Develop Bugs

[HOWTO] Create a GoldCard - Bypassing the RUU/SPL CID check to Root/Downgrade

If you are stuck on a ROM you don't like (t-mobile/asian carrier etc.) you can use this howto to create a goldcard to bypass the CID checks so you can downgrade and root your Hero.
01. Download QMAT 5.06 here
It’s a demo version so will only run for 10 minutes.
02. Format your SD card to FAT32. Please keep in mind some brands of SD cards do not work.
03. Use adb to run this command: adb shell cat /sys/class/mmc_host/mmc1/mmc1:*/cid
04. Copy the SD card cid code displayed after the adb command.
05. Start Qmat and Click on Cyptoanalysis Tools > Crypto Toolbox.
06. Look at the bottom, there is a text box (beside the “Reverse String” button) enter the SD card cid code you got earlier.
Click on the “Reverse String” button, the result is reversed…
Example: 532600bd227d9c0347329407514d5402
07. Copy the reversed SD card cid code.
08. Go to QMAT goldcard site here to generate your goldcard (yes it says for G1 but works for our Hero too).
09. Enter your email. For the correct SD card cid code, you need to replace the first 2 characters to 00.
Example: From “532600bd227d9c0347329407514d5402” to “002600bd227d9c0347329407514d5402”
10. Click Continue and you will receive the goldcard.img in .zip format in your email.
11. Go to your email, download the zip file and save it to a directory and unzip it to goldcard.img
12. Download HxD Hex Editor from here
13. Install and launch HxD Hex Editor program. (make sure you use "Run as Administrator" under Vista and win 7)
14. Go to Extra tab > Open Disk. Under Physical disk, select Removable Disk (Must be your SD card), uncheck “Open as Readonly), click OK.
15. Go to Extra again, Open Disk Image, open up goldcard.img which you’ve saved/unzipped earlier.
Now, you should have two tabs, one is your removable disk, the other is goldcard.img. Press OK when prompted for “Sector Size” 512 (Hard disks/Floppy disks), click OK.
16. Click on goldcard.img tab. Go to Edit tab > Select All, edit tab again > copy.
17. Click on the “removable disk” tab. Select offset 00000000 till offset 00000170 (including the 00000170 line), click on Edit tab and then Paste Write.
18. Click on File > Save. now you can exit the program.
19. Reboot your phone with this SD Card (now GoldCard) inside
20. Use the Official HTC RUU to downgrade to 2.73.405.5 (which you can get here) from which you can fastboot boot and/or root your phone with flashrec.
Done.
Credits:
Original heads up by tangzq with link to this
That site used the XDA Sapphire goldcard howto here
And apparently myself and XDA as this builds on the HTC knowledge from the old days (here)
In any case, enjoy your new found freedom

Holy ****znit it works! Downgrading!!!!!

Hmm. I've followed the guide and successfully skipped the CID lock check of the device and flashed it to version 2.73.405.5 WWE. Problem is, I can't seem to get the device to boot into recovery mode after using flashrec (I did download and flash it just fine). the recovery mode (home + power) booted the device but it hangs at the boot screen where it says HERO. Any idea?
Edit: Ah. a little bit of the update. while the buttons do not work, i can use adb shell reboot recovery; however, after using flashrec, it still shows the old recovery screen ?
Edit2: confirmed, recovery flasher doesn't work now im using the SEA rom
I'll try the RUU_Hero_HTC_WWE_1.76.405.6_WWE_release_signed_NoD river.exe rom later

I had the same issue with Recovery Flasher I couldn't to boot into recovery. I was also unable to downgrade to the 1.7 roms due to a bootloader version error, arghhh. Anywho, managed to work my way round it, i'll explain below. I've got a T-Mobile G2 updated to the latest rom (so no root access).
I first followed the instructions on making a goldcard and then flashed the 2.73.405.5 WWE rom fine.
Now make sure you have the cm-hero-recovery.img (http://content.modaco.net/dropzone/modacopatchedrecovery-1.0.zip) on the root of your sdcard. Aswell as Instant Root (http://neilandtheresa.co.uk/Android/) now install Instant Root on the phone. It should pop up with a notification "instant root was sucessfully" or along those lines. (If you have a problem installing Instant Root make sure Settings>Applications>Unknown Sources is checked)
Instant root then allows for root access with adb shell using the following 2 commands:
1) adb shell
then
2) su
the icon should change from a $ to #.
Now flash the recovery image with the following command:
1) flash_image recovery /sdcard/cm-hero-recovery.img
This shouldn't take that long once completed it will go back the # prompt example below.
# flash_image recovery /sdcard/cm-hero-recovery.img (I typed this)
flash_image recovery /sdcard/cm-hero-recovery.img (this pops up)
# (this shows the flash completed)
Now pull out your usb cable and battery, turn on the phone with the battery in place while holding the home button and it should boot into the custom recovery .
Well, I hope this helps someone and I didn't just waste my time . Oh, thanks for posting the goldcard instructions.

it worked!!!
Thanks so much! I did the exact process before (see other thread) but I must have missed something. Following this process exactly is what did it. I am guessing something about the reboot and the RUU is where i went wrong before.
I can confirm this works on the 2.73.707.9 ROM

Yaaahaaaayyhaahhahahaahaayyyyyyyyyyyy!!! I feel so happy for all you guys who had this problem (although I myself did not!!)

I kind of half gave up at 6:00 am yesrterday and i just woke up (1
:27pm) and followed the instructions here and BAM! got a working nandroid backup and a custom rom \o/!!! thanks to all of you!

so it's tested and proven for 2.73.707.9?great!

umm ... guys.. if u dont mind me asking...... why do we need it?
do we have hero versions which cant be rooted with any methods?

dying4004 said:
umm ... guys.. if u dont mind me asking...... why do we need it?
do we have hero versions which cant be rooted with any methods?
Click to expand...
Click to collapse
yup, we couldn't root certain asian carrier roms and t-mob rom and they couldnt downgrade so the where stuck, until now....

tianci86 said:
so it's tested and proven for 2.73.707.9?great!
Click to expand...
Click to collapse
CONFIRMED! it works on 2.73.707.9 , just got 2.73.405.5 , im so happy , thanks soo much guys your the best

My Hero..... lol
Thanks, I thought I would be owned by T-Mobile for ever after the ROM update
Now I'm back to the HTC default ROM (NOT T-Mobile G2 Touch!!!), cup of coffee time before Rooting flashing etc and remaining from now on faithful to Paul and the MoDaCo ROM

hey guys!
i have a question
im a owner of an tmobile g2 touch and want to have the new firmware of the htc hero can i use this hack to update to the newest firmware because at the moment it says if i want so update: error this rom is not for your device, and so on..
thx !
bye
sry for my english im from germany

gyounut said:
hey guys!
i have a question
im a owner of an tmobile g2 touch and want to have the new firmware of the htc hero can i use this hack to update to the newest firmware because at the moment it says if i want so update: error this rom is not for your device, and so on..
thx !
bye
sry for my english im from germany
Click to expand...
Click to collapse
ja das stimmt

thx jesterz
successfully update singapore hero 2.73.707 to 2.73.405, rooting in a while...
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

d0s said:
I had the same issue with Recovery Flasher I couldn't to boot into recovery. I was also unable to downgrade to the 1.7 roms due to a bootloader version error, arghhh. Anywho, managed to work my way round it, i'll explain below. I've got a T-Mobile G2 updated to the latest rom (so no root access).
I first followed the instructions on making a goldcard and then flashed the 2.73.405.5 WWE rom fine.
Now make sure you have the cm-hero-recovery.img (http://content.modaco.net/dropzone/modacopatchedrecovery-1.0.zip) on the root of your sdcard. Aswell as Instant Root (http://neilandtheresa.co.uk/Android/) now install Instant Root on the phone. It should pop up with a notification "instant root was sucessfully" or along those lines. (If you have a problem installing Instant Root make sure Settings>Applications>Unknown Sources is checked)
Instant root then allows for root access with adb shell using the following 2 commands:
1) adb shell
then
2) su
the icon should change from a $ to #.
Now flash the recovery image with the following command:
1) flash_image recovery /sdcard/cm-hero-recovery.img
This shouldn't take that long once completed it will go back the # prompt example below.
# flash_image recovery /sdcard/cm-hero-recovery.img (I typed this)
flash_image recovery /sdcard/cm-hero-recovery.img (this pops up)
# (this shows the flash completed)
Now pull out your usb cable and battery, turn on the phone with the battery in place while holding the home button and it should boot into the custom recovery .
Well, I hope this helps someone and I didn't just waste my time . Oh, thanks for posting the goldcard instructions.
Click to expand...
Click to collapse
Did it last night and got it working, used the AMON Hero recovery image instead and partitioned my sd card without going through the manual adb solution.
Cheers

could this be adapted for the sprint hero?

Sprint Hero support request strongly seconded, i am desperate to get my CDMA Hero rooted.

have you guys tried using thesame method and got anywhere? I mean, from what I know is that you can't even boot in to recovery mode right? have you guys tries the adb method to boot into rec mode at least?

Aces!!!!
Worked on Indian 2.73.720 like a charm.
Thanks.

[ROOT / TWRP][D851 ONLY][OSX/Linux/Windows] Root/TWRP your TMO G3 with PurpleDrake!

Howdy all!
What's this? Read on, dear reader, to discover the magic that is PurpleDrake.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
What is this?
This is a utility to easily root your LG G3 (specific models only). It's a fairly foolproof script that includes all the dependencies you'll need for getting your phone rooted easily.
This is the FULL version. This means that it will automatically root, and ask you if you want TWRP installed and a custom boot that doesn't trip the root checker!
Click to expand...
Click to collapse
Who made this?
This root is a collaboration between myself (IOMonster), jcase, and autoprime.
Special thanks also to beaups for some initial guidance looking at the vulnerable application.
Thanks to @Shelnutt2 for the security-disabled boot.img
Thanks to @Dees-Troy for the TWRP image!
Click to expand...
Click to collapse
Is my phone compatible?
The new LG G3 models each are slightly different with regards to rooting and unlocking.
To see a matrix of which LG G3 phones are compatible with this root, please see this Google Docs spreadsheet that we've compiled.
When you run this program, your phone will reboot and run a test to see if it's compatible. If the application succeeds, it'll let you know that it's able to permaroot you. If not, it'll fail gracefully and reboot you back to normal Android without having changed anything.
Please note that this version is currently only compatible with the T-Mobile D851 version of the LG G3. For other phones, we suggest you look for the LITE version of PurpleDrake.
Click to expand...
Click to collapse
How do I use this?
WE NOW SUPPORT WINDOWS! YAY ME
To start, for either platform you'll need to scroll down to the download section and get the file.
Ensure that your phone is in ADB mode (PTP Mode for everyone but Verizon. Verizon users need to be in "Internet"/"Ethernet" mode)
Linux Instructions (in a terminal!)
Extract the file you downloaded...
tar xvf ~/Downloads/PurpleDrake-TMO_VERSION.tar.gz
Mark the application as executable, and run it!
cd PurpleDrake-TMO
chmod +x purpledrake_linux.sh
./purpledrake_linux.sh
OSX Instructions (just a bit easier)
Extract the file you downloaded
Double-click on "purpledrake_osx"
Windows Instructions
Extract the file you downloaded
Double-click on "purpledrake_windows"
The application will guide you through all the steps you need.
You will still need to install SuperSU from the market after installing PurpleDrake. This pack does not include one.
If you choose to install the custom boot.img, your phone's root checker will not be tripped and your phone will show as UNROOTED.
After, be sure to check @autoprime's post for how to disable OTA upgrades! here : http://forum.xda-developers.com/showpost.php?p=54254111&postcount=2
Click to expand...
Click to collapse
But, what if I don't want to run your script to root?
Well then, I'd be a little hurt, but you can still do everything the script does manually.
Download the package, and extract it. Open a terminal in the main folder of the archive and run these commands:
Code:
adb reboot --bnr_recovery
adb push ./assets/start_restore /temp/start_restore
adb push ./assets/permaroot.bin /temp/start_restore
adb reboot
That will perma-root you, however there's no protection from doing something stupid or the phone being incompatible. Please be careful!
Click to expand...
Click to collapse
Where do I get this?
WINDOWS/OSX/LINUX VERSION OUT NOW!
- Fixed Windows support
- Fixed OSX ADB issues not detecting phone first try
- Fixed race conditions leading to errors permarooting
- Added 64-bit Linux ADB
Code:
[url]http://downloads.codefi.re/thecubed/lg_g3/purpledrake/PurpleDrake-TMO_R03.tar.gz[/url]
Old version here... (OSX/Linux only)
Code:
[url]http://downloads.codefi.re/thecubed/lg_g3/purpledrake/PurpleDrake-TMO_R01.tar.gz[/url]
Please DO NOT mirror or re-upload the PurpleDrake software to your own site, or any other file host.
If you need drivers for Windows (thanks @autoprime for having these handy!):
Verizon Drivers: http://downloads.codefi.re/autoprime/LG/LG_G3/LG VZW_United_WHQL_v2.14.1.exe
Everyone Else: http://downloads.codefi.re/autoprim...leDriver_S50MAN311AP22_ML_WHQL_Ver_3.11.3.exe
Click to expand...
Click to collapse
Help, it doesn't work!
Post here, let us know what happened and we'll try to help you. DO NOT private message us on XDA or on IRC asking for help. We will not assist privately.
Most questions if not answered here can be answered on #lg-g3 on IRC in Freenode.
Click to expand...
Click to collapse
Thanks so much! How can I show my appreciation?
Since this was a collaboration project, proceeds that are made from this root will be split between amongst us so we can purchase a Sprint test phone to root (as it's currently not rooted).
If you'd like to donate to us, click the "Donate to me" button on the left sidebar under my name, and be sure to enter a comment to let us know that you're donating towards the PurpleDrake project.
Thanks again!
Click to expand...
Click to collapse

FAQ:
Q: I'm running the Windows .bat as administrator and it's closing/not working.
A: There is no need to run the .bat as admin. Just double-click and run.
Q: I get the "Windows cannot find '.\assets\windows\bin\mintty.exe'." error.. watdo?
A: Try just double-clicking on the .bat instead of running as admin.
Also make sure the script is extracted properly first before running.
Q: I [used Flashify and] am stuck in fastboot.. how can I get out?
A: Be cautious using Flashify as it seems it's not working right.. or people are hitting the wrong buttons with it.
HERE are the stock TMO D851 partitions.
Use fastboot to flash recovery(TWRP or stock) and stock boot. This will install TWRP and fix booting into rom.
If on Windows you will need fastboot drivers. Use Google to find fastboot binaries and drivers.
Code:
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot reboot
The commands to flash TWRP manually instead of using flashify is below.
Place TWRP on the root of your internal /sdcard/ using MTP, downloading it directly to phone or using ADB push.
Code:
adb push name_of_file.img /sdcard/
adb shell
su
dd if=/sdcard/name_of_file.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery
Disable OTA:
Open LG Hidden Menu (3845#*851#) --> WLAN Test --> OTA Setting --> OFF
*Replace "851" with your devices model number, 850, 852, 855 etc...
The first D851 update has been released (10M). Bootloader remained unlocked. It would appear future OTAs will be safe to take AS LONG AS YOUR PHONE IS NOT MODIFIED! If you have flashed TWRP or installed xposed or modified /system then you need to restore any changes made or flash stock firmware (tot/kdz) before taking OTA.
If using a non-tmobile g3 I would be hesitant about taking OTA updates. An OTA may update the boot stack to block Bump!
EFS Backup:
Code:
[FONT="Arial Narrow"][B]Backup EFS after jailbreaking your G3. EFS is split into 2 partitions modemst1 and modemst2.
img files will be on root of internal sdcard. Save the .img files somewhere else besides the sdcard... email, cloud, etc..[/B]
DO NOT FLASH OTHER PEOPLES EFS OR FLASH YOUR OWN BACKUPS ONTO ANOTHER PHONE.
THIS WILL BREAK EFS ON THE PHONE YOU ARE FLASHING TO. EFS BACKUPS ARE FOR THE PHONE THEY CAME FROM ONLY.
I have made a new thread on EFS backup and restore which can be found [URL="http://forum.xda-developers.com/lg-g3/development/efs-lg-g3-efs-backup-restore-t2907329"]HERE[/URL].
[/HIDE]
[B][SIZE="5"]Restoring Stock / Remove root flag:[/SIZE][/B]
[HIDE]
Download the tmo .tot file and use lg flash to restore it to stock. itll format everything on internal sdcard so backup anything u may need off it.
T-Mobile firmware can be found [URL="http://downloads.codefi.re/wolfgart/LG_G3/D851"]here[/URL]. Thanks to [user=608699]@wolfgart[/user] for the files and [user=1157052]@thecubed[/user] for codefire hosting.
*Step by step picture guide - [url]http://imgur.com/W83hMPE[/url]
install the drivers.
put phone into Download Mode (power off. unplug USB. pull battery. put battery back in. press/hold Volume Up then plug in USB cable.)
In Windows Device Manager set the phones serial COM port to #41. (*see picture guide for help)
Install [URL="http://downloads.codefi.re/autoprime/LG/LG_G3/Setup_LGFlashTool_1.8.6.527.zip"][B]LG Flash[/B][/URL]. In "C:\LG\LG Flash" folder delete megalock dll. Replace with .dll below.
new megalock dll - [url]http://bit.ly/1cQADXm[/url] (this site includes a "download manager.. UNCHECK THE BOX before downloading dll file.)
Run LG Flash in the "C:\LG\LG Flash" folder. Select korean factory if asked.
When LG Flash opens you will see a box to select firmware and dll.
Select [URL="http://downloads.codefi.re/autoprime/LG/LG_G3/LGUP_8974.dll"][B]LG Flash .dll[/B][/URL]
Select (.tot)
Hit OK (*see picture guide for help)
Hit yellow start button. If you get Milkyway error click ok. LG Flash will then run a crc check on the tot file. Takes a bit.
After crc check finishes unplug the phone. plug phone back in. it should now be seen in LG Flash and start flashing.
Phone will reboot when finished. You may end up on a screen with s "2"... let it sit there for a minute or two.
If stuck on "2" try unplugging the usb cable from the phone.. wait 10 seconds.. then plug the usb cable back in. now wait 30 seconds and hopefully it changes to a "3"
Once the phone says "3" you can unplug the USB.. remove the battery and plug back in.. boot back up... you are now 100% stock.
[/HIDE]
[B][SIZE="5"]PurpleDrake YouTube Videos:[/SIZE][/B]
[HIDE]
[url]https://www.youtube.com/watch?v=wJtz51KgxjM[/url]
[/HIDE]

And where is the bootloader unlock talked about at the bounty thread or was it just a hoax?
Gesendet von meinem LG-D855

Tectas said:
And where is the bootloader unlock talked about at the bounty thread or was it just a hoax?
Gesendet von meinem LG-D855
Click to expand...
Click to collapse
Hoax? What?
This pack is ONLY for the T-Mobile G3 which has an unlocked bootloader out of the box.
D855 support is NOT included in here. There will be a separate thread when we have an unlock for the bootloaders of the rest of the G3 family.

Tectas said:
And where is the bootloader unlock talked about at the bounty thread or was it just a hoax?
Gesendet von meinem LG-D855
Click to expand...
Click to collapse
There is no boot loader unlock..where ever you read this is misinformed...the T-Mobile variant ships boot loader unlocked, it is the only one so far to be shipping unlocked.

Sweet

thecubed said:
Hoax? What?
This pack is ONLY for the T-Mobile G3 which has an unlocked bootloader out of the box.
D855 support is NOT included in here. There will be a separate thread when we have an unlock for the bootloaders of the rest of the G3 family.
Click to expand...
Click to collapse
I'm aware of that and sry it wasn't meant offensive or to put this one down, autoprime, did imply at the bounty thread, that you as well managed to unlock the bootloader, at least at the beginning, that's what I'm referring to, sry that i said it the wrong way, was a bit disappointed, which for sure isn't your fault or the one of this tool, it's still great progress you made.
Gesendet von meinem LG-D855

I wish the international G3 D855 will be unlocked too
Sent from my LG-D855 using XDA Premium 4 mobile app

Great glad to see this released thank to all that is involved
LGG3 and beyond

All my family is sleep in the room with my Mac will be running asap bright and early. Thank you for your hardwork

Thecubed, autoprime, shelnutt2, jcase, and whoever else....thanks for this. Truly appreciated! Can't wait for Windows support. :Cheers:
Sent from my LG-D851 using XDA Premium 4 mobile app

Plans to support recovery for D855 in the near future?
Need to know to sell or not the G3 ?

What the hell software compatible with a mac that's a 1st whoop whoop well done guys and thanks for the hard work

Yeah great time to be a Mac owner

I have a feeling this treads about to turn in to a "when will this version be supported" topic :/
LGG3 and beyond

Success!
1. THANK YOU!
2. It didn't work the first time around, temproot worked but permaroot did not. Maybe it had to do with the fact that I was reading this forum while it was waiting for my input... I can't see how that would have made a difference but whatever. [[ Edit: It worked the second time running, I just followed the instructions immediately - no problems. /Edit ]]
3. Just a reminder for Linux users ... you have to add udev rules as described here: http://developer.android.com/tools/device.html ... and when you are done with that, also run:
$ sudo service udev restart; sudo killall -9 adb
4. My G3 would only connect to my laptop (Ubuntu 14.04) when it was in PTP mode. MTP or Charge Only did _NOT_ work... Only PTP.
5. THANK YOU AGAIN! You devs rock!
Frank.

Same as the guy above didn't work the first time but worked perfect the second! OSX here.

@ OP
http://forum.xda-developers.com/lg-g3/general/s-carrier-specific-g3-threads-t2818549

I keep getting no such file or directory, going to re download drivers and see

@thecuba not telling you what to do but maybe put this on T-Mobile thread as well http://forum.xda-developers.com/tmobile-lg-g3/development
Hope you don't take it the wrong way

[Q&A] [Recovery] [v500] CWM 6.0.5.1

Q&A for [Recovery] [v500] CWM 6.0.5.1
Some developers prefer that questions remain separate from their main development thread to help keep things organized. Placing your question within this thread will increase its chances of being answered by a member of the community or by the developer.
Before posting, please use the forum search and read through the discussion thread for [Recovery] [v500] CWM 6.0.5.1. If you can't find an answer, post it here, being sure to give as much information as possible (firmware version, steps to reproduce, logcat if available) so that you can get help.
Thanks for understanding and for helping to keep XDA neat and tidy!

Didn't work- aboot needs flashing?
Hi, I got up to the last step, but aborted as per your instructions when access to aboot was denied. Does this mean I need to downgrade to a different stock android before putting a custom recovery on? If so, how do I do that?

When you first typed "su" to gain root access in the terminal, did you allow it in the SuperSU application? It sounds like your problem is related to root permissions not being given. Was the problem with using the "dd" command or the command to patch the recovery.img?
---------- Post added at 12:48 PM ---------- Previous post was at 12:44 PM ----------
Oh, I think the problem is that you need to go into the developer options and allow root to both apps and adb. Root permission is default to apps only and that setting needs to be changed to give adb root access.
Edit: I added a new note about this to the guide.

I am running stock HTC and there is no option to allow root access in developer options as in your screenshot (main thread- I don't have permission to post). However, I checked in SuperSU and root access is granted.
I am not very experienced in this area. Maybe I'm doing something wrong. Here's a copy and paste from command line I used to run ADB:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
E:\Google SDK\adt-bundle-windows-x86_64-20130729\sdk\platform-tools>adb push rec
overy.img /data/local/tmp
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
3423 KB/s (10514432 bytes in 2.999s)
E:\Google SDK\adt-bundle-windows-x86_64-20130729\sdk\platform-tools>adb push lok
i_tool /data/local/tmp
2286 KB/s (379276 bytes in 0.162s)
E:\Google SDK\adt-bundle-windows-x86_64-20130729\sdk\platform-tools>adb shell
[email protected]:/ $ su
su
[email protected]:/ # chmod 755 /data/local/tmp/loki_tool
chmod 755 /data/local/tmp/loki_tool
[email protected]:/ # dd if=/dev/block/platform/msm_sdcc.1/by-name/aboot of=/data/local
/tmp/aboot.img
cc.1/by-name/aboot of=/data/local/tmp/aboot.img <
1024+0 records in
1024+0 records out
524288 bytes transferred in 0.085 secs (6168094 bytes/sec)
[email protected]:/ # /data/local/tmp/loki_tool patch recovery /data/local/tmp/aboot.im
g /data/local/tmp/recovery.img /data/local/tmp/recovery.lok
a/local/tmp/recovery.img /data/local/tmp/recovery.lok <
Loki tool v2.1
[-] Unsupported aboot image.

Ok, your problem is not related to permissions. You have followed the directions correctly. The problem you have is that your aboot.img is not compatible with loki_tool, so it is unable to patch your recovery.img to recovery.lok. Perhaps downgrading your firmware would install an older loki_tool exploitable aboot partition. You might also just be able to change aboot without having to downgrade everything else, but it really depends on your version of software. There are some recovery threads that install a new aboot.img along with a new recovery.img, but just make sure you don't install the wrong aboot, because you might get a boot loop and have to reset with the LG tool.
Edit: when you say you are running stock HTC, do you really mean stock LG? This is for v500 devices only.

Yes, I meant stock LG. I've got version 4.4.2, v 50020d.
The threads I've seen seem to require a custom recovery to install the old version of android... which is what I need to install a custom recovery. Maybe I'm being dense. Can you point me in the right direction at all?

Yes, I think 20d is the latest firmware that has the aboot partition patched to prevent loki_tool from working. The safest way, without risking a boot loop, would probably be to downgrade your firmware to an older version with the LG tool. But, I don't know if those older images are available for your device. I would assume that any official v500 image from LG would work, as long as the hardware is not different. I've heard that some of the newer v500 devices have a different camera module, which would require the latest version of software for the different camera to be supported. By downgrading the LG firmware on newer models, you could lose the camera driver support. Maybe you should determine what camera is in your device before you make a decision on which version of software to install with the LG tool.

I stupidly upgraded from 500b to d when my OS recommended it but my G-Pad is a bit older. Basically, I should be able to downgrade to tha without risking the camera. But I don't know how. I had a look at an LG tool thread, but it was quite confusing and most talk was related to the LG G2. There are many options in the LG tool which I have no idea about. I might be abIe to work it out after extensive reading but a bigger problem is I don't know where to get the image to flash v500b from.

Yes, we need a thread with links to all the stock images.
---------- Post added at 03:31 PM ---------- Previous post was at 03:13 PM ----------
The question really is, which loki_tool exploitable aboot.img is compatible with the software on your device. I have a feeling that you would get a boot loop if you tried to change only your aboot.img to an older version without downgrading the system to match.
Edit: I'm not really sure what would happen if I made a copy of my aboot partition for you to flash over your copy. I could post my aboot.img, and it could be flashed to your device using dd, but it's risky.

Theoretically, if you flash a new aboot.img and recovery.lok (to match the new aboot partition), you would not be able to boot into the old system (because your boot partition does not match the new aboot partition), but you should still be able to get into the new custom recovery (because it matches aboot). Then you could install a custom Rom that replaces your old boot partition (the kernel).
Edit: I think you should take a look at this thread: http://forum.xda-developers.com/showpost.php?p=53140473&postcount=14
I was able to download the kdz file for my v500 which should work for your device also.
Here is a link to the LG Tool that is modified to download the file from a local server: http://storagecow.eu/index.php?dir=Xda/LG+Software/KDZ+Flashing+Tools/
Edit: I recommend using LG Flash Tool 2014 to flash the kdz file instead.
http://forum.xda-developers.com/showthread.php?t=2797190

Unsupported aboot image
Hi!
When I enter the command to patch the recovery I got the response "Unsupported aboot image"
I´m on V50020a, loki_tool only supports V50010a?

It means your aboot is patched. I'd downgrade with lg tool then root over again.

Deltadroid said:
It means your aboot is patched. I'd downgrade with lg tool then root over again.
Click to expand...
Click to collapse
Thanks, just looked thru the rest of this thread and realized that, lazy me.

Latest 20D and CWM - device unlock, so Boot success!! ??
Hi All,
I am trying to get into Recovery but I only get "device unlock, so Boot success!!", Goes dim for a second and then just loads back into Stock.
I am unable to access TWRP.
Any help?
SOLVED. Downgraded to 10A

Deltadroid said:
The new versions of LG Tool won't let you downgrade because the program checks for the latest firmware version to install. There is another version of LG Tool that does allow for downgrading firmware here:
http://forum.xda-developers.com/showthread.php?t=2797190
Now you just need to get the kdz file to install here:
https://www.androidfilehost.com/?w=files&flid=13296
Click to expand...
Click to collapse
I tried using that tool to downgrade to the 4.2.2 firmware, but the tool keeps saying that the pad became disconnected, ad the retry button does not work. I have tried both in USB Debugging mode and download mode. Is there any other way to get the V50010A_00.kdz firmware onto my GPad?

You must have your device in download mode in order to use the LG Tool. It doesn't matter what settings you have in the rom. Perhaps trying a different Windows computer could help.

Deltadroid said:
You must have your device in download mode in order to use the LG Tool. It doesn't matter what settings you have in the rom. Perhaps trying a different Windows computer could help.
Click to expand...
Click to collapse
I did end up trying with a different computer, and finally had success. Then I re-applied root with towelroot, and I'm good to go. Thanks!

I followed the instructions and have successfully installed the CM recovery. When I booted into the recovery, I decided to make a backup. The backup went fine, then I selected "restore" to see what was available, and there was one backup, just like I expected. However, the backup file was dated 1970-11-21.09.49.26. The clock on my tablet should have been set correctly, so why is it dated like that?

It seems like a patch is needed for CWM to set the proper time. I wonder if Philz gets the correct time. I know TWRP 8.0.0 has the correct time with a recent patch.
I'm sure someone with access could cherry pick that patch for us.

Now that I have done a backup, I am good to go to install a custom ROM now, correct? If I don't like the ROM I can just restore my backup to go back to stock 4.2.2?

2 x Gpad 8.3's 4.4.2 GB & US versions, help on trwp install needed

Good morning,
Please forgive me for my stupidity.
I am usually pretty good at doing phones tablets etc, namely samsung which we all own in this household.
I very rarely ever ask for guidance and sit back and learn myslef, but these LG's are working me hard.
I have brought 2 x lg gpad's for my sons for xmas and want to get them rooted and twrp installed.
I have a GB V50020d and a US V50020b Both on 4.4.2
I have read for two days how-to's and watched numerous videos, i have drivers installed and managed with both tablets, rooted them with Kingoroot.
Due to the amount of time that has past since they came out orignally and i buying them, there are so many threads, files etc i.e trwp 2.6, whereas it is now 2.8, will the how-to's still work the same?
The runmebat file i see mentioned numerous times but yet i am not educated to understand how i can open this and where it is located.
The information as regard this tablet is simply over powering and leaving me in a pickle.
I know the usual read read read method and believe me i have gone over and over to no avail.
Please any advice to get me to put custom recovery on both so i can test rom's the wonderful creators on here produce.
Your time is very much appreciated
Best wishes

I'm in the same boat mate. Installed custom recoveries and ROMs on 2 HTC phones before, but this one has me stumped. Bootloader can't be unlocked, don't understand loki hack, can't get it to work either.

Okay, my process from a fresh install of 4.4.2 is:
make sure to download everything you need before you start this process and read through it carefully... and realize you do this at your own risk, I will try to help, but this process can brick your device if done incorrectly...
1. Root device using stumproot, thread located here:
http://forum.xda-developers.com/lg-g...rizon-t2850906
Other root approaches potentially will work as well, I use stump since it also works on my phone...
2. Download and use step 3 from idioterror's thread here:
http://forum.xda-developers.com/show....php?t=2698267
You will need to modify his batch file to properly work the details for that are in the thread, the download by itself will not work without changing a line in the batch file (if I recall from memory find the query for 50010b and change it to 50010d.)
If that worked the batch file ends with an attempt to reboot into recovery. Unplug the cable after the batch file sends the reboot command so the adb reboot recovery command can properly complete and get you into recovery...
if the tablet boots back into stock try another adb reboot recovery manually(or use flashify to reboot into recovery), again unplug once the reboot starts.
If that does not get you into TWRP this step failed and youwill have to manually walk through what the batch file does... (manual instructions below, skip to them finish that and then come back here!).
Once you have this working recovery you need to decide which base you are going to use with your tablet, the 4.2.2. base (for AOSP based roms) or the 4.4.2 base (for recent stock based roms). The recoveries for the 4.2.2. and 4.4.2 are different see the details in this thread:
http://forum.xda-developers.com/show....php?t=2551499
If you are going to run AOSP based roms skip to 3b...
3a. I am running a 4.4.2 base and a modified stock myself, I make sure to install the latest 2.8.0 recovery for the 4.4.2 base... You can now flash stock based roms do not do step 3b for stock based roms...
3b. Install the 4.2.2. base (will actually install a different recovery partition and aboot partition, however it will get your firmware back to 4.2.2. which is what almost all of the AOSP roms expect...) thread and download details here:
http://forum.xda-developers.com/show....php?t=2719411
That download is huge and takes a while to flash, don't panic, but make sure that the MD5's match since a failed flash for that one can brick the tablet...
4. Enjoy your rooted and rommable tablet! (stop here if everything worked)
------ This is the manual process if the batch file from step 2 fails for some reason:
Step by Step Aboot/Recovery when the script fails
WARNING: I'm trying to help, I assume that you know how to recover from mistakes by reverting to stock with LG's software if needed. This is the procedure I followed by manually doing what Id10tError had in his batch file... If anything fails below I messed up in translating the instructions. I did not run the dd commands on my tablet to check since I have already done this process. Please be careful... If you find errors I will try and help... the dd command does have the ability to completely destroy your tablet if you use it incorrectly... if you have questions or see a difference between my instructions and the batch file ask and I'll be glad to answer questions. This was translated from idioterror's script, any errors are mine not his.
I assume that you have installed busybox, (this gives you a working dd on the device)
you have rooted your tablet
and you have adb working on your computer.
You could potentially also do this from the tablet itself if you copy the files needed to the proper locations (skip the push part below) and use a terminal directly. I also assume that you have downloaded idioterror's aboot replacement stuff from my earlier instructions. On the computer go to the directory that you opened the zip file and do a directory listing you should see:
the dd lines below may wrap depending upon how you are displaying this...
The directory should contain:
11/12/2014 09:59 PM <DIR> .
11/12/2014 09:59 PM <DIR> ..
05/16/2014 08:48 PM 524,288 aboot.img
05/16/2014 08:48 PM 815,104 adb.exe
05/16/2014 08:48 PM 96,256 AdbWinApi.dll
05/16/2014 08:48 PM 60,928 AdbWinUsbApi.dll
05/16/2014 08:48 PM <DIR> busybox
05/16/2014 08:48 PM 11,001,856 recovery.lok
07/07/2014 04:41 PM 4,156 runme.bat
then type
adb shell
su
mkdir /sdcard/flash_tmp/
exit
exit
adb push ./aboot.img /sdcard/flash_tmp/aboot.img
adb push ./recovery.lok /sdcard/flash_tmp/recovery.lok
adb shell
su
chmod -R 777 /sdcard/flash_tmp
dd if=/sdcard/flash_tmp/aboot.img of=/dev/block/platform/msm_sdcc.1/by-name/aboot
dd if=/sdcard/flash_tmp/recovery.lok of=/dev/block/platform/msm_sdcc.1/by-name/recovery
rm -rf /sdcard/flash_tmp/
exit
exit
adb reboot recovery
unplug the cable once it starts rebooting and enter TWRP recovery...
It will be dim if you are coming from the 4.4.2 base, go to a dark room if needed so you can see it and flash a newer 4.4.2 recovery next if you are planning on using stock roms, or flash the 4.2.2. base otherwise... see my earlier post for a link to the recovery thread or the 4.2.2 base.
All of this information was posted by me in the following thread (you may want to read it there for full context)
http://forum.xda-developers.com/lg-g-pad-83/help/v500-im-able-to-bootloader-t2936670/

ASUS ZenPad Z8 (ZT581KL) (P008) (Verizon) - Firmware

I found some firmware files for the Asus Zenpad Z8 ZT581KL for Verizon. Neither Asus or Verizon host any firmware for this device, despite having other similar device firmware available (like the ZT500KL, etc), which sucks.
VZW_ZT581KL_V3.4.16_all_user_M101901_16.0.0_160519.zip
ASUS Factory VZW_ZT581KL_V5.4.1_all_user_M101901_16.0.0_170202 androidhost.ru.zip
ZT581KL_T3.3.8_pre_burn_image_20160516.zip
ZT581KL_Z581KL_EMERGENCY_DLOAD.7z
ZT581KL_FUSE_Security_Keybox_160728.rar
Z581KL_initrd_diff.zip
ASUS.Flash.Tool.v1.0.0.45.zip
Running a stock, factory reset device, I was able to flash VZW_ZT581KL_V3.4.16_all_user_M101901_16.0.0_160519.zip using Asus Flash Tool 1.0.0.45, which successfully downgraded Tablet from V3.4.23 to V3.4.16.
I tried flashing ZT581KL_T3.3.8_pre_burn_image_20160516.zip but it did not work and error-ed out with no brick or anything. Usually the firmware is in a .raw format so you can flash either via zip file which has raw file in root folder of archive, or via the raw file itself. I tried both and was not successful. For some reason this archive had a .bin file instead of a .raw file. I tried renaming them but still didn't work. However, I was able to extract the .bin to find the firmware files inside just like the other version firmwares (that were in raw). One thing I have not tried yet, is to try manually flashing the individual firmware files from the extracted bin, and see if that works--or if someone else with this tablet wants to try, here are the files. If successful, it might lower kernel version down more to allow root exploits to root device.
I have not tried flashing V5.4.1, but I'm confident it will work. I do not know if via the Asus Flash Tool/Asus Tablet will allow doing a flash to V5.4.1 and downgrade back down to V3.4.16, but just did V.3.4.23 (stock orig fw already on device) to V.3.4.16 and it worked. I did receive an OTA to upgrade to V3.4.18 (or was it V.3.4.21, I can't remember) and took the upgrade (then flashed back to V.3.4.16), so it appears that when doing an OTA it will "leap-frog" to the next higher version release until you are on the newest build, so the first OTA you get won't do a direct upgrade from V3.4.16- to V5.4.1 or V5.4.5, but will upgrade it in an incremental way, via the next higher version release.
Hopefully someone can try to root their tablet if any of these files are of any help. I might work up courage to try 3.38 again via manual fastboot, but if you do it and succeed, I would love to hear about it.
The other files hosted ZT581KL_Z581KL_EMERGENCY_DLOAD.7z and ZT581KL_FUSE_Security_Keybox_160728.rar have to do with re-flashing the Qualcomm Snapdragon SoC (un-bricking), and the other one something to do with clearing/setting FUSE when the phone leaves factory or something, I'm not sure. Hopefully they can be of some use to someone to unlock this device. It would be nice. So here u go.
https://www.androidfilehost.com/?w=files&flid=289525 - link to ASUS_ZenPad_Z8_ZT581KL_P008_Verizon files

Has anyone tried flashing 'ZT581KL_T3.3.8_pre_burn_image_20160516' yet? Just wondering if it was successful; I haven't tried it yet.

smokejumper76 said:
Has anyone tried flashing 'ZT581KL_T3.3.8_pre_burn_image_20160516' yet? Just wondering if it was successful; I haven't tried it yet.
Click to expand...
Click to collapse
can you tell me how to extract the .raw from .bin, I will try to flash the device.

fuyangui said:
can you tell me how to extract the .raw from .bin, I will try to flash the device.
Click to expand...
Click to collapse
I used 7zip to extract the firmware from the archive.. Open 'ZT581KL_T3.3.8_pre_burn_image_20160516.zip' with 7zip. It should come up with a folder named 'ZT581KL_T3.3.8_pre_burn_image_20160516'. Go in that folder. There will then be a file shown called 'userdata.bin'. In 7zip, if you right click that file, then select 'Open Inside', it should open inside the .bin file and show the firmware files. From there, you can extract them somewhere. Hopefully, you can try to apply each .img file separately (fastboot), one at a time, and see if it works. Thank you!

Sorry to resurrect this old thread but I might have some info that will help others.
First off thanks for the OP for the download links as I cannot find the OEM ROMS anywhere for this device.
Second here are some more instructions that you may need if you are having issues with this device.
Use ASUS FLash Tool v1.0.0.45, it has the device model that you need and was the one that worked for me. Then download ASUS Factory VZW_ZT581KL_V5.4.1_all_user_M101901_16.0.0_170202 androidhost.ru.zip from the link the OP posted, it should be the first file, then this is the step that I missed and took forever to figure out. You have to open that zip file and extract the .raw file, so you should have a file called ZT581KL_all_VZW_user_V5.4.1.raw. That is the file that you need to select in the Asus Flash Tool by clicking the little box with a down arrow inside it, then boot your tablet into Fastboot (Hold down the Power and Volume Down buttons) then once in fastboot, make sure you select the right model for this tablet it should be, ZT581KL, then I left Wipe Data as no, then connect your tablet to your computer with a USB cable, and you should see your Serial Number and a round icon under the State column. Then once that is all correct click the Start button, you may get an error about some FPS thing that can't be downloaded or something just hit OK, then you should see under the Description column that it's flashing the ROM, wait for a while and you should then have a "Flash Image Successfully (The serial number for your device will show here)" under the description and your tablet will reboot.
My tablet was originally on v5.4.5, this ROM will take you back to v5.4.1 but then through the tablet settings you can do an upgrade to v5.4.4 then do another one and it will be at v5.4.5 then you are all set.
So the issue I was having with the tablet was after a factory reset it would freeze at the setup screen and not let me continue, it took me forever to find out how to get it fixed and the instructions above worked for me, so if anyone else is having similar issues then hopefully this will help. I literally spent days and searched through about 70 forums to try and find a fix for it, I even reached to Asus for help, which they basically told me I had to pay to send it in and have it fixed, I was just about to give up when I came upon this thread and the OP's download links, so thanks again smokejumper76. If anyone has any questions about my instructions feel free to reply/comment.
Thanks!

Downgrade success
I used the files provided by OP and was able to successfully flash from 5.4.1 to 3.4.16. I got this tablet from a friend a few years back that he acquired from his work when it went out of business. It has the frp lock on it and im looking at the few available options. So, since this tablet had been sitting for two years. Its Guinea pig time. I'll flash the 3.3.8 and check back. It seems you can go forward or backward in so versions with the flash tool. So I'm not too worried about brick. If I can just get usb debugging on I'll be gold. Possible exploits if it runs.

Well. The 3.3.8 is not packaged properly for flashing. And that 600mb file expands to 9gb. There is a file "system.img" inside that's roughly the right size as the system and has the correct file structure. I have a friend who is going to help me repack that rom correctly for flashing. Meanwhile I am going to look into the 3.4.16 rom and see if I can't set usb debug to on and flash the modded image. From there I should be able to sideload su. I'll report back.

mofugggz said:
Well. The 3.3.8 is not packaged properly for flashing. And that 600mb file expands to 9gb. There is a file "system.img" inside that's roughly the right size as the system and has the correct file structure. I have a friend who is going to help me repack that rom correctly for flashing. Meanwhile I am going to look into the 3.4.16 rom and see if I can't set usb debug to on and flash the modded image. From there I should be able to sideload su. I'll report back.
Click to expand...
Click to collapse
Any update? Thank you for your efforts!

smokejumper76 said:
Any update? Thank you for your efforts!
Click to expand...
Click to collapse
I have the same tablet as well. Root would be great, any chance of unlocking the BL?

klister said:
I have the same tablet as well. Root would be great, any chance of unlocking the BL?
Click to expand...
Click to collapse
hi
any advance with this?
Enviado desde mi P008 mediante Tapatalk

WHat is the password to the files

I used the emergency download file to unbrick the Japanese version of z581kl. However, maybe the partition structure is different, when I try to write to the system partition, it says that there is no partition. What should i do? I'm sorry for my bad English.

allisondanielle said:
WHat is the password to the files
Click to expand...
Click to collapse
https://www.asusflashtool.com/ - Description Page with Password
Unzip Password: asusflashtool.com

I installed ZT581KL_T3.3.8_pre_burn_image_20160516.zip on my z581kl.
That resulted in Android 6.0 AOSP working!
There is a bug that screen rotation is not possible, but everything else is fine.
There is a bug that the screen cannot be rotated, but other than that, everything is fine. After installing TWRP, you need to mount /system and the location of system.img, and then execute the following command from the TWRP terminal.
mkdir new-system
mount system.img new-system
cp -a -R -p new-system/* /system
Translated with www.DeepL.com/Translator (free version)
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

清水侑磨 said:
I installed ZT581KL_T3.3.8_pre_burn_image_20160516.zip on my z581kl.
That resulted in Android 6.0 AOSP working!
There is a bug that screen rotation is not possible, but everything else is fine.
There is a bug that the screen cannot be rotated, but other than that, everything is fine. After installing TWRP, you need to mount /system and the location of system.img, and then execute the following command from the TWRP terminal.
mkdir new-system
mount system.img new-system
cp -a -R -p new-system/* /system
Translated with www.DeepL.com/Translator (free version)View attachment 5251235View attachment 5251237View attachment 5251239
Click to expand...
Click to collapse
I flashed the zt581kl image using EDL mode as described in this blog because the partition structure of the zt581kl is different from that of the zt581kl.
z581klでEDLモードに入る方法
xxxxx
itgameinfo.blogspot.com

Hi. New to the forum. I’m looking to downgrade my asus zt581kl so that I can root. Can someone show me the exactly step by step to downgrade my table? The above replies are a bit confusing to follow.

Tmupt said:
Hi. New to the forum. I’m looking to downgrade my asus zt581kl so that I can root. Can someone show me the exactly step by step to downgrade my table? The above replies are a bit confusing to follow.
Click to expand...
Click to collapse
Maybe start here:
https://www.getdroidtips.com/v5-4-1-nougat-verizon-asus-zenpad-z8/

I've been messing around with some of the files, and I was able to brick and unbrick the device following the firehose SOP PDF instructions. It basically flashes a barebones boot w/o any OS, and you have to flash a complete firmware to it to restore it back.
I was also able to install TWRP but it showed 0 space avail, I think because I didn't wipe it. I'll play with that later.
Used these links (use google translate)
z581klでEDLモードに入る方法
xxxxx
itgameinfo.blogspot.com
zenpad 3 8.0に簡単にTWRPを導入する+fastbootの裏技
xxxxx
itgameinfo.blogspot.com
I need to ask @清水侑磨 about how to flash ZT581KL_T3.3.8_pre_burn_image_20160516.zip. I think the userdata.bin file is a NAND dump created by Chinese Miracle 2 / Infinity Box but I'm having problems getting it to read the partitions. I was able to get the tablet in EDL mode, so I'm not sure what I'm doing wrong.

Anyone have a QPST .QCN file for ZT581KL for this device? Flashing 3.3.8 from that preburn file will nuke your IMEI. Mine got changed to all 1s and lost provisioning connectability w/ carrier. in fastboot/adb, so I need to restore it. If anyone could make a QCN (with your IMEI removed of course) so I can do that I would be most appreciative.

smokejumper76 said:
I've been messing around with some of the files, and I was able to brick and unbrick the device following the firehose SOP PDF instructions. It basically flashes a barebones boot w/o any OS, and you have to flash a complete firmware to it to restore it back.
I was also able to install TWRP but it showed 0 space avail, I think because I didn't wipe it. I'll play with that later.
Used these links (use google translate)
z581klでEDLモードに入る方法
xxxxx
itgameinfo.blogspot.com
zenpad 3 8.0に簡単にTWRPを導入する+fastbootの裏技
xxxxx
itgameinfo.blogspot.com
I need to ask @清水侑磨 about how to flash ZT581KL_T3.3.8_pre_burn_image_20160516.zip. I think the userdata.bin file is a NAND dump created by Chinese Miracle 2 / Infinity Box but I'm having problems getting it to read the partitions. I was able to get the tablet in EDL mode, so I'm not sure what I'm doing wrong.
Click to expand...
Click to collapse
Sorry for the late reply.
To boot AOSP, instead of burning the system.img from edl or fastboot, use adb.
The method is as follows
1、Start TWRP.
2、Connect your PC to USB.
3、Go to the directory where system.img is located, and press
adb push system.img /sdcard/
4、Enter the shell
adb shell
5、Mount system.img.
mkdir new-system
mount system.img new-system
6、Copy the contents of the mounted system.img to the system partition.
cp -a -R -p new-system/* /system
(If this fails, check that the system partition is mounted. If the system partition is mounted but you cannot write to it, format the system partition.)
7、After rebooting, you should see an Android message
Translated with www.DeepL.com/Translator (free version)