[Q] Booting Hard Brick from external SD card - LG Optimus G Pro
Hi folks,
it seems there's a number of those with hard bricked e98x devices. The only real solution so far is a JTAG service which often is not an option.
Unfortunately, this device though great is not so widely spread as many others, that's may be the reason why HEX file is not publicly available and you can do nothing with (as seen in Linux)
Code:
05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)
on APQ8064T device (turning your device into SDCARD mode). The only chance I see so far is booting from external microSD card what you can achieve (probably) by forcing your CPU to alternate boot sequence.
Surprisingly, there's Service Manual available in Internet. It is marked as preliminary. It has interesting information about internal design of LG-E980, including data for boot configuration.
And here comes where more help needed. I personally do not have much skills and time to understand it from first glance. If some guidance and help added, I belive it's possible to accomplish the goal.
What I understand so far (please correct if it's mistake):
(1) According to the manual (page 208) the GPIO_87 is connected to 10K resistor R6023 which normally has TRUE for secure boot there;
(2) It is safe to connect CPU side of this resistor to the ground, 10K is enough to keep safe the transistor it is conneced to (Boot Config diagram on the same page);
(3) The location of R6023 is shown on page 240;
(4) This should change the boot sequence.
I want to clarify the matter even before connecting my oscillograph in. If the motherboard is blown, I loose any interest in the project, and I do not want that
Any comments are welcome.
Just in case
Just in case
yakovpol said:
Hi folks,
it seems there's a number of those with hard bricked e98x devices. The only real solution so far is a JTAG service which often is not an option.
Unfortunately, this device though great is not so widely spread as many others, that's may be the reason why HEX file is not publicly available and you can do nothing with (as seen in Linux)
Code:
05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)
on APQ8064T device (turning your device into SDCARD mode). The only chance I see so far is booting from external microSD card what you can achieve (probably) by forcing your CPU to alternate boot sequence.
Surprisingly, there's Service Manual available in Internet. It is marked as preliminary. It has interesting information about internal design of LG-E980, including data for boot configuration.
And here comes where more help needed. I personally do not have much skills and time to understand it from first glance. If some guidance and help added, I belive it's possible to accomplish the goal.
What I understand so far (please correct if it's mistake):
(1) According to the manual (page 208) the GPIO_87 is connected to 10K resistor R6023 which normally has TRUE for secure boot there;
(2) It is safe to connect CPU side of this resistor to the ground, 10K is enough to keep safe the transistor it is conneced to (Boot Config diagram on the same page);
(3) The location of R6023 is shown on page 240;
(4) This should change the boot sequence.
I want to clarify the matter even before connecting my oscillograph in. If the motherboard is blown, I loose any interest in the project, and I do not want that
Any comments are welcome.
Click to expand...
Click to collapse
now??
yakovpol said:
Hi folks,
<snip>
What I understand so far (please correct if it's mistake):
(1) According to the manual (page 208) the GPIO_87 is connected to 10K resistor R6023 which normally has TRUE for secure boot there;
(2) It is safe to connect CPU side of this resistor to the ground, 10K is enough to keep safe the transistor it is conneced to (Boot Config diagram on the same page);
(3) The location of R6023 is shown on page 240;
(4) This should change the boot sequence.
I want to clarify the matter even before connecting my oscillograph in. If the motherboard is blown, I loose any interest in the project, and I do not want that
Any comments are welcome.
Click to expand...
Click to collapse
R6011 to GPIO_50 = BOOT_CONFIG_0_1_6
R6007 to GPIO_4 = BOOT_CONFIG_0_1_6
R6023 to GPIO_87 = BOOT_CONFIG_0_1_6
Shorting either side to GND via a 1k resistor should not cause any harm.
I am going to take a stab in the dark and the say 0_1_6 of the boot config is bit 0/1/6 of the boot chart, E:V:A's documentation into bootloaders should allow you to match the boot order chosen.
EDIT My PDF viewer didnt show the chart at first, displayed here for speed
Code:
Config 1 Config 0
0 0 EMER. BOOT(SDC3 FOLLOWED BY USB HS)
0 1 SDC3 FOLLOWED BY SDC1
1 0 SDC3 FOLLOWED BYSDC2
1 1 SDC1 (eMMC, DEFAULT)
Config 6
0 Secure Boot
1 Fast Boot
Secure boot can be controlled via GPIO or QFUSE, if QFUSE is used then gpio options wont matter even if stilll present on the board. Early models may have not had the qfuse blown until the device had been proven which may mean some devices will load a hex file no problem and others wont. (educated assumption)
if you are using a oscilloscope then you should watch these GPIO's at power up and also record your DMESG for changes in the PID/VID of the device,
use this code to see a live view of DMESG when devices are sending their PID/VID
Code:
sudo tail -f /proc/kmsg
use CTRL+C to stop.
I've looked into some of the sources that would have been supplied to the manufacturer for them to develop with and there is options for them to alter the fail to boot behavior except the CPU PBL, this is why having no bootloader at all might work where having a failed bootloader wont.
I suggest also try other HEX files, not all are made equal.
darkspr1te
darkspr1te said:
R6011 to GPIO_50 = BOOT_CONFIG_0_1_6
R6007 to GPIO_4 = BOOT_CONFIG_0_1_6
R6023 to GPIO_87 = BOOT_CONFIG_0_1_6
......
I suggest also try other HEX files, not all are made equal.
Click to expand...
Click to collapse
darkspr1te, many thanks for your reply!
In fact, CPU side of the diagram shows the exact name for the signals:
R6007 to GPIO_4 = BOOT_CONFIG_6
R6011 to GPIO_50 = BOOT_CONFIG_1
R6023 to GPIO_87 = BOOT_CONFIG_0
I did not notice all except GPIO_87: search through PDF file found only horizontally oriented text.
As for HEX files, I tried ALL that I could find, one by one.
yakovpol said:
darkspr1te, many thanks for your reply!
In fact, CPU side of the diagram shows the exact name for the signals:
R6007 to GPIO_4 = BOOT_CONFIG_6
R6011 to GPIO_50 = BOOT_CONFIG_1
R6023 to GPIO_87 = BOOT_CONFIG_0
I did not notice all except GPIO_87: search through PDF file found only horizontally oriented text.
As for HEX files, I tried ALL that I could find, one by one.
Click to expand...
Click to collapse
Ok, progress, sort of. We now know that R6007 is the BOOT_CFG_6 bit, aka fastboot/secure boot. This could still be controlled by a qfuse or they may have shorted to gnd this point making it secure, removing the resistor to gnd and replacing with one to 1.8v/3.3v would always force fastboot.
you should find this on the diagram and board (sorry , time my side is limited)
measure this resistor to ground with device powered . The same for the others once you have found them.
EDIT:- Manual says they are powered from Q6000, so check for the actual precence of R6007, if it's missing then that gpio does not get power and boots in secure mode not fastboot.
darkspr1te
darkspr1te said:
Ok, progress, sort of. We now know that R6007 is the BOOT_CFG_6 bit, aka fastboot/secure boot.
...
Manual says they are powered from Q6000, so check for the actual precence of R6007
Click to expand...
Click to collapse
darkspr1te, thanks again.
In fact, I checked opposite to CPU sides of R6007, R6011, R6023: resistors really exist and all are connected together to the Drain of Q6000 (exactly like on the scheme in the manual). So Q6000 controls the signal on all three of GPIOs. It means it shoud have False in normal conditions.
I am still in preparations to the actual power on. I do not have a lab and some materials (like 1K resistors) needed.
What I think is most difficult for now is that all resistors are on the back side of the motherboard, faced to the screen. I do not know how to deal with that, I want to keep screen attached during the try.
yakovpol said:
darkspr1te, thanks again.
In fact, I checked opposite to CPU sides of R6007, R6011, R6023: resistors really exist and all are connected together to the Drain of Q6000 (exactly like on the scheme in the manual). So Q6000 controls the signal on all three of GPIOs. It means it shoud have False in normal conditions.
I am still in preparations to the actual power on. I do not have a lab and some materials (like 1K resistors) needed.
What I think is most difficult for now is that all resistors are on the back side of the motherboard, faced to the screen. I do not know how to deal with that, I want to keep screen attached during the try.
Click to expand...
Click to collapse
For most of the repair nothing will show on the screen, all the interaction is done via USB, the device will function without it for your purpose.
As we know that Q6000 drain is connected to our GPIO we can assume that on power up before the cpu is taken out of reset then power will be applied.
darkspr1te
FM Radio
One more thought.
It is known that manufacturer disabled the FM radio. If someone knows which pins exactly should be disconnected from the ground, that would be nice to check if there's any chance to use them for radio. This is U29001 chip, pages 221 and 235. I see a number of pins with name starting FM_...
FM_LNAVSS = B2
FM_PLLVSS = B3
FM_LNAVCOVDD = A1
FM_VCOVSS = A2
FM_PLLVDD = A3
Who knows the meaning of them? I see that all VSS ones are grounded, including those for Bluetooth. The question is about A1 and A3.
PS Tomorrow or on day after tomorrow I'll be hopefully able to try power on.
yakovpol said:
One more thought.
It is known that manufacturer disabled the FM radio. If someone knows which pins exactly should be disconnected from the ground, that would be nice to check if there's any chance to use them for radio. This is U29001 chip, pages 221 and 235. I see a number of pins with name starting FM_...
FM_LNAVSS = B2
FM_PLLVSS = B3
FM_LNAVCOVDD = A1
FM_VCOVSS = A2
FM_PLLVDD = A3
Who knows the meaning of them? I see that all VSS ones are grounded, including those for Bluetooth. The question is about A1 and A3.
PS Tomorrow or on day after tomorrow I'll be hopefully able to try power on.
Click to expand...
Click to collapse
VSS often means ground on IC's, VDD is power for IC's
PLL is Phase Locked Loop, this often refers to a antenna tunner,
at a Guess B2,B3,A2 goto ground, A1, A3 to power.
The diagram confirms this, A1,A3 get power from VDD_LN,
B1 is labled FM_RFIN, at a guess FM antenna IN, this normal is connected to headphones via some components(not sure exactly what parts)
You would need to not only check to see if the rquired hardware is there but also have access to the API/chip to switch on the FM input then decode it via the I2C audio channel which will mean changes to the kernel (trust me there, i had same issue with a Rockchip device with FM chip)
NOTE: the page 235 shows the BGA pinouts, not all may be connected on the board.
darkspr1te
QFUSE is not used!
Some good news here.
After some preparations I finally tried to boot the motherboard with putting BOOT_CONFIG_6 to TRUE. And I could get
USB HID v1.11 Device [HID 05c6:f006]
as a result. But it doesn't stay such, it enumerates once again to 05c6:f006, then switches to 05c6:f008 and remains so.
What I did is:
Unfortunately, I do not have soldering iron tidy and small enough for putting a wire on a resistor which provides BOOT_CONFIG_6 for the CPU. So I simply took a piece of wire sodered to a resistor 1K and connected two pins on sides. While I was holding pins connected to + and CPU side of the resistor, my wife connected a USB. At the same time I was watching
watch -n1 "lsusb | grep 05c6"
and
tail -f /var/log/kern.log
What I found: 1) the battery should be attached in order to get 05c6:f006; 2) pins are not sharp enough, needles should be used; 3) I should probably change the signal on other BOOT_CONFIG_0 and BOOT_CONFIG_1 to have it booting from external SD-card.
The questions: should I hold BOOT_CONFIG_6 on TRUE during all process long, or it will be enough for a few seconds? Or should I press some buttons during the moment when I have 05c6:f006?
As for the Antenna input of U29001 MDM9215M (FM_RFIN, B1), it is next to the edge/side of chip. Theoretically it is possible to connect there a wire, because there's a gap in between motherboard and the chip. But I'm sure special tools needed here and sides are covered by glaze.
Seems to be no profit in f006
Service manual shows quite tricky booting sequence. I loose hope it this approach
What I found is hardware/software solution Octoplus/Octopus. It has surprisingly much info included, mentioning no-JTAG booting problem solution by their software with single TP used on the motherboard. I attach here the way it is described.
By doing so I did not notice any enumeration after releasing the TP.
Encouraging fact is there exists non-JTAG (almost software-only) solution .
EDIT: I realised that TP is for hard hard brick, when no 9008 device comes up via USB on boot.
yakovpol said:
Service manual shows quite tricky booting sequence. I loose hope it this approach
What I found is hardware/software solution Octoplus/Octopus. It has surprisingly much info included, mentioning no-JTAG booting problem solution by their software with single TP used on the motherboard. I attach here the way it is described.
By doing so I did not notice any enumeration after releasing the TP.
Encouraging fact is there exists non-JTAG (almost software-only) solution .
EDIT: I realised that TP is for hard hard brick, when no 9008 device comes up via USB on boot.
Click to expand...
Click to collapse
That TP could be the DAT0 test point which stop the device from actually detecting a EMMC flash and will cause it to only follow the PBL. can you give me some timings on when the device switches USB VID/PID, like 1 sec on 9006, two on 9006.
The boot happens the moment the device see's power, normally for just getting the cpu up the usb power is enough although a few times i found that was not enough and had to use battery but that may have been usb port (front are poor for power) or the desktop itself.
as the boot path is emmc - sdcard - pbl in that order, if you notice that only changing one of the boot_0/1 skips the first boot option which is emmc so only one need to be targeted, see captive dev thread on unbrickable mod to get the basic idea of that , i think i posted that link a few posts back.
darkspr1te
To be continued
Long story short: I was very busy because of my work/obligations and did not write here in April.
I needed the phone much, so I tried to find an appropriate technician where I live now. I gave the phone to him, and he requested US$80 for repair. I refused and took the phone back. Then I realized that that technician used JTAG and phone became hard hard brick (100% dead, no 9008 state or any other sign of life). Removing lot of fluxing material I discovered short circuit between two JTAG contacts. I removed it and the phone came back to the hard brick state. Meanwhile I purchased Medusa Box (along with shipping and taxes it cost me US$128) and used it for so called USB repaire (the software knows HEX and all other things needed to work with e980's APQ8064T QDL mode, no JTAG needed). The phone came back to life.
I would sniff USB bus during communication with the phone in QDL mode and continue finding a way to boot it from sdcard. And I want to get FM radio working.
A chance to get HEX file
Recently I had to use testpoint on the motherboard to enter QDL mode again. I took the opportunity to sniff USB traffic while using Medusa box for restoring the bootloader, so I hope in the PCAP files I have HEX file is present. If someone wants to help me to extract it, please let me know with a private message or give me a hint how to do it.
Related
My BA kepps on hard resetting
here's a mystery : while not connected to the charger (althogh the battery is charged) the BA will not turn on. if i plug it to the charger, it then wakes up and starts as if it was hard reset but wether i wait for 20 seconds and do nothing (just keep looking on the "Windows Mobile ...tap the screen to....") or proceed with the touch screen alignment untill it gets to to setting up the device - it all of a sudden hard reset again !! any idea any 1 ? what could that be ?
OK, I solved the problem After thinking for a while on the matter and after looking in the hardware specs at WIKIS link ( http://www.electronicproducts.com/whatsinside/viewteardown.asp?filename=HTC_XDA_III_web.html ) I came across a fuse which was burnt - I replaced it and VOILA !!! the device is once again operational. attached is the picture of the fuse. i hope it will help anyone who has a similar problem. enjoy, yol.
Are you sayin that there is a fuse that you DONT need to solder in there? I had a look at that page and got no were. Did add the link to wiki techy section
Basicly, this a soldered SMD fuse. i took the wire out of a 2A regular fuse and solder it to the burnt SMD fuse as i curently dont have a fuse like the original one (i made this just for checking it solves the problem - which it does) - i will get a fuse like that on thursday and replace it with the bad one. MDAIIIUser, I think there should be a page or a section that has to do more with hardware and technical stuff, a page that will gather this kind of information from all users...
Yol Well I for one won't be doing that upgrade as I have enough problems getting my eggs in the pan for breakfast. Wiki is the place for that Info on how to do a page is here http://wiki.xda-developers.com/index.php?pagename=BA_Wiki_Development Example of a wiki page on that same page http://wiki.xda-developers.com/index.php?pagename=Wiki_Fromat
[Q] Where to get a motherboard?
Hello, I somehow managed to burn my kindle fire down by accidentally pluging it to an stereo amps output jack. It turned off instantly and never have got it past the TWRP boot logo nor with a factory cable or the motherboard short circuiting the connections mentioned on another thread. Nothing works. So, I searched for a new motherboard, found one and ordered it on ebay. Did not receive it within 1,5 months. Seller made a refund. Now I am searching for another one but cant seem to find any place where to get a replacement mobo. I would really like to go the road that consists of just the mobo, not the whole kindle with a broken screen or smth as I do not want to receive a piece of crap that has been floating in the pool for a week and then sold as "just broken screen, returns not accepted". In conclusion- if any one of you could point me in any direction I would be really really grateful. Thanks in advance.
Have you tried resetting the bootmode? [Edit:] Nothing about your statement makes a whole lot of sense. Typically, when your device hangs at the boot screen, it means it's in fastboot and is usually as simple as changing the bootmode to normal. A factory cable wouldn't work because it forces the device into fastboot mode. The shorting trick is just as useless because it boots the device into USBboot mode. Besides, if you had fried your motherboard I don't think your device would even turn on. [Edit:] What I think is more likely, assuming your amp output is a USB micro-b connector, is the connector is probably configured in the same way as a factory cable, forcing you into fastboot.
if you mean like with the kfu to set to normal boot mode- nothing, absolutely nothing there is mentioned on this forum works as something is fried near to the audio output jack, did not see any burnt resistors or anything else, but I am sure something is really f*ed up on the board itself where setting any bootmodes won't help. It seems that the kf turns off right after the twrp "press power button for recovery" which I cant enter and the device turns itself off about 15 secs in to boot just at the moment where bootanim should start. If there have not been any breaktrough methods discovered in the last 1.5 months on the topic of unbricking I am pretty sure that any attemt will end in a failure, so lets get back to the main topic - where could I score a working mobo?
skrubis said: but I am sure something is really f*ed up on the board itself where setting any bootmodes won't help Click to expand... Click to collapse You may be right, but you'll be pretty pissed off if you buy a new motherboard just to find out it was a software issue all along. Before spending any money you should check that your drivers are in order (perhaps reinstall them) and try again. When you use the factory cable, does it still shut itself down?
Yeay that would be unnecessary if this was just a software problem. I think the audio jack got a 12v dc blasted straight in to it from my car battery. The kf turns itself off at any attempt to do anything, except it stayed on with kf unbricker one of the adp attempts. nothing else (even the short circuiting the motherboard pin to grnd did not work)
skrubis said: Yeay that would be unnecessary if this was just a software problem. I think the audio jack got a 12v dc blasted straight in to it from my car battery. Click to expand... Click to collapse Yeah, that would probably do it. There's another thread here somewhere where buying another motherboard was being discussed. I'll post it if I can find it.
skrubis said: if you mean like with the kfu to set to normal boot mode- nothing, absolutely nothing there is mentioned on this forum works as something is fried near to the audio output jack, did not see any burnt resistors or anything else, but I am sure something is really f*ed up on the board itself where setting any bootmodes won't help. It seems that the kf turns off right after the twrp "press power button for recovery" which I cant enter and the device turns itself off about 15 secs in to boot just at the moment where bootanim should start. If there have not been any breaktrough methods discovered in the last 1.5 months on the topic of unbricking I am pretty sure that any attemt will end in a failure, so lets get back to the main topic - where could I score a working mobo? Click to expand... Click to collapse I don't know where to get a mobo in such conditions but I'd like to offer my 2 cents, have you tried reflashing recovery? when I first started testing Hashcode's ICS on my Kindle I'd see exactly the same behavior (since I didn't plug it into a live stereo output I had no reason to think something was wrong with the motherboard) so I tried flashing TWRP again and got it to work just fine. Again, this is something that might/might not work but you can as well try it while you find where to get a new mobo, who knows, maybe it works and you save yourself some bucks
So I found a dead kindle at the local classifieds for roughly 10 bucks in US currency and brought it home and switched the motherboards, sure enough the kindle boots as new. If anyone wants my old mobo to thinker with I will gladly give it to anyone who is willing to cover those 2-3 bucks for international shipping. Thank you for your support!
[Discussion] Direct access to e-MMC to fix bricked KF (HD 8.9 version)
Hello my brothers from the KF HD 8.9" forum! I come from over yonder at the KF2 forum with some useful information. Several months ago, I started this thread about "hacking" a KF2 in order to restore it from hardbrick. Well, thanks to a generous donation from @v0id7, I've finished the first steps of the process for 8.9" devices ! Unfortunately, as I do not have a spare 8.9" sitting around, all I can do is provide the pinout for continuing the process (although, v0id7 has mentioned to me that he is going to test it out on his device).
I have most of the process for the KF2 outlined over on this guide (minus the software part for now), but if you don't want to read that or the other post, here's a short rundown: You solder to a few points on the motherboard, allowing you to bypass the KF's processor and directly access the information on the eMMC. This allows you to reflash whatever it was that you flashed in the first place to kill said KF.
Once I have word from v0id7 that this does indeed work on the 8.9" (which I can't foresee it not working), I'll probably set up a guide specifically for the 8.9", as well.
I'm also in the process of prototyping something that would allow access without soldering. Hopefully I'll have the prototype done in the next few days here.
Let me know if you have any questions/comments/concerns.
...and now that I've blathered on for a while, here's the pinout:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
kurohyou, You are the King of all that is Kindle! you are an evil genius my friend.
Thanks kurohyou for your efforts. I tried to put all this together but unfortunately without success. Linux cannot open the block device reporting "No medium found". Full dmesg output is available upon request but in general the kernel usb driver keeps resetting the usb device and the usb reader led keeps flashing. I also observed the following. When VccQ is disconnected I can measure a steady Vcc voltage of 3.12V being passed to the board. When I connect the VccQ as show in the picture, the Vcc (and VccQ) drops to 0V just like being shortened. Not being an hardware expert I suspect that VccQ input point may be incorrect. Also I'm not very sure I get the exact Vcc soldering point from the picture posted. Even when I zoom it is not very clear where to solder to. I soldered Vcc to the right connection of a very small component (not sure resistor or capacitor) that sits between two relatively larger components above and below. Is this correct?
v0id7 said: Thanks kurohyou for your efforts. Click to expand... Click to collapse No, thank you for your donation and continuing the work! v0id7 said: I tried to put all this together but unfortunately without success. Linux cannot open the block device reporting "No medium found". Full dmesg output is available upon request but in general the kernel usb driver keeps resetting the usb device and the usb reader led keeps flashing. I also observed the following. When VccQ is disconnected I can measure a steady Vcc voltage of 3.12V being passed to the board. When I connect the VccQ as show in the picture, the Vcc (and VccQ) drops to 0V just like being shortened. Not being an hardware expert I suspect that VccQ input point may be incorrect. Click to expand... Click to collapse That's a bit odd. I rechecked everything and it's all correct. What happens if you connect VccQ and leave Vcc disconnected? v0id7 said: Also I'm not very sure I get the exact Vcc soldering point from the picture posted. Even when I zoom it is not very clear where to solder to. I soldered Vcc to the right connection of a very small component (not sure resistor or capacitor) that sits between two relatively larger components above and below. Is this correct? Click to expand... Click to collapse Yes, you are correct. Vcc as labelled in the photo above is the small component between the two larger components, the side opposite of the heat shield mount (or as looking at the board as above, the right side). Since it's not working with the current setup, though, hopefully that means we don't even need the Vcc point (fingers crossed). Also, while waiting for your response, I'm going to take some time to apply voltage to the VccQ point and see if I get a voltage measurement at the Vcc pins on the eMMC mount pins. I might also take a moment to look at the data sheet for the eMMC itself if I can find it, too. I'll post again when I have some info.
It works! it works like a charm! Here are my partitions (cat /proc/partitions) where sdb is the USB card reader: major minor #blocks name 8 0 625131864 sda 8 1 102400 sda1 8 2 625027072 sda2 11 0 695600 sr0 7 0 547860 loop0 8 16 30535680 sdb 8 17 128 sdb1 8 18 256 sdb2 8 19 64 sdb3 8 20 16 sdb4 8 21 2 sdb5 8 22 10240 sdb6 8 23 65536 sdb7 8 24 16384 sdb8 8 25 8192 sdb9 8 26 8192 sdb10 8 27 907264 sdb11 8 28 665600 sdb12 8 29 28853248 sdb13 8 32 3834912 sdc 8 33 3785472 sdc1 Sorry for my previous post. It was my fault incorrectly tweaking CD_SW. Tomorrow I'll reflash the boot partition sdb10 and I'll post the results here. Great job kurohyou!
v0id7 said: Tomorrow I'll reflash the boot partition sdb10 and I'll post the results here. Click to expand... Click to collapse Ups and downs! I flashed boot and recovery partitions but the Kindle still doesn't show any signs of life. Before the flashing, when powered on it was at least detected for a second as OMAP device. Now its absolutely quiet. What I did is flashing freedom-boot-8.4.6 to partition 10 and twrp-2.6.3.1-recovery to partition 9. dd if=kfhd8-freedom-boot-8.4.6.img of=/dev/sdb10 dd if=kfhd8-twrp-2.6.3.1-recovery.img of=/dev/sdb9Correct me if I'm wrong but IMO even just the boot patition should be sufficient to get control in fastboot mode. Any ideas how to continue from here? And two more questions: What behavior should I expect when connecting just the board with its USB cable to the USB port of a computer (no battery, no wifi board, no display, no power/volume controls). Is it mandatory to disconnect all soldered wires from the board to the USB reader when powering the motherboard on?
v0id7 said: Ups and downs! I flashed boot and recovery partitions but the Kindle still doesn't show any signs of life. Before the flashing, when powered on it was at least detected for a second as OMAP device. Now its absolutely quiet. What I did is flashing freedom-boot-8.4.6 to partition 10 and twrp-2.6.3.1-recovery to partition 9. dd if=kfhd8-freedom-boot-8.4.6.img of=/dev/sdb10 dd if=kfhd8-twrp-2.6.3.1-recovery.img of=/dev/sdb9Correct me if I'm wrong but IMO even just the boot patition should be sufficient to get control in fastboot mode. Any ideas how to continue from here? Click to expand... Click to collapse Try flashing it back to stock and seeing if there is any difference. Also, you might have to let it charge for a while. I think hard-bricking discharges the battery. I can't remember if I got anything when I first plugged it in or not. If flashing to stock doesn't work, try passing bs=1 when you use dd. That somehow made all the difference for someone on the original KF2 thread. Also, keep in mind, if you're putting the motherboard back in the case to hook it up, you need to shield the contacts on the bottom from the case. A quick measure with my DMM showed that the inside of the back case is conductive! Only semi-related: I was trying to find the partition layout for the 8.9", but a quick search didn't yield anything. Do you happen to have a link to it? I'd like it for reference and to place on the website I'm making. v0id7 said: What behavior should I expect when connecting just the board with its USB cable to the USB port of a computer (no battery, no wifi board, no display, no power/volume controls). Click to expand... Click to collapse I honestly don't know. I never really thought to try. My only guess would be that bootup would probably fail because the motherboard couldn't recognize its devices? I must admit that I'm not particularly familiar with the boot process, so it's just a shot in the dark. v0id7 said: Is it mandatory to disconnect all soldered wires from the board to the USB reader when powering the motherboard on? Click to expand... Click to collapse I never tried it any other way. My concern with leaving them connected is that you're now passing power back to the SD card reader, so it could result in some funny business. If you're concerned about having to resolder to the motherboard multiple times, I suppose a safer alternative would be to desolder all the wires from the SD card reader and keep them from shorting. You also might be able to get away with just desoldering the supply wires (Vcc and VccQ) and keeping them insulated from contacting anything (including each other).
kurohyou said: Try flashing it back to stock and seeing if there is any difference. Also, you might have to let it charge for a while. I think hard-bricking discharges the battery. I can't remember if I got anything when I first plugged it in or not. If flashing to stock doesn't work, try passing bs=1 when you use dd. That somehow made all the difference for someone on the original KF2 thread. Click to expand... Click to collapse I'm on it. Luckily I have stock backup. kurohyou said: I was trying to find the partition layout for the 8.9", but a quick search didn't yield anything. Do you happen to have a link to it? I'd like it for reference and to place on the website I'm making. Click to expand... Click to collapse Taken from stock firmware: mmcblk0p1 xloader mmcblk0p2 bootloader mmcblk0p3 idme mmcblk0p4 crypto mmcblk0p5 misc mmcblk0p6 dkernel mmcblk0p7 dfs mmcblk0p8 efs mmcblk0p9 recovery mmcblk0p10 boot mmcblk0p11 system mmcblk0p12 cache mmcblk0p13 userdata
What did you do that hardbricked it in the first place? I may be mistaken, but I thought that overwriting boot wasn't an issue, it was bootloader that generally did it?
All, I think I have to stop here. Yesterday while soldering the wires for second time I caused unrecoverable damage to the board – the CLOCK pad got torn off of the PCB. I guess I have overheated the pad. Anyway, I do believe that the approach of unbricking kfhd89 with directly flashing the eMMC will work! The pinout provided by @kurohyou proved to be correct – I successfully got access to the flash partitions. I just thoroughly sorry that during my first attempt I flashed the boot partition instead of the bootloader (which was actually the faulty one). kurohyou said: What did you do that hardbricked it in the first place? I may be mistaken, but I thought that overwriting boot wasn't an issue, it was bootloader that generally did it? Click to expand... Click to collapse I bricked my Kindle by flashing bootloader with incomplete download. I was happily running CM10.1 for quite a long time but decided to upgrade TWRP and didn’t check the md5s . I hope there will be someone with "brave heart" and bricked Kindle to continue this project as we are only a step away from marking it as confirmed.
v0id7 said: All, I think I have to stop here. Yesterday while soldering the wires for second time I caused unrecoverable damage to the board – the CLOCK pad got torn off of the PCB. I guess I have overheated the pad. Click to expand... Click to collapse Ouch. I hate when that happens. I can't say I haven't been there before, too, though. There may still be some hope for repairing it. I'll track down another point. If you don't want to mess with soldering again, you can always send it to me once I finish this solderless access device. I'm just waiting for UPS to deliver a pair of Loc Line pliers (I was supposed to get them on Tuesday) so I can finish drilling some holes in these nozzles to feed the wire. I hope to have it completed and tested (with pictures) by the beginning of next week. If you want a general idea of what it will look like, take a look at this and imagine spring-loaded contact probes in place of the alligator clips. Also, JohnnyLawless is in my neck of the woods and needs his device repaired, so we're planning to meet up and make it happen. At that time, I'm planning on taking pictures and screenshots for a guide.
kurohyou said: There may still be some hope for repairing it. I'll track down another point. Click to expand... Click to collapse If you spare time on this I'll try again.
I did a quick jaunt around the board and nothing was really standing out to me. There probably is another point, but it probably is one of the tiny components on there. There's no way soldering to one of those would work. There's a few options left, but neither are really pretty or easy. The first would be to carefully expose the via that was underneath the pad and use a spring-loaded contact probe to make a connection. The second would be to repair the pad, which involves a new pad (or the old pad if it's still in good shape) and epoxy. Again, if you're willing to send it my way, I'd be happy to give both of those a try for you, or I can provide you with the instructions for the device I'm working on (once I'm finished) or a link to some videos about PCB pad repair.
kurohyou said: I did a quick jaunt around the board and nothing was really standing out to me. There probably is another point, but it probably is one of the tiny components on there. There's no way soldering to one of those would work. There's a few options left, but neither are really pretty or easy. The first would be to carefully expose the via that was underneath the pad and use a spring-loaded contact probe to make a connection. The second would be to repair the pad, which involves a new pad (or the old pad if it's still in good shape) and epoxy. Click to expand... Click to collapse Thanks kurohyou. This thread is yours but I really believe we should keep it general and as close as possible to its subject. The issue with my clock pad is quite specific and off-topic. kurohyou said: Again, if you're willing to send it my way, I'd be happy to give both of those a try for you, or I can provide you with the instructions for the device I'm working on (once I'm finished) or a link to some videos about PCB pad repair. Click to expand... Click to collapse Forget about my board. Spending more efforts on it is not worthy. I would rather buy a new one, brick it and resume the tests .
no title gonna try this out. (cant send mine cause sending charges are too high since i live in uruguay)
If he doesn't respond i might be willing to attempy to fix it, finally got a new soldering tip meant for small circuitry(st7). All I need is a sdcard reader and some small gauge wire. Sent from my LG-P769 using xda app-developers app
I'll give it a shot. I'm going to try this soon, but I've got a couple of quick questions. 1. I'm not familiar with enamel-coated magnet wire, but it's the only 30-gauge I could find. Is it bad to use? 2. I found a MicroSD-only card reader more easily in stores than SD-only. I'm guessing it would be more difficult to solder due to the size. Would it be the same otherwise?
Prime Mover said: I'm going to try this soon, but I've got a couple of quick questions. 1. I'm not familiar with enamel-coated magnet wire, but it's the only 30-gauge I could find. Is it bad to use? 2. I found a MicroSD-only card reader more easily in stores than SD-only. I'm guessing it would be more difficult to solder due to the size. Would it be the same otherwise? Click to expand... Click to collapse I am new to this thread but I would like to help out with this cause. I have a hard-bricked motherboard that I can donate to anyone willing to attempt Kurohyou's soldering fix to this problem. It is for a 8.9 Kindle and I have little soldering experience, thus I would have no problem with donating my board in order to further this thread's progress. If I can be of help go ahead and pm me or respond to this post.
1. I'm not familiar with enamel-coated magnet wire, but it's the only 30-gauge I could find. Is it bad to use? Click to expand... Click to collapse Enamel coated wire serves different purpose and is much more difficult to strip the insulation at the ends before soldering. I would recommend regular solid-core hook-up wire with PVC insulation. 30-gauge is not a must. 26 would do just fine. 2. I found a MicroSD-only card reader more easily in stores than SD-only. I'm guessing it would be more difficult to solder due to the size. Would it be the same otherwise? Click to expand... Click to collapse I haven’t tried soldering on MicroSD-only card reader but I guess it will be difficult and more error-prone. Otherwise AFAIK they share same signaling interface. The only difference is that MicroSD has just one ground pin (while SD has two).
Hello v0id7, v0id7 said: I'm on it. Luckily I have stock backup. have you flashed your backed-up boot.img and rescue.img to successfully boot? And how do you extract the partitions from the amazon update .bin file? I think I will give this method a try. I didn't solder for a long time now, but let us see. Do you own KFHD now? Have a nice day. giderBey Click to expand... Click to collapse
[SOLVED][URGENT]Semi-hardware Brick?
Is my CPU damaged? My phone is having random reboots at certain times as I have mentioned in this thread:http://forum.xda-developers.com/xperia-m/help/help-strange-reboots-malfunctioned-t3148493 I came to the conclusion that the phone believes that the VOLUME_UP Key is being constantly held down. I used a multi-meter and checked the side keys. Everything checked fine. Then I opened the phone and tested the LINK FPC. The FPC is A-OK. Does this mean that the CPU pins are internally shorted or something? Even if it's the mobo and not the CPU, no-one is going to sit there de-soldering and soldering the parts on to a new board. And if so, what could cause such a scenario? I can't even flash back to stock, so forget about warranty. The LDIs are still white, so definitely not water damage. So I now have a device which is perfectly functioning(for the most part), but is extremely unsuitable as a daily driver.
Never experienced something like this but i would: Try a battery pull and hold the power button for at least 30 sec with the battery removed Check the side button again and pay attention to the small metal piece on the switch which makes the "click" sound. If you think you can put it back then remove it (be careful i lost mine) I think you can flash the .sin files manually via fastboot using the flashtool. If you can't flash stock then try other roms (try CM12.1)
side buttons on this phone are preatty low quality, I saw many cases that they broke for no reason. btw I don't belive that 68 celsuis degrees can broke processor. In hot days my xperia had over 60 degrees too, as well as my android tablet.
iks8 said: side buttons on this phone are preatty low quality, I saw many cases that they broke for no reason. btw I don't belive that 68 celsuis degrees can broke processor. In hot days my xperia had over 60 degrees too, as well as my android tablet. Click to expand... Click to collapse Thanks for ruling the processor heat out. I tested the button and the fpc. Both tested OK. I haven't inspcted the processor because it is under a metal can. Any thoughts on what might have gone wrong?
Ydraulikos said: Never experienced something like this but i would: Try a battery pull and hold the power button for at least 30 sec with the battery removed Check the side button again and pay attention to the small metal piece on the switch which makes the "click" sound. If you think you can put it back then remove it (be careful i lost mine) I think you can flash the .sin files manually via fastboot using the flashtool. If you can't flash stock then try other roms (try CM12.1) Click to expand... Click to collapse I tested continuity with multimeter. Tested at the connector to the motherboard. No short and closed loop when actually pressing the button. Tried battery pull. Don't think it's a software issue. The phone goes into fastboot when plugging phone into computer when powered off, so it is definitely a hardware issue. No reason the bootloader should have failed, but in a way that android can boot. Not to mention that holding vol down causes QC download mode (QC is triggered by both volume keys(can't get in to flashmode now)), so even a mode built in to the processor is wrongly detecting vol up pressed. The bottom line is, it is a hardware issue. I'll stick to cm11 because it allows me to use a volume quick toggle as a substitute for the volume key. The major concern/problem is the crashing caused by th volume key.
so try to change your buttons, I guess you have some electroinc experience. Search for "xperia m flex cable" on ebay, they are about 5-10$. Maybe buttons are causing short circuit and this causing reboot.
iks8 said: so try to change your buttons, I guess you have some electroinc experience. Search for "xperia m flex cable" on ebay, they are about 5-10$. Maybe buttons are causing short circuit and this causing reboot. Click to expand... Click to collapse Turns out my multimeter was showing >2000k as overload, so I used a different one. The link FPC was tested to be damaged. The power button shows infinite open resistance, the vol down shows about 7k open resistance and the vol up shows 2.2k. I guess the pull up/pull down resistors in Xperia m must be quite strong so only vol up shows as a short. Not quite a short though, so I wonder what is causing it. I searched link FPC at first, but the results were £14. After searching flex cable, I found it for £5. I ordered it, so thanks for the money saving tip. I'll report back with the results. P.s. how reliable at the buttons on Xperia z3 compact? Sent from an ARM powered device, running software that isn't oversimplified and actually "just works"
Simple flex replacement has fixed my phone. ????????? Sent from an ARM powered device, running software that isn't oversimplified and actually "just works"
Note2 N7100 dead - bootsd card image to repair
Hi my friends, I have an N7100 which is dead, I tried pluggging lab supply and it shows current from 0 to 0.20 amperes while pressing power button then goes back to 0. I suspect it needs boot repair but I can't seem to find a good sdcard image to repair it. Can anyone help please. I would also need the steps to flash it , I would have to check the current consumption to see it's actually doing the flashing progress right?. I already followed samsung service flowchart to check U500 and nearby capacitors to see if there's voltage there but I Measure no voltage on those caps, no shorts also. Samsung says to replace U501 which is a transistor if there are no voltages on U500 caps. I also checked U501 transistor and saw there's a signal OTG_EN which comes from eMMC I think. Anyways I was thinking also to reflow U500 but how can I discard U500 needs a reflow or it's an SD Boot repair problem? So many thanks my friends.