etc.) not require a rom? do i only need a rom if i want to change from the factory stock (+updates) rom i currently have?
or do i need a rom in order to get magisk working properly, and pass safety net, etc. too?
Albert pallam said:
Changed the phones board on warranty and is working fine now.
I just came to know that edge 20 lite and edge 20 fusion have different hardware. Mine's edge 20 fusion(Indian variant) and I accidently flashed lites rom which resulted in hardbricking the phone. I searched for edge 20 fusions rom and it is nowhere to be found. The Motorola's flashing software (lmsa) also downloaded the wrong rom for my phone as both the phones model number are same. So I recommend you to wait a bit longer if you have edge 20 fusion.
Click to expand...
Click to collapse
I also have a fusion, I've used lmsa to download the stock rom but I can't tell if it's for the moto edge 20 lite or for the fusion. How can you tell?
sinandredemption said:
Whoa, thanks for the heads-up! There should be a separate forum thread for Edge 20 Fusion since it runs different hardware.
BDW, if you don't mind answering, how is the Motorola warranty and service in India? Did they charge you for the replacement? Was it a good experience?
Click to expand...
Click to collapse
Agree, I'm trying to figure out who can we request a dedicated forum for the Fusion version.
The Issue:
The phone is constantly booting looping (flashes the Oneplus logo).I am unable to go to fastboot through either adb or through the on-phone buttons.
When plugged into a charger, it immediately begins to bootloop once enough power is supplied.
The only way to turn it off is by letting it get to 0%.
What caused the issue:
My phone got soft bricked all of a sudden, so I followed some tutorials that I found online showing me how to flash firmware using adb in fastboot and by unlocking my bootloader. This temporarily fixed the issue, but it told me that after doing everything I should relock it through ADB. Foolishly, I did so and am now stuck in this situation.
What I've tried:
I am able to get into EDL mode by holding both volume buttons, even while in the boot loop state.
I have downloaded the latest version of QPST and this firmware file (https://firmwarefile.com/oneplus-10t-5g-cph2415).
Quick note: I'm not sure if that's how it's meant to be, but QPST always detects my phone as "Download" (ESN: Download, Phone Number: Download, Banner: Download).
I am not quite sure how to use QPST and have tried following the guide, which told me to select some.hex files from the firmware I downloaded, but I was unable to find any.hex files at all and therefore could not proceed.
I also tried QFIL by selecting prog_firehose_ddr.elf from the IMAGES folder and tried multiple times in both UFS and emmc mode, selecting all of the rawprogram 1-5.xml files with their corresponding patch1-5.xml files from the IMAGES folder, but I always got the same error:
ERROR: function: sahara_rx_data:276 Unable to read packet header. Only read 0 bytes
ERROR: function: sahara_main:982 Sahara protocol error
ERROR: function: main:320 Uploading Image using Sahara protocol failed
Download Fail:Sahara Fail:QSaharaServer Fail process fail
Finish Download
I have tried the leaked EDL flasher from here: https://forum.xda-developers.com/t/edl-flash-tool-leak.4494211/. However, I have been unsuccessful in doing so, though I may have been doing it wrong, and it would be greatly appreciated if someone could explain or tell me how to do it. As you can see in the attached image, I tried to flash it by using the images folder located in the firmware that I have downloaded. But it just gets stuck at 3%
indefinitely as the time goes up forever.
Thanks for reading looking forward to any replies/info
uh do not flash it by qfil it will just not work because oneplus actually blocked qfil and qpst so the only way is their edl tool and you cannot flash it on the edl tool unless you have an (actual) account and (not) bypassed
oneplus is really starting to nerve me really their merge with oppo is like a mistake
oneplushypergaming said:
oneplus is really starting to nerve me really their merge with oppo is like a mistake
Click to expand...
Click to collapse
the Merge was a mistake, its laughable that OnePlus went from being with the opensource community to being completely against it.. What annoys me the most is, instead of just locking their bootloader, they post the source code for their phone, probably as they have to, yet they give no way to utilize that code without developers running the risk of bricking their device.. Developers are willing to dedicate their time and money, to build for a device, all they ask, is for the ability to be able to unbrick, that is humble, Devs ask for donations, they do not force it.. Oppo do not even allow their bootloader to be unlocked, which prevents users from bricking their device.. OnePlus allow users to unlock their bootloader, knowing full well that Developers will understandably not be willing to develop for a device without a potential 60-80% brick chance.. The code could very well build for said rom, but once flashed it has the potential to turn the dev's device into a paper weight, meaning something they do to provide, turns into something that ultimately takes..
hosthere247 said:
the Merge was a mistake, its laughable that OnePlus went from being with the opensource community to being completely against it.. What annoys me the most is, instead of just locking their bootloader, they post the source code for their phone, probably as they have to, yet they give no way to utilize that code without developers running the risk of bricking their device.. Developers are willing to dedicate their time and money, to build for a device, all they ask, is for the ability to be able to unbrick, that is humble, Devs ask for donations, they do not force it.. Oppo do not even allow their bootloader to be unlocked, which prevents users from bricking their device.. OnePlus allow users to unlock their bootloader, knowing full well that Developers will understandably not be willing to develop for a device without a potential 60-80% brick chance.. The code could very well build for said rom, but once flashed it has the potential to turn the dev's device into a paper weight, meaning something they do to provide, turns into something that ultimately takes..
Click to expand...
Click to collapse
Well said to be honest that clears my suspicion about oppo they are greedy and dirty and maybe it is oppo who is making oneplus act like this in the first place oneplus should really consider all of this and give the people what they want instead of being a monopoly like oppo i never even liked oppo from the beginning actually i trusted oneplus with my 7t because i knew if i were to brick it the msm tool will always be there it has been months since the release of the 10t and ace pro and yet still no msm tool for it or a way to even get it back yet but there are many msm tools for the rest of the oneplus devices so maybe i am wrong they can tell us but i still think it is wrong that th 10 pro has to have an actual account.
I'm stuck with a Hard Brick and my device screen is black, only entering EDL for a few seconds.
Qmiclient it's the new MSM
AkayamiShurui said:
Qmiclient it's the new MSM
Click to expand...
Click to collapse
Hello , I found this topic because i'm facing the same problem as OP after relocking bootloader .... As anyone found solution to flash on edl mode ? Thanks
mybrickplus said:
Hello , I found this topic because i'm facing the same problem as OP after relocking bootloader .... As anyone found solution to flash on edl mode ? Thanks
Click to expand...
Click to collapse
the only thing i can think of is a slot switch
Yes Probably what happened but now i'm totally stuck on the bootloop until no baterry left.
Cant access fastboot because the phone boot and 2 seconds later reboot ... I can only access edl mode with Oneplus Flasher (bypassed by Hexa change) but after that, like op described the time keep increasing ,and circle progress stays at 3%, nothing seems change on phone
You have no option but to use the official flashing revovery via Oneplus / oppo whoever does it which means paying them to reflash the phone correctly
Ok thank you, so ive to send back the phone or i can do it on my own ?
mybrickplus said:
Ok thank you, so ive to send back the phone or i can do it on my own ?
Click to expand...
Click to collapse
no need to send the phone to oneplus just contact them directly and arrange for one of their techs to reflash your phone over the internet
leezaal said:
no need to send the phone to oneplus just contact them directly and arrange for one of their techs to reflash your phone over the internet
Click to expand...
Click to collapse
He could try but I'm not that sure that they are continuing to offer this service.
Thank you for your help and answers
So anyone who still watching this thread I made progress on this whole problem I took the 11r firmware file and it has script.sh commands in there and I ran them and it extracted all of the firmware files and made a bin folder that has only two folders inside of it and it took all the files to make it it puts it in your recovery section of your computer but it compiled all the empty files so they actually have things on them if you want to know how I did it and what I used just private message me cuz I will not be posting public because Oppo