[Q] Why can't I flash my NAND - HBOOT 0.76.2000 - G2 and Desire Z Q&A, Help & Troubleshooting

What is up with fastboot and 0.76.2000??? In theory, I should be able to use fastboot to flash the pieces of a nandroid backup or the stock rom, but I've run into some odd issues.
I tried flashing system, boot, userdata, and cache on my G2 and it seems to hang- for over 10 mins. The little status bar sometimes starts to fill up, but not always. If it does actually finish sending the file, then the write fails. Is there some fastboot oem unlock command to use to enable flashing?
I've used fastboot to flash recoveries, radios, and SPLs on my G1, so I think it is working properly otherwise. I can flash the nandroid *.img files on my G1 and there are no problems using 1.33.2005 (AKA Death SPL) and an unmodified recovery. (I didn't have much luck with 1.33.2003 (Safe SPL) and an MTD patched recovery.)
Why doesn't this work on the my G2?
Code:
INFOversion: 0.5
INFOversion-bootloader: 0.76.2000
INFOversion-baseband: 26.03.02.26_M
INFOversion-cpld: None
INFOversion-microp: 0425
INFOversion-main: 1.22.531.8
INFOserialno: XXXX
INFOimei: XXXX
INFOproduct: vision
INFOplatform: HBOOT-7230
INFOmodelid: PC1010000
INFOcidnum: 11111111
INFObattery-status: good
INFObattery-voltage: 3872mV
INFOpartition-layout: Generic
INFOsecurity: off
INFObuild-mode: ENG
INFOboot-mode: FASTBOOT
INFOcommitno-bootloader: 977d3036
INFOhbootpreupdate: 11
INFOgencheckpt: 0
I'm using a Mac with fastboot via the developer site, but I also tried the fastboot that gets built with the aosp roms.
And yes, I can restore these parts via CMW recovery, but it seems like the eng hboot is missing some functionality.

I don't know why it's not working for you, so I'm clutching at straws here. But are you using the original HTC USB cable ? I had some odd issues myself when using a third-party cable.

I've use the original HTC cable with my G2 and it doesn't work.
On my G1, I've been using a non-HTC cable and it works fine. I've noticed some charging issues with a specific non-HTC cable and charging my G1, but I think it's just one bad cable.

Just to clarify, the fastboot binary that you've got is from the Android SDK (for Mac) from the AOSP site ?

I have one from the HTC site for ADP1 and the other gets compiled with the aosp source code when the rom is cooked. I don't recall the path but it's something like out/.../tools/
I didn't know that the new SDK comes with fastboot.
Sent from my CyanogenMod Vision

gee one said:
I have one from the HTC site for ADP1 and the other gets compiled with the aosp source code when the rom is cooked. I don't recall the path but it's something like out/.../tools/
I didn't know that the new SDK comes with fastboot.
Click to expand...
Click to collapse
I know that mine works fine using the fastboot from the SDK, and the eng hboot (I have a DZ). Worth a try to see if it's something about your fastboot binary ?

steviewevie said:
I know that mine works fine using the fastboot from the SDK, and the eng hboot (I have a DZ). Worth a try to see if it's something about your fastboot binary ?
Click to expand...
Click to collapse
You can flash the nandroid images to restore a rom? Mine seems to work fine otherwise and will even flash some of the smaller nandroid parts, but certainly not system.img and data.img on my G2. It works fine on the G1.
I'll dig around the SDK when I get home to make sure I'm using the lastest version of fastboot.
Sent from my CyanogenMod Vision

gee one said:
You can flash the nandroid images to restore a rom? Mine seems to work fine otherwise and will even flash some of the smaller nandroid parts, but certainly not system.img and data.img on my G2. It works fine on the G1.
Click to expand...
Click to collapse
I haven't tried it myself, but I'm 99% sure that you can't just flash a nandroid image for system via fastboot etc, you have to restore via nandroid.

steviewevie said:
I know that mine works fine using the fastboot from the SDK, and the eng hboot (I have a DZ). Worth a try to see if it's something about your fastboot binary ?
Click to expand...
Click to collapse
I reinstalled the latest SDK and there is no fastboot included. (I updated first, but reinstalled for the sake of completeness.) The only sources of fastboot that I know of are from the HTC developer site and from AOSP. The AOSP version has a few more features, such as being able to set the kernel base address and the NAND page size.
steviewevie said:
I haven't tried it myself, but I'm 99% sure that you can't just flash a nandroid image for system via fastboot etc, you have to restore via nandroid.
Click to expand...
Click to collapse
I did try this on my G1 (one) and was successful. I was able to restore my backup as if I had restored it via recovery. On my G1, however, I am using Amon-Ra 1.7.0, not ClockworkMod. The *.img file seem to be similar, so this seems to be an issue with fastboot not being fully functional with the G2/0.76.2000.
Anyone want to try flashing the *.img files via fastboot? "fastboot flash userdata data.img" should be enough to tell if it's working. I'm using a Mac with CM6.1.1/CMW2.5.1.3, in case that matters.
BTW, the reason that I think this is important is because if this works, people can flash parts of the stock rom or RUU or PC101.img or whatever, without flashing the locked bootloader, which leads to brick-o-rama.

gee one said:
I reinstalled the latest SDK and there is no fastboot included. (I updated first, but reinstalled for the sake of completeness.) The only sources of fastboot that I know of are from the HTC developer site and from AOSP. The AOSP version has a few more features, such as being able to set the kernel base address and the NAND page size.
Click to expand...
Click to collapse
Sorry but I beg to differ, at least for the Windows version of the SDK. Version 8 (latest) of the Windows SDK starter package comes with fastboot.exe in the "tools" folder. adb has been removed from the starter package and comes in the platform tools module. I see that you use a Mac, so that might be different.

gee one said:
I did try this on my G1 (one) and was successful. I was able to restore my backup as if I had restored it via recovery. On my G1, however, I am using Amon-Ra 1.7.0, not ClockworkMod. The *.img file seem to be similar, so this seems to be an issue with fastboot not being fully functional with the G2/0.76.2000.
Anyone want to try flashing the *.img files via fastboot? "fastboot flash userdata data.img" should be enough to tell if it's working. I'm using a Mac with CM6.1.1/CMW2.5.1.3, in case that matters.
BTW, the reason that I think this is important is because if this works, people can flash parts of the stock rom or RUU or PC101.img or whatever, without flashing the locked bootloader, which leads to brick-o-rama.
Click to expand...
Click to collapse
You're asking someone to experiment ? I wouldn't try it, because as far as I know, Clockwork mod uses YAFFS format for its backup images. They're not just an image dump of the partition, which is why I'm pretty sure you can't just flash them back on with fastboot.

I've tried it on my G1 and G2. I'm asking someone to confirm if it's an HBOOT issue or if it's isolated to me.
The Nandroid files from Amon Ra on the G1 are YAFFS format as well. Both data.img and system.img unyaffs the same whether they are the G1 or G2.
I think there is extremely low risk. If it's an HBOOT issue, it probably will hang during the send and never get to actually flashing the NAND. If it's just my issue and it works on other phones, then it should flash fine, similar to what I did on my G1.
Sent from my CyanogenMod Vision

This problem is ALL about the backup image that you are trying to restore.
There are two ways to create a backup.... direct binary copy of the partition (i.e. "dd"), or copying the contents of the filesystem (i.e. "cp -pr"). CWM/Vision uses the latter. Older nand devices typically use the FORMER.
If you want to fastboot flash a backup, your backups need to be direct binary dumps, which you can create using the "dd" command.
I.e. "dd if=/path/to/system/partition of=/sdcard/backups/system.img"
The backups made by CWM are a weird proprietary kind of backup (didn't look too far into it, since it is utterly uninteresting, or it may be yaffs, but WHY? It serves no purpose to use yaffs....). There IS a benefit to this kind of backup though (not to the use of yaffs though): it doesn't duplicate free space. The tradeoff is that you can't just flash it back. Remember that you have a total of 2.1 GB of internal storage on the device. A dd-type backup will take the exact same amount of space on your sdcard.
A much better way to do a backup is to create a SPARSE FILE backup.
Something along the lines of "dd if=/path/to/system/partition | cp --sparse=always /dev/stdin /sd-ext/backups/system.img" would cut out all the large spaces that are filled with nothing but zeros. Typically, on a magnetic disk, you would need to preceed this with a "dd if=/dev/zero of=/path/to/filesystem/to/be/backed/up/zerofile; sync; rm /path/to/filesystem/to/be/backed/up/zerofile; sync; umount/path/to/filesystem/to/be/backed/up" in order to clear all the random garbage from files that have already been deleted. MMC is a bit of an oddball though, with wear levelling, unused blocks get tagged and sometimes cleared, and sometimes the mmc device will "always return zero" for "unused" blocks, so it may not require you to zero everything out.
Note about sparse files: You need to store the sparse files on a filesystem that supports sparse files.... that means EXT, you can NOT create sparse files on a vfat filesystem.
When you READ a sparse file, offsets are automatically corrected and zeros automatically injected where applicable.
Now IF it is creating a yaffs backup, the same thing holds true.... yaffs is NOT COMPATIBLE WITH eMMC!!!! You can't flash a yaffs image onto the eMMC and expect it to work!

Thanks - I didn't realize that there was a change with backups, which explains the "issues" that I was having.

Related

[Q] Any chance of fixing USB Brick w/o root ?

Well I USB bricked my Desire last night.
To make things worse I was only able to apply the SD Card workaround via fastboot.
After flashing the update.zip from the modaco fix I instantly went back to the stock rom using the fastboot RUU process, without actually checking if it solved all the problems...
I know I had it coming...
Before I ship the phone out for repairs - maybe someone here knows if there is a chance to unbrick without root (nor having HBOOT version that allows to use any other method of rooting other than Unrevoked)
Code:
HBOOT 0.93
European 2.10.405 OTA
Thanks in advance
a more detailed description would help:
does your phone boot?
do you have running clockworkmod recovery?
did you do a nandroid backup before touching the system?
what modaco fix? give a link.
did you use unrevoked? thats the default root tool nowadays.
can you go to hboot/fastboot when pressing vol down while pressing power on?
Use a goldcard, it will enable you to put an unrooted Rom there. It's always a good reset option.
Sent from my HTC Desire using XDA App
mad-murdock said:
a more detailed description would help:
does your phone boot?
do you have running clockworkmod recovery?
did you do a nandroid backup before touching the system?
what modaco fix? give a link.
did you use unrevoked? thats the default root tool nowadays.
can you go to hboot/fastboot when pressing vol down while pressing power on?
Click to expand...
Click to collapse
Hi,
- the phone boots ok - It has most of the symptoms from All you need to know about USB-Bricks thread, the SD card started to work after issuing:
Code:
fastboot oem enableqxdm 0
This is the output from the fastboot oem boot command
Code:
$ fastboot-mac oem boot
... INFOsetup_tag addr=0xA0000100 cmdline add=0x8E07F9F0
INFOTAG:Ramdisk OK
INFOTAG:smi ok, size = 0
INFOTAG:hwid 0x0
INFOTAG:skuid 0x21F04
INFOTAG:hero panel = 0x0
INFOTAG:engineerid = 0x0
INFOMCP dual-die
INFOMCP dual-die
INFOTAG:mono-die = 0x0
INFODevice CID is not super CID
INFOCID is HTC__032
INFOsetting->cid::HTC__032
INFOserial number: HT057PL01634
INFOcommandline from head: no_console_suspend=1
INFOcommand line length =430
INFOactive commandline: board_bravo.disable_uart3=1 board_bravo.
INFOusb_h2w_sw=1 board_bravo.disable_sdcard=0 diag.enabled=0 boa
INFOrd_bravo.debug_uart=0 smisize=0 userdata_sel=0 androidboot.e
INFOmmc=false androidboot.baseband=5.09.05.30_2 androidboot.cid
INFO=HTC__032 androidboot.carrier=HTC-EastEurope androidboot.mid
INFO=PB9920000 androidboot.keycaps=qwerty androidboot.mode=norma
INFOl androidboot.serialno=HT057PL01634 androidboot.bootloader=0
INFO.93.0001 no_console_suspend=1
INFOaARM_Partion[0].name=misc
INFOaARM_Partion[1].name=recovery
INFOaARM_Partion[2].name=boot
INFOaARM_Partion[3].name=system
INFOaARM_Partion[4].name=cache
INFOaARM_Partion[5].name=userdata
INFOpartition number=6
INFOValid partition num=6
INFOmpu_nand_acpu_rw A1E 1000
INFOjump_to_kernel: machine_id(2457), tags_addr(0x20000100), ker
INFOnel_addr(0x20008000)
INFO-------------------hboot boot time:697447 msec
ERROR: usb_read failed with status e00002ed
FAILED (status read failed (No such file or directory))
- Sadly, I made a complete reflash using
Code:
fastboot rebootRUU;
fastboot flash zip rom.zip
... so no Clockwork recovery anymore
- Yes I have a nandroid backup but no means to put it back on the phone - the nandroid backup contains exactly the same rom I have now - just rooted
- As for the modaco fix I'm a new user I can't post external links, but it's the first link in this thread
- I did use the lastest Unrevoked3 (3.21) to root the phone
- I can use hboot / fastboot without problems but it's the stock 0.93.001 S-ON version.
Thanks
geejayoh said:
Use a goldcard, it will enable you to put an unrooted Rom there. It's always a good reset option.
Sent from my HTC Desire using XDA App
Click to expand...
Click to collapse
I have an unbranded Desire so no need to use a GoldCard if I'm not mistaken.
Anyway if memory serves me right using the GoldCard / HBOOT / PB99IMG flashing, won't allow me neither to downgrade, nor to flash an unsigned rom.
An unsigned rooted rom or HBOOT downgraded do 0.80 could help me fix my problem - but with HBOOT 0.93 - dowgrading doesn't seem to be an option. I get a "Main Version Older" error when trying to downgrade, and flashing an unsigned rom is a no-no for all stock bootloaders as far as I know (I tried both HBOOT and recovery, both as expected fail at signature verification).
But thanks anyway
Whats the exact problem now? You restored rom.zip via ruu. So you got a stock firmware with stock hboot and stock recovery which can be unrevoked again?
Seams i am missing a detail ^^
Sent from my HTC Desire using Tapatalk
mad-murdock said:
Whats the exact problem now? You restored rom.zip via ruu. So you got a stock firmware with stock hboot and stock recovery which can be unrevoked again?
Seams i am missing a detail ^^
Sent from my HTC Desire using Tapatalk
Click to expand...
Click to collapse
It seems to me you're missing the main issue not a detail
The main issue being a condition called "USB Brick" (well that's only half the truth, most of the main issue is me acting without thinking )
Please read the info thread on USB Bricks here, since you have a HTC Desire - it concerns you too. Good idea to backup the MISC partition if you plan to flash the phone again
Anyyyyway - as for my case:
I screwed up, flashed the stock firmware BEFORE checking if the applied USB brick fix solved my problems. So it's true I have stock firmware, stock hboot, stock recovery - but I also have no way to connect the phone to a computer via USB - because the flashing process updates the following partitions: system, recovery, boot but not the misc partition which is now corrupt, and its corruption is the cause of the USB brick...
USB Brick = no usb connection at all while booted to the Android OS
No usb connection = no usb debug mode
no usb debug mode = no unrevoked
The usb still works from HBOOT / FASTBOOT, so If you know of a way to start Unrevoked while the phone is in HBOOT / FASTBOOT - please enlighten me, because I couldn't do It.
Unrevoked only recognized the phone while it was in USB Debug mode, which it cannot enter now because of the USB Brick. When I connect the phone while in Fastboot USB mode or HBOOT USB mode Unrevoked just states "Waiting for device".
I don't think I am able to put this in any clearer way
Thanks
Ouch. Now i see. Didnt understand you at the start. Well, i had an usb brick myself after wiping the system. At least i had a modded hboot and recovery.
Now to your problem. Wierd situation, really. But if i remember right, flashing one of the ruu.Exe files should also fix misc. Then you have stock firmware with usb working. Cant link here in tapatalk, but those ruu file are a sticky in desire dev forum... tell me, if it worked...
Sent from my HTC Desire using Tapatalk
Solved!
I was able to successfully unbrick the phone
It wouldn't be possible without rageagainstthecage, All the people writing the tutorials on USB unbricking, QuickSSHd and the Terminal Emulator app. Thanks to the authors.
I'll try to sum things up for anyone interested:
The problem
Because of acting without thinking I ended up with a stock unrooted rom and a partial USB brick. To make things worse I accepted the OTA update, installing the oh so loved HBOOT 0.93.100 S-ON.
The Solution
After some reading about rageagainstthecage, PoC code on which the Unrevoked rooting solution is based I tried to run the exploit directly on the phone.
Without having access to adb I wasn't able to find a place to put the executable, as the /data/ directory is writable only by the system user and the system group, and most tutorials suggest to place the exploit somewhere inside that directory. But all the tutorials I found mentioned using adb push to put the file on the phone, which probably operates on the phone as system:system as it is capable of writing to the /data dir. I wasn't able to write there as I had the id of the Terminal Application
Since apps storing data seem to store er... data in /data/data I had a little breakthru. Becaue I couldn't find a free telnet solution I purchased the QuickSSHd from Android Market.
This allowed me to have write access to /data/data/<package_name>/home where I created a world readable (755) directory. I scp'd the rageagaintthecage, modified misc partition image and flash_image binary to the phones filesystem, and made them executable. I could've used the Terminal Apps <data dir>/shared_prefs directory (which would be a $$$ free solution, as the ssh was not free, but not expensive either) but I'm lazy and doing stuff from a PC keyboard is easier than from a touch keyboard.
Running the exploit and flash_image from inside a ssh session seemed like a good idea but the sshd died after running the exploit, and didn't want to start untill the phone was rebooted. So next time I just started the sshd and done the rest of the stuff from a Terminal Emulator (After preparing scripts for ease of execution, and dropboxing the paths for copy paste ). After running the exploit the Terminal Emulator app stopted working correctly (as expected) but after force closing it and running it again I was greeted with a # prompt
I flashed the misc partition with an image modified with my phones CID, rebooted and voila! USB brick gone
Now I just have to beat one thing into my empty head (in the manner of "stop, drop, and roll" firedrill mantra). STOP, READ and THINK - before flashing
g'night
mad-murdock said:
Ouch. Now i see. Didnt understand you at the start. Well, i had an usb brick myself after wiping the system. At least i had a modded hboot and recovery.
Now to your problem. Wierd situation, really. But if i remember right, flashing one of the ruu.Exe files should also fix misc. Then you have stock firmware with usb working. Cant link here in tapatalk, but those ruu file are a sticky in desire dev forum... tell me, if it worked...
Sent from my HTC Desire using Tapatalk
Click to expand...
Click to collapse
Hi,
Just fyi because I was able to resolve my problem in the meantime.
Because I was foolish enough to install the OTA upgrade before it occured to me that the USB is not working, installing any RRU either in the official way (by running the exe) or by extracting the rom.zip from inside of the exe didn't work. The latest RRU was older then the firmware with OTA upgrade on my phone, and it didn't seem to allow me to downgrade.
ZIP way = Main Version Older error
EXE way = You have to install the correct firmware version or some other bla bla bla
Anyway I took a look inside the rom.zip extracted from the RRU.exe - there are img files of every partition, radio and hboot but no misc.
But thanks again anyway
How did you solve your tricky situation then?
Sent from my HTC Desire using Tapatalk
quanchi said:
I was able to successfully unbrick the phone
It wouldn't be possible without rageagainstthecage, All the people writing the tutorials on USB unbricking, QuickSSHd and the Terminal Emulator app. Thanks to the authors.
I'll try to sum things up for anyone interested:
The problem
Because of acting without thinking I ended up with a stock unrooted rom and a partial USB brick. To make things worse I accepted the OTA update, installing the oh so loved HBOOT 0.93.100 S-ON.
The Solution
After some reading about rageagainstthecage, PoC code on which the Unrevoked rooting solution is based I tried to run the exploit directly on the phone.
Without having access to adb I wasn't able to find a place to put the executable, as the /data/ directory is writable only by the system user and the system group, and most tutorials suggest to place the exploit somewhere inside that directory. But all the tutorials I found mentioned using adb push to put the file on the phone, which probably operates on the phone as system:system as it is capable of writing to the /data dir. I wasn't able to write there as I had the id of the Terminal Application
Since apps storing data seem to store er... data in /data/data I had a little breakthru. Becaue I couldn't find a free telnet solution I purchased the QuickSSHd from Android Market.
This allowed me to have write access to /data/data/<package_name>/home where I created a world readable (755) directory. I scp'd the rageagaintthecage, modified misc partition image and flash_image binary to the phones filesystem, and made them executable. I could've used the Terminal Apps <data dir>/shared_prefs directory (which would be a $$$ free solution, as the ssh was not free, but not expensive either) but I'm lazy and doing stuff from a PC keyboard is easier than from a touch keyboard.
Running the exploit and flash_image from inside a ssh session seemed like a good idea but the sshd died after running the exploit, and didn't want to start untill the phone was rebooted. So next time I just started the sshd and done the rest of the stuff from a Terminal Emulator (After preparing scripts for ease of execution, and dropboxing the paths for copy paste ). After running the exploit the Terminal Emulator app stopted working correctly (as expected) but after force closing it and running it again I was greeted with a # prompt
I flashed the misc partition with an image modified with my phones CID, rebooted and voila! USB brick gone
Now I just have to beat one thing into my empty head (in the manner of "stop, drop, and roll" firedrill mantra). STOP, READ and THINK - before flashing
g'night
Click to expand...
Click to collapse
Any chance of adding some links or actual information?
I've got exactly the same problem and you seem to have the solution.
Any chance of sharing?
Usb Brick !? This is an OLD thing I have this some Months ago. Never heard of someone who got it again! YOU did something wrong ;-)
Sure, he did something wrong.I managed this, too, when playing with a partition tool not designed for my system. Misc partition damaged, so a nice usb brick...
About the requested links : just use forum search for usb brick. First hit is your sticky solution
Sent from my S-OFF'd brain using teh internetz
CyberTech71 said:
Any chance of adding some links or actual information?
I've got exactly the same problem and you seem to have the solution.
Any chance of sharing?
Click to expand...
Click to collapse
I couldn't post external links, forum limitation for new users... Now I see I can so:
This is a specific situation - usb brick and totally stock rom, recovery and hboot. It's not required for people who have a modified recovery and a rooted rom. It's easy like 1-2-3.
Before doing anything else enable the Debug Mode in the Applications / Dev menu
1. Download the rageagainstthecage exploit from the authors site:
http://c-skills.blogspot.com/2010/08/please-hold-line.html
2. Download the flash_image and misc (mtd0.img) partition image from this thread.
http://forum.xda-developers.com/showthread.php?t=691639&highlight=usb+brick
Modify the mtd0.img according to your phones CID (how to get the CID also explained in the thread)
2. Download Android Terminal Emulator from the Market
3. Copy the exploit binary (rageagainstthecage-arm5.bin), the flash_image and modifed mtd0.img to the sdcard via an external card reader
4. Start the Terminal
5. Copy the files to the Terminal app data directory (the only place on the data partition you will have write access while running the Terminal), and make the binaries executable
Code:
cat /sdcard/rageagainstthecage-arm5.bin > /data/data/jackpal.androidterm/shared_prefs/rageagainstthecage-arm5.bin
cat /sdcard/flash_image > /data/data/jackpal.androidterm/shared_prefs/flash_image
cat /sdcard/mtd0.img > /data/data/jackpal.androidterm/shared_prefs/mtd0.img
cd /data/data/jackpal.androidterm/shared_prefs/
chmod 755 rageagainstthecage-arm5.bin flash_image
6. Run the exploit
Code:
/data/data/jackpal.androidterm/shared_prefs/rageagainstthecage-arm5.bin
After the exploit exits/finishes there should be a short system freeze, followed by inablity to issue any command from the terminal (don't worry). Exit the Terminal by long pressing HOME and force close the Terminal app from the Application Manager
7. Start the terminal again, a root prompt should be visible
8. Flash the misc partition
Code:
cd /data/data/jackpal.androidterm/shared_prefs
./flash_image misc mtd0.img
9. Reboot
Done and done
Enjoy
PS. I suck at writing tutorials, but if the details are still hazy for you after reading this - better to service the phone, because you might end up bricking the device totally - cheers
quanchi said:
I was able to successfully unbrick the phone
It wouldn't be possible without rageagainstthecage, All the people writing the tutorials on USB unbricking, QuickSSHd and the Terminal Emulator app. Thanks to the authors.
I'll try to sum things up for anyone interested:
The problem
Because of acting without thinking I ended up with a stock unrooted rom and a partial USB brick. To make things worse I accepted the OTA update, installing the oh so loved HBOOT 0.93.100 S-ON.
The Solution
After some reading about rageagainstthecage, PoC code on which the Unrevoked rooting solution is based I tried to run the exploit directly on the phone.
Without having access to adb I wasn't able to find a place to put the executable, as the /data/ directory is writable only by the system user and the system group, and most tutorials suggest to place the exploit somewhere inside that directory. But all the tutorials I found mentioned using adb push to put the file on the phone, which probably operates on the phone as system:system as it is capable of writing to the /data dir. I wasn't able to write there as I had the id of the Terminal Application
Since apps storing data seem to store er... data in /data/data I had a little breakthru. Becaue I couldn't find a free telnet solution I purchased the QuickSSHd from Android Market.
This allowed me to have write access to /data/data/<package_name>/home where I created a world readable (755) directory. I scp'd the rageagaintthecage, modified misc partition image and flash_image binary to the phones filesystem, and made them executable. I could've used the Terminal Apps <data dir>/shared_prefs directory (which would be a $$$ free solution, as the ssh was not free, but not expensive either) but I'm lazy and doing stuff from a PC keyboard is easier than from a touch keyboard.
Running the exploit and flash_image from inside a ssh session seemed like a good idea but the sshd died after running the exploit, and didn't want to start untill the phone was rebooted. So next time I just started the sshd and done the rest of the stuff from a Terminal Emulator (After preparing scripts for ease of execution, and dropboxing the paths for copy paste ). After running the exploit the Terminal Emulator app stopted working correctly (as expected) but after force closing it and running it again I was greeted with a # prompt
I flashed the misc partition with an image modified with my phones CID, rebooted and voila! USB brick gone
Now I just have to beat one thing into my empty head (in the manner of "stop, drop, and roll" firedrill mantra). STOP, READ and THINK - before flashing
g'night
Click to expand...
Click to collapse
Hello
in you problem with USB bricks for unrooted HTC desire
I have the seam problem
please explain it to me
I copy the flash_image and mtd0.img to
\data\data in my device I only need to flash them to restore my device
when I try this command in terminal Eliminator
/data/data/flash_image misc /data/data/mtd0.img
It show me
error writing misc permission denied
help me please
I can't believe it, mate, finally this tutorial solved my usb (and bluetooth, and fm radio, and...) problem!!!!!
My Desire is unrooted, I've tried so many solution in the last 3 months but they all were useless.
I was starting to pack my phone for sending it to HTC Service when... tataaaa, I found your topic. Is on your if my wonderful Android powered phone got back fully functional.
Really, thank you for sharing your solution with us.
===========;-D
Francalberto
francalberto said:
I can't believe it, mate, finally this tutorial solved my usb (and bluetooth, and fm radio, and...) problem!!!!!
My Desire is unrooted, I've tried so many solution in the last 3 months but they all were useless.
I was starting to pack my phone for sending it to HTC Service when... tataaaa, I found your topic. Is on your if my wonderful Android powered phone got back fully functional.
Really, thank you for sharing your solution with us.
===========;-D
Francalberto
Click to expand...
Click to collapse
Good for you
All the credit goes to the people responsible for the tools used, I just put some things together.
Cheers
thank you very much
I really appreciate you effort you helped me so much
you are a brilliant man
thank you
Flashb, is your problem solved now?
Swyped with my S-OFF'd brain using teh internetz

Update recovery permanently and AlphaRev start up image.

I followed 2 guides to get my phone rooted and get my HBOOT patched to allow S-OFF - AlphaRev and Clockwork Recovery 2.5.0.1.
I want to get rid of the Joker from start up - had I would of known that I would of remained S-ON till they fixed that. That did permanently add Clockwork Recovery to the recovery area. There is a new version I downloaded and told it to install from ZIP and it reloaded and came to 2.5.0.7 but it never permanently patched it in. I am seriously considering going to AmonRA if it is available - I have done so many searches my head is spinning from lack of finds.
Am I missing something or is this something that needs to be done via ADB/Fastboot? If thats the case, I may need some help.
Permanently flashing recoveries has to be done through fastboot with a .img file, the update.zip way will never permanently flash a recovery, unfortunately. Here is a download link for the 2.5.0.7 recovery image, here's how you flash it (you must have the android sdk installed, and you have to have the fastboot.exe command in either \tools or \platform-tools):
Open up a command prompt window and type this:
fastboot flash recovery C:\location\of\recovery.img
When you reboot into recovery again via hboot, it should be 2.5.0.7.
As for the splash screen, that can be changed too (thank god, I hated the joker screen as well). Follow the instructions on this thread, there are plenty of screens to choose from, including the stock t-mobile screen.
If you need anything better explained, I can try to better explain it.
Thanks for the tips. I did find one I wanted - simple and Tmobile-ish. I do have the SDK installed with all updates from the Java Frontend that it uses BUT I still do not have fastboot.exe
I tried one from a friend but it keeps sticking at WAITING FOR DEVICE. Do I need to be in fastboot first on the phone then do this? It is detecting the phone with ADB devices command.
I'm pretty sure you need to be in fastboot to do this. Why the need for permanent recovery anyway?
I tried fastboot mode on the phone and it worked - Thanks for the tip! Flashed just fine and with help of some of the threads on the themes area i got the splash screen modified. (joker is gone - thank goodness!)
I am wanting to change the boot animation - I know how that works but I can't seem to find any for the MT3GS.
Again, I appreciate the tips. They have been helpful. ( I had to transpose what your talking about to the mac - and find fastboot for the mac - HTC had it on their site with a google search )
Yeah, for some reason google stopped compiling fastboot.exe for the sdk, it sucks. I just kept mine from older revisions of the sdk, and I copy it over whenever there's an update.
And at least for me, (@ whoever asked), permanent recoveries are significantly more convenient, and it saves time. It's nice to actually be able to use hboot recovery option, bypassing the stock recovery. It's also nice to be able to write to /system without a r/w overlay or without having to be in recovery.
MusicMan374 said:
Yeah, for some reason google stopped compiling fastboot.exe for the sdk, it sucks. I just kept mine from older revisions of the sdk, and I copy it over whenever there's an update.
And at least for me, (@ whoever asked), permanent recoveries are significantly more convenient, and it saves time. It's nice to actually be able to use hboot recovery option, bypassing the stock recovery. It's also nice to be able to write to /system without a r/w overlay or without having to be in recovery.
Click to expand...
Click to collapse
Not only that but it keeps that wonderfull 800k space free I am a space freak and like all free space and things organized. But the fact that if I screw up a flash - and for some reason I don't have a rom downloaded I can pop in my NANDROID backup card (which is stored in a safe under my foundation) and restore. That way I don't have to download update.zip anymore.
But I am seriously considering AmonRA - I just can't find a copy for my phone. Looks like it is for older phones unless I am missing something.
Does this phone support any other MicroSD cards 16GB or above?
thronka said:
Not only that but it keeps that wonderfull 800k space free I am a space freak and like all free space and things organized. But the fact that if I screw up a flash - and for some reason I don't have a rom downloaded I can pop in my NANDROID backup card (which is stored in a safe under my foundation) and restore. That way I don't have to download update.zip anymore.
But I am seriously considering AmonRA - I just can't find a copy for my phone. Looks like it is for older phones unless I am missing something.
Does this phone support any other MicroSD cards 16GB or above?
Click to expand...
Click to collapse
There is no AmonRA recovery for our phone, I don't believe. It was requested of him after we got s-off, but we don't know since he doesn't own a slide, and it's awfully hard to develop for a phone you don't have, haha
Well the easiest way to flash a recovery is to make sure you have CM7, or CM6, or separately put the files, MTD0 and Flash_Image in /Data/Local So if you have that, Here it is:
You just need to go to terminal Emulator type
Su
Flash_image recovery /sdcard/xxxx/xxxx.img
(Making sure you realize that the x's represent directories and file names)
For example I would put mine on the Root of the SD card and mine would look like this
Flash_Image recovery /sdcard/recovery.img
Sent from my T-Mobile myTouch 3G Slide using XDA App
iDaZzLeFatHoeZz said:
Well the easiest way to flash a recovery is to make sure you have CM7, or CM6, or separately put the files, MTD0 and Flash_Image in /Data/Local So if you have that, Here it is:
You just need to go to terminal Emulator type
Su
Flash_image recovery /sdcard/xxxx/xxxx.img
(Making sure you realize that the x's represent directories and file names)
For example I would put mine on the Root of the SD card and mine would look like this
Flash_Image recovery /sdcard/recovery.img
Sent from my T-Mobile myTouch 3G Slide using XDA App
Click to expand...
Click to collapse
Been flashed for a while now. I did not know this method but it is good to have and try when there is an update.
I have been tinkering with the ArayrayMod Revamped files since Arayray moved on to a MyTouch 4G. (traitor! LOL)
Looks like I may be going into the developing side of roms but I am just waiting for approval to post the rom for public viewing. a .32 kernel with Wifi calling included and thats really it - well retaining OC on that rom as well.
Much more tough than I thought doing this by hand - and I always thought my Unix Administration skills would be wasted.

[Q] How to make a back-up of the I9250 stock ROM without CWM

I would like create a backup (of my entire system including boot image, data and system partitions. Is there any way I can do this without the CWM. The main reason is that I could return the phone to the original state in case if I have to return for service.
For my knowledge (and i have no knoledge! ) samsung accept rooted device on service (otherwise if the phone has broken screen it is not accepted)...but, if i were you, i would install cwm and make a nandroid backup of the whole system. If you want to have all of google system images(to restore original stock) you could set your sdk environment http://developer.android.com/sdk/index.html and download google images (bootloader, rom, radio) and put in a safe place (the SDK supply adb/fasboot which are tools that you would use to restore the google's files). that's the thread with these contents: http://forum.xda-developers.com/showthread.php?t=1366806 That's the standard (so yours) original stock files from google actually on your phone!
and also i advise you to follow these steps to save your /EFS partition (you never know) before flashing custom things, BUT IT REQUIRES ROOT: http://forum.xda-developers.com/showthread.php?t=1352371
BUT, if you don't want to install cwm, you could also see here: http://forum.xda-developers.com/showthread.php?t=1392310
Thank you. If I am right, msskip's tools will install the CWM onto my phone as well. I have just come across a guide for back-up without CWM <http://forum.xda-developers.com/showthread.php?t=1420351>. I am just not quite sure if it is the same full back-up as I get for the Nandriod or CWM. Does anyone have any experience with this?
The post you linked doens' backup /boot partition and recovery. So you can backup only /system and /data; you can obtain these EXACTLY files just downloading the google system (4.0.1 - 4.0.2 - 4.0.3) files (*.img estension) and you have the same result, plus you can get bootloader.img and recovery (evrything stock, meaning samsung galaxy nexus stock files)...these are in the post i linked and are the stock google images and these are the files that our phones has inside (also including system.img).
that' the explanation why i think that is basically useless to make a backup of /system and /data for warranty purpose, because google (or first phone users in november when the phone came out on the market) provied all .img that you need to revert (using fastboot) anytime your phone to a stock 'new'phone (which is your now, so in warranty!). Make, instead, a backup for the files and apps (apk) (usually /data) that you need if you want to try custom roms and then if you are not satisfied get back to stock...
To answer to your question, no is not the same kind of backup, you will lack /boot and recovery.
adding that you can use adb to generate .img by
Code:
cat /proc/mtd
and you will have a fs table with adresses (i have no phone now so cannot provide), then using dd (assuming boot is on mtd2):
Code:
dd if=/dev/mtd/mtd2 of=/sdcard/boot-stock.img bs=2048
and also use this for recovery partition...never tried for system and data partition (but could work, i'm not sure so not do that in this way, wait more knowing-knoledge people and also never tried on ics but, just ginger remembering...dont' know if it's the same in this new system)
but this process make use of
Code:
adb shell
su
the second one requires root....
as of now, i dont' now any method not involving root to make these things but as i stated at first post, i don't know anything
Thank you. I am wondering if the image file you have provided is for yakjuux. I have come across many posts that if I get the wrong baseband, the phone will not work correctly.
post, please, your baseband version which you can find on settings->phone info->basedand version in your phone; mine is 19250xxkl1 that i have recently updated from xxkk1 (the stock one)
My Build # is ITL41F I9250 UGKL1 and the kernel is 3.0.1-ga052f63 [email protected] #1.
Do you think you have a image of this? Thanks.
As far is i know, you have a GSM version of Galaxy Nexus. So it's safe to grab google image of /system, /boot and for the radio grab UGKL1 radio/baseband version. To better answear it's better to know also you bootloader version (which probably is primekk15): you can view this by going on bootloader on you phone doing this:
1 setup android sdk environment (include fastboot) for your pc system (windows-linux-osx)
2 enter in the settings menu of the phone and tic the 'debug usb'
3 attach the phone to the pc and let it recognize your phone (windows-osx), for linux install udev that already are in your distrib/repo
4 (assuming you are on windows) on pc... start/run/ cmd: the the terminal open up and go in your android-sdk directory, enter and then go to platform-tools; there is adb command, run: adb reboot bootloader
this will restart your phone in the bootloader menu. There, you have all of information you need...just write here your bootloader version (to have a confirmation) to understand which versione you need to download and put in a safe place in case of warranty-need...
Then wait someone better than me that knows how to make backup of all partitions without root (without exploit i think it's difficult to grant su access on the standard ics system); if there is no such possibility, just root, install cwm and do a nandroid backup and then trasnferr on a safe place on your place and you are good to go to try modding.....
now i need sleep as here is 8 in the morning and finishing compilemy l701x kernel which weight 3,4 mb lzo compressed, fine tuning.....good nite,ehm,good mornig..mmm... good is enough
Thank you. It takes some time to download the packages.
The Bootloader shows the following
Product Name: Tuna
Variant: Maguro
HW Version: 9
Bootloader Verson: Primekk14
Baseband Version: I9250UGKL1
Carrier Info: None
Signing: Production
What would be the appropriate to donload. Do you have their respective link? Thank you for your ongoing support.
Would anyone with experience please provide me with inputs if:
1. there is any way to back-up without root
OR
2. the phone has to be rooted, is there any way to have a program residing in my computer iso the phone (CWM in this case).
OR
3. there is any way to remove CWM and other rooted apps before I use GNex Toolkit to relock the phone.
Thanks.
Here you go:
http://forum.xda-developers.com/showthread.php?t=1420351
Would anyone with experience please help?
I am struggling with the same issue. Restoring the nandroid, removing su and superuser.apk and then relocking the bootloader actually brings the phone to quite factory looking mode (except for timestamps in system)
I wonder if it is possible to pull dump of system the same way it is done for boot and recovery.
Guys - it is pretty trivial to restore all partitions you would be modifying to factory conditions because Google provides the factory images for which you can use fastboot to restore. You don't even need to be unlocked much less rooted or have CWM installed because the Google images are official and have the correct signatures.
As for making image copies of your phones partitions this cannot be done w/o root access because these partitions are only available to root. If you are rooted you can use a utility such as dd on the phone to copy the partitions.
Sent from my Galaxy Nexus using XDA App
silow said:
Guys - it is pretty trivial to restore all partitions you would be modifying to factory conditions because Google provides the factory images for which you can use fastboot to restore. You don't even need to be unlocked much less rooted or have CWM installed because the Google images are official and have the correct signatures.
As for making image copies of your phones partitions this cannot be done w/o root access because these partitions are only available to root. If you are rooted you can use a utility such as dd on the phone to copy the partitions.
Sent from my Galaxy Nexus using XDA App
Click to expand...
Click to collapse
Google provides yakju images only. Phones here in Canada come with yakjuux which is even 4.0.1. It will be pretty obvious you have thinkered with your phone if you return it with yakju image instead the original one.
As for root - I think it might not be necesary - I was able to do nandroid backup without flashing neither recovery or root to my system by simply unlocking the boot loader and booting CWM off fastboot. I am thinking can we dd while in CWM (flash of phone still intact - except of bootloader which is not an issue since it can be relocked)
Anyone have the dd syntax handy and the partition that needs to be dumped?
system partition seems to be /dev/block/platform/omap/omap_hsmmc.0/by-name/system (this is the df output after I mounted it in CWM)
Would the dd command be something like
Code:
dd if=/dev/block/platform/omap/omap_hsmmc.0/by-name/system of=/sdcard/yakjuux.img
CWM provides you "root" because it has the su binaries in the ramdisk.
You can run the following when booted into CWM since CWM will mount /data:
Code:
dd if=/dev/block/mmcblk0p10 of=/data/media/system.img
leobg said:
[snip]
Anyone have the dd syntax handy and the partition that needs to be dumped?
system partition seems to be /dev/block/platform/omap/omap_hsmmc.0/by-name/system (this is the df output after I mounted it in CWM)
Would the dd command be something like
Code:
dd if=/dev/block/platform/omap/omap_hsmmc.0/by-name/system of=/sdcard/yakjuux.img
Click to expand...
Click to collapse
I think that may work. The output file may be padded with extra zeros, so you may need to trim them before flashing (this is certainly the case when you dump the radio).
EDIT: I would probably use this instead (although I am not sure it will make a difference:
Code:
dd if=/dev/block/platform/omap/omap_hsmmc.0/by-name/system of=/data/media/yakjuux.img
efrant said:
I think that may work. The output file may be padded with extra zeros, so you may need to trim them before flashing (this is certainly the case when you dump the radio).
EDIT: I would probably use this instead (although I am not sure it will make a difference:
Code:
dd if=/dev/block/platform/omap/omap_hsmmc.0/by-name/system of=/data/media/yakjuux.img
Click to expand...
Click to collapse
Yes, that was what I actually ended up doing since /sdcard was a sym link to /data/media. Resulting file is 654MB uncompressed. I wonder how can I easily check if content is right on a win machine.
---------- Post added at 09:44 PM ---------- Previous post was at 09:37 PM ----------
silow said:
CWM provides you "root" because it has the su binaries in the ramdisk.
You can run the following when booted into CWM since CWM will mount /data:
Code:
dd if=/dev/block/mmcblk0p10 of=/data/media/system.img
Click to expand...
Click to collapse
Yes, I meant it's not necessary to make any changes on the filesystem to achieve it once bootloader lock is off. And by simply relocking the device after, there are zero traces of any 'hackery' being done on the phone.
leobg said:
Yes, that was what I actually ended up doing since /sdcard was a sym link to /data/media. Resulting file is 654MB uncompressed. I wonder how can I easily check if content is right on a win machine.
Click to expand...
Click to collapse
There is obviously some extra padding in there, as the file size should be closer to half that size uncompressed.
---------- Post added at 09:08 AM ---------- Previous post was at 08:51 AM ----------
leobg said:
[snip]
And by simply relocking the device after, there are zero traces of any 'hackery' being done on the phone.
Click to expand...
Click to collapse
Not sure why so many people are worried about "traces of hackery". I can't speak from personal experience, but many Nexus One owners (if not all of who have attempted), had NO issues returning devices to HTC that were unlocked... Remember, the N1 did not have a relockable bootloader, so they obviously knew you were messing around.
You don't have to FLASH CWM to USE CWM.
Just BOOT CWM. Simple.

[CONCLUSIONS] S-OFF with Unlock/Lock Bootloader

Hi everyone!
What we need:
A kernel hacker!
Why?
Because of this:​
no.human.being said:
Yep this is great. This routine will definitely play a key part for our further investigation. The plan I have is the following ...
I'd like to dump the device's Flash memory (physically, via JTAG), disassemble its contents (e. g. with objdump, as I'm not familiar with IDA and it actually looks quite "advanced") and find where the ARM starts execution. This is probably a fixed address, might find it in the processor's datasheets. There are no datasheets available for the MSM7227, however, it is a replica of the ARM1136EJS for which there are no datasheets either, but there are extensive datasheets for the ARM1136JS, which is probably similar. Just search for the document "ARM DDI 0211K" on your favourite search engine. It's very extensive, so there's really not much that should be "undocumented" about this processor.
Once we know where execution starts, we should try to analyze the "initialization routine" of the processor's firmware, which initializes the uC, loads the vendor specific firmware (Radio, HBOOT) into memory and starts execution. This routine will load the firmware from persistent (Flash) into volatile (RAM) memory and it will probably "pull together" the RAM contents from different parts of the Flash. (Might it already set up some page tables for the MMU at this point?) This is probably why you don't see the "jump table" in the HBOOT image. It's probably not part of HBOOT at all, but from a section that just gets "loaded near HBOOT" into volatile memory during the controller's initialization. (Might it be part of the Radio?)
When we trace the code further through the "jump table" (I'd love to do this on the actual physical device so I really hope that the processor supports single-stepping), we'll hopefully find the actual physical address of the secu_flag. As soon as we have it, the most obvious thing to do is just flick it via JTAG and check whether the device is S-OFF afterwards.
Finally, when we know where the secu_flag resides on the WFS (which means we know its physical address), we can try to find a way to access it from within Android. There's almost certainly some more protection in place, possibly protection via MMU, so we might have to modify Android to set up different page tables during boot process, but once we got that far, this should not be what stops us.
If you have any questions/suggestions, just feel free to ask/propose them.
At least the...
Code:
fastboot -c "mtdparts=msm_nand:0x..." boot recovery.img
... works and it does not require S-OFF! However, the ...
Code:
fastboot oem listpartition
... fails ...
Code:
... INFO[ERR] Command error !!! OKAY [ 0.000s] finished. total time: 0.000s
So yes, we can change the mapping of memory to mtd devices, but we cannot find out how the partitions are laid out on the device (at least not via fastboot, can't we ask the operating system somehow?).
...
Now stop a moment and take a deep breath!
...
Wait! What have we just found out? We can load an arbitrary OS image (kernel + initrd) via fastboot into the device's RAM and execute it! This sounds like the key to total awesomeness, doesn't it? Can't we build an OS image that has just one purpose which is S-OFFing the device (either by asking the Radio to do it, remember it is OUR custom kernel we're executing here so WE can talk to the Radio, or by mapping the memory the way we need it, then doing it directly)?
This may turn out to be easier than we expected it to be. Any kernel hackers here that could aid us in building a kernel that maps the entire memory of the device (this will include the Radio where secu_flag resides) and sticking an initrd to it that does the S-OFF? Of course we'll still need to find the flag in memory, but at least we now have a concrete plan how we can map the memory in. This will also enable us to build a very "user friendly" utility for S-OFF. No more zergRush, no more privilege escalation. The S-OFF utility is a self-contained OS image. You boot it, it does all the work and reboots the phone when done. How cool is that?
Click to expand...
Click to collapse
​
You probably still remember me for my famous "S-OFF without XTC-Clip conclusions" thread. We all know that now, HTC has given us the privilege of unlocking our Bootloaders using HTC-Dev. This allows us to Root and flash Custom ROMS, and all that; so we're all happy with that. But there are others out there, like me, who want to take even more advantage of this, and still get S-OFF, just like before. Now, we have a deeper understanding of our WFSs, so S-OFF is now much, much easier. If we get S-OFF, then we will have many more privileges on our phones.
With S-OFF, we can get:
Our warranties back
The ability to resize our system partitions.
The ability to flash different HBOOTs.
And many other things!
Be sure to visit *se-nsei.'s campaign, click here!
no.human.being posts his latest findings there.
My thoughts on this is:
from another thread, I've seen that when the HTC-Dev RUU was flashing HBOOT, it froze, but it still managed to flash rom_01.zip. This means, that when flashing HBOOT, the phone needs to be made S-OFF, then, when rom_02.zip is flashed, it finishes flashing HBOOT, and finally changes the security flag on, again.
So, I did some experimenting of my own. I flashed rom_01.zip using many methods, but all my attempts miserably fail. Why? Because the file is not signed properly. This got me thinking, if it's an HTC ROM, then why won't it flash?!?! Probably, because HTC made it in such a way, that the phone rejects it, or it won't work properly without the other files, that maybe reside in the RUU.
Maybe, someone can look into it, and find the function that S-OFFs the phone.
Perhaps, it might flash if it's on a Goldcard, so we'll have to do some more experimenting.
There is a possibility though, that using no.human.being's C code that he made earlier, we could S-OFF the phone, as it will be able to access more "sections" of the phone. We'll just have to compile/convert it and run/flash it.
Like before, if you have any suggestions, please tell me (by posting in this thread, please only PM if you think it's a very close solution, or if it's very important)
Good Luck everyone!
Isn't anyone going to post here!
no.human.being, eoghan2t7, are you there!?!
I think you might want to try extracting the img file and use fastboot flash radio radio.img.
yjwong said:
I think you might want to try extracting the img file and use fastboot flash radio radio.img.
Click to expand...
Click to collapse
Thanks, I have tried this though, but I didn't rename it to radio.img. Perhaps I'll ry this if I got some time (I'm still in High School, and they give me way to much homework. They are so annoying!)
Ideas! Anyone!
Is there a similar way to boot into ENG-HBOOT(unsecured)
like fastboot -c "mtdparts=msm_nand:0x..." boot unsecuredhboot.img ?
Then if unsecuredhboot.img wil be on sdcard we have possibility to flash s-offed hboot.
Somebody help this guy....... This is not my level. I'm a bit lower. I doubt it will work though.
Sent from my HTC Wildfire S A510e using XDA
slavislavi said:
Is there a similar way to boot into ENG-HBOOT(unsecured)
like fastboot -c "mtdparts=msm_nand:0x..." boot unsecuredhboot.img ?
Then if unsecuredhboot.img wil be on sdcard we have possibility to flash s-offed hboot.
Click to expand...
Click to collapse
No, that won't work. The "boot" command takes an Android image, which consists of a kernel, an initrd and a special header. The header tells the bootloader of the phone where to load the kernel in memory, etc. It won't be present in an ENG-HBOOT image, so the phone's bootloader won't be able to boot it.
Furthermore, HBOOT expects the controller to be "uninitialized" and will then initialize it. When the kernel is executed via Fastboot, the controller has already been initialized by HBOOT, after all that's the actual purpose of a bootloader. The ENG-HBOOT probably won't behave correctly if it finds the controller already initialized by a "lower level" bootloader.
Last but not least, the "mtdparts=..." is a kernel parameter. Basically it's just a string (character sequence) that is passed to the kernel. What the kernel does with it is principally the kernel's thing. It's just that "mtdparts=..." can be used on an embedded Linux kernel to change the partition mapping. I doubt that HBOOT can take parameters, since it's not designed to be loaded by anything else (apart from possibly an extremely low-level processor-specific firmware that most likely won't have a facility for passing parameters).

[FAQ & Support] TeamWin Recovery for the HTC Wildfire S

This is the user support thread for the Wildfire S port of the TeamWin Recovery Project. Go to: Distribution/Development
Frequently Asked Questions​
Where is the best place to obtain support?
You can visit #TWRP on FreeNode to seek support directly from the members of TeamWin for official releases. Please don't bring issues from development releases to #TWRP. You may also post here to solicit support from myself and the XDA community. Issues concerning development releases are best posted here as they may be unique to the build you are using, resulting from private changes that other developers may not be aware of.
Click to expand...
Click to collapse
How do these builds differ from the official first party releases?
The official releases from TeamWin are automatically compiled at points when the code is believed to be mature and stable enough for release to the general public. The builds available here may be more frequent allowing users to investigate and test new features and fixes before they are made available to the general public. Any known issues for the most current development release will be listed in the Distribution/Development thread. For a list of issues that affect the current first party release visit TeamWin.
Click to expand...
Click to collapse
How do I install a new recovery from an image file?
You can write a new image to the recovery partition of your phone using either of the following methods. Each method has it's own prerequisites that must first be met in order for you to succeed.
Native android image writer
If you are currently running a rooted Android distribution with flash_image you can use that binary to write images to partitions on your phone. If your phone is rooted but lacks a copy of the native image writer you can download and install one.
Download a copy of the recovery image onto your phone: the SD card will do nicely. From a super user terminal running on your device executing the flash_image command will write an image to the specified partition. The command will accept a full path if you choose not to change your working directory. In the following example the programme would write recovery.img from the current directory to the recovery partition.
Code:
flash_image recovery recovery.img
Fastboot
If you have a computer on which you've properly set up the Android Software Development Kit, installed the drivers for your phone and your device has been set to allow remote, rebooting your phone into fastboot, connecting it to your computer and typing the following sequence into a terminal will write a new image to the recovery partition. It assumes the image file is in your current working directory and that the Android SDK platform tools are in your path variable. If this is not true you can specify the complete path.
Code:
fastboot flash recovery recovery.img
Click to expand...
Click to collapse
Will there be future updates?
Yes, there will be updates. I plan on working with TeamWin to solve known issues and maintain a Marvel port of the software as it evolves. This is a young code base that still has a bit of growing to do and there will likely be a number of changes and issues before things settle. If you aren't comfortable with bleeding edge code I suggest you use a more mature recovery.
Click to expand...
Click to collapse
I'm unable to locate a previous build, where has it gone?
Recovery is a fail-safe tool designed to expedite the restoration of the system in the event of a catastrophic failure. Users should be able to depend on this software to help them quickly install/update the primary system firmware and maintain/restore backups without issue. To better facilitate this experience only stable feature complete builds will remain available long term. If you are no longer able to find a specific build or version it was likely removed because it had errors and has since been replaced with a newer stable build.
Click to expand...
Click to collapse
Why isn't there a flashable ZIP available of the newest build?
Flashable installers are intended to release complete software images in an easy to utilise package for a broad audience. Many builds produced along they way are unreliable and not fit for everyday use by the general user base. Flashable ZIP packages will only be made available for dependable feature complete builds.
Click to expand...
Click to collapse
I have a question.............................are there any bugs???? I'm asking because this was ported before by a fellow member for the WFS but the recovery couldnt format SD-EXT
I don't know...
csoulr666 said:
I have a question.............................are there any bugs???? I'm asking because this was ported before by a fellow member for the WFS but the recovery couldnt format SD-EXT
Click to expand...
Click to collapse
There are currently no reported issues. I personally haven't had any issues with formatting SD-EXT but, I'm waiting to hear back from other users outside controlled test cases. So far all I've gotten are support desk questions. I'll be sure to assault some of SD cards I have on had and partition/format them.
I chose to compile this as the other available version I found here in the forums has some issues and I needed a good, cleanly compiled recovery for the Wildfire S. I'm also working with a Frankenstein Fender but, modpunk's clean repo and quality Wildfire S ICS port provided a great CM9 base to start with before moving on to the Dream/Sapphire nightmare. I doubt I'll get that to build cleanly without any major issues in under a day.
OKay I have question how i can just flash it trought recovery?
I mean now im with recovery 5.xxxx so what i need to do 1st to remove it to begin back to stock recovery and then fallow the steps you mentioned?!
because befor when i flash the revoery 5.xxx was alot more easy than the writen step for touch recovery now
WoefulDerelict said:
There are currently no reported issues. I personally haven't had any issues with formatting SD-EXT but, I'm waiting to hear back from other users outside controlled test cases. So far all I've gotten are support desk questions. I'll be sure to assault some of SD cards I have on had and partition/format them.
I chose to compile this as the other available version I found here in the forums has some issues and I needed a good, cleanly compiled recovery for the Wildfire S. I'm also working with a Frankenstein Fender but, modpunk's clean repo and quality Wildfire S ICS port provided a great CM9 base to start with before moving on to the Dream/Sapphire nightmare. I doubt I'll get that to build cleanly without any major issues in under a day.
Click to expand...
Click to collapse
Nice to here that.............will you do more recovery projects like the EXT4 recovery???? Really like it's level of customization
I don't recommend that.
tsalta said:
OKay I have question how i can just flash it trought recovery?
I mean now im with recovery 5.xxxx so what i need to do 1st to remove it to begin back to stock recovery and then fallow the steps you mentioned?!
because befor when i flash the revoery 5.xxx was alot more easy than the writen step for touch recovery now
Click to expand...
Click to collapse
This image file is not designed to be flashed through recovery. It is generally considered poor practice to erase and rewrite an image the system is currently using. I've chosen not to create a easily flashable zip file as this distribution is relatively new and untested and I'd like to avoid as many issues as possible from inexperienced users. Most accomplished users and developers are familiar with the commands and can easily flash the image in seconds.
I believe most modern ClockworkMod Recovery ports include a full featured kernel and the flash_image command. You could run the command while booted into recovery via an adb shell but, I recommend against it. It is easiest to execute flash_image from your current rooted firmware. Simply open a terminal window on the phone or use an ADB shell.
Possibly...
csoulr666 said:
Nice to here that.............will you do more recovery projects like the EXT4 recovery???? Really like it's level of customization
Click to expand...
Click to collapse
I could possibly be coerced into working with other projects but, I'm unable to find a public repository for 4EXT Recovery so it doesn't seem like the developer is interested in public ports.
Sadly, the format issue does seem to exist and will be on of the first issues on my list. Hopefully I can work with the TWRP team to correct it.
Thanks for the update of the TeamWin recovery. I've rebooted but no functioning in the menu. Although this shows me system, power off, recovery, bootloader but not the cell phone rules. Could there still be followed by a further update? Thank you in advance! Sorry for my bad english...
Yes, there will be updates... eventually.
Prototyp1981 said:
Thanks for the update of the TeamWin recovery. I've rebooted but no functioning in the menu. Although this shows me system, power off, recovery, bootloader but not the cell phone rules. Could there still be followed by a further update? Thank you in advance!
Click to expand...
Click to collapse
Am I to understand that when you launch TWRP after installing the image that the touch menu isn't responsive? Are those the inital menu options TWRP is displaying for you? Are you using a Marvel device (GSM)? Do you know for which market your device originally shipped?
There will be more updates to tackle the issues listed in the original post and further maintenance after that as the TWRP code evolves. IF I can recruit some MarvelC users I plan to release a version for that board as well. Given the rarity of the MarvelCT I'm not sure I'll ever be able to provide a tested build of TWRP for that board.
I will grab a fresh copy of the image from the distribution server and check it on my device but, aside from the listed issues the software is working just fine on my Marvel.
Thanks for your answer! I bought my Wildfire S in Germany and the TWRP 2.1.4 beta0 run 100% stable but will also appear in the menu 2.1.8, the update everything works fine but on reboot the point (bottom right), he shows me correctly, the points system, power off, recovery & boot loader but no function. When I click on it there is not responding to the touch from the Wildfire S. Thank you but for your work!
I'm unable to reproduce this.
Prototyp1981 said:
Thanks for your answer! I bought my Wildfire S in Germany and the TWRP 2.1.4 beta0 run 100% stable but will also appear in the menu 2.1.8, the update everything works fine but on reboot the point (bottom right), he shows me correctly, the points system, power off, recovery & boot loader but no function. When I click on it there is not responding to the touch from the Wildfire S. Thank you but for your work!
Click to expand...
Click to collapse
So, as I understand it the entries in the Reboot sub-menu are unresponsive on your device. Unfortunately I can not reproduce this error on my own device. When I enter the Reboot sub-menu I am able to select each option and the device responds accordingly. The only possible complaint would be that the Bootloader option takes you into fastboot instead of the top level bootloader.
I would suggest downloading a new copy of the image to your computer and pushing it to your SD card. If your current firmware is rooted and has the native image writing commands please execute the following from a local terminal inside the root of your SD card. I'd suggest an ADB shell for ease of use.
Code:
erase_image recovery; flash_image recovery recovery.img
The output should look something like this.
Code:
[email protected]:/sdcard # erase_image recovery; flash_image recovery recovery.img
mtd: successfully wrote block at b10c00000000
mtd: successfully wrote block at b10c00040000
mtd: successfully wrote block at b10c00080000
mtd: successfully wrote block at b10c000c0000
mtd: successfully wrote block at b10c00100000
mtd: successfully wrote block at b10c00140000
mtd: successfully wrote block at b10c00180000
mtd: successfully wrote block at b10c001c0000
mtd: successfully wrote block at b10c00200000
mtd: successfully wrote block at b10c00240000
mtd: successfully wrote block at b10c00280000
mtd: successfully wrote block at b10c002c0000
mtd: successfully wrote block at b10c00300000
mtd: successfully wrote block at b10c00340000
mtd: successfully wrote block at b10c00380000
mtd: successfully wrote block at b10c003c0000
mtd: successfully wrote block at b10c00400000
mtd: successfully wrote block at b10c00440000
wrote recovery partition
[email protected]:/sdcard #
Once it completes try rebooting into recovery and testing them again.
WoefulDerelict, please excuse me. The TWRP Reovery 2.1.8 run very stable on my Wildfire S A510e. I had made the following error when I do not have a Rom on my Wildfire S then do not even work the buttons, reboot system, reboot recovery, power off & bootloader . Thanks again for the great job. Thumbs up from me :good:! Everything works very well! Sorry for my english, i hope you understand me .
in attention of WoefulDerelict
Me too I have same issue like here http://forum.xda-developers.com/showpost.php?p=28602310&postcount=11.I have Marvel A510e,whit:
***UNLOCKED***
MARVEL PVT SHIP S-ON RL
HBOOT-1.09.0099
MICROP-0451
RADIO-7.57.39.10M
Feb 8 2012,18;29;31.
GingerBread 2.3.5. firmware 2.26.401.3 kernel 2.6.35.10-gf696f19b htc [email protected] #1 Tue Apr 10 18:15:52 CST 2012
baseband 47.23e.3038H_7.57.39.10m
version number 2.26.401.3 CL362953 release-keys.
For me not work neither cwm recovery(in fact is working but whit blank screen-I've rooted the phone by blind method and I've made one backup from Rom Manager-I'm not sure if it's complet).I put in the atachament one log file found on cache/recovery maybe helps.
I've pushed recovery without any errrors,from first try,from cmd window.
Root Checker said I'm properly rooted.Many thanks.
Thanks!
sorinaugusto said:
Me too I have same issue like here http://forum.xda-developers.com/showpost.php?p=28602310&postcount=11.I have Marvel A510e,whit:
***UNLOCKED***
MARVEL PVT SHIP S-ON RL
HBOOT-1.09.0099
MICROP-0451
RADIO-7.57.39.10M
Feb 8 2012,18;29;31.
GingerBread 2.3.5. firmware 2.26.401.3 kernel 2.6.35.10-gf696f19b htc [email protected] #1 Tue Apr 10 18:15:52 CST 2012
baseband 47.23e.3038H_7.57.39.10m
version number 2.26.401.3 CL362953 release-keys.
For me not work neither cwm recovery(in fact is working but whit blank screen-I've rooted the phone by blind method and I've made one backup from Rom Manager-I'm not sure if it's complet).I put in the atachament one log file found on cache/recovery maybe helps.
I've pushed recovery without any errrors,from first try,from cmd window.
Root Checker said I'm properly rooted.Many thanks.
Click to expand...
Click to collapse
Well, I now know that your device claims to have the same unlocked SPL I updated to when HTC made it available and you're using the same version of the radio. The only difference is that my device is S-OFF. I'm still tracking down more details on what was changed in the newer devices so I can target the issue. I apologize as it will likely take me a while to tackle a problem out there in the ether while I'm currently focused on getting 2.2 working but, the new code has lots of changes targeting the formatting/wipe errors.
I believe I understand.
Prototyp1981 said:
WoefulDerelict, please excuse me. The TWRP Reovery 2.1.8 run very stable on my Wildfire S A510e. I had made the following error when I do not have a Rom on my Wildfire S then do not even work the buttons, reboot system, reboot recovery, power off & bootloader . Thanks again for the great job. Thumbs up from me :good:! Everything works very well! Sorry for my english, i hope you understand me .
Click to expand...
Click to collapse
As I understand it that was supposed to be part of a safety feature to keep users from rebooting their phone without any firmware installed. If you update to my latest release you'll notice there is now a confirmation dialogue that interrupts you if you try to reboot without any firmware installed.
Glad you enjoy the work and I hope to deliver something a bit more polished soon. Everyone is working hard to tackle bugs on their ends and I'm assisting where I am able. Trying to rally support for the new WFS hardware that suffers from display issues with custom recoveries and certain ROMs.
For any users suffering from blank display issues or boot loops with custom recovery software you can join the discussion here.
I have just installed this but am a bit confused about the following issue:
Reboots into recovery after backing up an image. This behaviour limits all backup operations to a single partition at a time as it will reboot after it completes the first operation.
Click to expand...
Click to collapse
Does this mean that you cannot do a full nandroid backup in one go? Does it also mean that any recovery operation will need multiple operations?
king_lud said:
I have just installed this but am a bit confused about the following issue:
Does this mean that you cannot do a full nandroid backup in one go? Does it also mean that any recovery operation will need multiple operations?
Click to expand...
Click to collapse
+1...I would also like to know. I use Link2SD so I do have a second partition. If that's the case, how do you perform a nandroid backup of the second partition? I'm not that advanced to know how to do it.
Plus the phone I have right now is one of the newer devices so CWM doesn't work. It has the white HTC screen as sorinaugusto mentioned earlier. Was just wondering if it would still work or not.
Here is some info:
***UNLOCKED***
MARVEL PVT SHIP S-ON RL
HBOOT-1.08.0099
MICROP-0451
RADIO-7.53.39.03M
Nov 28 2011, 19:09:21
Android Version 2.3.5
Kernel Version: 1.6.35.10-ga66971c [email protected] #1 Tue Nov 8m07:08:05 CST 2011
Baseband Version: 47.23a.35.3035H_7.53.39.03M
Build Number: 2.13.720.1 CL 197017 Release-Keys
Thanks for all your help
Actually I have done a restore since my last post and everything was restored just like it would have been for CWM and I am using link2SD also.
This was a restore from a single backup, again just like you would do in CWM.
The only difference was the lightning speed with which TWRP performed both tasks!
So it's all good!:good:
Yes, in my tests with the current version if you want a complete backup you must backup each partition individually. In my experience even if I select a complete system backup the end result was always a file that contained only /system data as it was the first partition backed up. Backup operations always end in a reboot on my device. I'm not entirely sure what the root of this issue is yet but, it does have higher priority than most the other issues.
I would examine your backup file to see if it contains more than information for /system. It is likely that the file is incomplete and does not contain information from the /data, /cache, sd-ext or any other partition. If they were properly backed up you would see options to restore them delineated by check-boxes.
The current workaround,sadly, is to backup each partition separately. You will have to select only one partition from the list at a time.
Currently there is NO custom recovery that will properly support the fidgety new revision to the Wildfire S. If the official 5.0.2.8 results in a black screen on your device then you will not find any CyanogenMod kernel based software that will work on your phone. All CM GB based projects will result in a black screen and all CM ICS/JB projects will result in your device halting at the initial splash: the green HTC on a white background. I'm still unsure why but, these new devices and the CynanogenMod kernel do not play well together; however, stock kernels play just fine. All custom recoveries are based off CM sources so you won't be able to reliably use any of them. There are some workarounds that will allow you to flash custom software through black screen recoveries as this software still responds to commands it just doesn't work with the display on your phone. These releases of TWRP were built using CyanogenMod ICS sources so they will result in new devices halting at the initial splash as I've already noted in the distribution post in the list of known issues.
Thanks for your reply. yes, I did check and indeed all I had backed up was the /system partition and it turned out that it was only that partition I needed to restore, which was lucky!
So to do a full restore, I presume one needs to select all of the separate backups and then swipe to restore, rather than one by one. Is that right?

Categories

Resources