Related
I'm on Hard SPL 1.24
Radio 1.20 Olinex
mtty 0.01
Trying to use MTTY commands. to check my CID status.
first of all it doesnt give a USB> prompt. it gives only a CMD prompt. well that i think is okay.
but when i type Cmd>task 32
nothing happens. it comes back to the CMD>
when i type Cmd>info 8
following comes up.
--- 2K bytes sector version ---
DEVICE NAME=samsung_k9k2g08
DEVICE ID=0xAA
DEVICE MAKER ID=0xEC
PAGE SIZE=0x800
TOTAL PAGE SIZE=0x840
BLOCK COUNT=0x800
BLOCK PAGE=0x40
Checking block information
BLOCK 8 (0x8) is reversed block
BLOCK 10 (0xA) is reversed block
BLOCK 11 (0xB) is reversed block
BLOCK 12 (0xC) is reversed block
BLOCK 13 (0xD) is reversed block
BLOCK 14 (0xE) is reversed block
Partition[0], type=0x20, start=0x2, total=0x63E
Partition[1], type=0x23, start=0x640, total=0x900
Partition[2], type=0x25, start=0xF40, total=0xF140
Partition[3], type=0x4, start=0x10080, total=0xAF40
CE Total Length(with sector info) = 0x80C0400
CE CheckSum Length(without sector info) = 0x8040000
---------
when i type Cmd>rtask b
the following come up and nothing happens...
Enter Radio Image
POWER OFF PMIC VREG_USB : SUCCESS!
AT-Command Interpreter ready
+PB_READY
-----
what could possibly be going wrong here.. am i doing something wrong?? please please help.
hi (sorry for my english )
i have a diamond diam100 and after use mtty to format, now appear the grey screen. :-(
now only can access to diamond with mtty tool....
how i can access to memory to put the DIAMIMG.NBH with mtty?
please anybody could help me???
thaks in advance
the info with mtty is :
Cmd>info 2
HTCSORANG309ˆ’ÇHTCE
Cmd>info 8
--- 2K bytes sector version ---
DEVICE NAME=samsung_k9k2g08
DEVICE ID=0xAA
DEVICE MAKER ID=0xEC
PAGE SIZE=0x800
TOTAL PAGE SIZE=0x840
BLOCK COUNT=0x800
BLOCK PAGE=0x40
Checking block information
BLOCK 0 (0x0) is reversed block
BLOCK 1 (0x1) is reversed block
BLOCK 2 (0x2) is reversed block
BLOCK 3 (0x3) is reversed block
BLOCK 8 (0x8) is reversed block
OS NOT FOUND !!!
solfree said:
hi (sorry for my english )
i have a diamond diam100 and after use mtty to format, now appear the grey screen. :-(
now only can access to diamond with mtty tool....
how i can access to memory to put the DIAMIMG.NBH with mtty?
please anybody could help me???
thaks in advance
the info with mtty is :
Cmd>info 2
HTCSORANG309ˆ’ÇHTCE
Cmd>info 8
--- 2K bytes sector version ---
DEVICE NAME=samsung_k9k2g08
DEVICE ID=0xAA
DEVICE MAKER ID=0xEC
PAGE SIZE=0x800
TOTAL PAGE SIZE=0x840
BLOCK COUNT=0x800
BLOCK PAGE=0x40
Checking block information
BLOCK 0 (0x0) is reversed block
BLOCK 1 (0x1) is reversed block
BLOCK 2 (0x2) is reversed block
BLOCK 3 (0x3) is reversed block
BLOCK 8 (0x8) is reversed block
OS NOT FOUND !!!
Click to expand...
Click to collapse
fi you start it in boot mode?!?!?
works???
yes i can ... but i can't put any spl signed and unsigned
thanks for the interest
Search the threads there are two commands to try using MTTY task 28 55aa and Task 29 (I'm not exactly sure if the format of the first one is correct but it is approximately the command you need, search for Task 28 and you should be able to find it).
Task 29 formats the user portion of the ROM area much like Hard Reset but better.
Task 28 reformats the ROM and extended ROM areas - don't quote me on this though as it's a long time since I've needed it and I could be wrong!
thanks for your reply but doesn't run...
the task 28 55aa doesn't nothing.....not appear any message..
the task 2a format all.... but sill can't put a hard spl...
I try the task 29 too... and nothing....
:-(
any idea?
the result of mtty
Cmd>task 28 55aa
Cmd>task 28
Cmd>task 29
Format BINFS start
Fill RSVD information for block 288 to 321
CE start sector=0x14, total sector of CE and TFAT=0x14
CE start start block=321, total block=1727
Write 0xFF start page=0x5040, total page=0x1AFC0
Format BINFS end
Cmd>task 2a
Format ALL start
backup SPL OK
backup MISC configuration OK
SPL start start block=288, total block of CE=1760
Write 0xFF start page=0x4800, total page=0x1B800
restore SPL OK
restore MISC configuratoin OK
restore MFG configuratoin OK
Format ALL end
Cmd>
solfree said:
thanks for your reply but doesn't run...
the task 28 55aa doesn't nothing.....not appear any message..
the task 2a format all.... but sill can't put a hard spl...
I try the task 29 too... and nothing....
:-(
any idea?
Click to expand...
Click to collapse
if you can start in boot mode, you can flash stock rom then........
ervius said:
if you can start in boot mode, you can flash stock rom then........
Click to expand...
Click to collapse
ups...thank you very much.... buuut.... how i can use this tool?
Flashing the stock ROM.
Download the stock ROM from your Cell Providers website or HTC and then put your device into bootloader and run the exe in which the ROM is packaged. It will unpack the rom and run an upgrade tool which will flash your device...
Here are the stock Roms
wtpelzer said:
Download the stock ROM from your Cell Providers website or HTC and then put your device into bootloader and run the exe in which the ROM is packaged. It will unpack the rom and run an upgrade tool which will flash your device...
Click to expand...
Click to collapse
thanks again... but not run... appear the error...262...
band27 said:
Here are the stock Roms
Click to expand...
Click to collapse
thank you very much
i have a lot of roms... but nothig run ok..
i need the rom for the dsm editor?
solfree said:
thank you very much
i have a lot of roms... but nothig run ok..
i need the rom for the dsm editor?
Click to expand...
Click to collapse
Hi,
You should try to find the exact same ROM you had before (the one that came with the TD originaly). You can find that on HTC website (if it accepts your serial number for download, then, the device should also accept it without any trcks or tweeks), or your provider (if it is a branded device)
GAlves said:
Hi,
You should try to find the exact same ROM you had before (the one that came with the TD originaly). You can find that on HTC website (if it accepts your serial number for download, then, the device should also accept it without any trcks or tweeks), or your provider (if it is a branded device)
Click to expand...
Click to collapse
doesn't accept de serial number.... :-( the phone is the orange spain
thanks for reading me
solfree said:
doesn't accept de serial number.... :-( the phone is the orange spain
thanks for reading me
Click to expand...
Click to collapse
Have you flashed hard spl before the phone bricked?
I don't think there is a spanish orange ROM in the forum. You should try to ask to Orange spain (customer service) where you can download the software updates for your diamond.
In alternative, you can try to flash an older oficial ROM (such as the 1.93)...
If it succeeds, then you hard spl your phone and flash whatever ROM you want. NOTICE that this will only work if you have previously flashd hard spl...
i can't never flash spl..... :-(
avery time stop at 0%...................
thanks!
Now you can't flash hard spl because the phone is bricked. You should have done it before you tried the first flash. Have you done it?
If you havnen't, that's what bricked the phone...
I believe that the only way to fix this is to flash the original ROM. You may get it from Orange
Ahora no puedes poner el hard spl. Diamond esta muerto. Lo que passa es que antes de intentar el primero flash deverias ter puesto el hard spl. Lo has hecho? Si no lo has hecho, eso es lo que ha bloqueado el telefono.
Créo que la unica solucion es descargar la ROM original de orange. La puedes tener directamente de orange
ok thank you very much... i find the oficial rom.... but in orange doesn't exist... :-(
GAlves said:
Now you can't flash hard spl because the phone is bricked. You should have done it before you tried the first flash. Have you done it?
If you havnen't, that's what bricked the phone...
I believe that the only way to fix this is to flash the original ROM. You may get it from Orange
Ahora no puedes poner el hard spl. Diamond esta muerto. Lo que passa es que antes de intentar el primero flash deverias ter puesto el hard spl. Lo has hecho? Si no lo has hecho, eso es lo que ha bloqueado el telefono.
Créo que la unica solucion es descargar la ROM original de orange. La puedes tener directamente de orange
Click to expand...
Click to collapse
I find this rom
http://www.orange.co.uk/diamond/RUU...igned_Diamond_52.29.25.12_1.00.25.05_Ship.exe
and run the exe and when it's at 1% reset it self......... :-(
a question:
exist a way to put in the 4gb ram the rom image by mtty????
my GOOD!!!
Any news dude?
Did you found the original Orange/Spanish Rom?
I had some problems flashing a Rom..
After some tries i used mtty..
Cmd>task 32
Level = FF
Cmd>task 28
Storage format start
Write Nand Success
dwBlockToWrite = 13
Storage start block: 433
Storage Total block: 503
Total Bad Block in CE: 0
NeedToEraseBlockStart: 446
NeedToEraseBlockEnd: 936
Storage format success
Cmd>info 8
Block 0x0(0) is Reversed block
Block 0x1(1) is Reversed block
Block 0x2(2) is Reversed block
Block 0x3(3) is Reversed block
Block 0x4(4) is Reversed block
Block 0x5(5) is Reversed block
Block 0x6(6) is BAD block !!!
Block 0x6(6) is Reversed block
Block 0x7(7) is Reversed block
Block 0x8(8) is Reversed block
Block 0x9(9) is Reversed block
Block 0xA(10) is Reversed block
Block 0xB(11) is Reversed block
Block 0xC(12) is Reversed block
Partition[0], type=0x20, start=0x2, total=0x18FE
Partition[1], type=0x23, start=0x1900, total=0x1700
Partition[2], type=0x25, start=0x3000, total=0x18100
Partition[3], type=0x4, start=0x1B100, total=0x1F700
CE Total Length(with sector info) = 0x36F8800
CE CheckSum Length(without sector info) = 0x3620000
I tried to whit other Hard spl and sspl but everytime the same..
Cmd>task 32
Level = 0
Cmd>task 28 55aa
Storage format start
Write Nand Success
dwBlockToWrite = 13
Storage start block: 433
Storage Total block: 503
Total Bad Block in CE: 0
NeedToEraseBlockStart: 446
Storage format success
Cmd>task 28
Storage format start
Write Nand Success
dwBlockToWrite = 13
Storage start block: 433
Storage Total block: 503
Total Bad Block in CE: 0
NeedToEraseBlockStart: 446
Storage format success
Cmd>task 2a
Cmd>info 8
Block 0x0(0) is Reversed block
Block 0x1(1) is Reversed block
Block 0x2(2) is Reversed block
Block 0x3(3) is Reversed block
Block 0x4(4) is Reversed block
Block 0x5(5) is Reversed block
Block 0x6(6) is BAD block !!!
Block 0x6(6) is Reversed block
Block 0x7(7) is Reversed block
Block 0x8(8) is Reversed block
Block 0x9(9) is Reversed block
Block 0xA(10) is Reversed block
Block 0xB(11) is Reversed block
Block 0xC(12) is Reversed block
Partition[0], type=0x20, start=0x2, total=0x18FE
Partition[1], type=0x23, start=0x1900, total=0x1700
Partition[2], type=0x25, start=0x3000, total=0x18100
Partition[3], type=0x4, start=0x1B100, total=0x1F700
CE Total Length(with sector info) = 0x36F8800
CE CheckSum Length(without sector info) = 0x3620000
Cmd>
How can i fix it...??
thx
...
up
...
I have the same problem.
any solution?????
yeah me too..my P3600i was fine with until i start flashing..I also got the same result.After using mtty..perhaps our method is wrong.Any experts here pls help us "i" users.
On the P3600, it is normal to have a bad block #6 after MTTY. It still functions normally with that.
On the P3600i, I'm sure there is also at least one bad block, but maybe they are different locations.
Someone with a good P3600i know the desired results?
maybe there is no one with good P3600i.Is there any other way to figure it out?Someone who have the original rom maybe?
Mtty116 IS A TROJAN??
I wonder why is so hard to find this cute little software..
This is why..
http://www.virustotal.com/file-scan/report.html?id=b0e2343a89aeb002c8bdd53fcf1643bfff5ca056290b2fdf16b66a8f13c8238a-1283316550
Qamarzamsyawal said:
I wonder why is so hard to find this cute little software..
This is why..
http://www.virustotal.com/file-scan/report.html?id=b0e2343a89aeb002c8bdd53fcf1643bfff5ca056290b2fdf16b66a8f13c8238a-1283316550
Click to expand...
Click to collapse
My guess would be that this is due to the fact that the software 'MTTY' is specifically designed to modify the Operating System, thus the Trojan Warning. For those who do not know what it's for, they could cause damage to their systems. This is just a theory. I've used MTTY for a couple years now, and have not noticed any adverse side effects, but maybe I'm missing something...
By all means, if you are not comfortable using it, please do not. Better safe than sorry.
One Bad Block is down..One more to go
Hey Sport!!
Successfully erase one bad block from my P3600i. But there is another one. It won't come out. Do anyone know why is this happen??
This is my result using "mtty116.exe"
Cmd>set 14 0
Write Nand Success
HTCST ÚÈÒHTCE
Cmd>task 28 55aa
Storage format start
Write Nand Success
dwBlockToWrite = 13
Storage start block: 646
Storage Total block: 1357
Total Bad Block in CE: 0
NeedToEraseBlockStart: 659
NeedToEraseBlockEnd: 2003
Storage format success
Cmd>task 0
Cmd>info 8
Block 0x0(0) is Reversed block
Block 0x1(1) is Reversed block
Block 0x2(2) is Reversed block
Block 0x3(3) is Reversed block
Block 0x4(4) is Reversed block
Block 0x5(5) is Reversed block
Block 0x6(6) is Reversed block
Block 0x7(7) is Reversed block
Block 0x8(8) is Reversed block
Block 0x9(9) is Reversed block
Block 0xA(10) is Reversed block
Block 0xB(11) is Reversed block
Block 0xC(12) is Reversed block
Block 0x346(838) is BAD block !!!
Block 0x792(1938) is BAD block !!!
Partition[0], type=0x20, start=0x2, total=0xFE
Partition[1], type=0x23, start=0x100, total=0x1300
Partition[2], type=0x25, start=0x1400, total=0x27200
Partition[3], type=0x4, start=0x28600, total=0x54D00
CE Total Length(with sector info) = 0x5203000
CE CheckSum Length(without sector info) = 0x50C0000
Cmd>password
Cmd>task 32
Level = 0
Cmd>task 28
Storage format start
Write Nand Success
dwBlockToWrite = 13
Storage start block: 646
Storage Total block: 1357
Total Bad Block in CE: 0
NeedToEraseBlockStart: 659
NeedToEraseBlockEnd: 2003
Storage format success
Cmd>task 2A
Check block : 838 - Good
Check block : 1938 - Bad
Cmd>info 8
Block 0x0(0) is Reversed block
Block 0x1(1) is Reversed block
Block 0x2(2) is Reversed block
Block 0x3(3) is Reversed block
Block 0x4(4) is Reversed block
Block 0x5(5) is Reversed block
Block 0x6(6) is Reversed block
Block 0x7(7) is Reversed block
Block 0x8(8) is Reversed block
Block 0x9(9) is Reversed block
Block 0xA(10) is Reversed block
Block 0xB(11) is Reversed block
Block 0xC(12) is Reversed block
Block 0x792(1938) is BAD block !!!
Partition[0], type=0x20, start=0x2, total=0xFE
Partition[1], type=0x23, start=0x100, total=0x1300
Partition[2], type=0x25, start=0x1400, total=0x27200
Partition[3], type=0x4, start=0x28600, total=0x54D00
CE Total Length(with sector info) = 0x5203000
CE CheckSum Length(without sector info) = 0x50C0000
Cmd>task 8
my P3600 have 2 BAD block, how can I fix it ?
Cmd>info 8
Block 0x0(0) is Reversed block
Block 0x1(1) is Reversed block
Block 0x2(2) is Reversed block
Block 0x3(3) is Reversed block
Block 0x4(4) is Reversed block
Block 0x5(5) is Reversed block
Block 0x6(6) is BAD block !!!
Block 0x6(6) is Reversed block
Block 0x7(7) is Reversed block
Block 0x8(8) is Reversed block
Block 0x9(9) is Reversed block
Block 0xA(10) is Reversed block
Block 0xB(11) is Reversed block
Block 0xC(12) is Reversed block
Block 0x3E2(994) is BAD block !!!
Partition[0], type=0x20, start=0x2, total=0x18FE
Partition[1], type=0x23, start=0x1900, total=0x1500
Partition[2], type=0x25, start=0x2E00, total=0x1D100
Partition[3], type=0x4, start=0x1FF00, total=0x5C400
CE Total Length(with sector info) = 0x40DF800
CE CheckSum Length(without sector info) = 0x3FE0000
Cmd>
I have 4 BAD BLOCK
----------------------------------------
Cmd>task 2A
Check block : 176 - Bad
Check block : 371 - Bad
Check block : 545 - Bad
Check block : 993 - Bad
Cmd>info 8
Block 0x0(0) is Reversed block
Block 0x1(1) is Reversed block
Block 0x2(2) is Reversed block
Block 0x3(3) is Reversed block
Block 0x4(4) is Reversed block
Block 0x5(5) is Reversed block
Block 0x6(6) is Reversed block
Block 0x7(7) is Reversed block
Block 0x8(8) is Reversed block
Block 0x9(9) is Reversed block
Block 0xA(10) is Reversed block
Block 0xB(11) is Reversed block
Block 0xC(12) is Reversed block
Block 0xB0(176) is BAD block !!!
Block 0x173(371) is BAD block !!!
Block 0x221(545) is BAD block !!!
Block 0x3E1(993) is BAD block !!!
Partition[0], type=0x20, start=0x2, total=0x18FE
Partition[1], type=0x23, start=0x1900, total=0x1800
Partition[2], type=0x25, start=0x3100, total=0x23000
Partition[3], type=0x4, start=0x26100, total=0x58F00
CE Total Length(with sector info) = 0x4D50800
CE CheckSum Length(without sector info) = 0x4C20000
Cmd>task 8
Here is a Video on how to bypass the setup wizard and enable usb debugging.
https://www.youtube.com/watch?v=VYU-Fs_lJ1c
Bro my droid turbo doesn't have developer options enabled! build number is locked!
its April security patch level.. plzz help
skyrio said:
Bro my droid turbo doesn't have developer options enabled! build number is locked!
its April security patch level.. plzz help
Click to expand...
Click to collapse
this is as far as i have gotten on the Droid Turbo 2
Tomsgt said:
this is as far as i have gotten on the Droid Turbo 2
Click to expand...
Click to collapse
Thank you so much bro for video..
but i already know this method.. this is not a completely bypass and one more thing in this method calling not working at all. you can call someone easily but you cant receive call.. it says the operator is busy.. any way to bypass account completely?
Thank You
skyrio said:
Thank you so much bro for video..
but i already know this method.. this is not a completely bypass and one more thing in this method calling not working at all. you can call someone easily but you cant receive call.. it says the operator is busy.. any way to bypass account completely?
Thank You
Click to expand...
Click to collapse
ok i have a full FRP bypass for this device coming really soon editing the video now
Tomsgt said:
ok i have a full FRP bypass for this device coming really soon editing the video now
Click to expand...
Click to collapse
Thanks a bunch Sir <3 Thanks alot will try this on my phone..
skyrio said:
Thanks a bunch Sir <3 Thanks alot will try this on my phone..
Click to expand...
Click to collapse
let me know how it works for you
Tomsgt said:
let me know how it works for you
Click to expand...
Click to collapse
sir i tried this method on moto x 2nd generation.. but encrypt phone button is locked in test dpc. even battery is 80% charged. what should i do? Sorry for disturbing you!
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Sir it doesnt showing device owners option..
Sent from my SM-G900T using XDA-Developers mobile app
potential clue?
1. enter bootloader/fastboot by holding vol down before and while inserting USB cable with data connection
2. boot in "factory mode"
3. only in factory mode will RSD lite show a phone when booted into the full system interface.
booting in other modes renders this grid empty usually
4. when I initiate an image flash while booted in factory mode, I see a bunch of processes terminate "app has stopped" errors quickly flash on the phone screen while RSD lite says "rebooting into flash mode" ....
5. so this is where I pass it on to everyone else. as far as I knew, the only way to send reboot commands to the phone was via ADB. RSD lite seems to have some kind of magical ADB-ish command that it is sending to the phone in order to reboot it. would it be possible to wireshark that data and look at it?
for me this is the main block ... no matter how many times I hit "build number" I do not get the familiar developer mode message when using the workarounds in the youtube videos
Hello, ive been reading about bootloader unlocking and rooting. I was able to enable developer settings and enable USB debugging. Is anyone else trying to get this phone unlocked with me? I hope not, so if u have any opinions or suggestions let them out!! ?
anyone have try this methode on new update firmware ?
Android Security Patch Level : May 1, 2016
System Version : 24.14.16. Kinzie_verzon.verizon.en.US
Build number : MCK24.78-13.16
henhida said:
anyone have try this methode on new update firmware ?
Android Security Patch Level : May 1, 2016
System Version : 24.14.16. Kinzie_verzon.verizon.en.US
Build number : MCK24.78-13.16
Click to expand...
Click to collapse
That Solution Not Working On New Secuirty Patch !
I have motorola droid turbo xt1254 with google id lock and when i am trying to tap on build number for unlocking developer option, nothing happens ((, can anyone halp me?
Thanks in advance
Hello all. I been seeing good deals on ebay for the turbo 2. Find one for $160 but it's Google locked. I have the factory Motorola cable. Will that help do anything in resetting to phone in RSS lite or do you need to boot in factory? Would like to pick this phone up and save $50 or more from buying one that is not.
umairabubakkar said:
pwrdbykyank said:
Here is a Video on how to bypass the setup wizard and enable usb debugging.
Here is new Method of Motorola Droid Turbo XT1254 FRP Solution
http://www.lahoremobile.net/motorola-droid-turbo-xt1254-frp.html
Click to expand...
Click to collapse
the web site it's showing the wrong command lines
INCORRECT: content insert -uri content://settings/secure -bind name:s:user_setup_complete -bind value:s:1
CORRECT: content insert --uri content://settings/secure --bind name:s:user_setup_complete --bind value:s:1
it work for me with on
motorola droid turbo xt1254 (verizon)
android 5. 1 / su4tl-49 /version: 23.21.49 / f14.mot.xt1254.0
security pacht: 2016-04-01
Click to expand...
Click to collapse
Thank you so mouch for me help sir
Gurrumichi said:
umairabubakkar said:
the web site it's showing the wrong command lines
INCORRECT: content insert -uri content://settings/secure -bind name:s:user_setup_complete -bind value:s:1
CORRECT: content insert --uri content://settings/secure --bind name:s:user_setup_complete --bind value:s:1
it work for me with on
motorola droid turbo xt1254 (verizon)
android 5. 1 / su4tl-49 /version: 23.21.49 / f14.mot.xt1254.0
security pacht: 2016-04-01
Click to expand...
Click to collapse
Yes he is absolutely right i have done and posted all detail how to root Motorola droid turbo with latest security and how to bypass google account on my blog post. I have also uploaded apps to my server and given direct links. i am unable to post link so please copy and paste give link to your browser.
pakfones.com/motorola-droid-turbo-google-account-bypass-new-security-2016/
Click to expand...
Click to collapse
Successed wipe FRP in hardstyle way. Pull off eMMC from PCB and soldered back. Logs here :
Code:
Z3X EasyJtag Software ver. 2.4.1.1
Loading eMMC Addon Firmware... IO: 1800 mV
Box S/N: 1414FD121D756485, ,FW Ver.: 01.56
CMD Pullup Level:1175 mV
CMD Active Level:1515 mV
Box IO Level:1800 mV
CLK Rate:21000 khz
HiPower mode is off!
---------- eMMC Device Information ----------
EMMC CID : 11010030333247373200B36CDA6E924E
EMMC CSD : D02700320F5903FFFFFFFFE78640009A
EMMC Manufacturer ID: 0011 , OEM ID: 0100
EMMC Date: 09/2015 Rev.0x0
EMMC NAME: 032G72 , S/N: 3010255470
EMMC NAME (HEX): 30333247373200
EMMC ROM1 (Main User Data) Capacity: 29820 MB
EMMC ROM2 (Boot Partition 1) Capacity: 4096 kB
EMMC ROM3 (Boot Partition 2) Capacity: 4096 kB
EMMC RPMB (Replay Protected Memory Block) Capacity: 4096 kB
EMMC Permanent Write Protection: No
EMMC Temporary Write Protection: No
EMMC Password Locked: No
Extended CSD rev 1.7 (MMC 5.0)
Boot configuration [PARTITION_CONFIG: 0x00] No boot partition configured.
Boot bus config [177]: 0x00 , width 1bit , Partition config [179]: 0x00.
H/W reset function [RST_N_FUNCTION]: 0x01
High-capacity W protect group size [HC_WP_GRP_SIZE: 0x00000000]
Partitioning Support [PARTITIONING_SUPPORT]: 0x07
Device support partitioning feature
Device can have enhanced tech.
Partitioning Setting [PARTITION_SETTING_COMPLETED]: 0x00
---------------------------------------------
Backup saved: 032G72_3010255470_20161111_1758.extcsd
Searching for partition tables...
Detected GPT over MBR...
Medium UUID: 98101B32-BBE2-4BF2-A06E-2BB33D000C20
Warning: Entries Count = 48
MMCBLK0P0 (MODEM) Range: [0X20000,0X3FFFE00] ,Len: 3FE0000
MMCBLK0P1 (PMIC) Range: [0X4000000,0X400B200] ,Len: B400
MMCBLK0P2 (SBL1) Range: [0X4020000,0X40DB600] ,Len: BB800
MMCBLK0P3 (DDR) Range: [0X4120000,0X421FE00] ,Len: 100000
MMCBLK0P4 (ABOOT) Range: [0X4220000,0X434BE00] ,Len: 12C000
MMCBLK0P5 (RPM) Range: [0X4397000,0X43CCA00] ,Len: 35C00
MMCBLK0P6 (TZ) Range: [0X4414000,0X44A3A00] ,Len: 8FC00
MMCBLK0P7 (SDI) Range: [0X4514000,0X452BE00] ,Len: 18000
MMCBLK0P8 (HYP) Range: [0X452C000,0X453EA00] ,Len: 12C00
MMCBLK0P9 (UTAGS) Range: [0X45AC000,0X462BE00] ,Len: 80000
MMCBLK0P10 (PADA) Range: [0X462C000,0X47FFE00] ,Len: 1D4000
MMCBLK0P11 (ABOOTBACKUP) Range: [0X4800000,0X492BE00] ,Len: 12C000
MMCBLK0P12 (RPMBACKUP) Range: [0X4977000,0X49ACA00] ,Len: 35C00
MMCBLK0P13 (TZBACKUP) Range: [0X49F4000,0X4A83A00] ,Len: 8FC00
MMCBLK0P14 (HYPBACKUP) Range: [0X4AF4000,0X4B06A00] ,Len: 12C00
MMCBLK0P15 (UTAGSBACKUP) Range: [0X4B74000,0X4BF3E00] ,Len: 80000
MMCBLK0P16 (PMICBACKUP) Range: [0X4C00000,0X4C0B200] ,Len: B400
MMCBLK0P17 (BLUETOOTH) Range: [0X4C20000,0X4E1FE00] ,Len: 200000
MMCBLK0P18 (PADB) Range: [0X4E20000,0X4FFFE00] ,Len: 1E0000
MMCBLK0P19 (MODEMST1) Range: [0X5000000,0X517FE00] ,Len: 180000
MMCBLK0P20 (MODEMST2) Range: [0X5180000,0X52FFE00] ,Len: 180000
MMCBLK0P21 (HOB) Range: [0X5300000,0X5379E00] ,Len: 7A000
MMCBLK0P22 (DHOB) Range: [0X537A000,0X5381E00] ,Len: 8000
MMCBLK0P23 (FSG) Range: [0X53A0000,0X551FE00] ,Len: 180000
MMCBLK0P24 (FSC) Range: [0X5520000,0X5520200] ,Len: 400
MMCBLK0P25 (CID) Range: [0X5520400,0X5540200] ,Len: 20000
MMCBLK0P26 (MISC) Range: [0X5540400,0X55C0200] ,Len: 80000
MMCBLK0P27 (METADATA) Range: [0X55C0400,0X5640200] ,Len: 80000
MMCBLK0P28 (LOGS) Range: [0X5640400,0X5840200] ,Len: 200000
MMCBLK0P29 (LIMITS) Range: [0X5860000,0X5860200] ,Len: 400
MMCBLK0P30 (LOGO) Range: [0X5880000,0X607FE00] ,Len: 800000
MMCBLK0P31 (CLOGO) Range: [0X6080000,0X6B7FE00] ,Len: B00000
MMCBLK0P32 (FRP) Range: [0X6B80000,0X6BFFE00] ,Len: 80000
MMCBLK0P33 (PERSIST) Range: [0X6C00000,0X73FFE00] ,Len: 800000
MMCBLK0P34 (KPAN) Range: [0X7400000,0X7BFFE00] ,Len: 800000
MMCBLK0P35 (BOOT) Range: [0X7C00000,0XA3FFE00] ,Len: 2800000
MMCBLK0P36 (RECOVERY) Range: [0XA400000,0XCC13E00] ,Len: 2814000
MMCBLK0P37 (SSD) Range: [0XCC20000,0XCC21E00] ,Len: 2000
MMCBLK0P38 (LOGS-CHARGING) Range: [0XCC22000,0XCF21E00] ,Len: 300000
MMCBLK0P39 (PADC) Range: [0XCF22000,0XCFFFE00] ,Len: DE000
MMCBLK0P40 (SP) Range: [0XD000000,0XD7FFE00] ,Len: 800000
MMCBLK0P41 (KEYSTORE) Range: [0XD800000,0XDFFFE00] ,Len: 800000
MMCBLK0P42 (CUSTOMIZE) Range: [0XE000000,0XFFFFE00] ,Len: 2000000
MMCBLK0P43 (OEM) Range: [0X10000000,0X10FFFE00] ,Len: 1000000
MMCBLK0P44 (CARRIER) Range: [0X11000000,0X11FFFE00] ,Len: 1000000
MMCBLK0P45 (CACHE) Range: [0X12000000,0X41FFFE00] ,Len: 30000000
MMCBLK0P46 (SYSTEM) Range: [0X42000000,0X141FFFE00] ,Len: 100000000
MMCBLK0P47 (USERDATA) Range: [0X142000000,0X745BDFE00] ,Len: 603BE0000
Done...Presets has been updated...
Done.
Running:Format FRP Partition...
Z3X EasyJtag Software ver. 2.4.1.1
Loading eMMC Addon Firmware... IO: 1800 mV
Box S/N: 1414FD121D756485, ,FW Ver.: 01.56
CMD Pullup Level:1691 mV
CMD Active Level:1763 mV
Box IO Level:1800 mV
CLK Rate:21000 khz
HiPower mode is off!
---------- eMMC Device Information ----------
EMMC CID : 11010030333247373200B36CDA6E924E
EMMC CSD : D02700320F5903FFFFFFFFE78640009A
EMMC Manufacturer ID: 0011 , OEM ID: 0100
EMMC Date: 09/2015 Rev.0x0
EMMC NAME: 032G72 , S/N: 3010255470
EMMC NAME (HEX): 30333247373200
EMMC ROM1 (Main User Data) Capacity: 29820 MB
EMMC ROM2 (Boot Partition 1) Capacity: 4096 kB
EMMC ROM3 (Boot Partition 2) Capacity: 4096 kB
EMMC RPMB (Replay Protected Memory Block) Capacity: 4096 kB
High-capacity W protect group size [HC_WP_GRP_SIZE: 0x00000000]
Partitioning Support [PARTITIONING_SUPPORT]: 0x07
Device support partitioning feature
Device can have enhanced tech.
Partitioning Setting [PARTITION_SETTING_COMPLETED]: 0x00
---------------------------------------------
Searching for partition tables...
Detected GPT over MBR...
Medium UUID: 98101B32-BBE2-4BF2-A06E-2BB33D000C20
GPT Entries Count = 48
Searching for FRP Data...
Marker of 6b80000 is: 19901873
FRP/Persistent Storage Format Success!
Searching for KillSwitch Specific FRP Data...
LG Custom Data is not found!
Done.
Z3X EasyJtag Software ver. 2.4.1.1
Skip loading eMMC Addon Firmware
CMD Pullup Level:1691 mV
CMD Active Level:1763 mV
Box IO Level:1800 mV
CLK Rate:21000 khz
Erasing 603BE0000 bytes from 142000000 ...ROM1
Erase Done.
Z3X EasyJtag Software ver. 2.4.1.1
Skip loading eMMC Addon Firmware
CMD Pullup Level:1691 mV
CMD Active Level:1763 mV
Box IO Level:1800 mV
CLK Rate:21000 khz
Erasing 30000000 bytes from 12000000 ...ROM1
Erase Done.
Z3X EasyJtag Software ver. 2.4.1.1
Skip loading eMMC Addon Firmware
CMD Pullup Level:1691 mV
CMD Active Level:1763 mV
Box IO Level:1800 mV
CLK Rate:21000 khz
Erasing 02000000 bytes from 0E000000 ...ROM1
Erase Done.
Z3X EasyJtag Software ver. 2.4.1.1
Skip loading eMMC Addon Firmware
CMD Pullup Level:1691 mV
CMD Active Level:1763 mV
Box IO Level:1800 mV
CLK Rate:21000 khz
Erasing 00B00000 bytes from 06080000 ...ROM1
Erase Done.
this is good news
any pics logs or docs hardware software that you can share would be awesome
vim1 said:
Successed wipe FRP in hardstyle way. Pull off eMMC from PCB and soldered back. Logs here :
Code:
Z3X EasyJtag Software ver. 2.4.1.1
Loading eMMC Addon Firmware... IO: 1800 mV
Box S/N: 1414FD121D756485, ,FW Ver.: 01.56
CMD Pullup Level:1175 mV
CMD Active Level:1515 mV
Box IO Level:1800 mV
CLK Rate:21000 khz
HiPower mode is off!
---------- eMMC Device Information ----------
EMMC CID : 11010030333247373200B36CDA6E924E
EMMC CSD : D02700320F5903FFFFFFFFE78640009A
EMMC Manufacturer ID: 0011 , OEM ID: 0100
EMMC Date: 09/2015 Rev.0x0
EMMC NAME: 032G72 , S/N: 3010255470
EMMC NAME (HEX): 30333247373200
EMMC ROM1 (Main User Data) Capacity: 29820 MB
EMMC ROM2 (Boot Partition 1) Capacity: 4096 kB
EMMC ROM3 (Boot Partition 2) Capacity: 4096 kB
EMMC RPMB (Replay Protected Memory Block) Capacity: 4096 kB
EMMC Permanent Write Protection: No
EMMC Temporary Write Protection: No
EMMC Password Locked: No
Extended CSD rev 1.7 (MMC 5.0)
Boot configuration [PARTITION_CONFIG: 0x00] No boot partition configured.
Boot bus config [177]: 0x00 , width 1bit , Partition config [179]: 0x00.
H/W reset function [RST_N_FUNCTION]: 0x01
High-capacity W protect group size [HC_WP_GRP_SIZE: 0x00000000]
Partitioning Support [PARTITIONING_SUPPORT]: 0x07
Device support partitioning feature
Device can have enhanced tech.
Partitioning Setting [PARTITION_SETTING_COMPLETED]: 0x00
---------------------------------------------
Backup saved: 032G72_3010255470_20161111_1758.extcsd
Searching for partition tables...
Detected GPT over MBR...
Medium UUID: 98101B32-BBE2-4BF2-A06E-2BB33D000C20
Warning: Entries Count = 48
MMCBLK0P0 (MODEM) Range: [0X20000,0X3FFFE00] ,Len: 3FE0000
MMCBLK0P1 (PMIC) Range: [0X4000000,0X400B200] ,Len: B400
MMCBLK0P2 (SBL1) Range: [0X4020000,0X40DB600] ,Len: BB800
MMCBLK0P3 (DDR) Range: [0X4120000,0X421FE00] ,Len: 100000
MMCBLK0P4 (ABOOT) Range: [0X4220000,0X434BE00] ,Len: 12C000
MMCBLK0P5 (RPM) Range: [0X4397000,0X43CCA00] ,Len: 35C00
MMCBLK0P6 (TZ) Range: [0X4414000,0X44A3A00] ,Len: 8FC00
MMCBLK0P7 (SDI) Range: [0X4514000,0X452BE00] ,Len: 18000
MMCBLK0P8 (HYP) Range: [0X452C000,0X453EA00] ,Len: 12C00
MMCBLK0P9 (UTAGS) Range: [0X45AC000,0X462BE00] ,Len: 80000
MMCBLK0P10 (PADA) Range: [0X462C000,0X47FFE00] ,Len: 1D4000
MMCBLK0P11 (ABOOTBACKUP) Range: [0X4800000,0X492BE00] ,Len: 12C000
MMCBLK0P12 (RPMBACKUP) Range: [0X4977000,0X49ACA00] ,Len: 35C00
MMCBLK0P13 (TZBACKUP) Range: [0X49F4000,0X4A83A00] ,Len: 8FC00
MMCBLK0P14 (HYPBACKUP) Range: [0X4AF4000,0X4B06A00] ,Len: 12C00
MMCBLK0P15 (UTAGSBACKUP) Range: [0X4B74000,0X4BF3E00] ,Len: 80000
MMCBLK0P16 (PMICBACKUP) Range: [0X4C00000,0X4C0B200] ,Len: B400
MMCBLK0P17 (BLUETOOTH) Range: [0X4C20000,0X4E1FE00] ,Len: 200000
MMCBLK0P18 (PADB) Range: [0X4E20000,0X4FFFE00] ,Len: 1E0000
MMCBLK0P19 (MODEMST1) Range: [0X5000000,0X517FE00] ,Len: 180000
MMCBLK0P20 (MODEMST2) Range: [0X5180000,0X52FFE00] ,Len: 180000
MMCBLK0P21 (HOB) Range: [0X5300000,0X5379E00] ,Len: 7A000
MMCBLK0P22 (DHOB) Range: [0X537A000,0X5381E00] ,Len: 8000
MMCBLK0P23 (FSG) Range: [0X53A0000,0X551FE00] ,Len: 180000
MMCBLK0P24 (FSC) Range: [0X5520000,0X5520200] ,Len: 400
MMCBLK0P25 (CID) Range: [0X5520400,0X5540200] ,Len: 20000
MMCBLK0P26 (MISC) Range: [0X5540400,0X55C0200] ,Len: 80000
MMCBLK0P27 (METADATA) Range: [0X55C0400,0X5640200] ,Len: 80000
MMCBLK0P28 (LOGS) Range: [0X5640400,0X5840200] ,Len: 200000
MMCBLK0P29 (LIMITS) Range: [0X5860000,0X5860200] ,Len: 400
MMCBLK0P30 (LOGO) Range: [0X5880000,0X607FE00] ,Len: 800000
MMCBLK0P31 (CLOGO) Range: [0X6080000,0X6B7FE00] ,Len: B00000
MMCBLK0P32 (FRP) Range: [0X6B80000,0X6BFFE00] ,Len: 80000
MMCBLK0P33 (PERSIST) Range: [0X6C00000,0X73FFE00] ,Len: 800000
MMCBLK0P34 (KPAN) Range: [0X7400000,0X7BFFE00] ,Len: 800000
MMCBLK0P35 (BOOT) Range: [0X7C00000,0XA3FFE00] ,Len: 2800000
MMCBLK0P36 (RECOVERY) Range: [0XA400000,0XCC13E00] ,Len: 2814000
MMCBLK0P37 (SSD) Range: [0XCC20000,0XCC21E00] ,Len: 2000
MMCBLK0P38 (LOGS-CHARGING) Range: [0XCC22000,0XCF21E00] ,Len: 300000
MMCBLK0P39 (PADC) Range: [0XCF22000,0XCFFFE00] ,Len: DE000
MMCBLK0P40 (SP) Range: [0XD000000,0XD7FFE00] ,Len: 800000
MMCBLK0P41 (KEYSTORE) Range: [0XD800000,0XDFFFE00] ,Len: 800000
MMCBLK0P42 (CUSTOMIZE) Range: [0XE000000,0XFFFFE00] ,Len: 2000000
MMCBLK0P43 (OEM) Range: [0X10000000,0X10FFFE00] ,Len: 1000000
MMCBLK0P44 (CARRIER) Range: [0X11000000,0X11FFFE00] ,Len: 1000000
MMCBLK0P45 (CACHE) Range: [0X12000000,0X41FFFE00] ,Len: 30000000
MMCBLK0P46 (SYSTEM) Range: [0X42000000,0X141FFFE00] ,Len: 100000000
MMCBLK0P47 (USERDATA) Range: [0X142000000,0X745BDFE00] ,Len: 603BE0000
Done...Presets has been updated...
Done.
Running:Format FRP Partition...
Z3X EasyJtag Software ver. 2.4.1.1
Loading eMMC Addon Firmware... IO: 1800 mV
Box S/N: 1414FD121D756485, ,FW Ver.: 01.56
CMD Pullup Level:1691 mV
CMD Active Level:1763 mV
Box IO Level:1800 mV
CLK Rate:21000 khz
HiPower mode is off!
---------- eMMC Device Information ----------
EMMC CID : 11010030333247373200B36CDA6E924E
EMMC CSD : D02700320F5903FFFFFFFFE78640009A
EMMC Manufacturer ID: 0011 , OEM ID: 0100
EMMC Date: 09/2015 Rev.0x0
EMMC NAME: 032G72 , S/N: 3010255470
EMMC NAME (HEX): 30333247373200
EMMC ROM1 (Main User Data) Capacity: 29820 MB
EMMC ROM2 (Boot Partition 1) Capacity: 4096 kB
EMMC ROM3 (Boot Partition 2) Capacity: 4096 kB
EMMC RPMB (Replay Protected Memory Block) Capacity: 4096 kB
High-capacity W protect group size [HC_WP_GRP_SIZE: 0x00000000]
Partitioning Support [PARTITIONING_SUPPORT]: 0x07
Device support partitioning feature
Device can have enhanced tech.
Partitioning Setting [PARTITION_SETTING_COMPLETED]: 0x00
---------------------------------------------
Searching for partition tables...
Detected GPT over MBR...
Medium UUID: 98101B32-BBE2-4BF2-A06E-2BB33D000C20
GPT Entries Count = 48
Searching for FRP Data...
Marker of 6b80000 is: 19901873
FRP/Persistent Storage Format Success!
Searching for KillSwitch Specific FRP Data...
LG Custom Data is not found!
Done.
Z3X EasyJtag Software ver. 2.4.1.1
Skip loading eMMC Addon Firmware
CMD Pullup Level:1691 mV
CMD Active Level:1763 mV
Box IO Level:1800 mV
CLK Rate:21000 khz
Erasing 603BE0000 bytes from 142000000 ...ROM1
Erase Done.
Z3X EasyJtag Software ver. 2.4.1.1
Skip loading eMMC Addon Firmware
CMD Pullup Level:1691 mV
CMD Active Level:1763 mV
Box IO Level:1800 mV
CLK Rate:21000 khz
Erasing 30000000 bytes from 12000000 ...ROM1
Erase Done.
Z3X EasyJtag Software ver. 2.4.1.1
Skip loading eMMC Addon Firmware
CMD Pullup Level:1691 mV
CMD Active Level:1763 mV
Box IO Level:1800 mV
CLK Rate:21000 khz
Erasing 02000000 bytes from 0E000000 ...ROM1
Erase Done.
Z3X EasyJtag Software ver. 2.4.1.1
Skip loading eMMC Addon Firmware
CMD Pullup Level:1691 mV
CMD Active Level:1763 mV
Box IO Level:1800 mV
CLK Rate:21000 khz
Erasing 00B00000 bytes from 06080000 ...ROM1
Erase Done.
Click to expand...
Click to collapse
It seem impossible to find any useful root tools for the Huawei Nova (EU edition).
This thread is in hope to collect some more info on this device, in order to give people better instruction on how to Root it.
Getting the boot-loader unlocked is easy as its unlock code is given by Huawei, and described
elsewhere. (1st 6 steps.) The problem appears to be to find an easy and persistent method for
root. It is very possible that I have missed something as I have not had much time to look
around very hard. So any input and links would be greatly appreciated.
If you do find the FULL firmware, please upload it and post a new link. It seem that most links I've found are
either fake, behind a long chain of ad-walls or on Chinese hard to navigate websites.
First of all the phone (I am interested in) has the following Firmware properties:
Code:
[ro.build.cust.id]: [CAN-L11C432B100CUSTC432D004]
[ro.product.fingerprintName]: [HUAWEI-MILAN]
[ro.product.CustCVersion]: [C432]
[ro.product.CustDVersion]: [D004]
[ro.product.board]: [CAN-L11]
[ro.product.hardwareversion]: [HL1CANL01M]
The update available so far is incomplete since it's an OTA to patch and resolve some
minor issues. So don't take it. Other OTAs can be found with this tool.
The processor (MSM8953) is exactly the same as for the following devices:
Code:
Asus Zenfone 3 (ZE520KL)
Asus Zenfone 3 (ZE552KL)
Asus Zenfone 3 Deluxe 5.5"
Huawei G9 Plus
Huawei Nova
Huawei Nova plus
Lenovo Vibe P2
Motorola Moto Z Play
Oppo R9s
Qiku 360 N4S
Samsung Galaxy C7
Samsung Galaxy On7 (2016)
Vivo X9
Xiaomi Redmi 4 Prime(32GB)
ZTE Axon Max 2
ZTE Axon 7 MAX
This means, that anything root that works on these, may also have a better success on this device.
But be careful, since these are just common names of devices and not exact model numbers!
For the bootloader unlock you need to provide this info:
Code:
Product Model: [ro.product.model]:
Product Serial number* [ro.boot.serialno]:
Product IMEI || MEID: (*#06#):
Product ID: (*#*#1357946#*#*):
All it takes is for someone to compile twrp. Knowing the differences in the models is important. I am in China so looking at the 64g internal 4gb memory. It is listed as CAZ-AL10. The partitions seem different, as the twrp developed does not support other models. Build it with you partition breakdown and it will work.
wangdaning said:
All it takes is for someone to compile twrp. Knowing the differences in the models is important. I am in China so looking at the 64g internal 4gb memory. It is listed as CAZ-AL10. The partitions seem different, as the twrp developed does not support other models. Build it with you partition breakdown and it will work.
Click to expand...
Click to collapse
Yeah, I was thinking to do that since nobody else seem interested, but since I'm not rooted yet, I can't even get a proper partition layout as standard partition layout "by-name" is unreadable for non-root, at least not from simple shell. Is your device using the same processor (see my post above)? (I doubt it.) However, it was compiled with kernel debug fs, so perhaps something can be used there. I was also asking elsewhere if we can use the recent full AOS 7.0 (EMUI 5.0) update posted by @lgstoian and use it to build TWRP also for the original 6.0 (EMUI 4.1)?
By the way, where does Huawei post their sources? And who to contact to make them post it? Do they normally comply with open-source requirements?
The partition table seem to look as follows:
Code:
$ cat /proc/partitions
major minor #blocks name
254 0 524288 zram0
179 0 30535680 mmcblk0
179 1 512 mmcblk0p1
179 2 512 mmcblk0p2
179 3 2048 mmcblk0p3
179 4 256 mmcblk0p4
179 5 8192 mmcblk0p5
179 6 256 mmcblk0p6
179 7 256 mmcblk0p7
179 8 256 mmcblk0p8
179 9 512 mmcblk0p9
179 10 512 mmcblk0p10
179 11 2048 mmcblk0p11
179 12 256 mmcblk0p12
179 13 8192 mmcblk0p13
179 14 256 mmcblk0p14
179 15 256 mmcblk0p15
179 16 256 mmcblk0p16
179 17 65536 mmcblk0p17
179 18 4096 mmcblk0p18
179 19 4096 mmcblk0p19
179 20 4096 mmcblk0p20
179 21 163840 mmcblk0p21
179 22 1 mmcblk0p22
179 23 8 mmcblk0p23
179 24 16384 mmcblk0p24
179 25 32 mmcblk0p25
179 26 16 mmcblk0p26
179 27 8192 mmcblk0p27
179 28 11264 mmcblk0p28
179 29 4096 mmcblk0p29
179 30 81920 mmcblk0p30
179 31 81920 mmcblk0p31
259 0 81920 mmcblk0p32
259 1 1024 mmcblk0p33
259 2 262144 mmcblk0p34
259 3 7168 mmcblk0p35
259 4 65536 mmcblk0p36
259 5 65536 mmcblk0p37
259 6 512 mmcblk0p38
259 7 512 mmcblk0p39
259 8 32 mmcblk0p40
259 9 512 mmcblk0p41
259 10 1024 mmcblk0p42
259 11 32768 mmcblk0p43
259 12 512 mmcblk0p44
259 13 4096 mmcblk0p45
259 14 128 mmcblk0p46
259 15 128 mmcblk0p47
259 16 256 mmcblk0p48
259 17 256 mmcblk0p49
259 18 8 mmcblk0p50
259 19 16384 mmcblk0p51
259 20 524288 mmcblk0p52
259 21 3788800 mmcblk0p53
259 22 25178095 mmcblk0p54
179 32 4096 mmcblk0rpmb
253 0 3758932 dm-0
253 1 520124 dm-1
253 2 25178079 dm-2
But we need the correct mapping to the files as given in the full update.
They usually drop their sources here for international : http://consumer.huawei.com/en/support/mobile-phones/index.htm and here for chinese : http://consumer.huawei.com/cn/support/mobile-phones/index.htm
From what I saw they pop up there 2 - 3 months after the phones launch date.
Looking forward for the root of the Huawei nova urgently. I think it needs more time for this newly device to get one great dev to compile twrp and get a root method to work.
I just switched from HTC 10 to nova and I'm very impressed. Huawei emui did so much better than HTC.
Everything is working out of the box and looks great. The only thing I really miss is root for using adblock and a network speed indicator.
Getting my popcorn bowl !! :laugh:
Nova Plus
E:V:A said:
It seem impossible to find any useful root tools for the Huawei Nova (EU edition).
This thread is in hope to collect some more info on this device, in order to give people better instruction on how to Root it.
Getting the boot-loader unlocked is easy as its unlock code is given by Huawei, and described
elsewhere. (1st 6 steps.) The problem appears to be to find an easy and persistent method for
root. It is very possible that I have missed something as I have not had much time to look
around very hard. So any input and links would be greatly appreciated.
If you do find the FULL firmware, please upload it and post a new link. It seem that most links I've found are
either fake, behind a long chain of ad-walls or on Chinese hard to navigate websites.
First of all the phone (I am interested in) has the following Firmware properties:
Code:
[ro.build.cust.id]: [CAN-L11C432B100CUSTC432D004]
[ro.product.fingerprintName]: [HUAWEI-MILAN]
[ro.product.CustCVersion]: [C432]
[ro.product.CustDVersion]: [D004]
[ro.product.board]: [CAN-L11]
[ro.product.hardwareversion]: [HL1CANL01M]
The update available so far is incomplete since it's an OTA to patch and resolve some
minor issues. So don't take it. Other OTAs can be found with this tool.
The processor (MSM8953) is exactly the same as for the following devices:
Code:
Asus Zenfone 3 (ZE520KL)
Asus Zenfone 3 (ZE552KL)
Asus Zenfone 3 Deluxe 5.5"
Huawei G9 Plus
Huawei Nova
Huawei Nova plus
Lenovo Vibe P2
Motorola Moto Z Play
Oppo R9s
Qiku 360 N4S
Samsung Galaxy C7
Samsung Galaxy On7 (2016)
Vivo X9
Xiaomi Redmi 4 Prime(32GB)
ZTE Axon Max 2
ZTE Axon 7 MAX
This means, that anything root that works on these, may also have a better success on this device.
But be careful, since these are just common names of devices and not exact model numbers!
For the bootloader unlock you need to provide this info:
Code:
Product Model: [ro.product.model]:
Product Serial number* [ro.boot.serialno]:
Product IMEI || MEID: (*#06#):
Product ID: (*#*#1357946#*#*):
Click to expand...
Click to collapse
Hi man! I bought my Nova but it didn't arrive yet. But I'm following this thread and searched a bit. It seems that there is a source for Zenfone 3 ZE520KL here. Don't know if something can be done from here.
Sadly, Huawei G9 Plus isn't even listed at the site that @lgstoian sent. For more accurated source, we will have to wait for Huawei to put the source code on the site =/
EDIT: in fact, I noticed that g9 plus isn't to be found anywhere in Huawei website. And it seems that G9 Plus has the same specs of Nova Plus, So they might be the same device.
As I stated in the bootloader thread, I'm really interested in compiling TWRP for the device, but I'm on L01. I put together some files and if everything goes well, I'll give it a try at the end of the week. This isn't a promise, but I try to..
The difference between the L-01 and the L-11 should only the modem because the dual sim.
Tell new hat you need.
That's right..but let me start with L01-Version..at the moment I've some problems to solve for compiling, but the files should be complete..
If you read with compile, send me a copy I will try it on my L-11. (I bricked it with manual flash a system img from the 7.0 Update xD )
And with a working TWRP i can flash a backup from another phone, to get it work again.
Let me guess you tried the C900 one? Have you tried to flash also recovery and boot from this package?
Vinnom said:
...And it seems that G9 Plus has the same specs of Nova Plus, So they might be the same device.
Click to expand...
Click to collapse
It probably is the same device. I would guess it is a test release device, possibly even a developer device from a very limited release.
-=MoRpH=- said:
The difference between the L-01 and the L-11 should only the modem because the dual sim.
Click to expand...
Click to collapse
Yep, I think so too, because both firmware and and ro.product.hardwareversion are often referring to L01.
What we need is a working partition table, to know what can be flashed where. ATM I can't even read the partitions, since I have no working root. I'm closely following the developments on the dirtycow thread. However, the full AOS 7 update contain all partitions, but I need to get the mappings.
Running 7zip on the UPDATE.APP give you these 61 image files:
Code:
$ ls -1
aboot.img*
abootbak.img*
apdp.img*
boot.img*
bootfail_info.img*
cache.img*
cmnlib.img*
cmnlib64.img*
cmnlib64bak.img*
cmnlibbak.img*
config.img*
cust.img*
DDR.img*
devcfg.img*
devcfgbak.img*
devinfo.img*
dip.img*
dpo.img*
dsp.img*
erecovery.img*
fsc.img*
fsg.img*
keymaster.img*
keymasterbak.img*
keystore.img*
limits.img*
lksecapp.img*
lksecappbak.img*
log.img*
mcfg.img*
mdtp.img*
misc.img*
modem.img*
modemst1.img*
modemst2.img*
mota.img*
msadp.img*
nff.img*
oeminfo.img*
pad0.img*
pad1.img*
pad2.img*
patch.img*
persist.img*
product.img*
recovery.img*
rpm.img*
rpmbak.img*
rrecord.img*
sbl1.img*
sbl1bak.img*
sec.img*
splash.img*
ssd.img*
syscfg.img*
system.img*
tz.img*
tzbak.img*
userdata.img*
vendor.img*
version.img*
However, using 7z to unpack give you an error for each, even though the names (and number of partitions) now seem correct. This is because the image packaging contain additional non-standard data. Although there are some differences, it's something like this:
Code:
1. First 92 bytes are 0x00
2. Each file are started with 55AA 5AA5
3. Then 4 bytes for Header Length
4. Then 4 bytes for Unknown1
5. Then 8 bytes for Hardware ID
6. Then 4 bytes for File Sequence
7. Then 4 bytes for File Size
8. Then 16 byts for File Date
9. Then 16 byts for File Time
10.Then 16 byts for File Type
11.Then 16 byts for Blank1
12.Then 2 bytes for Header Checksum
13.Then 2 bytes for BlockSize
14.Then 2 bytes for Blank2
15.Then ($headerLength-98) bytes for file checksum
16.Then data file length bytes for files.
17.Then padding if have
18.Then repeat 2 to 17
So you need to use a Huawei specific unpacker. Trying to use any previous and outdated split_updata.pl (or splitupdate) scripts, does not give all the partitions without modifications. There are some hope for the better maintained Huawei Updater Extractor tool by @worstenbrood.
Mapping this back to /proc/partitions, should be fairly straight forward...
What is note worthy is that the mmcblk0p54 partition is 16 bytes larger than dm-2 (verity?), and /system is mounted on dm-2.
The question here is, how got the Chinese guy the mounting point or the partition table for the 64gb version? My Chinese is to bad, so I can't ask him.
Gesendet von iPhone mit Tapatalk
@morph wich Chinese guy do you mean?
I think he is referring to this thread : http://club.huawei.com/thread-11271738-1-1.html
Yes @lgstoian That's what I mean.
The recovery boot on my L11 but can't mount the partitions.
Gesendet von iPhone mit Tapatalk
Google's translation of the link:
Code:
NovaTWRP for XiaoWang_v1.1
UPDATE:
1. Added the king su_v3.64, integrated with the recovery file
2. Perfect support sub-f2fs
3. Solved the previous version of the bug
Boot file also improved, to solve the last version of the small probability
of the collapse of the phenomenon, be sure to use the new version
Because the system can not support supersu, will not start, so the use
of the kingroot team file (kingroot program is really high, I looked
directly on the ignorant of), and by the kingroot implementation of
the root. This program needs to format the data, please make a backup
As the screenshot upload it is too slow, so do not upload, and then
pass on the following text with a very detailed description of it
Before operation, please charge the battery to 60 or more, just in
case
1. First of all, please back up good data, first of all, please back
up good data, first back up good data, I have said important three times
2. Your phone needs to unlock the OEM before follow-up operation
3. Press the power button to restart, hold down the black screen of the moment the volume down, it will enter fastboot
4. Then extract the downloaded file, click the brush into the boot,
brush into the recovery, will be prompted to brush into the general impossible to error
5. Unplug the USB, press the power button to shut down,
press and hold the volume after the black screen, until you see a
large English, and so on 3 seconds to release, entered the Nova
special TWRP latest version
6. Go to Main> Clear> Format data partition> enter yes>
7. Main interface> Restart> Recovery
8. The main interface> mount> the system hook
9. Main interface> Advanced> File management> Select su folder> Select su> Copy> system> xbin> Point to the lower right corner of the hook> Slide button to confirm >>>> Back to system / xbin / Select su file>
10. Main interface> Restart> System>
11. Restart to the system, do not set the fingerprint and account
12. Install KingRoot.apk just downloaded, be sure to this version, do not download other versions, and do not download other software will be error, will become a serious brick
13.root after he turned around and then complete the point that the blue immediately deal with
14. Do not ask me why always the middle of the night post
15. Cherish the fruits of labor, reproduced, please indicate the source
If the operation failed, please do not lose heart, I also prepared the
original document, under any circumstances, as long as BootLoader
is not formatted, you can save the brick paste is a virtue, to
download the file, please reply " My brother "file 118.92M, it is
recommended to use WiFi download
Pan.baidu.com/s/1eRTkmsi
This link was updated on November 26, 2016 at 22:37:36
Xelfmade said:
Let me guess you tried the C900 one? Have you tried to flash also recovery and boot from this package?
Click to expand...
Click to collapse
First i tried the L11 EMUI 5 Beta (Yes boot, recovery and system.img). After that i got a boot loop and tried to wipe user data... that fails at 30%.
Than i tried the full firmware for the C900 (dload and fastboot) doesn't work too. Right now i can only boot the recovery and erecovery.
@lgstoian does that mean, he has successfully rooted the nova and we only have to translate his description correct to get a working root?