Develop Bugs

Easily flashing H815 bootloder with dd?

I've bought an Italian TIM branded H815, got root access through send_command.exe exploit, and within the root shell I got, I've made a backup of the system and "cust" (the branding) partitions; then downloaded the image, injected root and used dd to overwrite the sytem partition with the rooted one.
After that, I've disabled OTAs, installed ssh server (dropbear), removed TIM branding and put back the stock unbranded stuff, removed all the bloatware, changed the dialer with the one shipped with the lollipop nexus 5 and everything works very nicely.
That's when, while exploring the partitions, I've found that the recovery seems to be in /dev/block/mmcblk0p39.
Being the bootloader still locked (and I'd like to keep it that way), I was pretty sure I couldn't write to the partition, BUT I've run dd to fetch the first bytes of the partition, wrote that to a file, and flashed the file back, overwriting what was there. *So, it was possible*.
Here's what I've done:
dd if=/dev/block/platform/f9824900.sdhci/by-name/recovery bs=1 count=70 of=/sdcard/recovery.partial.img
dd of=/dev/block/platform/f9824900.sdhci/by-name/recovery if=/sdcard/recovery.partial.img
Now here're the questions:
- What would happen if I would just write TWRP through dd over the partition from the running system? (ex.: dd if=/sdcard/twrp.img bs=8192 of=/dev/block/mmcblk0p39)... it seems I wouldn't be blocked by anything in doing so!
- Can you see my very same partitions inside the directory /dev/block/platform/f9824900.sdhci/by-name/ ? (at the end of the post the node listing) -- in case you can't, I've tought they could be useful to you to determine where they are in first place: I've read of people that couldn't find the node "recovery", thus couldn't write to it. Anyway, in that case, there are some tools to explore drive images in GPT form like testdisk and they could be used to find the location of that partition and write over it through dd using the "seek=" parameter.
- In case you already know all that, I presume there is a protection system that runs a checksum of the recovery partition on boot and would argue "hey, what's that? here, eat this bootloop!", otherwise I really can't imagine why I can't change the bootloader.
Thanks in advance!
Alessio
PS, here are the GPT partitions:
Code:
lrwxrwxrwx 1 root root 21 Jan 4 2015 DDR -> /dev/block/mmcblk0p30
lrwxrwxrwx 1 root root 20 Jan 4 2015 aboot -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root root 21 Jan 4 2015 abootbak -> /dev/block/mmcblk0p14
lrwxrwxrwx 1 root root 21 Jan 4 2015 apdp -> /dev/block/mmcblk0p18
lrwxrwxrwx 1 root root 21 Jan 4 2015 boot -> /dev/block/mmcblk0p38
lrwxrwxrwx 1 root root 21 Jan 4 2015 cache -> /dev/block/mmcblk0p49
lrwxrwxrwx 1 root root 21 Jan 4 2015 cust -> /dev/block/mmcblk0p48
lrwxrwxrwx 1 root root 21 Jan 4 2015 devinfo -> /dev/block/mmcblk0p17
lrwxrwxrwx 1 root root 21 Jan 4 2015 dpo -> /dev/block/mmcblk0p20
lrwxrwxrwx 1 root root 21 Jan 4 2015 drm -> /dev/block/mmcblk0p40
lrwxrwxrwx 1 root root 21 Jan 4 2015 eksst -> /dev/block/mmcblk0p33
lrwxrwxrwx 1 root root 21 Jan 4 2015 encrypt -> /dev/block/mmcblk0p32
lrwxrwxrwx 1 root root 21 Jan 4 2015 factory -> /dev/block/mmcblk0p43
lrwxrwxrwx 1 root root 21 Jan 4 2015 fota -> /dev/block/mmcblk0p44
lrwxrwxrwx 1 root root 21 Jan 4 2015 fsc -> /dev/block/mmcblk0p27
lrwxrwxrwx 1 root root 21 Jan 4 2015 fsg -> /dev/block/mmcblk0p26
lrwxrwxrwx 1 root root 21 Jan 4 2015 grow -> /dev/block/mmcblk0p51
lrwxrwxrwx 1 root root 20 Jan 4 2015 hyp -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root root 21 Jan 4 2015 hypbak -> /dev/block/mmcblk0p12
lrwxrwxrwx 1 root root 21 Jan 4 2015 keystore -> /dev/block/mmcblk0p29
lrwxrwxrwx 1 root root 21 Jan 4 2015 laf -> /dev/block/mmcblk0p37
lrwxrwxrwx 1 root root 21 Jan 4 2015 limits -> /dev/block/mmcblk0p16
lrwxrwxrwx 1 root root 21 Jan 4 2015 misc -> /dev/block/mmcblk0p22
lrwxrwxrwx 1 root root 20 Jan 4 2015 modem -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 root root 21 Jan 4 2015 modemst1 -> /dev/block/mmcblk0p24
lrwxrwxrwx 1 root root 21 Jan 4 2015 modemst2 -> /dev/block/mmcblk0p25
lrwxrwxrwx 1 root root 21 Jan 4 2015 mpt -> /dev/block/mmcblk0p42
lrwxrwxrwx 1 root root 21 Jan 4 2015 msadp -> /dev/block/mmcblk0p19
lrwxrwxrwx 1 root root 21 Jan 4 2015 persist -> /dev/block/mmcblk0p23
lrwxrwxrwx 1 root root 21 Jan 4 2015 persistent -> /dev/block/mmcblk0p35
lrwxrwxrwx 1 root root 20 Jan 4 2015 pmic -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root root 21 Jan 4 2015 pmicbak -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root root 21 Jan 4 2015 raw_resources -> /dev/block/mmcblk0p45
lrwxrwxrwx 1 root root 21 Jan 4 2015 raw_resourcesbak -> /dev/block/mmcblk0p46
lrwxrwxrwx 1 root root 21 Jan 4 2015 rct -> /dev/block/mmcblk0p34
lrwxrwxrwx 1 root root 21 Jan 4 2015 recovery -> /dev/block/mmcblk0p39
lrwxrwxrwx 1 root root 20 Jan 4 2015 rpm -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root root 21 Jan 4 2015 rpmbak -> /dev/block/mmcblk0p13
lrwxrwxrwx 1 root root 20 Jan 4 2015 sbl1 -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root root 20 Jan 4 2015 sbl1bak -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root root 20 Jan 4 2015 sdi -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root root 21 Jan 4 2015 sdibak -> /dev/block/mmcblk0p15
lrwxrwxrwx 1 root root 21 Jan 4 2015 sec -> /dev/block/mmcblk0p31
lrwxrwxrwx 1 root root 21 Jan 4 2015 sns -> /dev/block/mmcblk0p41
lrwxrwxrwx 1 root root 21 Jan 4 2015 spare1 -> /dev/block/mmcblk0p21
lrwxrwxrwx 1 root root 21 Jan 4 2015 spare2 -> /dev/block/mmcblk0p36
lrwxrwxrwx 1 root root 21 Jan 4 2015 ssd -> /dev/block/mmcblk0p28
lrwxrwxrwx 1 root root 21 Jan 4 2015 system -> /dev/block/mmcblk0p47
lrwxrwxrwx 1 root root 20 Jan 4 2015 tz -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root root 21 Jan 4 2015 tzbak -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 root root 21 Jan 4 2015 userdata -> /dev/block/mmcblk0p50

you can write to any partition.. bootloader locked or not.. as long as you have root. but that doesn't mean the newly written partition will actually boot afterwards.
locked bootloader = bootloader checking for valid boot/recovery partition signatures.
if you do not have LG's signing key to sign TWRP or custom boot.img.. then whatever custom image you write to recovery or boot partition will not boot.

Oh, I see, so there's a sort of DRM; nevermind, thanks for your clarification by the way
One last question: do you know if after the bootloader unlock any partition changes? I wonder if I could just change my whole firmware with an unlocked one, but I guess it's IMEI-dependent and an internal cryptochip would notice it and refuse to boot, right?

autoprime said:
you can write to any partition.. bootloader locked or not.. as long as you have root. but that doesn't mean the newly written partition will actually boot afterwards.
locked bootloader = bootloader checking for valid boot/recovery partition signatures.
if you do not have LG's signing key to sign TWRP or custom boot.img.. then whatever custom image you write to recovery or boot partition will not boot.
Click to expand...
Click to collapse
do you think it would work modifying the boot.img ( adding gov , overclocking, etc) using the any kernel method which extracts the img and modify the boot.img and then repacks it..or would that mess with the lg signing

autoprime said:
you can write to any partition.. bootloader locked or not.. as long as you have root. but that doesn't mean the newly written partition will actually boot afterwards.
locked bootloader = bootloader checking for valid boot/recovery partition signatures.
if you do not have LG's signing key to sign TWRP or custom boot.img.. then whatever custom image you write to recovery or boot partition will not boot.
Click to expand...
Click to collapse
What's stopping you from writing to the bootloader partition? Is it encrypted or something?

bigalex said:
... After that, I've disabled OTAs, installed ssh server (dropbear), removed TIM branding and put back the stock unbranded stuff, removed all the bloatware, changed the dialer with the one shipped with the lollipop nexus 5 and everything works very nicely.
Click to expand...
Click to collapse
Could you please outline the steps necessary to exchange the dialer?
Thanks in advance.

@dogroll: The bootloader is signed, so tampering with it will cause a bootloop, or brick the device anyway.
 @Google~Android: Yeah, tampering with about anything will cause the kernel to know your device has been tampered, and it will complain about it in ways I just don't want to know (probably will surprise you with a nice brick).
 @Jens1969: Yeah, and very happy to have been asked it: you can just install the Nexus 5 "Dialer.apk" you can get from any n5 firmware into the /system partition (it can't be installed into /data).
Doing so will cause, however, logcat messages about "hey, I can't find com.google.android.dialer.support library!".
So, you will also need the library, and you can find it in any gapps flashable package (I've used this one for example: CyanogenMod hxxp://d-h.st/dGPA).
The library is called com.google.android.dialer.support.jar and must be placed into /system/framework.
You also need to put the /system/etc/permissions/com.google.android.dialer.support.xml file in place. Once I have a minute, I will make a package for it

bigalex said:
@dogroll: The bootloader is signed, so tampering with it will cause a bootloop, or brick the device anyway.
@Google~Android: Yeah, tampering with about anything will cause the kernel to know your device has been tampered, and it will complain about it in ways I just don't want to know (probably will surprise you with a nice brick).
@Jens1969: Yeah, and very happy to have been asked it: you can just install the Nexus 5 "Dialer.apk" you can get from any n5 firmware into the /system partition (it can't be installed into /data).
Doing so will cause, however, logcat messages about "hey, I can't find com.google.android.dialer.support library!".
So, you will also need the library, and you can find it in any gapps flashable package (I've used this one for example: CyanogenMod hxxp://d-h.st/dGPA).
The library is called com.google.android.dialer.support.jar and must be placed into /system/framework.
You also need to put the /system/etc/permissions/com.google.android.dialer.support.xml file in place. Once I have a minute, I will make a package for it
Click to expand...
Click to collapse
I tried the method found here. But my Google Phone FCs and I can't use it for incoming calls. Since my Bootloader is still locked (don't want to void my warranty), I can't use a Zip package. But I could extract the contents and simply copy files and change permissions.

Jens1969 said:
I tried the method found here. But my Google Phone FCs and I can't use it for incoming calls. Since my Bootloader is still locked (don't want to void my warranty), I can't use a Zip package. But I could extract the contents and simply copy files and change permissions.
Click to expand...
Click to collapse
Yep, that's exactly what I did (and I forgot to mention the permissions thing that caused it to crash).
Did you check logcat to see why was it causing FC?
My bootloder is locked too, but still I was able to replace the dialer, so don't worry!
Just, remember to disable the LG dialer, and since you're there, debloat everything! (first line in the code below)
LG G4 debloat :
Code:
pm disable com.android.contacts;
pm disable com.android.LGSetupWizard;
pm disable com.lge.sizechangable.weather.platform;
pm disable com.lge.launcher2.theme.tim;
pm disable com.lge.cloudhub;
pm disable com.lge.remote.lgairdrive;
pm disable com.lge.eltest;
pm disable com.android.browser;
pm disable com.lge.bioitplatform.sdservice.service;
pm disable com.lge.sizechangable.favoritecontacts;
pm disable com.lge.wapservice;
pm disable com.lge.wfds.service.v3;
pm disable com.lge.gcuv;
pm disable com.lge.sync;
pm disable com.lge.livewallpaper.multiphoto;
pm disable com.lge.concierge;
pm disable com.lge.musicshare;
pm disable com.lge.pcsyncui;
pm disable com.lge.updatecenter;
pm disable com.lge.lgfota.permission;
pm disable com.lge.mlt;
pm disable com.lge.appwidget.dualsimstatus;
pm disable com.lge.sizechangable.musicwidget.widget;
pm disable com.lge.cic.eden.service;
pm disable com.lge.music;
pm disable com.lge.hiddenpersomenu;

autoprime said:
you can write to any partition.. bootloader locked or not.. as long as you have root. but that doesn't mean the newly written partition will actually boot afterwards.
locked bootloader = bootloader checking for valid boot/recovery partition signatures.
if you do not have LG's signing key to sign TWRP or custom boot.img.. then whatever custom image you write to recovery or boot partition will not boot.
Click to expand...
Click to collapse
I had the same question, as I'm sure many others have too, so I'm glad I found this post. So taking this a little further would it be possible to pull the bootloader from an unlocked device and overwrite the bootloader on a locked device? I'm a little unclear on the boot sequence so perhaps this question doesn't make sense. I'm running on the thought that the bootloader is "boot -> /dev/block/mmcblk0p38", or is it actually buried a bit deeper and not part of the file system at all?
Apologies if this has already been discussed in another thread (can be difficult to think of the right magic search phrase)
EDIT: actually it looks like the bootloader is "aboot -> /dev/block/mmcblk0p8"

Unofficial CM 13.0 [MM 6.0.1] Issue - Finding Boot Image

The output of
Code:
[email protected]:/ # ls -l /dev/block/platform/omap/omap_hsmmc.0/by-name/
total 0
lrwxrwxrwx 1 root root 20 2016-05-20 18:17 boot -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root root 21 2016-05-20 18:17 cache -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 root root 20 2016-05-20 18:17 dgs -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root root 20 2016-05-20 18:17 efs -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root root 21 2016-05-20 18:17 metadata -> /dev/block/mmcblk0p13
lrwxrwxrwx 1 root root 20 2016-05-20 18:17 misc -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root root 20 2016-05-20 18:17 param -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root root 20 2016-05-20 18:17 radio -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root root 20 2016-05-20 18:17 recovery -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root root 20 2016-05-20 18:17 sbl -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root root 21 2016-05-20 18:17 system -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root root 21 2016-05-20 18:17 userdata -> /dev/block/mmcblk0p12
lrwxrwxrwx 1 root root 20 2016-05-20 18:17 xloader -> /dev/block/mmcblk0p1
says boot is
Code:
mmcblk0p7
but when unpacked, changed, and flashed to boot, I load up into CWM Recovery, when the recovery partition is clearly
Code:
mmcblk0p8
.
Am I doing something wrong? Is the (insert non-n00b word here) skipping the boot partition?

[GUIDE][GT-I9192][stuck at splash] how to get your data back

This is how I got my data from my GT-I9192 with TWRP and CM13. I don't know if it works for the other GT-I91XX models or with other firmware, but if you are in a similar situation like me it is worth a try.
Background:
I installed Cyanogenmod 13 and TWRP successfully about two month ago.
About a week ago my phone suddenly was black and did not want to boot at all. I convinced it to restart after pulling battery/recharge cable some times and putting them back, sometimes whilest holding power button pressed at the same time, until it gave a life sign again.
Current situation:
My phone stucks at samsung logo splash screen and reboots.
When trying to boot into recovery (TWRP; VOL.UP+HOME(+POWER)) the TeamWinRecovery logo screen is shown but then reboots.
Download mode (VOL.DOWN+HOME) works, Odin recognizes phone, but flashing TWRP successfully again does not fix anything.
Fastboot and adb do not recognize phone while it is in boot loop/recovery start loop/download mode!
But the interesting part is:
I am able to get via adb shell onto the phone while it is offline! Pull battery, put it back again, connect the phone via USB to PC and leave it off. Battery charging screen shows up and about a minute later adb shell is possible. It is in a strange state then, neither sdcard nor any else partition besides system is mounted, but mounting sdcard and data partition manually is possible.
Required:
Installed Samsung drivers, downloaded ADB tools, CM13(?), root enabled for adb.
make sure phone is off (pull battery/cable, put it back again)
connect phone via usb to pc
at pc cmd type
Code:
adb wait-for-device
when prompt is back, type
Code:
adb shell
use the commands below to get to your data
list internal partitions by name:
Code:
ls -l /dev/block/platform/msm_sdcc.1/by-name
output:
Code:
total 0
lrwxrwxrwx 1 root root 20 1970-01-01 00:00 aboot -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root root 21 1970-01-01 00:00 backup -> /dev/block/mmcblk0p16
lrwxrwxrwx 1 root root 21 1970-01-01 00:00 boot -> /dev/block/mmcblk0p13
lrwxrwxrwx 1 root root 21 1970-01-01 00:00 cache -> /dev/block/mmcblk0p22
lrwxrwxrwx 1 root root 21 1970-01-01 00:00 efs -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root root 21 1970-01-01 00:00 fota -> /dev/block/mmcblk0p15
lrwxrwxrwx 1 root root 21 1970-01-01 00:00 fsg -> /dev/block/mmcblk0p17
lrwxrwxrwx 1 root root 21 1970-01-01 00:00 hidden -> /dev/block/mmcblk0p23
lrwxrwxrwx 1 root root 20 1970-01-01 00:00 modem -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 root root 21 1970-01-01 00:00 modemst1 -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 root root 21 1970-01-01 00:00 modemst2 -> /dev/block/mmcblk0p12
lrwxrwxrwx 1 root root 20 1970-01-01 00:00 pad -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root root 20 1970-01-01 00:00 param -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root root 21 1970-01-01 00:00 persdata -> /dev/block/mmcblk0p20
lrwxrwxrwx 1 root root 21 1970-01-01 00:00 persist -> /dev/block/mmcblk0p19
lrwxrwxrwx 1 root root 21 1970-01-01 00:00 recovery -> /dev/block/mmcblk0p14
lrwxrwxrwx 1 root root 20 1970-01-01 00:00 rpm -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root root 20 1970-01-01 00:00 sbl1 -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root root 20 1970-01-01 00:00 sbl2 -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root root 20 1970-01-01 00:00 sbl3 -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root root 21 1970-01-01 00:00 ssd -> /dev/block/mmcblk0p18
lrwxrwxrwx 1 root root 21 1970-01-01 00:00 system -> /dev/block/mmcblk0p21
lrwxrwxrwx 1 root root 20 1970-01-01 00:00 tz -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root root 21 1970-01-01 00:00 userdata -> /dev/block/mmcblk0p24 [COLOR="red"]<<< there is your userdata[/COLOR]
list all partitions with size:
Code:
cat /proc/partitions
output:
Code:
major minor #blocks name
179 0 7634944 mmcblk0
179 1 61440 mmcblk0p1
179 2 128 mmcblk0p2
179 3 256 mmcblk0p3
179 4 512 mmcblk0p4
179 5 2048 mmcblk0p5
179 6 512 mmcblk0p6
179 7 512 mmcblk0p7
179 8 12800 mmcblk0p8
179 9 8192 mmcblk0p9
179 10 13952 mmcblk0p10
179 11 3072 mmcblk0p11
179 12 3072 mmcblk0p12
179 13 10240 mmcblk0p13
179 14 10240 mmcblk0p14
179 15 10240 mmcblk0p15
179 16 7160 mmcblk0p16
179 17 3072 mmcblk0p17
179 18 8 mmcblk0p18
179 19 8192 mmcblk0p19
179 20 12288 mmcblk0p20
179 21 1536000 mmcblk0p21
179 22 204800 mmcblk0p22
179 23 36864 mmcblk0p23
179 24 5685231 mmcblk0p24 [COLOR="red"]<<< userdata partition has about 5.7 GB size[/COLOR]
179 32 30703616 mmcblk1
179 33 30703582 mmcblk1p1 [COLOR="red"]<<< this is your external sdcard partition[/COLOR]
get partition format
Code:
blkid
output:
Code:
/dev/block/mmcblk0p1: SEC_TYPE="msdos" UUID="00BC-614E" TYPE="vfat"
/dev/block/mmcblk0p10: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
/dev/block/mmcblk0p19: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
/dev/block/mmcblk0p20: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
/dev/block/mmcblk0p21: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
/dev/block/mmcblk0p22: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
/dev/block/mmcblk0p23: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4"
/dev/block/mmcblk0p24: UUID="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" TYPE="ext4" [COLOR="Red"]<<< userdata has ext4 format[/COLOR]
/dev/block/mmcblk1p1: UUID="02A3-21FE" LABEL="Volume" TYPE="exfat" [COLOR="Red"]<<< external sdcard has exfat format[/COLOR]
get currently mounted partitions
Code:
mount
output:
Code:
rootfs on / type rootfs (rw,seclabel)
tmpfs on /dev type tmpfs (rw,seclabel,nosuid,relatime,mode=755)
devpts on /dev/pts type devpts (rw,seclabel,relatime,mode=600)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,seclabel,relatime)
selinuxfs on /sys/fs/selinux type selinuxfs (rw,relatime)
/sys/kernel/debug on /sys/kernel/debug type debugfs (rw,seclabel,relatime)
none on /acct type cgroup (rw,relatime,cpuacct)
none on /sys/fs/cgroup type tmpfs (rw,seclabel,relatime,mode=750,gid=1000)
none on /sys/fs/cgroup/memory type cgroup (rw,relatime,memory)
tmpfs on /mnt type tmpfs (rw,seclabel,relatime,mode=755,gid=1000)
none on /dev/memcg type cgroup (rw,relatime,memory)
none on /dev/cpuctl type cgroup (rw,relatime,cpu)
none on /sys/fs/cgroup/bfqio type cgroup (rw,relatime,bfqio)
/dev/block/mmcblk0p21 on /system type ext4 (ro,seclabel,relatime,data=ordered)
neither data nor external sdcard is mounted
mount your external sdcard
Code:
mkdir /mnt/sdext
mount /dev/block/mmcblk1p1 /mnt/sdext
extract your data partition as image to your sdcard
Code:
dd if=/dev/block/mmcblk0p24 of=/mnt/sdext/userdata.img
important info: as your data partition is larger than 4GB, you can only put the whole image to your sdcard if it is in exFat or NTFS format (fat32 does not allow files larger than 4GB). You could copy the image splitted like follows:
Code:
dd if=/dev/block/mmcblk0p24 of=/mnt/sdext/userdata_1.img count=4000000
dd if=/dev/block/mmcblk0p24 of=/mnt/sdext/userdata_2.img skip=4000000
copy your images later to pc and put it together in windows cmd with
Code:
copy /B userdata_1.img + userdata_2.img userdata.img
Not tested though.
look if there is enough space on your external sdcard
Code:
df -H
H=human readable sizes with 1000 based system; use no option to list number of 1k blocks; use -P do list 512byte blocks, usefull as dd uses same block size per default
output:
Code:
Filesystem Size Used Avail Use% Mounted on
tmpfs 708M 41k 708M 1% /dev
none 708M 0 708M 0% /sys/fs/cgroup
tmpfs 708M 0 708M 0% /mnt
/dev/block/mmcblk0p21 1.5G 986M 562M 64% /system
/dev/block/mmcblk0p24 [COLOR="red"]5.7G[/COLOR] 5.3G 423M 93% /mnt/userdata
/dev/block/mmcblk1p1 31G 14G [COLOR="red"]18G[/COLOR] 44% /mnt/sdext
or mount your internal data partition as well and copy only the data you need
Code:
mkdir /mnt/userdata
mount /dev/block/mmcblk0p24 /mnt/userdata
use cd and ls -al commands to find your desired data;
in a secondary cmd at your pc copy directly to your pc via e.g. (contacts, sms, photos, TWRP backup, ...)
Code:
adb pull /mnt/userdata/data/com.android.providers.contacts/databases/contacts2.db
adb pull /mnt/userdata/data/com.android.providers.telephony/databases/mmssms.db
adb pull /mnt/userdata/media/0/DCIM
adb pull /mnt/userdata/media/0/TWRP
However, copying whole directories often failed and resulted in reboot of phone...
So, what to do with this image?
Mounting it in windows as new drive worked very well with OSFMount. As windows can not read ext4 partitions, you might want to install a ext4 driver like ext2fsd. And there is your data. Interesting folders are /media/0 where your internal sdcard data (like photos) resides and /data where all your apps store its data. You can find your contacts here /data/com.android.providers.contacts/databases/contacts2.db and your SMS here /data/com.android.providers.telephony/databases/mmssms.db. You can copy this databases to your new phone or inspect them via sqlite3.exe from your Android Development Tools. Here is a macro that could convert your contacts to vcard.
Credits:
Many of these information can be found at various xda threads, i do not remember all threads where I got which information from. Everything here was written from mind. Google and Wikipedia is also helpfull when it comes to command details. However this thread contains also most of the commands i showed above. This thread might give some inspirations about reading ext4 partition images under windows. If you feel that another thread has to be mentioned here, please write a message and I'll add it.

Thank you for this clarify guide. I try it even if my phone isn't bricked.
GT-I9190 cihazımdan Tapatalk kullanılarak gönderildi

Can´t boot any ROM

Hi.
I get a Nexus 7 2013. Problem is, it will not boot any rom.
Fastboot, TWRP, flash rom or factory image works fine, but i will bootloop every time with any rom.
Tried with CM14.1, CM13, AOSP, latest factory image and first factory image.
Someone has an idea? Can i log the boot somehow?

baggerbodo said:
Hi.
I get a Nexus 7 2013. Problem is, it will not boot any rom.
Fastboot, TWRP, flash rom or factory image works fine, but i will bootloop every time with any rom.
Tried wich CM14.1, CM13, AOSP, latest factory image and first factory image.
Someone has an idea? Can i log the boot somehow?
Click to expand...
Click to collapse
Hello, I think I know the problem but let's see some logs first. Start your OS and on the next bootloop turn it off and as quickly as possible turn it back on to TWRP recovery. The off/on must happen within max 2 seconds in order to preserve last_kmsg in RAM intact. Then while in TWRP attach an OTG USB drive with my get-logs.zip on it, 'install' it and post 'logs.tgz' which was created on the flashdrive.
If you don't have an OTG drive/adapter, have a look inside the zip and use ADB to get the logs manually.

That´s crazy. Now i havo no bootloops more but stuck on boot logo.
Anyway, here is my log after 15 minutes boot. (please remove .zip)

The kernel cannot communicate properly with LTE modem and constantly, repeatedly logs this sequence:
Code:
mdm_modem_ioctl: Powering on mdm id 0
mdm_do_soft_power_on: id 0: soft resetting mdm modem
It is either a software/data or hardware issue.
Apart from the 'radio' partition which you have reflashed many times, the modem also needs:
Code:
modemst1 mmcblk0p2 3MB
modemst2 mmcblk0p3 3MB
fsg mmcblk0p8 3MB
These partitions are never flashed from OS and I/we always back them up before any ROM changes on mobile phones.
I don't have the LTE N7 and can't help you if the partitions are corrupt or erased.
As for possible hardware issue I note on the pictures antenna sockets, so the modem seems to be next to SIM card reader on the daughterboard PCB. If so, then the fix is very simple. The wide silver flex cable which connects both PCBs is notoriously unreliable and needs to be re-seated on both connectors. I'd bet on it :fingers-crossed:

So you think i need a complete system dump?
Here are my partitiones.
Code:
179 0 30539776 mmcblk0
179 1 87536 mmcblk0p1
179 2 3072 mmcblk0p2
179 3 3072 mmcblk0p3
179 4 15000 mmcblk0p4
179 5 780 mmcblk0p5
179 6 780 mmcblk0p6
179 7 780 mmcblk0p7
179 8 3072 mmcblk0p8
179 9 1500 mmcblk0p9
179 10 1500 mmcblk0p10
179 11 2048 mmcblk0p11
179 12 5120 mmcblk0p12
179 13 512 mmcblk0p13
179 14 16384 mmcblk0p14
179 15 512 mmcblk0p15
179 16 1 mmcblk0p16
179 17 1500 mmcblk0p17
179 18 2048 mmcblk0p18
179 19 5120 mmcblk0p19
179 20 512 mmcblk0p20
179 21 512 mmcblk0p21
179 22 860160 mmcblk0p22
179 23 573440 mmcblk0p23
179 24 1024 mmcblk0p24
179 25 10240 mmcblk0p25
179 26 8 mmcblk0p26
179 27 8 mmcblk0p27
179 28 1 mmcblk0p28
179 29 32 mmcblk0p29
179 30 28180463 mmcblk0p30
Code:
drwxr-xr-x 2 root root 640 Jan 1 00:02 .
drwxr-xr-x 4 root root 700 Jan 1 00:02 ..
lrwxrwxrwx 1 root root 21 Jan 1 00:02 DDR -> /dev/block/mmcblk0p26
lrwxrwxrwx 1 root root 21 Jan 1 00:02 aboot -> /dev/block/mmcblk0p12
lrwxrwxrwx 1 root root 21 Jan 1 00:02 abootb -> /dev/block/mmcblk0p19
lrwxrwxrwx 1 root root 21 Jan 1 00:02 boot -> /dev/block/mmcblk0p14
lrwxrwxrwx 1 root root 21 Jan 1 00:02 cache -> /dev/block/mmcblk0p23
lrwxrwxrwx 1 root root 20 Jan 1 00:02 fsg -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root root 20 Jan 1 00:02 m9kefs1 -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root root 20 Jan 1 00:02 m9kefs2 -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root root 20 Jan 1 00:02 m9kefs3 -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root root 21 Jan 1 00:02 m9kefsc -> /dev/block/mmcblk0p28
lrwxrwxrwx 1 root root 21 Jan 1 00:02 metadata -> /dev/block/mmcblk0p29
lrwxrwxrwx 1 root root 21 Jan 1 00:02 misc -> /dev/block/mmcblk0p24
lrwxrwxrwx 1 root root 20 Jan 1 00:02 modemst1 -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root root 20 Jan 1 00:02 modemst2 -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root root 21 Jan 1 00:02 pad -> /dev/block/mmcblk0p16
lrwxrwxrwx 1 root root 20 Jan 1 00:02 persist -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root root 20 Jan 1 00:02 radio -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 root root 21 Jan 1 00:02 recovery -> /dev/block/mmcblk0p25
lrwxrwxrwx 1 root root 21 Jan 1 00:02 rpm -> /dev/block/mmcblk0p13
lrwxrwxrwx 1 root root 21 Jan 1 00:02 rpmb -> /dev/block/mmcblk0p20
lrwxrwxrwx 1 root root 20 Jan 1 00:02 sbl1 -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root root 21 Jan 1 00:02 sbl2 -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root root 21 Jan 1 00:02 sbl2b -> /dev/block/mmcblk0p17
lrwxrwxrwx 1 root root 21 Jan 1 00:02 sbl3 -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 root root 21 Jan 1 00:02 sbl3b -> /dev/block/mmcblk0p18
lrwxrwxrwx 1 root root 21 Jan 1 00:02 ssd -> /dev/block/mmcblk0p27
lrwxrwxrwx 1 root root 21 Jan 1 00:02 system -> /dev/block/mmcblk0p22
lrwxrwxrwx 1 root root 21 Jan 1 00:02 tz -> /dev/block/mmcblk0p15
lrwxrwxrwx 1 root root 21 Jan 1 00:02 tzb -> /dev/block/mmcblk0p21
lrwxrwxrwx 1 root root 21 Jan 1 00:02 userdata -> /dev/block/mmcblk0p30
Now i get bootloops again, please have a look in my logs.

baggerbodo said:
So you think i need a complete system dump?
Now i get bootloops again, please have a look in my logs.
Click to expand...
Click to collapse
I think you need to check the cable first.
The new logs don't offer more insights but if you are successful in capturing logcat during bootloop it would be very interesting:
http://forum.xda-developers.com/general/xda-university/universal-test-rom-build-didnt-boot-t3258818
http://forum.xda-developers.com/showpost.php?p=47172724

Mi A2 Lite boots only on slot B

I have a problem with my Mi A2 Lite.
I have installed the Lineage OS ROM: https://forum.xda-developers.com/mi-a2-lite/development/lineageos-16-0-xiaomi-mi-a2-lite-t3919060
It seems that works only one slot, the slot B.
I flash the updates of the rom following this guide: https://github.com/tkchn/daisyinstall/blob/master/README.md
If the active slot is the slot B, when I install an update of the rom in the slot A and then change the active slot to slot A in TWRP, then reboot and the phone goes in bootloop with the androidone logo.
Then I reboot the phone holding the power button, boot to fastboot and boot to recovery.
As this point I repeat the whole process, flashing the rom to slot B and changing the active slot to slot B and now if I reboot the phone all work.
I had this problem with all the updates that I have done.

You have probably different firmware versions on each partition. You can fix that by writing the B partitions into the A ones.
Go to twrp, and through either 'adb shell' or the recovery shell:
Code:
su
dd if=/dev/block/mmcblk0p32 of=/dev/block/mmcblk0p31
dd if=/dev/block/mmcblk0p27 of=/dev/block/mmcblk0p26
dd if=/dev/block/mmcblk0p25 of=/dev/block/mmcblk0p24
dd if=/dev/block/mmcblk0p14 of=/dev/block/mmcblk0p13
dd if=/dev/block/mmcblk0p45 of=/dev/block/mmcblk0p44
dd if=/dev/block/mmcblk0p29 of=/dev/block/mmcblk0p28
dd if=/dev/block/mmcblk0p48 of=/dev/block/mmcblk0p47
dd if=/dev/block/mmcblk0p55 of=/dev/block/mmcblk0p54
dd if=/dev/block/mmcblk0p20 of=/dev/block/mmcblk0p19
dd if=/dev/block/mmcblk0p18 of=/dev/block/mmcblk0p17
dd if=/dev/block/mmcblk0p59 of=/dev/block/mmcblk0p58
You should have exactly similar A/B partitions after this (except for system and boot, the ones updated), and there should be no problem.

With custom rom...
Install the rom , TWRP and disable encryption in slot A
Install gapps, magisk, kernel, etc in slot B
The device only boots in B slot
In stock rom boots in A slot
Its ok

GDFI said:
You have probably different firmware versions on each partition. You can fix that by writing the B partitions into the A ones.
Go to twrp, and through either 'adb shell' or the recovery shell:
Code:
su
dd if=/dev/block/mmcblk0p32 of=/dev/block/mmcblk0p31
dd if=/dev/block/mmcblk0p27 of=/dev/block/mmcblk0p26
dd if=/dev/block/mmcblk0p25 of=/dev/block/mmcblk0p24
dd if=/dev/block/mmcblk0p14 of=/dev/block/mmcblk0p13
dd if=/dev/block/mmcblk0p45 of=/dev/block/mmcblk0p44
dd if=/dev/block/mmcblk0p29 of=/dev/block/mmcblk0p28
dd if=/dev/block/mmcblk0p48 of=/dev/block/mmcblk0p47
dd if=/dev/block/mmcblk0p55 of=/dev/block/mmcblk0p54
dd if=/dev/block/mmcblk0p20 of=/dev/block/mmcblk0p19
dd if=/dev/block/mmcblk0p18 of=/dev/block/mmcblk0p17
dd if=/dev/block/mmcblk0p59 of=/dev/block/mmcblk0p58
You should have exactly similar A/B partitions after this (except for system and boot, the ones updated), and there should be no problem.
Click to expand...
Click to collapse
Thank you very much @GDFI!
Probably I have android 8 in slot A and android 9 in slot B.
I will try to do this. Will all my data and settings survive this?
For knowledge, is there a list to understand what mmcblk**** partitions match?
leechgid said:
With custom rom...
Install the rom , TWRP and disable encryption in slot A
Install gapps, magisk, kernel, etc in slot B
The device only boots in B slot
In stock rom boots in A slot
Its ok
Click to expand...
Click to collapse
I don't understand, can you explain better?

I found how to see the list of partitions of the Mi A2 Lite:
Code:
daisy:/ # ls -l /dev/block/platform/soc/7824900.sdhci/by-name/
total 0
lrwxrwxrwx 1 root root 20 1970-05-16 13:21 DDR -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 aboot_a -> /dev/block/mmcblk0p31
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 aboot_b -> /dev/block/mmcblk0p32
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 apdp -> /dev/block/mmcblk0p15
lrwxrwxrwx 1 root root 20 1970-05-16 13:21 bk1 -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root root 20 1970-05-16 13:21 bk2 -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 bk3 -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 bk4 -> /dev/block/mmcblk0p34
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 bk5 -> /dev/block/mmcblk0p42
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 bk6 -> /dev/block/mmcblk0p46
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 boot_a -> /dev/block/mmcblk0p51
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 boot_b -> /dev/block/mmcblk0p52
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 cmnlib64_a -> /dev/block/mmcblk0p26
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 cmnlib64_b -> /dev/block/mmcblk0p27
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 cmnlib_a -> /dev/block/mmcblk0p24
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 cmnlib_b -> /dev/block/mmcblk0p25
lrwxrwxrwx 1 root root 20 1970-05-16 13:21 config -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 devcfg_a -> /dev/block/mmcblk0p13
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 devcfg_b -> /dev/block/mmcblk0p14
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 devinfo -> /dev/block/mmcblk0p38
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 dip -> /dev/block/mmcblk0p33
lrwxrwxrwx 1 root root 20 1970-05-16 13:21 dpo -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 dsp_a -> /dev/block/mmcblk0p44
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 dsp_b -> /dev/block/mmcblk0p45
lrwxrwxrwx 1 root root 20 1970-05-16 13:21 fsc -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 fsg -> /dev/block/mmcblk0p39
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 keymaster_a -> /dev/block/mmcblk0p28
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 keymaster_b -> /dev/block/mmcblk0p29
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 keystore -> /dev/block/mmcblk0p22
lrwxrwxrwx 1 root root 20 1970-05-16 13:21 limits -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 lksecapp -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 lksecappbak -> /dev/block/mmcblk0p12
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 logdump -> /dev/block/mmcblk0p53
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 mcfg -> /dev/block/mmcblk0p37
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 mdtp_a -> /dev/block/mmcblk0p47
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 mdtp_b -> /dev/block/mmcblk0p48
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 misc -> /dev/block/mmcblk0p30
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 modem_a -> /dev/block/mmcblk0p54
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 modem_b -> /dev/block/mmcblk0p55
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 modemst1 -> /dev/block/mmcblk0p40
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 modemst2 -> /dev/block/mmcblk0p41
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 mota -> /dev/block/mmcblk0p21
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 msadp -> /dev/block/mmcblk0p16
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 persist -> /dev/block/mmcblk0p49
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 persistbak -> /dev/block/mmcblk0p50
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 rpm_a -> /dev/block/mmcblk0p19
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 rpm_b -> /dev/block/mmcblk0p20
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 sbl1_a -> /dev/block/mmcblk0p17
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 sbl1_b -> /dev/block/mmcblk0p18
lrwxrwxrwx 1 root root 20 1970-05-16 13:21 sec -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 splash -> /dev/block/mmcblk0p43
lrwxrwxrwx 1 root root 20 1970-05-16 13:21 ssd -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 syscfg -> /dev/block/mmcblk0p23
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 system_a -> /dev/block/mmcblk0p56
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 system_b -> /dev/block/mmcblk0p57
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 tz_a -> /dev/block/mmcblk0p35
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 tz_b -> /dev/block/mmcblk0p36
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 userdata -> /dev/block/mmcblk0p60
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 vendor_a -> /dev/block/mmcblk0p58
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 vendor_b -> /dev/block/mmcblk0p59
@GDFI You have omitted three partitions: system, boot, tz.
I understand system and boot, but what is the tz partition?
Should not be copied?
Code:
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 tz_a -> /dev/block/mmcblk0p35
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 tz_b -> /dev/block/mmcblk0p36

epcesp said:
@GDFI You have omitted three partitions: system, boot, tz.
I understand system and boot, but what is the tz partition?
Should not be copied?
Code:
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 tz_a -> /dev/block/mmcblk0p35
lrwxrwxrwx 1 root root 21 1970-05-16 13:21 tz_b -> /dev/block/mmcblk0p36
Click to expand...
Click to collapse
Sorry I omitted the TZ partition by error, it must be copied from b to a too. (not important here but if you want to have an idea about every partition "role" : https://forum.xda-developers.com/android/general/info-android-device-partitions-basic-t3586565 )
For the boot and system partitions, you can also flash them from the B slot to the A one if you want, but when you flash an update from the B slot, the new system.img and boot.img from the update will be flashed into the A partitions ; so there's no absolute need to copy them manually unless you want to try booting from the A slot without updating. (I hope I am somehow clear lol )
Oh and it won't affect your data at all!

GDFI said:
Sorry I omitted the TZ partition by error, it must be copied from b to a too. (not important here but if you want to have an idea about every partition "role" : https://forum.xda-developers.com/android/general/info-android-device-partitions-basic-t3586565 )
For the boot and system partitions, you can also flash them from the B slot to the A one if you want, but when you flash an update from the B slot, the new system.img and boot.img from the update will be flashed into the A partitions ; so there's no absolute need to copy them manually unless you want to try booting from the A slot without updating. (I hope I am somehow clear lol )
Oh and it won't affect your data at all!
Click to expand...
Click to collapse
Thanks, you were very clear!
Definitely, I used these commands:
Code:
su
dd if=/dev/block/mmcblk0p32 of=/dev/block/mmcblk0p31 # aboot_b -> aboot_a
dd if=/dev/block/mmcblk0p52 of=/dev/block/mmcblk0p51 # boot_b -> boot_a
dd if=/dev/block/mmcblk0p27 of=/dev/block/mmcblk0p26 # cmnlib64_b -> cmnlib64_a
dd if=/dev/block/mmcblk0p25 of=/dev/block/mmcblk0p24 # cmnlib_b -> cmnlib_a
dd if=/dev/block/mmcblk0p14 of=/dev/block/mmcblk0p13 # devcfg_b -> devcfg_a
dd if=/dev/block/mmcblk0p45 of=/dev/block/mmcblk0p44 # dsp_b -> dsp_a
dd if=/dev/block/mmcblk0p29 of=/dev/block/mmcblk0p28 # keymaster_b -> keymaster_a
dd if=/dev/block/mmcblk0p48 of=/dev/block/mmcblk0p47 # mdtp_b -> mdtp_a
dd if=/dev/block/mmcblk0p55 of=/dev/block/mmcblk0p54 # modem_b -> modem_a
dd if=/dev/block/mmcblk0p20 of=/dev/block/mmcblk0p19 # rpm_b -> rpm_a
dd if=/dev/block/mmcblk0p18 of=/dev/block/mmcblk0p17 # sbl1_b -> sbl1_a
dd if=/dev/block/mmcblk0p57 of=/dev/block/mmcblk0p56 # system_b -> system_a
dd if=/dev/block/mmcblk0p36 of=/dev/block/mmcblk0p35 # tz_b -> tz_a
dd if=/dev/block/mmcblk0p59 of=/dev/block/mmcblk0p58 # vendor_b -> vendor_a
Now I have to wait the next update to see if it works.
I have a doubt, if the custom roms only change the system and boot partitions, does that mean that without having the original rom the other partitions will no longer be updated?

epcesp said:
Now I have to wait the next update to see if it works.
I have a doubt, if the custom roms only change the system and boot partitions, does that mean that without having the original rom the other partitions will no longer be updated?
Click to expand...
Click to collapse
Nice!
Yep, the custom roms rely on stock vendor, modem etc... and if you install one on the top of 10.0.0.3 stock for example, the vendor, modem, about, and other partitions will keep the same version and won't be updated with the custom rom updates.
You can update them manually by flashing newer images of those partitions (that can be extracted from ota updates), as long as the new version is still compatible with the rom ; for example a custom rom made to be compatible with an Oreo vendor may not work if the vendor is updated to its Pie version (The vendor having an Oreo version in the slot A might be the reason you couldn't boot :v ). Some developers recommend to use certain versions sometimes.
In short, those partitions won't be updated unless you want to do it manually

Clear, but if I want to update to latest version, mantaining my data and my rom, which partitions should I flash?
All except system and boot?

Yes, you flash everything except system and boot.
But one important thing is : if you have disabled encryption, flashing an update of vendor partition will re-enable forced encryption, so you would need to go to TWRP just after flashing and install Encryption disabler zip BEFORE the first boot, otherwise your data would be encrypted directly after first booting.

I made an update of the rom and now the phone works also in slot a, thanks @GDFI!
GDFI said:
Yes, you flash everything except system and boot.
But one important thing is : if you have disabled encryption, flashing an update of vendor partition will re-enable forced encryption, so you would need to go to TWRP just after flashing and install Encryption disabler zip BEFORE the first boot, otherwise your data would be encrypted directly after first booting.
Click to expand...
Click to collapse
What happens if I have my data already encrypted? I encrypted the phone from android settings.
When I installed the rom for the first time I flashed also force encryption disabled, as reported in the installation guide. Then in the rom from android security settings I encrypted the phone.
I'm not very sure about the purpouse of force encryption disabler.

epcesp said:
What happens if I have my data already encrypted? I encrypted the phone from android settings.
When I installed the rom for the first time I flashed also force encryption disabled, as reported in the installation guide. Then in the rom from android security settings I encrypted the phone.
I'm not very sure about the purpouse of force encryption disabler.
Click to expand...
Click to collapse
Happy it worked
Some ROMs don't support encryption, and TWRP especially cannot read encrypted data so most people prefer disable it. Since you're already encrypted, you can ignore the Disabler stuff!

Ok, thank you very much for all the support!