XDA:DevDB Information
{WIP} {ROM} MSM8909 Service Rom From Source / QPST Root + Unlock + Unbrick, ROM for the HTC Desire 526
Contributors
BigCountry907
ROM OS Version: 5.1.x Lollipop
ROM Kernel: Linux 3.10.x
ROM Firmware Required: Verizon 526 CID=VZW_001 or CID=VZW_003
Based On: HTC RUU + Qcom BSP
Version Information
Status: Partition-xml-Generator.ods Release 1
Created 2017-01-24
Last Updated 2017-01-24
We will be attempting to cook a Service Rom that can be used for unlocking / unbricking.
A lot of progress has been made and I will now try to add all downloads to the project in an organized manner.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
XDA REFERENCE LINKS
https://forum.xda-developers.com/chef-central/android/tool-universal-htc-ruu-rom-decryption-t3382928
https://forum.xda-developers.com/showthread.php?p=26516911#post26516911
https://forum.xda-developers.com/htc-10/help/htc-10-bootloader-lock-flag-t3380245
https://forum.xda-developers.com/one-m9/one-m9-general/beware-htc-one-m9-m9e-e9-e9-users-t3550726
https://forum.xda-developers.com/windows-10-mobile/create-rawprogram0-xml-ffu-file-extract-t3385201
KERNEL SOURCE CODE Desire 526 A13
https://github.com/Bigcountry907/HTC_a13_vzw_Kernel
GEN UNLOCKED RUU Desire 526 A13
http://www.mediafire.com/file/5xdb32...1.10.509.4.zip
DECRYPTED GEN UNLOCKED RUU Desire 526 A13
http://www.mediafire.com/file/k4w9ya0uli39ky8/ROM-decrypted.zip
DEVICE BACKUPS Desire 526 A13
http://www.mediafire.com/file/8nkk4qw6ymz8p11/526-emmc.zip
http://www.mediafire.com/file/5cspbcg6sky6bw9/pull.zip
TEMPLATE ROM DOWNLOAD LINK
http://www.needrom.com/download/longcheer-l6350/
EXTERNAL DOWNLOAD LINKS
http://www.mediafire.com/file/0t1znbr1sl2y6fm/THE-CODE.zip
http://www.mediafire.com/file/awo4z3i3j4qdz45/THE-CODE-8916.gz
EXTERNAL LINKS MANUALS
https://github.com/dante198406/Qual...0-NR964-4_C_MSM8909_LA_SW_User_Manual_SPD.pdf
https://github.com/dante198406/Qualcomm_tech
PUBLIC QUALCOMM TOOLS MANUALS REPOSITOR
https://developer.qualcomm.com/hardw...ard-410c/tools
EXTERNAL REFERENCE LINKS
https://translate.google.com/transl...reen1900/article/details/46442909&prev=search
http://blog.csdn.net/green1900/article/details/46442909
http://jnisz.blogspot.com/
http://www.jonrajewski.com/resources/
http://forum.gsmhosting.com/vbb/f83/htc-codes-1919416/index3.html
https://securityresear.ch/2017/01/04/fastboot-oem-sha1sum/
https://translate.google.com/transl....cc/archive/index.php/t-1276.html&prev=search
https://translate.google.com/transl...et/fybon/article/details/18185441&prev=search
https://translate.google.com/transl...et/fybon/article/details/37565227&prev=search
https://translate.google.com/transl...reen1900/article/details/46442909&prev=search
Partition-XML-Generator_release1
http://www.mediafire.com/file/2f7aaj9a88k44c4/Partition-XML-Generator_release1.ods.zip
Tools Download
http://www.mediafire.com/file/vb221nxb2nob37z/Convert-Sparse.zip
http://www.mediafire.com/file/tdzwfnimsw9vdy4/0PM3_keyfile_1.zip
http://www.garykessler.net/software/
https://forum.xda-developers.com/windows-10-mobile/create-rawprogram0-xml-ffu-file-extract-t3385201
The Why
Before we get started
Before we get going lets take a step back to define the problem related to the Verizon HTC Desire 526.
1) Verizon devices do not allow you to unlock the bootloader using the HTC-DEV site.
2) The ENABLE OEM UNLOCK option does not exist in the Developer Options of the Desire 562.
We can circumvent this by changing the 00 to 01 last byte of the FRP partition (FRP.img)
This will let you generate a bootloader unlock code using fastboot.
Code:
fastboot oem get_identifier_token
3) HTC-DEV rejects the unlock token because the CID VZW_001 or VZW_003 is not allowed to be unlocked.
4) You cannot change your CID unless you have s-off.
5) There is 1 RUU that i have for the desire 526 Verizon. It is labeled OM for Other Model.
This RUU has the enable_oem_unlock option.
This RUU has a non verizon CID so you can generate a unlocktoken.bin
The problem is that you can't flash this RUU unless you are Super CID.
To unlock the bootloader without special tools here is what needs to happen.
A) Must modify last byte of FRP. ( We can do this )
B) Change the CID ( WE cant do this )
C) Replaces B....... Edit the pg2fs partition. ( We can edit the image but we cant flash it )
So in a nutshell we need to figure out one of the following.
How to change CID.
How to flash pg2fs on a locked device
How to re-encrypt a de-crypted ruu and flash it with the device S-on.
How to pull the unlocked files from my unlocked device and flash them to a locked device.
This is where I believe a QPST flash able rom ( or even just the partitions we need) may work.
Since the bootloaders ect will come from my device or the unlocked ruu the signing of the files is not a issue.
The bad thing is if the FIREHOSE could need to be signed by HTC Keys or QPST will not be able to flash the device. ( Testing Soon )
We will get more into that as we go. This could work but it might not. At any rate it will be fun to try and might lead to more possibilities.
Really important files we were lucky to find.
GET THESE FILES NOW !!! IF YOU WAIT THEY MIGHT NOT BE THERE :crying:
http://www.mediafire.com/file/0t1znbr1sl2y6fm/THE-CODE.zip
http://www.mediafire.com/file/awo4z3i3j4qdz45/THE-CODE-8916.gz
https://github.com/dante198406/Qual...0-NR964-4_C_MSM8909_LA_SW_User_Manual_SPD.pdf
https://github.com/dante198406/Qualcomm_tech
:good:
CAF Source
Ok so if your lucky enough to get what you need.
Then get the CAF source. ( WHAT Manifest / Branch ?? )
So then you need to look for the CAF Manifest "RELEASE"
LA.BR.1.2.3-09910-8x09.0-1*
https://wiki.codeaurora.org/xwiki/bin/QAEP/release
This one is a exact match. We will start with it. However we could very well use a newer release as well.
For now we will stick with the match. We can expand our horizon later.
September 03, 2015 LA.BR.1.2.3-09910-8x09.0 msm8909 LA.BR.1.2.3-09910-8x09.0.xml 05.01.01
First you must have installed git.
Then you can download the source by doing.
Code:
repo init -u git://codeaurora.org/platform/manifest.git -b release -m LA.BR.1.2.3-09910-8x09.0.xml --repo-url=git://codeaurora.org/tools/repo.git --repo-branch=caf-stable
Code:
repo sync
I will get the RUU's up.
Download all of this stuff and then we are just about ready to get COOKING. :highfive:
Alright so you want to know what were up to.
Study Here
http://jnisz.blogspot.com/
Unlockable_RUU / Device Backup Complete.
Full Backup-Stock Able To Unlock Bootloader-s-off-supercid.
http://www.mediafire.com/file/h37q6893qxr3j9j/526_UL_Pull.zip
Removed Link to post a clean backup from a fresh install.
This is the upload of my complete unlocked device.
My device is Bootloader Unlocked and S-OFF.
This is a backup of the 526 running the General "OM" UNLOCKED RUU.
The commands used to pull the backup using a TWRP shell.
If you do this with the device running change external_sd/ to /sdcard2/
Code:
dd if=/dev/block/mmcblk0p1 of=/external_sd/board_info
dd if=/dev/block/mmcblk0p2 of=/external_sd/pg1fs
dd if=/dev/block/mmcblk0p3 of=/external_sd/sbl1
dd if=/dev/block/mmcblk0p4 of=/external_sd/reserve_1
dd if=/dev/block/mmcblk0p5 of=/external_sd/mfg
dd if=/dev/block/mmcblk0p6 of=/external_sd/pg2fs
dd if=/dev/block/mmcblk0p7 of=/external_sd/rpm
dd if=/dev/block/mmcblk0p8 of=/external_sd/tz
dd if=/dev/block/mmcblk0p9 of=/external_sd/aboot
dd if=/dev/block/mmcblk0p10 of=/external_sd/sp1
dd if=/dev/block/mmcblk0p11 of=/external_sd/ddr
dd if=/dev/block/mmcblk0p12 of=/external_sd/rfg_0
dd if=/dev/block/mmcblk0p13 of=/external_sd/rfg_1
dd if=/dev/block/mmcblk0p14 of=/external_sd/rfg_2
dd if=/dev/block/mmcblk0p15 of=/external_sd/rfg_3
dd if=/dev/block/mmcblk0p16 of=/external_sd/rfg_4
dd if=/dev/block/mmcblk0p17 of=/external_sd/rfg_5
dd if=/dev/block/mmcblk0p18 of=/external_sd/rfg_6
dd if=/dev/block/mmcblk0p19 of=/external_sd/rfg_7
dd if=/dev/block/mmcblk0p20 of=/external_sd/fsg
dd if=/dev/block/mmcblk0p21 of=/external_sd/radio
dd if=/dev/block/mmcblk0p22 of=/external_sd/tool_diag
dd if=/dev/block/mmcblk0p23 of=/external_sd/wcnss
dd if=/dev/block/mmcblk0p24 of=/external_sd/limits
dd if=/dev/block/mmcblk0p25 of=/external_sd/reserve_2
dd if=/dev/block/mmcblk0p26 of=/external_sd/misc
dd if=/dev/block/mmcblk0p27 of=/external_sd/debug_config
dd if=/dev/block/mmcblk0p28 of=/external_sd/modem_st1
dd if=/dev/block/mmcblk0p29 of=/external_sd/modem_st2
dd if=/dev/block/mmcblk0p30 of=/external_sd/pdata
dd if=/dev/block/mmcblk0p31 of=/external_sd/persist
dd if=/dev/block/mmcblk0p32 of=/external_sd/sec
dd if=/dev/block/mmcblk0p33 of=/external_sd/cdma_record
dd if=/dev/block/mmcblk0p34 of=/external_sd/fsc
dd if=/dev/block/mmcblk0p35 of=/external_sd/ssd
dd if=/dev/block/mmcblk0p36 of=/external_sd/rfg_8
dd if=/dev/block/mmcblk0p37 of=/external_sd/rfg_9
dd if=/dev/block/mmcblk0p38 of=/external_sd/rfg_10
dd if=/dev/block/mmcblk0p39 of=/external_sd/rfg_11
dd if=/dev/block/mmcblk0p40 of=/external_sd/rfg_12
dd if=/dev/block/mmcblk0p41 of=/external_sd/rfg_13
dd if=/dev/block/mmcblk0p42 of=/external_sd/rfg_14
dd if=/dev/block/mmcblk0p43 of=/external_sd/rfg_15
dd if=/dev/block/mmcblk0p44 of=/external_sd/control
dd if=/dev/block/mmcblk0p45 of=/external_sd/extra
dd if=/dev/block/mmcblk0p46 of=/external_sd/local
dd if=/dev/block/mmcblk0p47 of=/external_sd/skylink
dd if=/dev/block/mmcblk0p48 of=/external_sd/carrier
dd if=/dev/block/mmcblk0p49 of=/external_sd/frp
dd if=/dev/block/mmcblk0p50 of=/external_sd/vzw_quality
dd if=/dev/block/mmcblk0p51 of=/external_sd/vzw_logger
dd if=/dev/block/mmcblk0p52 of=/external_sd/fataldevlog
dd if=/dev/block/mmcblk0p53 of=/external_sd/devlog
dd if=/dev/block/mmcblk0p54 of=/external_sd/ramdump
dd if=/dev/block/mmcblk0p55 of=/external_sd/battery
dd if=/dev/block/mmcblk0p56 of=/external_sd/absolute
dd if=/dev/block/mmcblk0p57 of=/external_sd/reserve
dd if=/dev/block/mmcblk0p58 of=/external_sd/hosd
dd if=/dev/block/mmcblk0p59 of=/external_sd/boot
dd if=/dev/block/mmcblk0p60 of=/external_sd/recovery
dd if=/dev/block/mmcblk0p61 of=/external_sd/cache
dd if=/dev/block/mmcblk0p62 of=/external_sd/system
dd if=/dev/block/mmcblk0p63 of=/external_sd/cota
dd if=/dev/block/mmcblk0p64 of=/external_sd/pppreload
dd if=/dev/block/mmcblk0p65 of=/external_sd/userdata
dd if=/dev/block/mmcblk0rpmb of=/external_sd/rpmb
Here are my terminal results.
Code:
~ # dd if=/dev/block/mmcblk0p1 of=/external_sd/board_info
32+0 records in
32+0 records out
16384 bytes (16.0KB) copied, 0.112135 seconds, 142.7KB/s
~ # dd if=/dev/block/mmcblk0p2 of=/external_sd/pg1fs
8192+0 records in
8192+0 records out
4194304 bytes (4.0MB) copied, 0.181353 seconds, 22.1MB/s
~ # dd if=/dev/block/mmcblk0p3 of=/external_sd/sbl1
2048+0 records in
2048+0 records out
1048576 bytes (1.0MB) copied, 0.057713 seconds, 17.3MB/s
~ # dd if=/dev/block/mmcblk0p4 of=/external_sd/reserve_1
55230+0 records in
55230+0 records out
28277760 bytes (27.0MB) copied, 1.281492 seconds, 21.0MB/s
~ # dd if=/dev/block/mmcblk0p5 of=/external_sd/mfg
512+0 records in
512+0 records out
262144 bytes (256.0KB) copied, 0.021042 seconds, 11.9MB/s
~ # dd if=/dev/block/mmcblk0p6 of=/external_sd/pg2fs
48510+0 records in
48510+0 records out
24837120 bytes (23.7MB) copied, 1.152466 seconds, 20.6MB/s
~ # dd if=/dev/block/mmcblk0p7 of=/external_sd/rpm
512+0 records in
512+0 records out
262144 bytes (256.0KB) copied, 0.018598 seconds, 13.4MB/s
~ # dd if=/dev/block/mmcblk0p8 of=/external_sd/tz
4096+0 records in
4096+0 records out
2097152 bytes (2.0MB) copied, 0.106354 seconds, 18.8MB/s
~ # dd if=/dev/block/mmcblk0p9 of=/external_sd/aboot
8192+0 records in
8192+0 records out
4194304 bytes (4.0MB) copied, 0.183958 seconds, 21.7MB/s
~ # dd if=/dev/block/mmcblk0p10 of=/external_sd/sp1
20480+0 records in
20480+0 records out
10485760 bytes (10.0MB) copied, 0.450550 seconds, 22.2MB/s
~ # dd if=/dev/block/mmcblk0p11 of=/external_sd/ddr
64+0 records in
64+0 records out
32768 bytes (32.0KB) copied, 0.009250 seconds, 3.4MB/s
~ # dd if=/dev/block/mmcblk0p12 of=/external_sd/rfg_0
2048+0 records in
2048+0 records out
1048576 bytes (1.0MB) copied, 0.057357 seconds, 17.4MB/s
~ # dd if=/dev/block/mmcblk0p13 of=/external_sd/rfg_1
2048+0 records in
2048+0 records out
1048576 bytes (1.0MB) copied, 0.050431 seconds, 19.8MB/s
~ # dd if=/dev/block/mmcblk0p14 of=/external_sd/rfg_2
2048+0 records in
2048+0 records out
1048576 bytes (1.0MB) copied, 0.050208 seconds, 19.9MB/s
~ # dd if=/dev/block/mmcblk0p15 of=/external_sd/rfg_3
2048+0 records in
2048+0 records out
1048576 bytes (1.0MB) copied, 0.056875 seconds, 17.6MB/s
~ # dd if=/dev/block/mmcblk0p16 of=/external_sd/rfg_4
2048+0 records in
2048+0 records out
1048576 bytes (1.0MB) copied, 0.049847 seconds, 20.1MB/s
~ # dd if=/dev/block/mmcblk0p17 of=/external_sd/rfg_5
2048+0 records in
2048+0 records out
1048576 bytes (1.0MB) copied, 0.050074 seconds, 20.0MB/s
~ # dd if=/dev/block/mmcblk0p18 of=/external_sd/rfg_6
2048+0 records in
2048+0 records out
1048576 bytes (1.0MB) copied, 0.050956 seconds, 19.6MB/s
~ # dd if=/dev/block/mmcblk0p19 of=/external_sd/rfg_7
2048+0 records in
2048+0 records out
1048576 bytes (1.0MB) copied, 0.050909 seconds, 19.6MB/s
~ # dd if=/dev/block/mmcblk0p20 of=/external_sd/fsg
3072+0 records in
3072+0 records out
1572864 bytes (1.5MB) copied, 0.072868 seconds, 20.6MB/s
~ # dd if=/dev/block/mmcblk0p21 of=/external_sd/radio
120834+0 records in
120834+0 records out
61867008 bytes (59.0MB) copied, 2.821129 seconds, 20.9MB/s
~ # dd if=/dev/block/mmcblk0p22 of=/external_sd/tool_diag
20480+0 records in
20480+0 records out
10485760 bytes (10.0MB) copied, 0.469522 seconds, 21.3MB/s
~ # dd if=/dev/block/mmcblk0p23 of=/external_sd/wcnss
10240+0 records in
10240+0 records out
5242880 bytes (5.0MB) copied, 0.246516 seconds, 20.3MB/s
~ # dd if=/dev/block/mmcblk0p24 of=/external_sd/limits
2+0 records in
2+0 records out
1024 bytes (1.0KB) copied, 0.003674 seconds, 272.2KB/s
~ # dd if=/dev/block/mmcblk0p25 of=/external_sd/reserve_2
8766+0 records in
8766+0 records out
4488192 bytes (4.3MB) copied, 0.208363 seconds, 20.5MB/s
~ # dd if=/dev/block/mmcblk0p26 of=/external_sd/misc
2048+0 records in
2048+0 records out
1048576 bytes (1.0MB) copied, 0.053019 seconds, 18.9MB/s
~ # dd if=/dev/block/mmcblk0p27 of=/external_sd/debug_config
8+0 records in
8+0 records out
4096 bytes (4.0KB) copied, 0.004576 seconds, 874.1KB/s
~ # dd if=/dev/block/mmcblk0p28 of=/external_sd/modem_st1
3072+0 records in
3072+0 records out
1572864 bytes (1.5MB) copied, 0.070377 seconds, 21.3MB/s
~ # dd if=/dev/block/mmcblk0p29 of=/external_sd/modem_st2
3072+0 records in
3072+0 records out
1572864 bytes (1.5MB) copied, 0.072494 seconds, 20.7MB/s
~ # dd if=/dev/block/mmcblk0p30 of=/external_sd/pdata
512+0 records in
512+0 records out
262144 bytes (256.0KB) copied, 0.016079 seconds, 15.5MB/s
~ # dd if=/dev/block/mmcblk0p31 of=/external_sd/persist
45056+0 records in
45056+0 records out
23068672 bytes (22.0MB) copied, 0.999638 seconds, 22.0MB/s
~ # dd if=/dev/block/mmcblk0p32 of=/external_sd/sec
32+0 records in
32+0 records out
16384 bytes (16.0KB) copied, 0.004130 seconds, 3.8MB/s
~ # dd if=/dev/block/mmcblk0p33 of=/external_sd/cdma_record
2048+0 records in
2048+0 records out
1048576 bytes (1.0MB) copied, 0.057156 seconds, 17.5MB/s
~ # dd if=/dev/block/mmcblk0p34 of=/external_sd/fsc
2+0 records in
2+0 records out
1024 bytes (1.0KB) copied, 0.003637 seconds, 275.0KB/s
~ # dd if=/dev/block/mmcblk0p35 of=/external_sd/ssd
16+0 records in
16+0 records out
8192 bytes (8.0KB) copied, 0.001878 seconds, 4.2MB/s
~ # dd if=/dev/block/mmcblk0p36 of=/external_sd/rfg_8
256+0 records in
256+0 records out
131072 bytes (128.0KB) copied, 0.007651 seconds, 16.3MB/s
~ # dd if=/dev/block/mmcblk0p37 of=/external_sd/rfg_9
256+0 records in
256+0 records out
131072 bytes (128.0KB) copied, 0.007942 seconds, 15.7MB/s
~ # dd if=/dev/block/mmcblk0p38 of=/external_sd/rfg_10
256+0 records in
256+0 records out
131072 bytes (128.0KB) copied, 0.009237 seconds, 13.5MB/s
~ # dd if=/dev/block/mmcblk0p39 of=/external_sd/rfg_11
256+0 records in
256+0 records out
131072 bytes (128.0KB) copied, 0.008919 seconds, 14.0MB/s
~ # dd if=/dev/block/mmcblk0p40 of=/external_sd/rfg_12
256+0 records in
256+0 records out
131072 bytes (128.0KB) copied, 0.008970 seconds, 13.9MB/s
~ # dd if=/dev/block/mmcblk0p41 of=/external_sd/rfg_13
256+0 records in
256+0 records out
131072 bytes (128.0KB) copied, 0.008053 seconds, 15.5MB/s
~ # dd if=/dev/block/mmcblk0p42 of=/external_sd/rfg_14
256+0 records in
256+0 records out
131072 bytes (128.0KB) copied, 0.007848 seconds, 15.9MB/s
~ # dd if=/dev/block/mmcblk0p43 of=/external_sd/rfg_15
256+0 records in
256+0 records out
131072 bytes (128.0KB) copied, 0.008416 seconds, 14.9MB/s
~ # dd if=/dev/block/mmcblk0p44 of=/external_sd/control
32+0 records in
32+0 records out
16384 bytes (16.0KB) copied, 0.002520 seconds, 6.2MB/s
~ # dd if=/dev/block/mmcblk0p45 of=/external_sd/extra
128+0 records in
128+0 records out
65536 bytes (64.0KB) copied, 0.005092 seconds, 12.3MB/s
~ # dd if=/dev/block/mmcblk0p46 of=/external_sd/local
2562+0 records in
2562+0 records out
1311744 bytes (1.3MB) copied, 0.075206 seconds, 16.6MB/s
~ # dd if=/dev/block/mmcblk0p47 of=/external_sd/skylink
512+0 records in
512+0 records out
262144 bytes (256.0KB) copied, 0.015891 seconds, 15.7MB/s
~ # dd if=/dev/block/mmcblk0p48 of=/external_sd/carrier
81920+0 records in
81920+0 records out
41943040 bytes (40.0MB) copied, 1.743840 seconds, 22.9MB/s
~ # dd if=/dev/block/mmcblk0p49 of=/external_sd/frp
1024+0 records in
1024+0 records out
524288 bytes (512.0KB) copied, 0.035311 seconds, 14.2MB/s
~ # dd if=/dev/block/mmcblk0p50 of=/external_sd/vzw_quality
32768+0 records in
32768+0 records out
16777216 bytes (16.0MB) copied, 0.726684 seconds, 22.0MB/s
~ # dd if=/dev/block/mmcblk0p51 of=/external_sd/vzw_logger
32768+0 records in
32768+0 records out
16777216 bytes (16.0MB) copied, 0.744803 seconds, 21.5MB/s
~ # dd if=/dev/block/mmcblk0p52 of=/external_sd/fataldevlog
40960+0 records in
40960+0 records out
20971520 bytes (20.0MB) copied, 0.912097 seconds, 21.9MB/s
~ # dd if=/dev/block/mmcblk0p53 of=/external_sd/devlog
61440+0 records in
61440+0 records out
31457280 bytes (30.0MB) copied, 1.367718 seconds, 21.9MB/s
~ # dd if=/dev/block/mmcblk0p54 of=/external_sd/ramdump
20480+0 records in
20480+0 records out
10485760 bytes (10.0MB) copied, 0.456369 seconds, 21.9MB/s
~ # dd if=/dev/block/mmcblk0p55 of=/external_sd/battery
20480+0 records in
20480+0 records out
10485760 bytes (10.0MB) copied, 0.462165 seconds, 21.6MB/s
~ # dd if=/dev/block/mmcblk0p56 of=/external_sd/absolute
32768+0 records in
32768+0 records out
16777216 bytes (16.0MB) copied, 0.729198 seconds, 21.9MB/s
~ # dd if=/dev/block/mmcblk0p57 of=/external_sd/reserve
7460+0 records in
7460+0 records out
3819520 bytes (3.6MB) copied, 0.193873 seconds, 18.8MB/s
~ # dd if=/dev/block/mmcblk0p58 of=/external_sd/hosd
98304+0 records in
98304+0 records out
50331648 bytes (48.0MB) copied, 2.166511 seconds, 22.2MB/s
~ # dd if=/dev/block/mmcblk0p59 of=/external_sd/boot
65536+0 records in
65536+0 records out
33554432 bytes (32.0MB) copied, 1.460251 seconds, 21.9MB/s
~ # dd if=/dev/block/mmcblk0p60 of=/external_sd/recovery
65536+0 records in
65536+0 records out
33554432 bytes (32.0MB) copied, 1.456974 seconds, 22.0MB/s
~ # dd if=/dev/block/mmcblk0p61 of=/external_sd/cache
524288+0 records in
524288+0 records out
268435456 bytes (256.0MB) copied, 11.097091 seconds, 23.1MB/s
~ # dd if=/dev/block/mmcblk0p62 of=/external_sd/system
5242880+0 records in
5242880+0 records out
2684354560 bytes (2.5GB) copied, 112.860430 seconds, 22.7MB/s
~ # dd if=/dev/block/mmcblk0p63 of=/external_sd/cota
10240+0 records in
10240+0 records out
5242880 bytes (5.0MB) copied, 0.241214 seconds, 20.7MB/s
~ # dd if=/dev/block/mmcblk0p64 of=/external_sd/pppreload
10240+0 records in
10240+0 records out
5242880 bytes (5.0MB) copied, 0.243527 seconds, 20.5MB/s
~ # dd if=/dev/block/mmcblk0p65 of=/external_sd/userdata
8388608+0 records in
8388607+1 records out
4294967295 bytes (4.0GB) copied, 184.223417 seconds, 22.2MB/s
~ # dd if=/dev/block/mmcblk0rpmb of=/external_sd/rpmb
8192+0 records in
8192+0 records out
4194304 bytes (4.0MB) copied, 0.196190 seconds, 20.4MB/s
~ #
Figure out how to get this on a locked device and you will have a unlocked bootloader.
Full Backup-Stock UNABLE TO UNLOCK
UPLOADING NOW
This is the upload of my complete LOCKED device.
My device is Bootloader LOCKED and S-ON.
This is a backup of the 526 running the VZW STOCK RUU.
The commands used to pull the backup using a normal root shell wile booted.
If you do this with the device running change external_sd/ to /sdcard2/
Code:
dd if=/dev/block/mmcblk0p1 of=/sdcard2/board_info
dd if=/dev/block/mmcblk0p2 of=/sdcard2/pg1fs
dd if=/dev/block/mmcblk0p3 of=/sdcard2/sbl1
dd if=/dev/block/mmcblk0p4 of=/sdcard2/reserve_1
dd if=/dev/block/mmcblk0p5 of=/sdcard2/mfg
dd if=/dev/block/mmcblk0p6 of=/sdcard2/pg2fs
dd if=/dev/block/mmcblk0p7 of=/sdcard2/rpm
dd if=/dev/block/mmcblk0p8 of=/sdcard2/tz
dd if=/dev/block/mmcblk0p9 of=/sdcard2/aboot
dd if=/dev/block/mmcblk0p10 of=/sdcard2/sp1
dd if=/dev/block/mmcblk0p11 of=/sdcard2/ddr
dd if=/dev/block/mmcblk0p12 of=/sdcard2/rfg_0
dd if=/dev/block/mmcblk0p13 of=/sdcard2/rfg_1
dd if=/dev/block/mmcblk0p14 of=/sdcard2/rfg_2
dd if=/dev/block/mmcblk0p15 of=/sdcard2/rfg_3
dd if=/dev/block/mmcblk0p16 of=/sdcard2/rfg_4
dd if=/dev/block/mmcblk0p17 of=/sdcard2/rfg_5
dd if=/dev/block/mmcblk0p18 of=/sdcard2/rfg_6
dd if=/dev/block/mmcblk0p19 of=/sdcard2/rfg_7
dd if=/dev/block/mmcblk0p20 of=/sdcard2/fsg
dd if=/dev/block/mmcblk0p21 of=/sdcard2/radio
dd if=/dev/block/mmcblk0p22 of=/sdcard2/tool_diag
dd if=/dev/block/mmcblk0p23 of=/sdcard2/wcnss
dd if=/dev/block/mmcblk0p24 of=/sdcard2/limits
dd if=/dev/block/mmcblk0p25 of=/sdcard2/reserve_2
dd if=/dev/block/mmcblk0p26 of=/sdcard2/misc
dd if=/dev/block/mmcblk0p27 of=/sdcard2/debug_config
dd if=/dev/block/mmcblk0p28 of=/sdcard2/modem_st1
dd if=/dev/block/mmcblk0p29 of=/sdcard2/modem_st2
dd if=/dev/block/mmcblk0p30 of=/sdcard2/pdata
dd if=/dev/block/mmcblk0p31 of=/sdcard2/persist
dd if=/dev/block/mmcblk0p32 of=/sdcard2/sec
dd if=/dev/block/mmcblk0p33 of=/sdcard2/cdma_record
dd if=/dev/block/mmcblk0p34 of=/sdcard2/fsc
dd if=/dev/block/mmcblk0p35 of=/sdcard2/ssd
dd if=/dev/block/mmcblk0p36 of=/sdcard2/rfg_8
dd if=/dev/block/mmcblk0p37 of=/sdcard2/rfg_9
dd if=/dev/block/mmcblk0p38 of=/sdcard2/rfg_10
dd if=/dev/block/mmcblk0p39 of=/sdcard2/rfg_11
dd if=/dev/block/mmcblk0p40 of=/sdcard2/rfg_12
dd if=/dev/block/mmcblk0p41 of=/sdcard2/rfg_13
dd if=/dev/block/mmcblk0p42 of=/sdcard2/rfg_14
dd if=/dev/block/mmcblk0p43 of=/sdcard2/rfg_15
dd if=/dev/block/mmcblk0p44 of=/sdcard2/control
dd if=/dev/block/mmcblk0p45 of=/sdcard2/extra
dd if=/dev/block/mmcblk0p46 of=/sdcard2/local
dd if=/dev/block/mmcblk0p47 of=/sdcard2/skylink
dd if=/dev/block/mmcblk0p48 of=/sdcard2/carrier
dd if=/dev/block/mmcblk0p49 of=/sdcard2/frp
dd if=/dev/block/mmcblk0p50 of=/sdcard2/vzw_quality
dd if=/dev/block/mmcblk0p51 of=/sdcard2/vzw_logger
dd if=/dev/block/mmcblk0p52 of=/sdcard2/fataldevlog
dd if=/dev/block/mmcblk0p53 of=/sdcard2/devlog
dd if=/dev/block/mmcblk0p54 of=/sdcard2/ramdump
dd if=/dev/block/mmcblk0p55 of=/sdcard2/battery
dd if=/dev/block/mmcblk0p56 of=/sdcard2/absolute
dd if=/dev/block/mmcblk0p57 of=/sdcard2/reserve
dd if=/dev/block/mmcblk0p58 of=/sdcard2/hosd
dd if=/dev/block/mmcblk0p59 of=/sdcard2/boot
dd if=/dev/block/mmcblk0p60 of=/sdcard2/recovery
dd if=/dev/block/mmcblk0p61 of=/sdcard2/cache
dd if=/dev/block/mmcblk0p62 of=/sdcard2/system
dd if=/dev/block/mmcblk0p63 of=/sdcard2/cota
dd if=/dev/block/mmcblk0p64 of=/sdcard2/pppreload
dd if=/dev/block/mmcblk0p65 of=/sdcard2/userdata
dd if=/dev/block/mmcblk0rpmb of=/sdcard2/rpmb
Here are my terminal results.
Code:
32+0 records in
32+0 records out
16384 bytes transferred in 0.012 secs (1365333 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p2 of=/sdcard2/pg1fs
8192+0 records in
8192+0 records out
4194304 bytes transferred in 1.753 secs (2392643 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p3 of=/sdcard2/sbl1
2048+0 records in
2048+0 records out
1048576 bytes transferred in 0.786 secs (1334066 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p4 of=/sdcard2/reserve_1
55230+0 records in
55230+0 records out
28277760 bytes transferred in 19.504 secs (1449844 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p5 of=/sdcard2/mfg
512+0 records in
512+0 records out
262144 bytes transferred in 0.128 secs (2048000 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p6 of=/sdcard2/pg2fs
48510+0 records in
48510+0 records out
24837120 bytes transferred in 12.459 secs (1993508 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p7 of=/sdcard2/rpm
512+0 records in
512+0 records out
262144 bytes transferred in 0.140 secs (1872457 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p8 of=/sdcard2/tz
4096+0 records in
4096+0 records out
2097152 bytes transferred in 1.046 secs (2004925 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p9 of=/sdcard2/aboot
8192+0 records in
8192+0 records out
4194304 bytes transferred in 1.850 secs (2267191 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p10 of=/sdcard2/sp1
20480+0 records in
20480+0 records out
10485760 bytes transferred in 4.977 secs (2106843 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p11 of=/sdcard2/ddr
64+0 records in
64+0 records out
32768 bytes transferred in 0.014 secs (2340571 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p12 of=/sdcard2/rfg_0
2048+0 records in
2048+0 records out
1048576 bytes transferred in 0.491 secs (2135592 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p13 of=/sdcard2/rfg_1
2048+0 records in
2048+0 records out
1048576 bytes transferred in 0.492 secs (2131252 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p14 of=/sdcard2/rfg_2
2048+0 records in
2048+0 records out
1048576 bytes transferred in 0.503 secs (2084644 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p15 of=/sdcard2/rfg_3
2048+0 records in
2048+0 records out
1048576 bytes transferred in 0.530 secs (1978445 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p16 of=/sdcard2/rfg_4
2048+0 records in
2048+0 records out
1048576 bytes transferred in 0.498 secs (2105574 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p17 of=/sdcard2/rfg_5
2048+0 records in
2048+0 records out
1048576 bytes transferred in 0.505 secs (2076388 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p18 of=/sdcard2/rfg_6
2048+0 records in
2048+0 records out
1048576 bytes transferred in 0.498 secs (2105574 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p19 of=/sdcard2/rfg_7
2048+0 records in
2048+0 records out
1048576 bytes transferred in 0.601 secs (1744718 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p20 of=/sdcard2/fsg
3072+0 records in
3072+0 records out
1572864 bytes transferred in 1.115 secs (1410640 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p21 of=/sdcard2/radio
120834+0 records in
120834+0 records out
61867008 bytes transferred in 43.021 secs (1438065 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p22 of=/sdcard2/tool_diag
20480+0 records in
20480+0 records out
10485760 bytes transferred in 4.736 secs (2214054 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p23 of=/sdcard2/wcnss
10240+0 records in
10240+0 records out
5242880 bytes transferred in 2.047 secs (2561250 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p24 of=/sdcard2/limits
2+0 records in
2+0 records out
1024 bytes transferred in 0.004 secs (256000 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p25 of=/sdcard2/reserve_2
8766+0 records in
8766+0 records out
4488192 bytes transferred in 3.128 secs (1434843 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p26 of=/sdcard2/misc
2048+0 records in
2048+0 records out
1048576 bytes transferred in 0.718 secs (1460412 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p27 of=/sdcard2/debug_config
8+0 records in
8+0 records out
4096 bytes transferred in 0.018 secs (227555 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p28 of=/sdcard2/modem_st1
3072+0 records in
3072+0 records out
1572864 bytes transferred in 0.933 secs (1685813 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p29 of=/sdcard2/modem_st2
3072+0 records in
3072+0 records out
1572864 bytes transferred in 0.999 secs (1574438 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p30 of=/sdcard2/pdata
512+0 records in
512+0 records out
262144 bytes transferred in 0.096 secs (2730666 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p31 of=/sdcard2/persist
45056+0 records in
45056+0 records out
23068672 bytes transferred in 10.149 secs (2272999 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p32 of=/sdcard2/sec
32+0 records in
32+0 records out
16384 bytes transferred in 0.007 secs (2340571 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p33 of=/sdcard2/cdma_record
2048+0 records in
2048+0 records out
1048576 bytes transferred in 0.531 secs (1974719 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p34 of=/sdcard2/fsc
2+0 records in
2+0 records out
1024 bytes transferred in 0.003 secs (341333 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p35 of=/sdcard2/ssd
16+0 records in
16+0 records out
8192 bytes transferred in 0.006 secs (1365333 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p36 of=/sdcard2/rfg_8
256+0 records in
256+0 records out
131072 bytes transferred in 0.058 secs (2259862 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p37 of=/sdcard2/rfg_9
256+0 records in
256+0 records out
131072 bytes transferred in 0.064 secs (2048000 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p38 of=/sdcard2/rfg_10
256+0 records in
256+0 records out
131072 bytes transferred in 0.063 secs (2080507 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p39 of=/sdcard2/rfg_11
256+0 records in
256+0 records out
131072 bytes transferred in 0.054 secs (2427259 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p40 of=/sdcard2/rfg_12
256+0 records in
256+0 records out
131072 bytes transferred in 0.059 secs (2221559 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p41 of=/sdcard2/rfg_13
256+0 records in
256+0 records out
131072 bytes transferred in 0.065 secs (2016492 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p42 of=/sdcard2/rfg_14
256+0 records in
256+0 records out
131072 bytes transferred in 0.069 secs (1899594 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p43 of=/sdcard2/rfg_15
256+0 records in
256+0 records out
131072 bytes transferred in 0.061 secs (2148721 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p44 of=/sdcard2/control
32+0 records in
32+0 records out
16384 bytes transferred in 0.010 secs (1638400 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p45 of=/sdcard2/extra
128+0 records in
128+0 records out
65536 bytes transferred in 0.028 secs (2340571 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p46 of=/sdcard2/local
2562+0 records in
2562+0 records out
1311744 bytes transferred in 0.597 secs (2197226 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p47 of=/sdcard2/skylink
512+0 records in
512+0 records out
262144 bytes transferred in 0.119 secs (2202890 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p48 of=/sdcard2/carrier
81920+0 records in
81920+0 records out
41943040 bytes transferred in 30.662 secs (1367915 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p49 of=/sdcard2/frp
1024+0 records in
1024+0 records out
524288 bytes transferred in 0.363 secs (1444319 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p50 of=/sdcard2/vzw_quality
32768+0 records in
32768+0 records out
16777216 bytes transferred in 6.772 secs (2477438 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p51 of=/sdcard2/vzw_logger
32768+0 records in
32768+0 records out
16777216 bytes transferred in 11.583 secs (1448434 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p52 of=/sdcard2/fataldevlog
40960+0 records in
40960+0 records out
20971520 bytes transferred in 9.259 secs (2264987 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p53 of=/sdcard2/devlog
61440+0 records in
61440+0 records out
31457280 bytes transferred in 21.769 secs (1445049 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p54 of=/sdcard2/ramdump
20480+0 records in
20480+0 records out
10485760 bytes transferred in 4.992 secs (2100512 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p55 of=/sdcard2/battery
20480+0 records in
20480+0 records out
10485760 bytes transferred in 4.352 secs (2409411 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p56 of=/sdcard2/absolute
32768+0 records in
32768+0 records out
16777216 bytes transferred in 11.894 secs (1410561 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p57 of=/sdcard2/reserve
7460+0 records in
7460+0 records out
3819520 bytes transferred in 2.001 secs (1908805 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p58 of=/sdcard2/hosd
98304+0 records in
98304+0 records out
50331648 bytes transferred in 30.229 secs (1665012 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p59 of=/sdcard2/boot
65536+0 records in
65536+0 records out
33554432 bytes transferred in 17.478 secs (1919809 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p60 of=/sdcard2/recovery
65536+0 records in
65536+0 records out
33554432 bytes transferred in 23.483 secs (1428881 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p61 of=/sdcard2/cache
786432+0 records in
786432+0 records out
402653184 bytes transferred in 275.457 secs (1461764 bytes/sec)
[email protected]_a13wlpp:/ # dd if=/dev/block/mmcblk0p62 of=/sdcard2/system
Kernel source code
Here is my source code for the kernel.
It builds without error.
Still needs some work but not too bad of a start.
Download the zip.
If you clone it the version gets messed up.
https://github.com/Bigcountry907/HTC_a13_vzw_Kernel
Full Unlocked EMMC Backup Image
FULL EMMC BACKUP UNLOCKED / SUPER CID / S-OFF
http://www.mediafire.com/file/n8yaqtacaf3od21/526-DD-EMMC.zip
Removed link to post backup from a fresh install
This is a complete emmc backup of the full 8GB Emmc.
That means it contains the GPT Header and Partition Information.
The GPT Partition Table can be dumped from this file and also directly read from this file.
The GPT Partition Table can be pulled on the device as well.
And by the way. The GPT_Main-8g.img that you see in the Unencrypted Unpacked RUU.
Well that is the GPT Partition Table from the factory. WAHoooooo.
If you look around you will not find much info on generating the Partition.xml
That's why most will never even attempt this. ( I have the method down to a science )
The other thing needed done here is to make a full EMMC backup of a locked device.
Then we can use the diff command to find the differences in the code between a locked device and a fully unlocked device.
Once we know what it takes to flash a fully unlocked device ( Upon Flash Completion ).
We can polish up the partition.xml and generate a full rom flashable in Emergency Download Mode..
Some may fear bricking their device.
The thing you should know is if you are running linux.
We can create the rom package from the partition.xml.
And flash it to a sd card in a card reader for verification.
This way we can evaluate the disk structure and verify that the sd card is an exact clone of the device emmc.
After we achieve that then we can flash a real device with confidence.
Breakdown of the Raw GPT.
We can View the Emmc Backup image in a hex editor and decode the GPT.
There are easier ways but we will start out here. I have tools that aren't doing too bad of a job but when it comes to getting the GPT correct we need to be really really sure.
Here is the Breakdown of the GPT Partition Table.
Have Fun, :good:
Here is the RUU for the 526 Verizon Other Carrier Version.
http://www.mediafire.com/file/5xdb32tpy10x1os/0PM3IMG_VZW_OM_US_1.10.509.4.zip
The rom I am building will be based off of this RUU.
To flash this RUU rename the file to 0PM3IMG.zip
copy it to your external sd card.
Boot the device into download mode.
Hit the volume up key to flash the RUU.
PLEASE NOTE: THIS RUU HAS A DIFFERENT CID.
SO UNLESS YOU ARE SUPER CID YOU CAN NOT FLASH IT.
iT WILL NOT LET YOU.
Which is unfortunate.
Unlocking the boot loader is as simple as loading this RUU.
And then following the normal HTC dev process.
Because of the CID the device will not flash this RUU.
Unless you can change your CID like I Did.
With this RUU loaded the Enable_Oem_unlocking option shows up in the developer options menu.
Turing this on allows you to generate the unlock token.
When submitting the unlock token to htc dev it will pass.
The cid of this ruu is not blocked from being unlocked.
So then you will get the unlockcode.bin from htc dev and easily unlock your bootloader.
The problem is you can't flash this ruu.
So by taking this RUU and making a rom flashable in qdl9008 mode we might be able to get it on your device.
Provided we can flash in QDL9008 mode.
So there you have it.
The answer to unlocking the bootloader.
And with some luck. A way to flash it to locked devices.
Detailed Process
waring-----warning------if not completed properly this COULD turn your device into a paperweight forever
waring-----warning-----by following these steps you agree to assume responsibility for any damage to your device.
Step 1 PREPARE THE DEVICE
Step 1) Preparing the device.
The first thing you need to do is UNLOCK THE BOOT LOADER. ( We need to flash TWRP )
After the boot loader is unlocked we want the freshest EMMC backup we can get.
Here is how we will accomplish that.
#1 ) Flash the RUU----(for non 526 device flash the factory firmware)
#2 ) (IF THE BOOT-LOADER IS LOCKED YOU MUST UNLOCK IT NOW)
#3 ) Flash the RUU AGAIN --->>> WITH THE BOOT LOADER UNLOCKED
#4 ) WHEN THE RUU IS FINISHED HIT THE POWER BUTTON TO POWER OFF THE DEVICE
#5 ) DO NOT POWER THE DEVICE ON. ( DO NOT BOOT IT TO SYSTEM AT ALL )
#6 ) THIS MEANS APPS ARE NOT INITIALIZED AND INITIAL SETUP HAS NOT BEEN COMPLETED
#7) The device is currently in the newly flashed state ( NEVER TURNED ON )
#7) Now we can continue and get a as flashed backup ( NEVER TURNED ON )
I cant stress enough the NEVER TURNED ON PART. <<<<------ Must Follow
Creating a full emmc backup
Step 2) BACKUP THE ENTIRE EMMC TO ONE IMAGE.
#1 Hold the volume down button and press power to boot to download mode.
If you accidentally boot into system then start over with Preparing the Device.
#2 Flash the TWRP recovery to the device
Obviously change the recovery name to the actual name of your recovery image.
From terminal
Code:
fastboot flash recovery twrprecovery.img
My terminal output when flashing TWRP.
Code:
[email protected]:~$ sudo fastboot flash recovery Twrp-526-NO-TOUCH.img
target reported max download size of 723000000 bytes
sending 'recovery' (12226 KB)...
OKAY [ 2.053s]
writing 'recovery'...
(bootloader) HOSD CL#577815
(bootloader) [email protected]
(bootloader) [email protected]%
(bootloader) Update partition OK
(bootloader) [email protected]
OKAY [ 2.863s]
finished. total time: 4.916s
[email protected]:~$
After you have flashed the recovery press the power button to go back to download mode.
Then select reboot to bootloader.
At the bootloader menu select boot to recovery mode.
WHEN THE TWRP SCREEN APPEARS DO NOT TOUCH ANYTHING ON THE DEVICE
DO NOT "SWIPE TO UNLOCK" OR "SWIPE TO ALLOW MODIFICATIONS"
LET THE DEVICE JUST SIT / IF THE SCREEN GOES OFF ITS OK
#3 USE THE SHELL AND CREATE A BACKUP USING DD
Warning---->>> You can only do this in LINUX.
Warning---->>> A backup to the sd card is no good. ( dont even try it )
The reason for this is because our backup image is going to be almost 8gb.
The windows file system and the sd card file system will not handel a single file that is this size.
The EXT-4 file system can handel files this size.
That is why you have to use linux.
Warning---->>>If you fail to follow the above instruction your backup will get cut off and be NO GOOD ( dont even try it )
So then how will we get this backup?
Normally we dd to the sd card and the pull to the computer. :crying:
Well due to the above circumstance we need to dd from the device directly to the computer.
What...........yes this is possible and now I will show you how.:good:
#4 USE THE SHELL AND (ADB Port Forwarding to CREATE A BACKUP USING DD
you should still be booted to TWRP and never have turned the phone on for normal boot
Open up a terminal shell window in linux.
We have to install busybox for this to work.
We will use the busybox binary and the nc file included.
We need to put them in the /system/xbin folder on the device.
Download the busybox zip from this post.
Then copy the unzipped xbin folder to your external sd card.
Then follow the commands.
Code:
adb shell
mount -o rw -t ext4 /dev/block/mmcblk0p62 /system
cp -rf /external_sd/xbin/busybox /system/xbin/busybox
cp -rf /external_sd/xbin/nc /system/xbin/nc
cd /system/xbin
ls
You should see busybox and the file nc in the system/xbin folder now.
the last command "ls" should show the files.
Once the files are there continue to the next step.
#5 CREATE A BACKUP USING DD
open a new terminal window.
run the following commands 1 line at a time.
TERMINAL 1
Code:
adb forward tcp:5555 tcp:5555
adb shell
mount -o rw -t ext4 /dev/block/mmcblk0p62 /system
/system/xbin/busybox nc -l -p 5555 -e /system/xbin/busybox dd if=/dev/block/mmcblk0
If you get an error about system being busy when you try to mount.
It means you already mounted system. (Which you should have)
So skip the mount -o rw -t ext4 /dev/block/mmcblk0p62 /system if you previously mounted /system and have not re booted.
KEEP TERMINAL WINDOW 1 OPEN AND OPEN A 2ND TERMINAL WINDOW.
Run the commands one line at a time.
TERMINAL 2
Code:
adb forward tcp:5555 tcp:5555
adb shell
/system/xbin/busybox nc -l -p 5555 -e /system/xbin/busybox dd if=/dev/block/mmcblk0
Your backup should start running.
It will take a wile. Its allmost 8gb.
Once this is complete you are all set.
Move your backup file to your project location on your computer.
feel free to rename it to something like HTC-526-RAW.img
Your terminal windows will look like this AFTER THE BACKUP IS COMPLETE.
WINDOW1
Code:
[email protected]:~$ adb forward tcp:5555 tcp:5555
[email protected]:~$ nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0.clean1
7.28GiB 0:19:17 [6.44MiB/s] [ <=> ]
[email protected]:~$
WINDOW2
Code:
[email protected]:~$ adb forward tcp:5555 tcp:5555
[email protected]:~$ adb shell
~ # /system/xbin/busybox nc -l -p 5555 -e /system/xbin/busybox dd if=/dev/block/
mmcblk0
15269888+0 records in
15269888+0 records out
7818182656 bytes (7.3GB) copied, 1157.157114 seconds, 6.4MB/s
~ #
So now we have a way to get the current GPT.
From the fresh clean backup we just made.
Not to mention we have a full backup image in case something goes wrong.
Now we want to get a backup of each partition individually.
FOLLOW THEESE STEPS.
close the terminal windows and open a new one.
Code:
adb shell
mkdir /external_sd/pull
Code:
dd if=/dev/block/mmcblk0p1 of=/external_sd/pull/board_info.bin
dd if=/dev/block/mmcblk0p2 of=/external_sd/pull/pg1fs.dd
dd if=/dev/block/mmcblk0p3 of=/external_sd/pull/sbl1-8909-1.img
dd if=/dev/block/mmcblk0p4 of=/external_sd/pull/reserve_1.dd
dd if=/dev/block/mmcblk0p5 of=/external_sd/pull/mfg.bin
dd if=/dev/block/mmcblk0p6 of=/external_sd/pull/pg2fs_ship_signkey.img
dd if=/dev/block/mmcblk0p7 of=/external_sd/pull/rpm-8909-1.img
dd if=/dev/block/mmcblk0p8 of=/external_sd/pull/tz-8909-1.img
dd if=/dev/block/mmcblk0p9 of=/external_sd/pull/aboot_signed.img
dd if=/dev/block/mmcblk0p10 of=/external_sd/pull/sp1.dd
dd if=/dev/block/mmcblk0p11 of=/external_sd/pull/ddr.dd
dd if=/dev/block/mmcblk0p12 of=/external_sd/pull/Rfg_0.dd
dd if=/dev/block/mmcblk0p13 of=/external_sd/pull/rfg_1.img
dd if=/dev/block/mmcblk0p14 of=/external_sd/pull/rfg_2.img
dd if=/dev/block/mmcblk0p15 of=/external_sd/pull/Rfg_3.dd
dd if=/dev/block/mmcblk0p16 of=/external_sd/pull/Rfg_4.dd
dd if=/dev/block/mmcblk0p17 of=/external_sd/pull/Rfg_5.dd
dd if=/dev/block/mmcblk0p18 of=/external_sd/pull/Rfg_6.dd
dd if=/dev/block/mmcblk0p19 of=/external_sd/pull/Rfg_7.dd
dd if=/dev/block/mmcblk0p20 of=/external_sd/pull/rfg_8.dd
dd if=/dev/block/mmcblk0p21 of=/external_sd/pull/radio.img
dd if=/dev/block/mmcblk0p22 of=/external_sd/pull/tool_diag.dd
dd if=/dev/block/mmcblk0p23 of=/external_sd/pull/wcnss.img
dd if=/dev/block/mmcblk0p24 of=/external_sd/pull/limits.dd
dd if=/dev/block/mmcblk0p25 of=/external_sd/pull/Reserve_2.dd
dd if=/dev/block/mmcblk0p26 of=/external_sd/pull/misc.nb0
dd if=/dev/block/mmcblk0p27 of=/external_sd/pull/debug_config.dd
dd if=/dev/block/mmcblk0p28 of=/external_sd/pull/modem_st1.img
dd if=/dev/block/mmcblk0p29 of=/external_sd/pull/modem_st2.img
dd if=/dev/block/mmcblk0p30 of=/external_sd/pull/pdata.dd
dd if=/dev/block/mmcblk0p31 of=/external_sd/pull/persist.img
dd if=/dev/block/mmcblk0p32 of=/external_sd/pull/sec.dd
dd if=/dev/block/mmcblk0p33 of=/external_sd/pull/cdma_record.dd
dd if=/dev/block/mmcblk0p34 of=/external_sd/pull/fsc.dd
dd if=/dev/block/mmcblk0p35 of=/external_sd/pull/ssd.dd
dd if=/dev/block/mmcblk0p36 of=/external_sd/pull/rfg_8.dd
dd if=/dev/block/mmcblk0p37 of=/external_sd/pull/Rfg_9.dd
dd if=/dev/block/mmcblk0p38 of=/external_sd/pull/Rfg_10.dd
dd if=/dev/block/mmcblk0p39 of=/external_sd/pull/Rfg_11.dd
dd if=/dev/block/mmcblk0p40 of=/external_sd/pull/Rfg_12.dd
dd if=/dev/block/mmcblk0p41 of=/external_sd/pull/Rfg_13.dd
dd if=/dev/block/mmcblk0p42 of=/external_sd/pull/Rfg_14.dd
dd if=/dev/block/mmcblk0p43 of=/external_sd/pull/Rfg_15.dd
dd if=/dev/block/mmcblk0p44 of=/external_sd/pull/control.dd
dd if=/dev/block/mmcblk0p45 of=/external_sd/pull/extra.dd
dd if=/dev/block/mmcblk0p46 of=/external_sd/pull/local.dd
dd if=/dev/block/mmcblk0p47 of=/external_sd/pull/skylink.dd
dd if=/dev/block/mmcblk0p48 of=/external_sd/pull/carrier.dd
dd if=/dev/block/mmcblk0p49 of=/external_sd/pull/frp.dd
dd if=/dev/block/mmcblk0p50 of=/external_sd/pull/vzw_quality.dd
dd if=/dev/block/mmcblk0p51 of=/external_sd/pull/vzw_logger.dd
dd if=/dev/block/mmcblk0p52 of=/external_sd/pull/fataldevlog.dd
dd if=/dev/block/mmcblk0p53 of=/external_sd/pull/devlog.dd
dd if=/dev/block/mmcblk0p54 of=/external_sd/pull/ramdump.dd
dd if=/dev/block/mmcblk0p55 of=/external_sd/pull/battery.dd
dd if=/dev/block/mmcblk0p56 of=/external_sd/pull/absolute.dd
dd if=/dev/block/mmcblk0p57 of=/external_sd/pull/reserve.dd
dd if=/dev/block/mmcblk0p58 of=/external_sd/pull/hosd_signed.img
dd if=/dev/block/mmcblk0p59 of=/external_sd/pull/boot_signed.img
dd if=/dev/block/mmcblk0p60 of=/external_sd/pull/recovery_signed.img
dd if=/dev/block/mmcblk0p61 of=/external_sd/pull/cache.dd
dd if=/dev/block/mmcblk0p62 of=/external_sd/pull/system_raw.img
dd if=/dev/block/mmcblk0p63 of=/external_sd/pull/cota.img
dd if=/dev/block/mmcblk0p64 of=/external_sd/pull/appreload.img
dd if=/dev/block/mmcblk0p65 of=/external_sd/pull/userdata.img
MY TERMINAL OUTPUT LOOKS LIKE THIS.
Code:
[email protected]:~$ adb shell
~ # mkdir /external_sd/pull
~ # dd if=/dev/block/mmcblk0p1 of=/external_sd/pull/board_info.bin
32+0 records in
32+0 records out
16384 bytes (16.0KB) copied, 0.098473 seconds, 162.5KB/s
~ # dd if=/dev/block/mmcblk0p2 of=/external_sd/pull/pg1fs.dd
8192+0 records in
8192+0 records out
4194304 bytes (4.0MB) copied, 0.156699 seconds, 25.5MB/s
~ # dd if=/dev/block/mmcblk0p3 of=/external_sd/pull/sbl1-8909-1.img
2048+0 records in
2048+0 records out
1048576 bytes (1.0MB) copied, 0.043596 seconds, 22.9MB/s
~ # dd if=/dev/block/mmcblk0p4 of=/external_sd/pull/reserve_1.dd
55230+0 records in
55230+0 records out
28277760 bytes (27.0MB) copied, 0.956632 seconds, 28.2MB/s
~ # dd if=/dev/block/mmcblk0p5 of=/external_sd/pull/mfg.bin
512+0 records in
512+0 records out
262144 bytes (256.0KB) copied, 0.014895 seconds, 16.8MB/s
~ # dd if=/dev/block/mmcblk0p6 of=/external_sd/pull/pg2fs_ship_signkey.img
48510+0 records in
48510+0 records out
24837120 bytes (23.7MB) copied, 0.856908 seconds, 27.6MB/s
~ # dd if=/dev/block/mmcblk0p7 of=/external_sd/pull/rpm-8909-1.img
512+0 records in
512+0 records out
262144 bytes (256.0KB) copied, 0.011324 seconds, 22.1MB/s
~ # dd if=/dev/block/mmcblk0p8 of=/external_sd/pull/tz-8909-1.img
4096+0 records in
4096+0 records out
2097152 bytes (2.0MB) copied, 0.075822 seconds, 26.4MB/s
~ # dd if=/dev/block/mmcblk0p9 of=/external_sd/pull/aboot_signed.img
8192+0 records in
8192+0 records out
4194304 bytes (4.0MB) copied, 0.134908 seconds, 29.6MB/s
~ # dd if=/dev/block/mmcblk0p10 of=/external_sd/pull/sp1.dd
20480+0 records in
20480+0 records out
10485760 bytes (10.0MB) copied, 0.343767 seconds, 29.1MB/s
~ # dd if=/dev/block/mmcblk0p11 of=/external_sd/pull/ddr.dd
64+0 records in
64+0 records out
32768 bytes (32.0KB) copied, 0.004690 seconds, 6.7MB/s
~ # dd if=/dev/block/mmcblk0p12 of=/external_sd/pull/Rfg_0.dd
2048+0 records in
2048+0 records out
1048576 bytes (1.0MB) copied, 0.049373 seconds, 20.3MB/s
~ # dd if=/dev/block/mmcblk0p13 of=/external_sd/pull/rfg_1.img
2048+0 records in
2048+0 records out
1048576 bytes (1.0MB) copied, 0.036289 seconds, 27.6MB/s
~ # dd if=/dev/block/mmcblk0p14 of=/external_sd/pull/rfg_2.img
2048+0 records in
2048+0 records out
1048576 bytes (1.0MB) copied, 0.044942 seconds, 22.3MB/s
~ # dd if=/dev/block/mmcblk0p15 of=/external_sd/pull/Rfg_3.dd
2048+0 records in
2048+0 records out
1048576 bytes (1.0MB) copied, 0.037648 seconds, 26.6MB/s
~ # dd if=/dev/block/mmcblk0p16 of=/external_sd/pull/Rfg_4.dd
2048+0 records in
2048+0 records out
1048576 bytes (1.0MB) copied, 0.038489 seconds, 26.0MB/s
~ # dd if=/dev/block/mmcblk0p17 of=/external_sd/pull/Rfg_5.dd
2048+0 records in
2048+0 records out
1048576 bytes (1.0MB) copied, 0.036902 seconds, 27.1MB/s
~ # dd if=/dev/block/mmcblk0p18 of=/external_sd/pull/Rfg_6.dd
2048+0 records in
2048+0 records out
1048576 bytes (1.0MB) copied, 0.044936 seconds, 22.3MB/s
~ # dd if=/dev/block/mmcblk0p19 of=/external_sd/pull/Rfg_7.dd
2048+0 records in
2048+0 records out
1048576 bytes (1.0MB) copied, 0.041938 seconds, 23.8MB/s
~ # dd if=/dev/block/mmcblk0p20 of=/external_sd/pull/rfg_8.dd
3072+0 records in
3072+0 records out
1572864 bytes (1.5MB) copied, 0.052896 seconds, 28.4MB/s
~ # dd if=/dev/block/mmcblk0p21 of=/external_sd/pull/radio.img
120834+0 records in
120834+0 records out
61867008 bytes (59.0MB) copied, 2.042541 seconds, 28.9MB/s
~ # dd if=/dev/block/mmcblk0p22 of=/external_sd/pull/tool_diag.dd
20480+0 records in
20480+0 records out
10485760 bytes (10.0MB) copied, 0.332921 seconds, 30.0MB/s
~ # dd if=/dev/block/mmcblk0p23 of=/external_sd/pull/wcnss.img
10240+0 records in
10240+0 records out
5242880 bytes (5.0MB) copied, 0.182862 seconds, 27.3MB/s
~ # dd if=/dev/block/mmcblk0p24 of=/external_sd/pull/limits.dd
2+0 records in
2+0 records out
1024 bytes (1.0KB) copied, 0.003620 seconds, 276.2KB/s
~ # dd if=/dev/block/mmcblk0p25 of=/external_sd/pull/Reserve_2.dd
8766+0 records in
8766+0 records out
4488192 bytes (4.3MB) copied, 0.169308 seconds, 25.3MB/s
~ # dd if=/dev/block/mmcblk0p26 of=/external_sd/pull/misc.nb0
2048+0 records in
2048+0 records out
1048576 bytes (1.0MB) copied, 0.038574 seconds, 25.9MB/s
~ # dd if=/dev/block/mmcblk0p27 of=/external_sd/pull/debug_config.dd
8+0 records in
8+0 records out
4096 bytes (4.0KB) copied, 0.008537 seconds, 468.5KB/s
~ # dd if=/dev/block/mmcblk0p28 of=/external_sd/pull/modem_st1.img
3072+0 records in
3072+0 records out
1572864 bytes (1.5MB) copied, 0.055145 seconds, 27.2MB/s
~ # dd if=/dev/block/mmcblk0p29 of=/external_sd/pull/modem_st2.img
3072+0 records in
3072+0 records out
1572864 bytes (1.5MB) copied, 0.056552 seconds, 26.5MB/s
~ # dd if=/dev/block/mmcblk0p30 of=/external_sd/pull/pdata.dd
512+0 records in
512+0 records out
262144 bytes (256.0KB) copied, 0.020551 seconds, 12.2MB/s
~ # dd if=/dev/block/mmcblk0p31 of=/external_sd/pull/persist.img
45056+0 records in
45056+0 records out
23068672 bytes (22.0MB) copied, 0.708484 seconds, 31.1MB/s
~ # dd if=/dev/block/mmcblk0p32 of=/external_sd/pull/sec.dd
32+0 records in
32+0 records out
16384 bytes (16.0KB) copied, 0.004855 seconds, 3.2MB/s
~ # dd if=/dev/block/mmcblk0p33 of=/external_sd/pull/cdma_record.dd
2048+0 records in
2048+0 records out
1048576 bytes (1.0MB) copied, 0.052320 seconds, 19.1MB/s
~ # dd if=/dev/block/mmcblk0p34 of=/external_sd/pull/fsc.dd
2+0 records in
2+0 records out
1024 bytes (1.0KB) copied, 0.003174 seconds, 315.1KB/s
~ # dd if=/dev/block/mmcblk0p35 of=/external_sd/pull/ssd.dd
16+0 records in
16+0 records out
8192 bytes (8.0KB) copied, 0.003442 seconds, 2.3MB/s
~ # dd if=/dev/block/mmcblk0p36 of=/external_sd/pull/rfg_8.dd
256+0 records in
256+0 records out
131072 bytes (128.0KB) copied, 0.009233 seconds, 13.5MB/s
~ # dd if=/dev/block/mmcblk0p37 of=/external_sd/pull/Rfg_9.dd
256+0 records in
256+0 records out
131072 bytes (128.0KB) copied, 0.008369 seconds, 14.9MB/s
~ # dd if=/dev/block/mmcblk0p38 of=/external_sd/pull/Rfg_10.dd
256+0 records in
256+0 records out
131072 bytes (128.0KB) copied, 0.008319 seconds, 15.0MB/s
~ # dd if=/dev/block/mmcblk0p39 of=/external_sd/pull/Rfg_11.dd
256+0 records in
256+0 records out
131072 bytes (128.0KB) copied, 0.007546 seconds, 16.6MB/s
~ # dd if=/dev/block/mmcblk0p40 of=/external_sd/pull/Rfg_12.dd
256+0 records in
256+0 records out
131072 bytes (128.0KB) copied, 0.007442 seconds, 16.8MB/s
~ # dd if=/dev/block/mmcblk0p41 of=/external_sd/pull/Rfg_13.dd
256+0 records in
256+0 records out
131072 bytes (128.0KB) copied, 0.009552 seconds, 13.1MB/s
~ # dd if=/dev/block/mmcblk0p42 of=/external_sd/pull/Rfg_14.dd
256+0 records in
256+0 records out
131072 bytes (128.0KB) copied, 0.007462 seconds, 16.8MB/s
~ # dd if=/dev/block/mmcblk0p43 of=/external_sd/pull/Rfg_15.dd
256+0 records in
256+0 records out
131072 bytes (128.0KB) copied, 0.007470 seconds, 16.7MB/s
~ # dd if=/dev/block/mmcblk0p44 of=/external_sd/pull/control.dd
32+0 records in
32+0 records out
16384 bytes (16.0KB) copied, 0.002275 seconds, 6.9MB/s
~ # dd if=/dev/block/mmcblk0p45 of=/external_sd/pull/extra.dd
128+0 records in
128+0 records out
65536 bytes (64.0KB) copied, 0.004667 seconds, 13.4MB/s
~ # dd if=/dev/block/mmcblk0p46 of=/external_sd/pull/local.dd
2562+0 records in
2562+0 records out
1311744 bytes (1.3MB) copied, 0.061205 seconds, 20.4MB/s
~ # dd if=/dev/block/mmcblk0p47 of=/external_sd/pull/skylink.dd
512+0 records in
512+0 records out
262144 bytes (256.0KB) copied, 0.012928 seconds, 19.3MB/s
~ # dd if=/dev/block/mmcblk0p48 of=/external_sd/pull/carrier.dd
81920+0 records in
81920+0 records out
41943040 bytes (40.0MB) copied, 1.674405 seconds, 23.9MB/s
~ # dd if=/dev/block/mmcblk0p49 of=/external_sd/pull/frp.dd
1024+0 records in
1024+0 records out
524288 bytes (512.0KB) copied, 0.027144 seconds, 18.4MB/s
~ # dd if=/dev/block/mmcblk0p50 of=/external_sd/pull/vzw_quality.dd
32768+0 records in
32768+0 records out
16777216 bytes (16.0MB) copied, 0.725511 seconds, 22.1MB/s
~ # dd if=/dev/block/mmcblk0p51 of=/external_sd/pull/vzw_logger.dd
32768+0 records in
32768+0 records out
16777216 bytes (16.0MB) copied, 0.677459 seconds, 23.6MB/s
~ # dd if=/dev/block/mmcblk0p52 of=/external_sd/pull/fataldevlog.dd
40960+0 records in
40960+0 records out
20971520 bytes (20.0MB) copied, 0.741942 seconds, 27.0MB/s
~ # dd if=/dev/block/mmcblk0p53 of=/external_sd/pull/devlog.dd
61440+0 records in
61440+0 records out
31457280 bytes (30.0MB) copied, 1.202796 seconds, 24.9MB/s
~ # dd if=/dev/block/mmcblk0p54 of=/external_sd/pull/ramdump.dd
20480+0 records in
20480+0 records out
10485760 bytes (10.0MB) copied, 0.543807 seconds, 18.4MB/s
~ # dd if=/dev/block/mmcblk0p55 of=/external_sd/pull/battery.dd
20480+0 records in
20480+0 records out
10485760 bytes (10.0MB) copied, 0.573615 seconds, 17.4MB/s
~ # dd if=/dev/block/mmcblk0p56 of=/external_sd/pull/absolute.dd
32768+0 records in
32768+0 records out
16777216 bytes (16.0MB) copied, 1.057161 seconds, 15.1MB/s
~ # dd if=/dev/block/mmcblk0p57 of=/external_sd/pull/reserve.dd
7460+0 records in
7460+0 records out
3819520 bytes (3.6MB) copied, 0.234693 seconds, 15.5MB/s
~ # dd if=/dev/block/mmcblk0p58 of=/external_sd/pull/hosd_signed.img
98304+0 records in
98304+0 records out
50331648 bytes (48.0MB) copied, 2.571142 seconds, 18.7MB/s
~ # dd if=/dev/block/mmcblk0p59 of=/external_sd/pull/boot_signed.img
65536+0 records in
65536+0 records out
33554432 bytes (32.0MB) copied, 1.872602 seconds, 17.1MB/s
~ # dd if=/dev/block/mmcblk0p60 of=/external_sd/pull/recovery_signed.img
65536+0 records in
65536+0 records out
33554432 bytes (32.0MB) copied, 1.310425 seconds, 24.4MB/s
~ # dd if=/dev/block/mmcblk0p61 of=/external_sd/pull/cache.dd
524288+0 records in
524288+0 records out
268435456 bytes (256.0MB) copied, 13.365671 seconds, 19.2MB/s
~ # dd if=/dev/block/mmcblk0p62 of=/external_sd/pull/system_raw.img
5242880+0 records in
5242880+0 records out
2684354560 bytes (2.5GB) copied, 95.306577 seconds, 26.9MB/s
~ # dd if=/dev/block/mmcblk0p63 of=/external_sd/pull/cota.img
10240+0 records in
10240+0 records out
5242880 bytes (5.0MB) copied, 0.175248 seconds, 28.5MB/s
~ # dd if=/dev/block/mmcblk0p64 of=/external_sd/pull/appreload.img
10240+0 records in
10240+0 records out
5242880 bytes (5.0MB) copied, 0.185360 seconds, 27.0MB/s
~ # dd if=/dev/block/mmcblk0p65 of=/external_sd/pull/userdata.img
8388608+0 records in
8388607+1 records out
4294967295 bytes (4.0GB) copied, 139.304669 seconds, 29.4MB/s
~ #
Continuation of last post
Now we have a backups from a device that was only booted to recovery.
You can share if you like and not worry about anyone getting your userdata.
Since we didnt boot the system there is no userdata other than the factory userdata.
Only risk is someone could still get your IMEI number.
My device is not activated with verizon so my imei number will not be of use to anyone.
Now copy the /pull folder from the sd card into your project folder.
And you should have copied the HTC-526-RAW.img into your project folder.
And also the RUU should be copied to the project folder.
Create one more folder called RUU-Unpacked into your project folder.
We need to decrypt and unpack the RUU to get to the Firmware and System.img
Next we will decrypt the RUU.
Get the RUU DECRYPT TOOL HERE.
https://forum.xda-developers.com/chef-central/android/tool-universal-htc-ruu-rom-decryption-t3382928
I will attach the keyfile for decrypting the RUU to this post.
Copy it to the keyfiles folder of the rom decrypt tool.
Copy the ruu into the main folder of the decrypt tool.
Where the Binary file RUU_Decrypt_Tool is located.
open a new shell
cd to the directory
Where the Binary file RUU_Decrypt_Tool is located.
Rename the RUU to rom.zip
run the following command.
Code:
./RUU_Decrypt_Tool -k rom.zip
your terminal output should look like this.
Code:
[email protected]:~/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt$ ./RUU_Decrypt_Tool -k rom.zip
+++ Welcome to the HTC RUU Decryption Tool 3.0.7 +++
by nkk71 and Captain_Throwback
RUU identified as Normal Zip file
Moving 'rom.zip' temporarily to working folder
Extracting ZIP files
Normal Zip format detected, using unzip
Archive: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/romzip/rom.zip
extracting: info.bin
extracting: zip_0.zip
extracting: zip_1.zip
extracting: zip_2.zip
extracting: zip_3.zip
extracting: zip_4.zip
extracting: zip_5.zip
extracting: zip_6.zip
extracting: zip_7.zip
extracting: zip_8.zip
extracting: zip_9.zip
extracting: zip_10.zip
extracting: zip_11.zip
extracting: zip_12.zip
extracting: zip_13.zip
extracting: zip_14.zip
extracting: zip_15.zip
Finished: Successfully extracted zip files to 'dumped_zips'
Attempting to find suitable keyfile
Find First Encrypted ZIP
Encrypted zip to be used for testing: 'zip_0.zip'
Trying force extraction of hboot/hosd...
Archive: zip_0.zip
warning [zip_0.zip]: 384 extra bytes at beginning or within zipfile
(attempting to process anyway)
file #1: bad zipfile offset (local header sig): 42649524
(attempting to re-compensate)
file #1: bad zipfile offset (local header sig): 42649524
caution: filename not matched: hboot*
Archive: zip_1.zip
warning [zip_1.zip]: 384 extra bytes at beginning or within zipfile
(attempting to process anyway)
caution: filename not matched: hboot*
caution: filename not matched: hosd*
Archive: zip_2.zip
warning [zip_2.zip]: 384 extra bytes at beginning or within zipfile
(attempting to process anyway)
caution: filename not matched: hboot*
caution: filename not matched: hosd*
Archive: zip_3.zip
warning [zip_3.zip]: 384 extra bytes at beginning or within zipfile
(attempting to process anyway)
caution: filename not matched: hboot*
caution: filename not matched: hosd*
Archive: zip_4.zip
warning [zip_4.zip]: 384 extra bytes at beginning or within zipfile
(attempting to process anyway)
caution: filename not matched: hboot*
caution: filename not matched: hosd*
Archive: zip_5.zip
warning [zip_5.zip]: 384 extra bytes at beginning or within zipfile
(attempting to process anyway)
caution: filename not matched: hboot*
caution: filename not matched: hosd*
Archive: zip_6.zip
warning [zip_6.zip]: 384 extra bytes at beginning or within zipfile
(attempting to process anyway)
caution: filename not matched: hboot*
caution: filename not matched: hosd*
Archive: zip_7.zip
warning [zip_7.zip]: 384 extra bytes at beginning or within zipfile
(attempting to process anyway)
caution: filename not matched: hboot*
caution: filename not matched: hosd*
Archive: zip_8.zip
warning [zip_8.zip]: 384 extra bytes at beginning or within zipfile
(attempting to process anyway)
caution: filename not matched: hboot*
caution: filename not matched: hosd*
Archive: zip_9.zip
warning [zip_9.zip]: 384 extra bytes at beginning or within zipfile
(attempting to process anyway)
caution: filename not matched: hboot*
caution: filename not matched: hosd*
Archive: zip_10.zip
warning [zip_10.zip]: 384 extra bytes at beginning or within zipfile
(attempting to process anyway)
caution: filename not matched: hboot*
caution: filename not matched: hosd*
Archive: zip_11.zip
warning [zip_11.zip]: 384 extra bytes at beginning or within zipfile
(attempting to process anyway)
caution: filename not matched: hboot*
caution: filename not matched: hosd*
Archive: zip_12.zip
warning [zip_12.zip]: 384 extra bytes at beginning or within zipfile
(attempting to process anyway)
caution: filename not matched: hboot*
caution: filename not matched: hosd*
Archive: zip_13.zip
warning [zip_13.zip]: 384 extra bytes at beginning or within zipfile
(attempting to process anyway)
caution: filename not matched: hboot*
caution: filename not matched: hosd*
Archive: zip_14.zip
warning [zip_14.zip]: 384 extra bytes at beginning or within zipfile
(attempting to process anyway)
caution: filename not matched: hboot*
caution: filename not matched: hosd*
Archive: zip_15.zip
warning [zip_15.zip]: 384 extra bytes at beginning or within zipfile
(attempting to process anyway)
caution: filename not matched: hboot*
caution: filename not matched: hosd*
no files were force-extracted.
No proper keyfile, trying known keys instead...
Testing keyfile '0P6B_keyfile_1.bin'...
ruuveal
-------
Invalid zip file - aborting!
failed to decrypt zip file!
Testing keyfile '0P6B_keyfile_6.20.654.3.bin'...
ruuveal
-------
Invalid zip file - aborting!
failed to decrypt zip file!
Testing keyfile '0P6B_keyfile_6.bin'...
ruuveal
-------
Invalid zip file - aborting!
failed to decrypt zip file!
Testing keyfile '0PAJ_keyfile_1.bin'...
ruuveal
-------
Invalid zip file - aborting!
failed to decrypt zip file!
Testing keyfile '0PCV_keyfile_1.bin'...
ruuveal
-------
Invalid zip file - aborting!
failed to decrypt zip file!
Testing keyfile '0PFH_keyfile_2.bin'...
ruuveal
-------
Invalid zip file - aborting!
failed to decrypt zip file!
Testing keyfile '0PGZ_keyfile_1.bin'...
ruuveal
-------
Invalid zip file - aborting!
failed to decrypt zip file!
Testing keyfile '0PJA_keyfile_2.bin'...
ruuveal
-------
Invalid zip file - aborting!
failed to decrypt zip file!
Testing keyfile '0PKV_keyfile_1.bin'...
ruuveal
-------
Invalid zip file - aborting!
failed to decrypt zip file!
Testing keyfile '0PM3_keyfile_1.bin'...
ruuveal
-------
Decrypted RUU (zip) written to: tmpzip.zip
Archive: tmpzip.zip
testing: android-info.txt OK
testing: aboot_signed.img OK
testing: radio.img OK
testing: splash1.nb0 OK
testing: rfg_1.img OK
testing: rfg_2.img OK
testing: wcnss.img OK
testing: ramdisk.img OK
testing: android-info2.txt OK
testing: pg2fs_ship_signkey.img OK
testing: apppreload.img OK
testing: emmc_appsboot.mbn OK
testing: persist.img OK
testing: dt.img OK
testing: bootloader OK
testing: sbl1-8909-1.img OK
testing: gpt_main_8g.img OK
testing: rpm-8909-1.img OK
testing: tz-8909-1.img OK
testing: cota.img OK
testing: partition_info OK
testing: recovery_signed.img OK
testing: hosd_signed.img OK
testing: boot_signed.img OK
testing: backup_android-info.txt OK
No errors detected in compressed data of tmpzip.zip.
INFO: keyfile passed all tests
Finished: Successfully found decryption key, copied to 'tmp/use_keyfile.bin'
Decrypting ZIP files
Decrypting (1/16) 'zip_0.zip'
Encrypted zip detected, running ruuveal...
ruuveal
-------
Decrypted RUU (zip) written to: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/decrypted_zips/dec_zip_0.zip
Decrypting (2/16) 'zip_1.zip'
Encrypted zip detected, running ruuveal...
ruuveal
-------
Decrypted RUU (zip) written to: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/decrypted_zips/dec_zip_1.zip
Decrypting (3/16) 'zip_2.zip'
Encrypted zip detected, running ruuveal...
ruuveal
-------
Decrypted RUU (zip) written to: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/decrypted_zips/dec_zip_2.zip
Decrypting (4/16) 'zip_3.zip'
Encrypted zip detected, running ruuveal...
ruuveal
-------
Decrypted RUU (zip) written to: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/decrypted_zips/dec_zip_3.zip
Decrypting (5/16) 'zip_4.zip'
Encrypted zip detected, running ruuveal...
ruuveal
-------
Decrypted RUU (zip) written to: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/decrypted_zips/dec_zip_4.zip
Decrypting (6/16) 'zip_5.zip'
Encrypted zip detected, running ruuveal...
ruuveal
-------
Decrypted RUU (zip) written to: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/decrypted_zips/dec_zip_5.zip
Decrypting (7/16) 'zip_6.zip'
Encrypted zip detected, running ruuveal...
ruuveal
-------
Decrypted RUU (zip) written to: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/decrypted_zips/dec_zip_6.zip
Decrypting (8/16) 'zip_7.zip'
Encrypted zip detected, running ruuveal...
ruuveal
-------
Decrypted RUU (zip) written to: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/decrypted_zips/dec_zip_7.zip
Decrypting (9/16) 'zip_8.zip'
Encrypted zip detected, running ruuveal...
ruuveal
-------
Decrypted RUU (zip) written to: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/decrypted_zips/dec_zip_8.zip
Decrypting (10/16) 'zip_9.zip'
Encrypted zip detected, running ruuveal...
ruuveal
-------
Decrypted RUU (zip) written to: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/decrypted_zips/dec_zip_9.zip
Decrypting (11/16) 'zip_10.zip'
Encrypted zip detected, running ruuveal...
ruuveal
-------
Decrypted RUU (zip) written to: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/decrypted_zips/dec_zip_10.zip
Decrypting (12/16) 'zip_11.zip'
Encrypted zip detected, running ruuveal...
ruuveal
-------
Decrypted RUU (zip) written to: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/decrypted_zips/dec_zip_11.zip
Decrypting (13/16) 'zip_12.zip'
Encrypted zip detected, running ruuveal...
ruuveal
-------
Decrypted RUU (zip) written to: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/decrypted_zips/dec_zip_12.zip
Decrypting (14/16) 'zip_13.zip'
Encrypted zip detected, running ruuveal...
ruuveal
-------
Decrypted RUU (zip) written to: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/decrypted_zips/dec_zip_13.zip
Decrypting (15/16) 'zip_14.zip'
Encrypted zip detected, running ruuveal...
ruuveal
-------
Decrypted RUU (zip) written to: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/decrypted_zips/dec_zip_14.zip
Decrypting (16/16) 'zip_15.zip'
Encrypted zip detected, running ruuveal...
ruuveal
-------
Decrypted RUU (zip) written to: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/decrypted_zips/dec_zip_15.zip
Finished: Successfully decrypted zips to 'decrypted_zips'
Unzipping decrypted ZIP files
Unzipping decrypted zip: (1/16) 'dec_zip_0.zip'
Archive: dec_zip_0.zip
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/android-info.txt
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/aboot_signed.img
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/radio.img
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/splash1.nb0
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/rfg_1.img
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/rfg_2.img
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/wcnss.img
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/ramdisk.img
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/android-info2.txt
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/pg2fs_ship_signkey.img
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/apppreload.img
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/emmc_appsboot.mbn
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/persist.img
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/dt.img
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/bootloader
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/sbl1-8909-1.img
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/gpt_main_8g.img
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/rpm-8909-1.img
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/tz-8909-1.img
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/cota.img
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/partition_info
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/recovery_signed.img
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/hosd_signed.img
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/boot_signed.img
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/backup_android-info.txt
Unzipping decrypted zip: (2/16) 'dec_zip_1.zip'
Archive: dec_zip_1.zip
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/system.img_00
Unzipping decrypted zip: (3/16) 'dec_zip_2.zip'
Archive: dec_zip_2.zip
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/system.img_01
Unzipping decrypted zip: (4/16) 'dec_zip_3.zip'
Archive: dec_zip_3.zip
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/system.img_02
Unzipping decrypted zip: (5/16) 'dec_zip_4.zip'
Archive: dec_zip_4.zip
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/system.img_03
Unzipping decrypted zip: (6/16) 'dec_zip_5.zip'
Archive: dec_zip_5.zip
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/system.img_04
Unzipping decrypted zip: (7/16) 'dec_zip_6.zip'
Archive: dec_zip_6.zip
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/system.img_05
Unzipping decrypted zip: (8/16) 'dec_zip_7.zip'
Archive: dec_zip_7.zip
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/system.img_06
Unzipping decrypted zip: (9/16) 'dec_zip_8.zip'
Archive: dec_zip_8.zip
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/system.img_07
Unzipping decrypted zip: (10/16) 'dec_zip_9.zip'
Archive: dec_zip_9.zip
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/system.img_08
Unzipping decrypted zip: (11/16) 'dec_zip_10.zip'
Archive: dec_zip_10.zip
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/system.img_09
Unzipping decrypted zip: (12/16) 'dec_zip_11.zip'
Archive: dec_zip_11.zip
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/system.img_10
Unzipping decrypted zip: (13/16) 'dec_zip_12.zip'
Archive: dec_zip_12.zip
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/system.img_11
Unzipping decrypted zip: (14/16) 'dec_zip_13.zip'
Archive: dec_zip_13.zip
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/system.img_12
Unzipping decrypted zip: (15/16) 'dec_zip_14.zip'
Archive: dec_zip_14.zip
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/system.img_13
Unzipping decrypted zip: (16/16) 'dec_zip_15.zip'
Archive: dec_zip_15.zip
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/userdata.img
inflating: /home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT/firmware/tp_HMX852XD.img
Finished: Successfully unzipped files to 'firmware'
Moving system img files
(1/14) moving system.img_00
(2/14) moving system.img_01
(3/14) moving system.img_02
(4/14) moving system.img_03
(5/14) moving system.img_04
(6/14) moving system.img_05
(7/14) moving system.img_06
(8/14) moving system.img_07
(9/14) moving system.img_08
(10/14) moving system.img_09
(11/14) moving system.img_10
(12/14) moving system.img_11
(13/14) moving system.img_12
(14/14) moving system.img_13
Finished: Successfully moved system img files to 'decrypted_system'
Attempting to create system.img
Multi-part system images (14 parts)
Sparse Image detected, using simg2img
Please be patient, this can take several minutes...
Processing file 'system.img_00'...
Processing file 'system.img_01'...
Processing file 'system.img_02'...
Processing file 'system.img_03'...
Processing file 'system.img_04'...
Processing file 'system.img_05'...
Processing file 'system.img_06'...
Processing file 'system.img_07'...
Processing file 'system.img_08'...
Processing file 'system.img_09'...
Processing file 'system.img_10'...
Processing file 'system.img_11'...
Processing file 'system.img_12'...
Processing file 'system.img_13'...
finished.
Finished: Successfully created system.img 'system/system.img'
Testing system.img...
e2fsck 1.42.13 (17-May-2015)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
system/system.img: 3338/163840 files (0.0% non-contiguous), 514860/655360 blocks
Finished: system.img successfully passed filesystem check
Adding boot.img to the system folder
Copying firmware/boot_signed.img to system/boot.img
Checking keyfile state
Keyfile used already matches one in the keyfiles folder.
Restoring 'rom.zip' to normal folder
Removing unneeded work folders
INFO: RUU modelid: 0PM310000
INFO: RUU mainver: 1.10.509.4
Finished: Successfully extracted zip files to
'/home/bigcountry907/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt/OUT'
[email protected]:~/Auto-Key-HTC/Master-AUTO-KEY-Files/Tools/RUU-Toolz/RUU-REBUILD/DE-Crypt$
Now copy the OUT folder to your Project Folder.
Rename it to ROM.
Now we have all the files we need to work with in our project folder.
:victory:
Template Rom
Ok so this will be a whole lot easier if we have a template rom to follow as we build our rom. We are creating nearly the same exact thing. The best part about this rom is it is built to flash a few different ways. Including with QDL9008 mode. This rom is specifically for the msm8909 chipset and nearly the exact same release that is currently on our device.
Perfect
It gets even better. I guess Longcheer releases all the source files with there updates.
This is exactly what we have here. We have everything you would have after compiling the rom from source.
And everything you would have if you built all the Qualcomm Images as well. This is the full meal deal.
Every last file is there and all of the tools you need to package flashable roms, ota, updates.
Even better this is a user-debug version.
Even More Better its only signed by Qualcomm Test Keys. And the Keys are included.
So this thing is the cream of the crop. And fully compatible with our device.
We can cherry-pick what we want and use it on the Desire 526..
In order to complete our project we need certain qualcomm tools.
They are included in this PUBLICLY RELEASED Official Update From Longcheer.
That means we have a legitimate way of having these tools that is not in violation of any license. (ITS A PUBLIC RELEASE :silly
Make sure you look inside every folder and remember where things are.
This is a msm8909 developers goldmine. I will reference this rom a lot in the future.
Unfortunately Need Rom will require you register. But it's free.
I will try to upload this somewhere.
DOWNLOAD PAGE
http://www.needrom.com/download/longcheer-l6350/
Longcheer Website.
http://www.longcheer.net/index_en.aspx
The best place in the world to get Qualcomm Proprietary Manuals and Proprietary Tools Legitimately from Qualcomm.
https://developer.qualcomm.com/hardware/dragonboard-410c/tools
Most all of the msm8916 manuals apply to the MSM8909.
Even some of the source code is the same.
I just wanted to share the LEGITIMATE Public Sources. It is legit to do this and have these tools.
Backups From The backup exercise
Since I know most of you cant flash TWRP and might have a hard time decrypting the RUU.
I am posting the backups that were generated in the instructional post.
This way you can still follow along with this project if you like.
The full EMMC as 1 image.
http://www.mediafire.com/file/8nkk4qw6ymz8p11/526-emmc.zip
The separate partition images.
http://www.mediafire.com/file/5cspbcg6sky6bw9/pull.zip
The decrypted RUU.
http://www.mediafire.com/file/k4w9ya0uli39ky8/ROM-decrypted.zip
Remember to get the template rom posted previously. You need the tools.
Right now I am working on the easiest methods to get the GPT Partition Table and create the partition.xml
On a good note I successfully flashed the Template Rom Image to a SD-Card.:highfive:
This is good because we have the full emmc backup.
We have the ruu and device backup partitions needed to recreate the full EMMC image.
We can now create the FULL EMMC Image using the tools.
Then we can compare the created EMMC image against the Backup EMMC image.
If they are Identical.....were ready to flash the device.
Soon as we get over the GPT hurdle it's smooth Sailing.
Getting over the GPT Hurdle
Download the attached pdf presentation for reference. ( or get it from the link below )
Start at slide 26
Complied list of tools/scripts/resources for MBR/GPT analysis
http://www.jonrajewski.com/resources/
In the “Speaker Presentations” folder you will find
Evidence Files
MBR/GPT Resource
Presentation
Review the presentation so you have an Idea of what we are looking at.
This way you will be able to understand what we are doing and how we are doing it.
Then you will be ready.
Set up the required directory tree
The black art of generating the partition.xml
First of all this is a somewhat complicated process that needs each step to be completed properly.
It is my suggestion to create the same directory structure that I have.
If you make the same director structure then you can use the same commands without editing.
Otherwise edit the commands to have the correct PATHS.
Step #1 Set up the Directory Structure
Open a terminal shell and create the directories.
Code:
mkdir ~/Desktop/526-Completed
mkdir ~/Desktop/526-Completed/A13-Backup
mkdir ~/Desktop/526-Completed/bin
mkdir ~/Desktop/526-Completed/Convert-Sparse
mkdir ~/Desktop/526-Completed/Get-GPT_Info
mkdir ~/Desktop/526-Completed/manuals
mkdir ~/Desktop/526-Completed/Other-Tools
mkdir ~/Desktop/526-Completed/TARGET_Build
mkdir ~/Desktop/526-Completed/A13-Backup/boot-img
mkdir ~/Desktop/526-Completed/A13-Backup/EMMC-Image
mkdir ~/Desktop/526-Completed/A13-Backup/pull
mkdir ~/Desktop/526-Completed/A13-Backup/RUU
mkdir ~/Desktop/526-Completed/A13-Backup/TWRP-Recovery
mkdir ~/Desktop/526-Completed/Convert-Sparse/data
mkdir ~/Desktop/526-Completed/Convert-Sparse/sys
mkdir ~/Desktop/526-Completed/Example-Rom
Step #2 Set up the Backup Device Files
Add the full emmc image that we pulled from the device in previous post into this folder.
Code:
~/Desktop/526-Completed/A13-Backup/EMMC-Image
Rename the image file to ( 526-EMMC-Complete.img ) without the brackets.
The file path should now be.
Code:
~/Desktop/526-Completed/A13-Backup/EMMC-Image/526-EMMC-Complete.img
Add the separate partition backups that we made in a previous post to this folder.
Code:
mkdir ~/Desktop/526-Completed/A13-Backup/pull
The folder should now have the following paths.
Code:
~/Desktop/526-Completed/A13-Backup/pull/aboot_signed.img
~/Desktop/526-Completed/A13-Backup/pull/absolute.dd
~/Desktop/526-Completed/A13-Backup/pull/appreload.img
~/Desktop/526-Completed/A13-Backup/pull/battery.dd
~/Desktop/526-Completed/A13-Backup/pull/board_info.bin
~/Desktop/526-Completed/A13-Backup/pull/boot_signed.img
~/Desktop/526-Completed/A13-Backup/pull/cache.dd
~/Desktop/526-Completed/A13-Backup/pull/carrier.dd
~/Desktop/526-Completed/A13-Backup/pull/cdma_record.dd
~/Desktop/526-Completed/A13-Backup/pull/control.dd
~/Desktop/526-Completed/A13-Backup/pull/cota.img
~/Desktop/526-Completed/A13-Backup/pull/ddr.dd
~/Desktop/526-Completed/A13-Backup/pull/debug_config.dd
~/Desktop/526-Completed/A13-Backup/pull/devlog.dd
~/Desktop/526-Completed/A13-Backup/pull/extra.dd
~/Desktop/526-Completed/A13-Backup/pull/fataldevlog.dd
~/Desktop/526-Completed/A13-Backup/pull/frp.dd
~/Desktop/526-Completed/A13-Backup/pull/fsc.dd
~/Desktop/526-Completed/A13-Backup/pull/hosd_signed.img
~/Desktop/526-Completed/A13-Backup/pull/limits.dd
~/Desktop/526-Completed/A13-Backup/pull/local.dd
~/Desktop/526-Completed/A13-Backup/pull/mfg.bin
~/Desktop/526-Completed/A13-Backup/pull/misc.nb0
~/Desktop/526-Completed/A13-Backup/pull/modem_st1.img
~/Desktop/526-Completed/A13-Backup/pull/modem_st2.img
~/Desktop/526-Completed/A13-Backup/pull/pdata.dd
~/Desktop/526-Completed/A13-Backup/pull/persist.img
~/Desktop/526-Completed/A13-Backup/pull/pg1fs.dd
~/Desktop/526-Completed/A13-Backup/pull/pg2fs_ship_signkey.img
~/Desktop/526-Completed/A13-Backup/pull/radio.img
~/Desktop/526-Completed/A13-Backup/pull/ramdump.dd
~/Desktop/526-Completed/A13-Backup/pull/recovery_signed.img
~/Desktop/526-Completed/A13-Backup/pull/reserve.dd
~/Desktop/526-Completed/A13-Backup/pull/reserve_1.dd
~/Desktop/526-Completed/A13-Backup/pull/Reserve_2.dd
~/Desktop/526-Completed/A13-Backup/pull/rfg_1.img
~/Desktop/526-Completed/A13-Backup/pull/rfg_2.img
~/Desktop/526-Completed/A13-Backup/pull/rfg_8.dd
~/Desktop/526-Completed/A13-Backup/pull/Rfg_0.dd
~/Desktop/526-Completed/A13-Backup/pull/Rfg_3.dd
~/Desktop/526-Completed/A13-Backup/pull/Rfg_4.dd
~/Desktop/526-Completed/A13-Backup/pull/Rfg_5.dd
~/Desktop/526-Completed/A13-Backup/pull/Rfg_6.dd
~/Desktop/526-Completed/A13-Backup/pull/Rfg_7.dd
~/Desktop/526-Completed/A13-Backup/pull/Rfg_9.dd
~/Desktop/526-Completed/A13-Backup/pull/Rfg_10.dd
~/Desktop/526-Completed/A13-Backup/pull/Rfg_11.dd
~/Desktop/526-Completed/A13-Backup/pull/Rfg_12.dd
~/Desktop/526-Completed/A13-Backup/pull/Rfg_13.dd
~/Desktop/526-Completed/A13-Backup/pull/Rfg_14.dd
~/Desktop/526-Completed/A13-Backup/pull/Rfg_15.dd
~/Desktop/526-Completed/A13-Backup/pull/rpm-8909-1.img
~/Desktop/526-Completed/A13-Backup/pull/sbl1-8909-1.img
~/Desktop/526-Completed/A13-Backup/pull/sec.dd
~/Desktop/526-Completed/A13-Backup/pull/skylink.dd
~/Desktop/526-Completed/A13-Backup/pull/sp1.dd
~/Desktop/526-Completed/A13-Backup/pull/ssd.dd
~/Desktop/526-Completed/A13-Backup/pull/system_raw.img
~/Desktop/526-Completed/A13-Backup/pull/tool_diag.dd
~/Desktop/526-Completed/A13-Backup/pull/tz-8909-1.img
~/Desktop/526-Completed/A13-Backup/pull/userdata.img
~/Desktop/526-Completed/A13-Backup/pull/vzw_logger.dd
~/Desktop/526-Completed/A13-Backup/pull/vzw_quality.dd
~/Desktop/526-Completed/A13-Backup/pull/wcnss.img
Step#3 Add the DECRYPTED RUU FILES
We decrypted the RUU in a previous post and renamed the OUT folder to ROM.
The folder containing the decrypted ruu should be renamed to ROM.
Put the ROM Folder into this folder.
Code:
/home/bigcountry907/Desktop/526-Completed/A13-Backup/RUU
The RUU Folder should now have the following file paths.
The folder should now have the following paths.
Code:
~/Desktop/526-Completed/A13-Backup/RUU/ROM
~/Desktop/526-Completed/A13-Backup/RUU/ROM/boot
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware
~/Desktop/526-Completed/A13-Backup/RUU/ROM/system
~/Desktop/526-Completed/A13-Backup/RUU/ROM/boot/boot.img
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/aboot_signed.img
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/android-info.txt
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/android-info2.txt
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/apppreload.img
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/backup_android-info.txt
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/bootloader
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/boot_signed.img
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/cota.img
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/dt.img
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/emmc_appsboot.mbn
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/gpt_main_8g.img
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/hosd_signed.img
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/partition_info
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/persist.img
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/pg2fs_ship_signkey.img
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/radio.img
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/ramdisk.img
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/recovery_signed.img
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/rfg_1.img
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/rfg_2.img
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/rpm-8909-1.img
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/sbl1-8909-1.img
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/splash1.nb0
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/tp_HMX852XD.img
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/tz-8909-1.img
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/userdata.img
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/wcnss.img
~/Desktop/526-Completed/A13-Backup/RUU/ROM/system/system.img
We downloaded a template rom in a previous post..
Put the 2 Template Rom downloads into this folder and unzip them.
Code:
~/Desktop/526-Completed/Example-Rom
The folder should now have the following paths.
Code:
~/Desktop/526-Completed/Example-Rom/LLD0005_0113031301_T07C0618_userdebug
~/Desktop/526-Completed/Example-Rom/Longcheer-l6350-FOTA
~/Desktop/526-Completed/Example-Rom/Longcheer-l6350.20150618.T07.rar
~/Desktop/526-Completed/Example-Rom/Longcheer-l6350-FOTA.zip
After you have all the files where they need to be we can get started on the GPT. :silly:
It's a lot I know. My folder is about 70gb. We need all of this to make the Rom.
If you followed along in my previous post then you should have created all the files needed.
If not all the files you need have been posted within those instructional threads.
MAKE SURE YOU HAVE ALL THE FILES
MAKE SURE YOU PUT THEM WHERE THERE NEEDED AS POSTED ABOVE
Getting the GPT Table and Translating it.
We have already done a lot of work I know.
But there is much more to come. And unfortunately it's a little deep.
If you have the above directory structure just follow my instructions here.
#1 Get the GPT Table
Lucky for us we have 2 places we can get the GPT Table.
Coincidently the gpt table is a part of the ruu if you look here it is.
Code:
~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/gpt_main_8g.img
Lets copy that file to the Get-GPT_Info folder.
Code:
cp -rf ~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/gpt_main_8g.img ~/Desktop/526-Completed/Get-GPT_Info/gpt_main_8g.img
Cool That was easy. NO NO unfortunately not.
The question is " IS the gpt_main_8g.img Identical to the GPT on my Device"
"If you are running the ruu posted before on the device now....Maybe" :good:
Lets find out.
Obviously the best place we can get the GPT info is from the GPT Table on the device.
But...But..... :crying:
The commands we need to use don't work well on the device. So how are we gonna do this?
Use Linux To get the GPT from the EMMC Backup Image File
Yes, the dd copy of the device EMMC that we made is a Block by Block copy.
This means it is a Identical clone of the memory on the device.
Luckily the GPT table is the first 17407 bytes of the image.
Run this command to copy the partition table from the device backup image we created before.
Code:
dd if=~/Desktop/526-Completed/A13-Backup/EMMC-Image/526-EMMC-Complete.img of=~/Desktop/526-Completed/Get-GPT_Info/526-EMMC-GPT.bin bs=1 count=17407
Now we have 2 complete partition tables for our device.
You can find them here.
Code:
~/Desktop/526-Completed/Get-GPT_Info/gpt_main_8g.img
~/Desktop/526-Completed/Get-GPT_Info/526-EMMC-GPT.bin
:laugh: Now What