Guidance for recovering "bootlogo" FireTV Stick (Montoya) via adb

Guidance for recovering "bootlogo" FireTV Stick (Montoya) via adb - Fire TV Q&A, Help & Troubleshooting

Hello everyone,
i am currently trying one last time to recover my Fire TV Stick. It lay on my shelf with a boot loop for quite a white (sometime in 2015),
but i thought i give it one last try and ask you guys for help.
So i bought a fastboot/a-to-a usb cable, to connect it, and i can actually connect via adblink v2.0.5, that is, the adb shell shows
"[email protected]", and i can see its file system, although i don't know if i have root access.
First some facts:
- Fire TV Stick "Codename Montoya"
- Possibly Firmware 5.0.51 or the next one that came along (5.2.1.0 ? - can i find this out via adb?)
- no custom recovery
- may have root access due to KingRoot app, SuperSU
- i installed some desktop / app manager app, maybe even with auto boot mode (to kodi, i think it was firestarter)
- boots to animated "Fire TV Stick" logo
- usb adb connection is stable, so no reboots or actual "loop", just the animated logo
How i ****ed it up:
- at the time, i had the vulnerable 5.0.5 firmware on the stick, and found out about the KingRoot method, wanted to stop
amazon pushing further updates, as i was quite content with the status quo
- i am/was a big fool trying kingroot via sideloaded .apk, then remove/replace with superSU because i didnt trust kingroot
- i got lucky, as it actually rooted my device after several runs, but then i could not remove kingroot, as it wouldnt let me
- i think i tried some root apps manager to remove kingroot, thats when the boot loop problem happened
- i thought i was an even bigger fool trying to recover the stick via pushing the buttons on the remote at boot, as it could have
reset the fire stick, so it is not connecting to wifi/adb would be disabled
Luckily, as it turns out, i can still access via adb, so maybe not everything is lost?
Back then I hadn't used adb much, only to sideload apks to the firetv stick, so i am not sure if there is any possibility to recover the stick.
Can you point me in the right direction? From here on i don't have a clue what to do/look for on the device.
Logs? Error messages? Whatever may help you to help me, just ask!
Thank you very much! Any help is appreciated!
Greetings from Germany
deadlockfx
//edit:
This looks like i do actually have root access, right?
[email protected]:/ $ su
su
1|[email protected]:/ $
Click to expand...
Click to collapse
PS Output:
[email protected]:/ $ ps
ps
USER PID PPID VSIZE RSS WCHAN PC NAME
root 1 0 920 484 ffffffff 00000000 S /init
root 2 0 0 0 ffffffff 00000000 S kthreadd
root 3 2 0 0 ffffffff 00000000 S ksoftirqd/0
root 4 2 0 0 ffffffff 00000000 S kworker/0:0
root 5 2 0 0 ffffffff 00000000 S kworker/u:0
root 6 2 0 0 ffffffff 00000000 S migration/0
root 7 2 0 0 ffffffff 00000000 S migration/1
root 8 2 0 0 ffffffff 00000000 S kworker/1:0
root 9 2 0 0 ffffffff 00000000 S ksoftirqd/1
root 10 2 0 0 ffffffff 00000000 S khelper
root 11 2 0 0 ffffffff 00000000 S netns
root 12 2 0 0 ffffffff 00000000 S suspend
root 13 2 0 0 ffffffff 00000000 S i2c_master_rese
root 14 2 0 0 ffffffff 00000000 S i2c_master_rese
root 15 2 0 0 ffffffff 00000000 S i2c_master_rese
root 16 2 0 0 ffffffff 00000000 S i2c_master_rese
root 17 2 0 0 ffffffff 00000000 S knllog
root 18 2 0 0 ffffffff 00000000 S sync_supers
root 19 2 0 0 ffffffff 00000000 S bdi-default
root 20 2 0 0 ffffffff 00000000 S kblockd
root 21 2 0 0 ffffffff 00000000 S kworker/0:1
root 22 2 0 0 ffffffff 00000000 S khubd
root 23 2 0 0 ffffffff 00000000 S cfg80211
root 24 2 0 0 ffffffff 00000000 S kworker/1:1
root 25 2 0 0 ffffffff 00000000 S rpciod
root 26 2 0 0 ffffffff 00000000 S bcm_hsotgctrl_e
root 27 2 0 0 ffffffff 00000000 S khungtaskd
root 28 2 0 0 ffffffff 00000000 S kswapd0
root 29 2 0 0 ffffffff 00000000 S ksmd
root 30 2 0 0 ffffffff 00000000 S fsnotify_mark
root 31 2 0 0 ffffffff 00000000 S nfsiod
root 32 2 0 0 ffffffff 00000000 S crypto
root 50 2 0 0 ffffffff 00000000 S VCHIQka-0
root 51 2 0 0 ffffffff 00000000 S VCHIQ-0
root 52 2 0 0 ffffffff 00000000 S VCHIQr-0
root 53 2 0 0 ffffffff 00000000 S VCHIQs-0
root 54 2 0 0 ffffffff 00000000 S vc-watchdog
root 55 2 0 0 ffffffff 00000000 S kworker/u:1
root 62 2 0 0 ffffffff 00000000 S dwc_otg
root 63 2 0 0 ffffffff 00000000 S DWC Notificatio
root 64 2 0 0 ffffffff 00000000 S f_mtp
root 65 2 0 0 ffffffff 00000000 S file-storage
root 66 2 0 0 ffffffff 00000000 S kinteractiveup
root 67 2 0 0 ffffffff 00000000 S SPUM proc threa
root 68 2 0 0 ffffffff 00000000 S SPUM done threa
root 73 2 0 0 ffffffff 00000000 S SPUM proc threa
root 74 2 0 0 ffffffff 00000000 S SPUM done threa
root 79 2 0 0 ffffffff 00000000 S binder
root 80 2 0 0 ffffffff 00000000 S irq/156-caph-in
root 81 2 0 0 ffffffff 00000000 S AudioCtrlWq
root 82 2 0 0 ffffffff 00000000 S VC-FB-Read
root 83 2 0 0 ffffffff 00000000 S SMIO
root 84 2 0 0 ffffffff 00000000 S mmcqd/0
root 85 2 0 0 ffffffff 00000000 S mmcqd/0boot0
root 86 2 0 0 ffffffff 00000000 S mmcqd/0boot1
root 87 2 0 0 ffffffff 00000000 S mmcqd/0rpmb
root 88 1 892 412 ffffffff 00000000 S /sbin/ueventd
root 90 2 0 0 ffffffff 00000000 S jbd2/mmcblk0p15
root 91 2 0 0 ffffffff 00000000 S ext4-dio-unwrit
root 94 2 0 0 ffffffff 00000000 S flush-179:0
root 96 2 0 0 ffffffff 00000000 S jbd2/mmcblk0p18
root 97 2 0 0 ffffffff 00000000 S ext4-dio-unwrit
root 98 2 0 0 ffffffff 00000000 S jbd2/mmcblk0p17
root 99 2 0 0 ffffffff 00000000 S ext4-dio-unwrit
root 104 2 0 0 ffffffff 00000000 S jbd2/mmcblk0p5-
root 105 2 0 0 ffffffff 00000000 S ext4-dio-unwrit
logd 113 1 6392 1044 ffffffff 00000000 S /system/bin/logd
root 114 1 1588 188 ffffffff 00000000 S /sbin/healthd
root 115 1 2388 1088 ffffffff 00000000 S /system/bin/lmkd
system 116 1 1244 564 ffffffff 00000000 S /system/bin/servicemanager
root 117 1 5800 1708 ffffffff 00000000 S /system/bin/vold
system 118 1 39476 9748 ffffffff 00000000 S /system/bin/surfaceflinger
system 119 1 8536 1840 ffffffff 00000000 S /system/bin/mcDriverDaemon
root 127 1 248 96 ffffffff 00000000 S /system/bin/debuggerd64
install 128 1 1944 908 ffffffff 00000000 S /system/bin/installd
root 131 1 21368 7224 ffffffff 00000000 S /system/xbin/vitals_collection_agent
system 141 1 6376 1180 ffffffff 00000000 S /system/bin/vclmk
system 142 1 2148 1092 ffffffff 00000000 S /system/bin/cecdaemon
keystore 143 1 4324 1724 ffffffff 00000000 S /system/bin/keystore
media_rw 145 1 3584 508 ffffffff 00000000 S /system/bin/sdcard
root 146 1 1320 456 ffffffff 00000000 S /system/bin/btremoted
root 147 1 1092 528 ffffffff 00000000 S /system/bin/sh
shell 148 1 5668 252 ffffffff 00000000 S /sbin/adbd
root 188 1 252 100 ffffffff 00000000 S /system/bin/debuggerd64
root 190 2 0 0 ffffffff 00000000 S mc_log
root 202 2 0 0 ffffffff 00000000 S kauditd
root 352 2 0 0 ffffffff 00000000 R kworker/0:2
graphics 473 1 17352 5420 ffffffff 00000000 S /system/bin/bootanimation
root 492 2 0 0 ffffffff 00000000 S flush-253:0
shell 504 148 1112 560 c00a2718 402fe8a4 S /system/bin/sh
system 546 1 29584 6936 ffffffff 00000000 S /system/bin/tvserver
root 825 1 816964 56016 ffffffff 00000000 R zygote
root 826 1 10696 1088 ffffffff 00000000 S /system/bin/netd
media 827 1 33508 9156 ffffffff 00000000 S /system/bin/mediaserver
drm 828 1 15376 6280 ffffffff 00000000 S /system/bin/drmserver
drm 850 828 15376 6280 ffffffff 00000000 S /system/bin/drmserver
shell 1083 504 2432 900 00000000 404216d0 R ps
Click to expand...
Click to collapse
When i try to disable OTA updates:
[email protected]:/ $ su
su
1|[email protected]:/ $ pm disable com.amazon.device.software.ota
pm disable com.amazon.device.software.ota
Error: Could not access the Package Manager. Is the system running?
Click to expand...
Click to collapse

deadlockfx said:
Hello everyone,
i am currently trying one last time to recover my Fire TV Stick. It lay on my shelf with a boot loop for quite a white (sometime in 2015),
but i thought i give it one last try and ask you guys for help.
So i bought a fastboot/a-to-a usb cable, to connect it, and i can actually connect via adblink v2.0.5, that is, the adb shell shows
"[email protected]", and i can see its file system, although i don't know if i have root access.
First some facts:
- Fire TV Stick "Codename Montoya"
- Possibly Firmware 5.0.51 or the next one that came along (5.2.1.0 ? - can i find this out via adb?)
- no custom recovery
- may have root access due to KingRoot app, SuperSU
- i installed some desktop / app manager app, maybe even with auto boot mode (to kodi, i think it was firestarter)
- boots to animated "Fire TV Stick" logo
- usb adb connection is stable, so no reboots or actual "loop", just the animated logo
How i ****ed it up:
- at the time, i had the vulnerable 5.0.5 firmware on the stick, and found out about the KingRoot method, wanted to stop
amazon pushing further updates, as i was quite content with the status quo
- i am/was a big fool trying kingroot via sideloaded .apk, then remove/replace with superSU because i didnt trust kingroot
- i got lucky, as it actually rooted my device after several runs, but then i could not remove kingroot, as it wouldnt let me
- i think i tried some root apps manager to remove kingroot, thats when the boot loop problem happened
- i thought i was an even bigger fool trying to recover the stick via pushing the buttons on the remote at boot, as it could have
reset the fire stick, so it is not connecting to wifi/adb would be disabled
Luckily, as it turns out, i can still access via adb, so maybe not everything is lost?
Back then I hadn't used adb much, only to sideload apks to the firetv stick, so i am not sure if there is any possibility to recover the stick.
Can you point me in the right direction? From here on i don't have a clue what to do/look for on the device.
Logs? Error messages? Whatever may help you to help me, just ask!
Thank you very much! Any help is appreciated!
Greetings from Germany
deadlockfx
//edit:
This looks like i do actually have root access, right?
PS Output:
When i try to disable OTA updates:
Click to expand...
Click to collapse
Im almost fully certain that you will be able to recover the stick with Windows version of KINGOROOT. Not KING ROOT, KINGO ROOT. Install this on to a windows laptop or pc and make sure your adb drivers are installed.
Connect your Fire stick up to pc with USB lead and run the KINGO ROOT pc application.
This should restore your messed up su files and boot you back up.
If you are on 5.0.5.1 try it numerous times. As 5.0.5.1 seems to work for some but not others. Good luck.

Thanks, im going to try that right away!
Do you know if Kingo Root is safe? Its one thing to fiddle with on android devices, another on my home laptop...
My virus scanner warns me of a PUA/InstallCore(gen) when i try to start it.
Edit:
Just went with it, and it concluded sucessfully! Connected it to the power suppy, and it went from the white amazon logo to the color fire tv animated logo, but not any further
But at least, when i connect via adb, it now shows
[email protected]:/ $ su
su
[email protected]:/ #
Click to expand...
Click to collapse
So the rooting process worked and i have proper root now!
Here is the ps log again, after the Kingo Root:
[email protected]:/ # ps
ps
USER PID PPID VSIZE RSS WCHAN PC NAME
root 1 0 920 484 c0150570 00029578 S /init
root 2 0 0 0 c00ad108 00000000 S kthreadd
root 3 2 0 0 c0094ea8 00000000 S ksoftirqd/0
root 4 2 0 0 c00a8d2c 00000000 S kworker/0:0
root 5 2 0 0 c00a8d2c 00000000 S kworker/u:0
root 6 2 0 0 c00d1870 00000000 S migration/0
root 7 2 0 0 c00d1870 00000000 S migration/1
root 8 2 0 0 00000000 00000000 R kworker/1:0
root 9 2 0 0 c0094ea8 00000000 S ksoftirqd/1
root 10 2 0 0 c00a9064 00000000 S khelper
root 11 2 0 0 c00a9064 00000000 S netns
root 12 2 0 0 c00a9064 00000000 S suspend
root 13 2 0 0 c00a9064 00000000 S i2c_master_rese
root 14 2 0 0 c00a9064 00000000 S i2c_master_rese
root 15 2 0 0 c00a9064 00000000 S i2c_master_rese
root 16 2 0 0 c00a9064 00000000 S i2c_master_rese
root 17 2 0 0 c004d65c 00000000 S knllog
root 18 2 0 0 c0115d04 00000000 S sync_supers
root 19 2 0 0 c0116cc8 00000000 S bdi-default
root 20 2 0 0 c00a9064 00000000 S kblockd
root 21 2 0 0 c00a8d2c 00000000 S kworker/0:1
root 22 2 0 0 c032a62c 00000000 S khubd
root 23 2 0 0 c00a9064 00000000 S cfg80211
root 24 2 0 0 c00a8d2c 00000000 S kworker/1:1
root 25 2 0 0 c00a9064 00000000 S rpciod
root 26 2 0 0 c00a9064 00000000 S bcm_hsotgctrl_e
root 27 2 0 0 c00d5cf0 00000000 S khungtaskd
root 28 2 0 0 c010d574 00000000 S kswapd0
root 29 2 0 0 c0130878 00000000 S ksmd
root 30 2 0 0 c0174c10 00000000 S fsnotify_mark
root 31 2 0 0 c00a9064 00000000 S nfsiod
root 32 2 0 0 c00a9064 00000000 S crypto
root 50 2 0 0 c0300510 00000000 S VCHIQka-0
root 51 2 0 0 c00b2600 00000000 S VCHIQ-0
root 52 2 0 0 c00b2600 00000000 S VCHIQr-0
root 53 2 0 0 c00b2600 00000000 S VCHIQs-0
root 54 2 0 0 c02e8574 00000000 S vc-watchdog
root 55 2 0 0 c00a8d2c 00000000 S kworker/u:1
root 62 2 0 0 c00a9064 00000000 S dwc_otg
root 63 2 0 0 c00a9064 00000000 S DWC Notificatio
root 64 2 0 0 c00a9064 00000000 S f_mtp
root 65 2 0 0 c036cf28 00000000 S file-storage
root 66 2 0 0 c03a72a4 00000000 S kinteractiveup
root 67 2 0 0 c00b2600 00000000 S SPUM proc threa
root 68 2 0 0 c00b2600 00000000 S SPUM done threa
root 73 2 0 0 c00b2600 00000000 S SPUM proc threa
root 74 2 0 0 c00b2600 00000000 S SPUM done threa
root 79 2 0 0 c00a9064 00000000 S binder
root 80 2 0 0 c00d6fb8 00000000 S irq/156-caph-in
root 81 2 0 0 c00a9064 00000000 S AudioCtrlWq
root 82 2 0 0 c00b2600 00000000 S VC-FB-Read
root 83 2 0 0 c00b2600 00000000 S SMIO
root 84 2 0 0 c03b6a24 00000000 S mmcqd/0
root 85 2 0 0 c03b6a24 00000000 S mmcqd/0boot0
root 86 2 0 0 c03b6a24 00000000 S mmcqd/0boot1
root 87 2 0 0 c03b6a24 00000000 S mmcqd/0rpmb
root 88 1 892 412 c0150570 00029578 S /sbin/ueventd
root 90 2 0 0 c01dd59c 00000000 S jbd2/mmcblk0p15
root 91 2 0 0 c00a9064 00000000 S ext4-dio-unwrit
root 94 2 0 0 c01639f8 00000000 S flush-179:0
root 96 2 0 0 c01dd59c 00000000 S jbd2/mmcblk0p18
root 97 2 0 0 c00a9064 00000000 S ext4-dio-unwrit
root 98 2 0 0 c01dd59c 00000000 S jbd2/mmcblk0p17
root 99 2 0 0 c00a9064 00000000 S ext4-dio-unwrit
root 104 2 0 0 c01dd59c 00000000 S jbd2/mmcblk0p5-
root 105 2 0 0 c00a9064 00000000 S ext4-dio-unwrit
logd 113 1 6392 1044 ffffffff 402be8a4 S /system/bin/logd
root 114 1 1588 188 c0177fdc 0003506c S /sbin/healthd
root 115 1 2388 1088 c0177fdc 40498adc S /system/bin/lmkd
system 116 1 1244 564 c03e0a64 40422128 S /system/bin/servicemanager
root 117 1 5800 1708 ffffffff 401fb884 S /system/bin/vold
system 118 1 39432 9704 ffffffff 4015badc S /system/bin/surfaceflinger
system 119 1 8536 1840 ffffffff 401b6a98 S /system/bin/mcDriverDaemon
root 127 1 248 96 c00b15d8 0001583c S /system/bin/debuggerd64
install 128 1 1944 908 c044df70 40262a90 S /system/bin/installd
root 133 1 21352 7208 ffffffff 401b4884 S /system/xbin/vitals_collection_agent
system 140 1 6376 1180 ffffffff 401a9a98 S /system/bin/vclmk
system 141 1 2148 1092 c0150570 4036e480 S /system/bin/cecdaemon
keystore 142 1 4324 1724 c03e0a64 4013a128 S /system/bin/keystore
media_rw 145 1 3584 532 ffffffff 402326d0 S /system/bin/sdcard
root 146 1 1320 456 c0150570 40218480 S /system/bin/btremoted
root 148 1 1092 528 c0150570 402fc61c S /system/bin/sh
shell 149 1 5708 340 ffffffff 000261d4 S /sbin/adbd
root 189 1 252 100 c00b15d8 0001583c S /system/bin/debuggerd64
root 216 2 0 0 c00d23bc 00000000 S kauditd
root 220 2 0 0 c03ead44 00000000 S mc_log
root 280 2 0 0 c00a8d2c 00000000 S kworker/0:2
root 374 1 1060 372 c044df70 40282a90 S daemonsu:mount:master
root 419 1 2084 396 ffffffff 40282a90 S daemonsu:master
graphics 489 1 17352 5420 ffffffff 40212128 S /system/bin/bootanimation
root 502 2 0 0 c01639cc 00000000 S flush-253:0
system 520 1 29584 6936 ffffffff 40162128 S /system/bin/tvserver
shell 3545 149 1112 560 c00a2718 4045f8a4 S /system/bin/sh
shell 3809 3545 1060 476 c0150570 4011d61c S su
root 3812 419 4136 520 ffffffff 40282a90 S daemonsu:0
root 3814 3812 4144 648 c0150570 4028261c S daemonsu:0:3809
root 3815 3814 1112 560 c00a2718 403fe8a4 S tmp-mksh
root 4321 1 10696 1088 ffffffff 40299884 S /system/bin/netd
root 4322 1 942224 56580 ffffffff 401e261c S zygote
media 4323 1 33520 9168 ffffffff 401c1884 S /system/bin/mediaserver
drm 4325 1 15376 6280 ffffffff 4011c128 S /system/bin/drmserver
drm 4359 4325 15376 6280 c00a1bcc 4011c58c S /system/bin/drmserver
system 4560 4322 939324 27028 ffffffff 401b8a98 S zygote
root 4568 3815 2432 900 00000000 4038d6d0 R ps
Click to expand...
Click to collapse

deadlockfx said:
Thanks, im going to try that right away!
Do you know if Kingo Root is safe? Its one thing to fiddle with on android devices, another on my home laptop...
My virus scanner warns me of a PUA/InstallCore(gen) when i try to start it.
Edit:
Just went with it, and it concluded sucessfully! Connected it to the power suppy, and it went from the white amazon logo to the color fire tv animated logo, but not any further
But at least, when i connect via adb, it now shows
So the rooting process worked and i have proper root now!
Here is the ps log again, after the Kingo Root:
Click to expand...
Click to collapse
Well as long as you have root... if you still can't get it to boot... once I release recovery you'll be able to fix it.

rbox said:
Well as long as you have root... if you still can't get it to boot... once I release recovery you'll be able to fix it.
Click to expand...
Click to collapse
Thats awesome! You do amazing work, rbox!
Thanks a Lot!

rbox said:
Well as long as you have root... if you still can't get it to boot... once I release recovery you'll be able to fix it.
Click to expand...
Click to collapse
Excellent news. Thanks for your work on fire stick!
I for one cant wait for this to be released and im sure there are alot of folk too.
---------- Post added at 07:56 AM ---------- Previous post was at 07:53 AM ----------
deadlockfx said:
Thats awesome! You do amazing work, rbox!
Thanks a Lot!
Click to expand...
Click to collapse
You could try re rooting it again with KINGOROOT.
Or now you have root just wait until rbox releases custom recovery as it now looks promising

Thanks,
i'll try both! Meanwhile i copied the output of logcat over to the pc, but can't make sense of too much, just that some services seem to constantly crash or are not available:

deadlockfx said:
Hello everyone,
i am currently trying one last time to recover my Fire TV Stick. It lay on my shelf with a boot loop for quite a white (sometime in 2015),
but i thought i give it one last try and ask you guys for help.
So i bought a fastboot/a-to-a usb cable, to connect it, and i can actually connect via adblink v2.0.5, that is, the adb shell shows
"[email protected]", and i can see its file system, although i don't know if i have root access.
First some facts:
- Fire TV Stick "Codename Montoya"
- Possibly Firmware 5.0.51 or the next one that came along (5.2.1.0 ? - can i find this out via adb?)
- no custom recovery
- may have root access due to KingRoot app, SuperSU
- i installed some desktop / app manager app, maybe even with auto boot mode (to kodi, i think it was firestarter)
- boots to animated "Fire TV Stick" logo
- usb adb connection is stable, so no reboots or actual "loop", just the animated logo
How i ****ed it up:
- at the time, i had the vulnerable 5.0.5 firmware on the stick, and found out about the KingRoot method, wanted to stop
amazon pushing further updates, as i was quite content with the status quo
- i am/was a big fool trying kingroot via sideloaded .apk, then remove/replace with superSU because i didnt trust kingroot
- i got lucky, as it actually rooted my device after several runs, but then i could not remove kingroot, as it wouldnt let me
- i think i tried some root apps manager to remove kingroot, thats when the boot loop problem happened
- i thought i was an even bigger fool trying to recover the stick via pushing the buttons on the remote at boot, as it could have
reset the fire stick, so it is not connecting to wifi/adb would be disabled
Luckily, as it turns out, i can still access via adb, so maybe not everything is lost?
Back then I hadn't used adb much, only to sideload apks to the firetv stick, so i am not sure if there is any possibility to recover the stick.
Can you point me in the right direction? From here on i don't have a clue what to do/look for on the device.
Logs? Error messages? Whatever may help you to help me, just ask!
Thank you very much! Any help is appreciated!
Greetings from Germany
deadlockfx
//edit:
This looks like i do actually have root access, right?
PS Output:
When i try to disable OTA updates:
Click to expand...
Click to collapse
Hi,
To find firmware version and others info from your firestick tv via adb:
$ adb connect < ip firestick >
$ adb shell
[email protected]:/ $ getprop
So you can put here the output result info.
Can you type these command and put here result too:
[email protected]:/ $ pm list packages
and
[email protected]:/ $ pm list packages -d
and
[email protected]:/ $ pm list packages -3

Connect to adb via ADBfire then run this is a cmd window
adb shell pm uninstall com.kingouser.com
adb shell pm uninstall com.kingoapp.root
adb shell pm uninstall com.kingstudio.purify
adb shell pm uninstall com.kingroot.kinguser
adb shell pm list packages -3 -f
pause
Should un**** your stick

Ah, sorry guys, i was waiting for the release and forgot to check up here again - i am going to do what you recommended right away tomorrow and post results! Thanks again guys!

Related

downgrade htc desire HD

Hallo guys
i followed this article
http://forum.xda-developers.com/showthread.php?t=905003
but i have problem see the picture
http://tinypic.com/view.php?pic=2drfbko&s=7
software number
1.83.415.4
sorry for my bad English
thanks for the help

Hala!
thats because its not 'adb push psneuter /date/local/tmp'
its adb push psneuter /data/local/tmp
not date -- its data

Lmao we've all made that mistake at least once

its a typo!!.. like me in the first time.

thanx guys for reply
i just laughed at myself

cant get the "#" in the result
i do as this
Section 2b [For Gingerbread ROMs, 2.x]
•Connect Desire HD to a computer. Charge only, USB Debugging enabled!
•Open up a cmd and go to Downgrade folder, execute commands:
Code:
adb push misc_version /data/local/tmp
adb push fre3vo /data/local/tmp
adb shell chmod 777 /data/local/tmp/fre3vo
adb shell chmod 777 /data/local/tmp/misc_version
adb shell
./data/local/tmp/fre3vo -debug -start FBB00000 -end FFFFFFFF
i am on HTC Desire Hd
androin 2,3,3
htc sense 2,1
kernel 2,6,35,10
versio 2,50,405,2
If you got "#" in the result, you have temporary root! Proceed with commands:
Code:
cd /data/local/tmp
./misc_version -s 1.31.405.6
but i dont Get the "#"

Yeah the only # i get in my results is "fre3vo by #teamwin following the results.. so i just try to type the 2nd to last command "cd /data/local/tmp i get "path not specified" ?
but the last thing the results say is "running exploit" then waiting for my next command???

I am also trying to downgrade. I get the same meesages as @mistage1990
C:\Documents and Settings\Administrator\Skrivebord\htc\Downgrade_v3\Downgrade>ad
b shell
$ ./data/local/tmp/fre3vo -debug -start FBB00000 -end FFFFFFFF
./data/local/tmp/fre3vo -debug -start FBB00000 -end FFFFFFFF
fre3vo by #teamwin
Please wait...
Attempting to modify ro.secure property...
fb_fix_screeninfo:
id: msmfb
smem_start: 802160640
smem_len: 3145728
type: 0
type_aux: 0
visual: 2
xpanstep: 0
ypanstep: 1
line_length: 1920
mmio_start: 0
accel: 0
fb_var_screeninfo:
xres: 480
yres: 800
xres_virtual: 480
yres_virtual: 1600
xoffset: 0
yoffset: 0
bits_per_pixel: 32
activate: 16
height: 106
width: 62
rotate: 0
grayscale: 0
nonstd: 0
accel_flags: 0
pixclock: 0
left_margin: 0
right_margin: 0
upper_margin: 0
lower_margin: 0
hsync_len: 0
vsync_len: 0
sync: 0
vmode: 0
Buffer offset: 00000000
Buffer size: 8192
Scanning region fbb00000...
Potential exploit area found at address fbb7f800:1800.
Exploiting device...
C:\Documents and Settings\Administrator\Skrivebord\htcDowngrade_v3\Downgrade>cd
/data/local/tmp
system can not find path
What do i do next? i have tried to search, but i do not exatly what to search for

Same problem as above
Hey all,
I'm getting exactly the same error as ko1979 above. Does anyone know if there's a solution to this yet?

[Q] How to unbrick Dropad A8x?

Hello
I accidentally brick my device with firmware upgrade
First: it was Boot logo. and after that black screen. Using DNW tool i got this information
===== USB DEVICE STATUS =====
USB_CONFIGURATION_DESCRIPTOR
bLength = 0x9, decimal 9
bDescriptorType = 0x2 ( USB_CONFIGURATION_DESCRIPTOR_TYPE )
wTotalLength = 0x20, decimal 32
bNumInterfaces = 0x1, decimal 1
bConfigurationValue = 0x1, decimal 1
iConfiguration = 0x0, decimal 0
bmAttributes = 0xc0 ( ??? UNKNOWN!! )
MaxPower = 0x19, decimal 25
-----------------------------
USB_INTERFACE_DESCRIPTOR #0
bLength = 0x9
bDescriptorType = 0x4 ( USB_INTERFACE_DESCRIPTOR_TYPE )
bInterfaceNumber = 0x0
bAlternateSetting = 0x0
bNumEndpoints = 0x2
bInterfaceClass = 0xff
bInterfaceSubClass = 0x0
bInterfaceProtocol = 0x0
bInterface = 0x0
-----------------------------
USB_ENDPOINT_DESCRIPTOR for Pipe00
bLength = 0x7
bDescriptorType = 0x5 ( USB_ENDPOINT_DESCRIPTOR_TYPE )
bEndpointAddress= 0x81 ( INPUT )
bmAttributes= 0x2 ( USB_ENDPOINT_TYPE_BULK )
wMaxPacketSize= 0x200, decimal 512
bInterval = 0x0, decimal 0
-----------------------------
USB_ENDPOINT_DESCRIPTOR for Pipe01
bLength = 0x7
bDescriptorType = 0x5 ( USB_ENDPOINT_DESCRIPTOR_TYPE )
bEndpointAddress= 0x2 ( OUTPUT )
bmAttributes= 0x2 ( USB_ENDPOINT_TYPE_BULK )
wMaxPacketSize= 0x200, decimal 512
bInterval = 0x0, decimal 0
-----------------------------
Second: device in system appears as SEC S5PC110 Test B/D. and asks for driver.
I used drivers for samsung dev board.
The device build on samsung s5pc110 with 512mb nand memory
some shots of board inside.
Add some log from rs232
Rid images mywes below 0x0.
?lengthsdistance symbolsdynamic bit lengths tree{tance codent memoryINVAL
Error:Neither High_Speed esize:0x0
[s3c_usb_print_pkt:tcoov ...
?kernel entry point!
rom environment
o current device
(null)
(s)
not valid on device 26476424 **
ize(0x0)
_J?Under 128M
ME u¬??t erase FAT region~~!!!
ormat complete.
qoe>img4 buffer~~!!
uffer~~!!
er?~a???*I?for jounaling : 0
dr : 0x0
Descriptor Table(0)~~~!!!
?t<erase inode table(0)~~~!!!
Can't write rootdata~~~!!!
't write 7th inode~~~!!!
ta~?youg to mount ext2 filesystem...
(indir 1) malloc failed. **
1) failed. **
fsyz?U2gs read block (indir 2 2) malloc failed. **
2) failed. **
fs doesn't support tripple indirecv8au?9?zYXzONI?‘•?partition sector 0
alid Block Device Descriptor (NULL)
**
(e8rc8?{yZev: (null)
s Firm: (null) Ser#: ”y“libuP^?Oy“o7wP^?j{?v
s available
movable i?ion Map for UNKNOWN Partition Type: (null)
own partition table
partition table on 0:ad .5µt 0 26476424 1835e50s
rtition Start Sector Num Sectors Type
- list files from 'dev' on 'interface' in a 'direaooy[filename] [bytes]
- load binary file 'filename' from 'dev' on 'interface'
to address 'addr' from ext2 filesystem
o–‹?address not on sector boundary
precedes start sector
r boundary
sN…EN?and/or end address not on sector boundary
or: end address (0xx) not in flash!
tect Flash Bank # 0
Bad sectoo?|EN•‘) type
address format
0 sectors
Bank # 0
ash Sectors 0-0 in e?on for all FLASH memory banks
flinfo N
- print information for FLASH memory bank # N
ase - erase FLASH memory
|–?'start' to the end of sect w/addr 'start'+'len'-1
erase N:SF[-SL]
- erase sectors SF-SL in FLASH bank # N
erase bank N
?yuaFLASH write protection
tart end
- protect FLASH from addr 'start' to addr 'end'
protect on start +len
- protect FLqO?,?KI?SF-SL in FLASH bank # N
protect on bank N
- protect FLASH bank # N
protect on all
- protect all FLASH banks
proteaoyi> - make FLASH from addr 'start' to end of sect w/addr 'start'+'len'-1 wrtable
protect off N:SF[-SL]
- make sectors SF-SL wreuajj…*•?all FLASH banks writable
s'
-lt=?®EOµA•UMNEO?N?returning error when dumping path: , (null)
0 times to (null)...
wSUI?...
to 0x00000000 at 0 bps...
for binary (kermit) download to 0x00000000 auya0vo 0 bps and press ESC ...
ad Addr = 0x00000000
## Last Load Addr = 0x00000000
## Total Size = 0x00000000 = 0 BytesSi?0S-Record file over serial line
- load S-Record file over serial line with offset 'off'
adb - load binary ??offset 'off' and baudrate 'baud'
- load binary file over serial line (ymodem mode)
Address: 0x00000000
:?O?‘?00000000, expected 00000000
???
word at 0x00000000 (0x00000000) != word at 0x00000000 (0x00000000)
alfwordayA•02x)
ordwere the same
0000y
[# of oa?y{j•µ?Ea?modify, auto increment address
m(constant address)
ddress
- memory modify, readaory
opy
e target count
- copy memory
cmpre
addr2 co~CRC32 checksum [save at addr]
set address offset
- print address offset for memory commands
base offi??ue
.w, .l] address number_of_objects
- loop on a set of addresses
mtestRAM test
tart [end [pattern]_]yagxecution for N seconds (N is _decimal_ !!!)
turer ID: 0
cSpeed: tZ<0-bit
C read: dev # 0, block # 0, count 0 ...: (null)
write: dev # 0, blyuw,saIN•µread <device num> addr blk# cnt
mmc write <device num> addr blk# cnt
mmc rescan <device num>
mmc list - list available davoENyesoot of image at addr 0x00000000 ...
- boot image via network using BootP/TFTP protocol
stIPaddr:]bootfilename]
ootRP/TFTP protocol
dhcp - invoke DHCP clientato ob|O8=}IEUMQ?to network host
Saving Environment to (null)...
or: illegal character '=' in variable name "(null)"
uuI?not supported
tenvonment size: 0/0 bytes
onment variables
- print8?…µ•?
t environment variables
e ...
- set environment variable 'name' to 'value ...'
setenv name
- ay|?K…?•)vironment variable
- run the commands in the environment variable(s) 'var'o8oot a block start address
th is not block aligned
write (0 blocks):
ad blocks 0 at 0x0 is skipped.e80x0, 0
---ofs=0x0,len=0x0,retlen=0x0,addr=0x0,oob=0x0
(0 blocks):
k8(0) reading page 00000000
:
00 00 00 00 04 00 2x 00 00 00 00 00
zess
ffs2 write:
ata -- 0%.0x0, 0vice 0 bad blocks:
0000 at 0x00000000
ND (null): Q®I•?failed 0x0, 0
iled 0x0, 0
rite test failed at 0xx
b: (null)
—?…?‘OneNAND sub-systemable OneNAND devices
onenand bad - show bad blocks
onenand read[.oob] addr off size
oneny?uy?Ea?address 'addr', skipping bad blocks.
onenand write.yaffs addr off size - read/write `size' bytes starting
at offset `off'?uytest [off size] - test 'size' bytes from
offset 'off' (entire device if not specified)
onenand dump[.oob] off - dump page
onena?oEµ…N???)to transmit data
nw - initialize USB device and ready to receive for Windows server (speaigy?A•?for (null) command
art
for imxtract
tractt a part of a multi-image
qble.
known command '(null)' - try 'help' without arguments for list of all known commands
ynewline
like /bin/sh
]
- test functionality
t script
§help' prints online help for the monitor commands.
Without arguments, it prints a short usage message for all commands.
To get guys as arguments.
- alias for 'help'
devices available!
utput devices available!
_env---default_environment=0x0,ENV_SIZE=0x0
ror - default environment is too large
arning - bad CRC, using defaultui/Flash
t and/or end address not on sector boundary
Unknown Vendor of Flash
pe of Flash
E)t allocated
There is a global environment variable with the same name.
I?µ?main input shell.
iftil) reached
ERROR, too many US~ F?U?E?AN?E± error 0
config descriptor too short (expected 0, got 0)
t reset port 0!?
USB device not responding, gi?Wk•?descriptor (error=0)
device descriptor short read (expected 0, got 0)
d to set default configuration len 0, staooyel part
Unknown errorCd(SOH)/0(STX)/0(CAN) packets, 0 retries
ock sequence error/checksu}??II?file1 .. 0, ld x 0x0ld loader.. 0, 0 ernel..>7y?mmc r/w sub system for SMDK board
Initialize moviNAND and show card info
movi read {u-boot | kernel} {addr} - Read data0g?‘‘Eo?[bytes(hex)] - Read rootfs data from sd/mmc by size
movi write rootfs {addr} [bytes(hex)] - Write rootfs data to sd/mmc by sia {sector#} {bytes(hex)} {addr} - instead of this, you can use "mmc write"
for Android image downloading.
8cyte) installation.
tem image installation.
d system image(0 byte) installation.
ge instalua?±•N•‘?kernel image (0 byte) installation.
installation.
ed uboot image (0 byte) installation.
vor Android
insdroid zimage - Install zimage image for Android
insdroid ramdisk - Install ramdisk image for Android
insdroid syu?eE??write u-boot {address} - Make bootable SD card with uboot
Partition table on OneNAND]
-…™™IWarning can not do hw and sw ecc for partition '(null)'
ng these flags
boot: Adding partitions from envy?Error:FASTBOOT no partition name for '(null)'
Error:FASTBOOT no closing on name
ror:FASTBOOT partitii?Y[±?a?default partition information
rtition informations!dding: (null), offset 0x8x, size 0x00000000, flags 0x00000000
•?N•‘)ted
ables setading of 0 bytes finished
load buffer
yN????does not exist
rtition '(null)' erased
ownloadad of 0 bytes
y?•±?.
mage..
ng failed
eset the board
alid boot image?…ENaN???partition '(null)' flashed
'(null)' failed : (null)
'(null)' saveenv-ed
NFOunknown OEM comma?rytes read
sing Image from SD Card.]
ill read images from the followy???A?oot- use USB Fastboot protocol
out]
- Run as a fastboot usb device.
?oy?!sdfuse - read images from FAT partition of SD card and write them to booting device.
- print0yz0 erase userdata, cache, and reboot.
sdfuse flash <partition> [ <filename> ] - write a file to>yy"•U??•?is NOT founded.
device's initialization is failed.
block start # block count paoti|*A"? 0x00
0 0 0x00
0 0 0*yysd/mmc.
e_num> - create partition.
fdisk -p <device_num> - print partition information
- using default u~yE«99?..
riables
bootable device data
oyyIThe input address don't need a virtual-to-physical translation : 00000000
DKC110
dowi syo?aON?down system now!
s 0!
!
s 1 already!
{KKKVE‹}µµ?}‘•U??•?error!
le to use mmc 0 for fatload **
-------------Download_addr--=0xi–‘…N…?image Error!
nd!
ea00000 0ge installation.
aDya‚‚‚?
A0000 write.yaffs2 40000000 e00000 6a00000age installation.
imgonenand write 30008000 b00000 300000k image installation.
nload kernel image Error!
ernel imq000l image installation.
logo.binnload logo image Error!
yo’‚‚‚‚‚onenand write 30008000 80000 200000.
d.bin‚A‚‚‚‚Completed uboot image installation.
update software!
d!
a|e Android zImage images Fail!
id Ramdisk images Fail!
droid System images Fail!
Android userdata imayyy‹?Uboot images Fail!
mages Fail!
images Fail!
;########################################
Completed Write Android all images From SD to Onenand!
ndroid images include:uboot/zim??0123456789abcdefghijklmnopqrstuvwxyz?literal/length code enderrorry?}IO‰µ?N}©?‰e ENOMEM
Full_SpYuZ«‘?
0, Download Filesize:0x0
sb_print_pkt:able Connected!
a OTG cauynjJ?N??fastboot ...
SId Fastbootbytes: (null)
ate_success--shut doy+E‹…
ironment
AT32 nt device
Interface: y=Invalid FAT entry
(null) file(s), 0 dir(s)
get_dentfromdir: (null)
atname: |(null)|
== NULLu=t>valid on device 0 **
on0: Start Address(0xx), Size(0x0)
is broken **
r~~!!
?•E?256M
16G~
NO NAME ite PBR~~~!!!
ke img buffer~~(reserved)!!
ggion~~!!!
ite FAT~~~!!!
n0 format complete.
* Partition0 is not ext2 file-system 0 **
mg2 buf?y?y?
make zero buffer~~!!
an't make img5 buffer~~!!
ake rootdata buffer~~!!
buffer~~!!
aling : 0
te addr : 0x0
lock(0)~~~!!!
ptor Table(d)~~~!!!
an't write reserve.~oe(0)~~~!!!
ta~~~!!!
an't write root+1~~~!!!
te 7th inode~~~!!!
't write 8th inode~~~!!!
A:?±•IaIN•µ?..
lock (indir 1) malloc failed. **
ead block (indir 1) failed. **
ext2fs read block*(?indir 2 2) malloc failed. **
d block (indir 2 2) failed. **
ext2fs doesn't support tripple indirect blocks. **
ay|ition sector 0
* Invalid Block Device Descriptor (NULL)
ext2fs_devread() read error **
* ext2fs_devread() read error8E> (null) Firm: (null) Ser#: s
Type: evice# 00 # Capacity:<y|yNition Type: (null)
?T?NA?9a&g§?`?IGyiy?y?Io?yyy??a::‚Aba? r4 : 00000000
?|VE«n?instruction
y??}?’?I2ay?*AIaI?= 0MHz, PclkPsys = ‹5!e
?yu?…?‘?erase ea00000 1160000onenanaa~oyyada/¬??•yaffs_unlink returning error:ay??yY.EEEEEEEEE *")nPageReads........... 0unAiiyyyycyceaTrying to add an object to a null pointY>u??aoa?N?valids_guts.h 0
?you•?N?values pagesInUse 0 counted chunk bits 0
?o}Yyr mismtch parentId 0 obj->parent is NULL
y??‡~ou•?0 0 0
?y?,uk*I)|oIbn 0 has chunkId 0 (null) (null)
?ea??W?I?(0:0)
yyy«N§???invalid chunk 0
x?aa!
±±??…N?E?out !!!!!!!!!!!!!!!!!
y—Y?I…ffs_FindObjectByName: non-directory
oyy<{*| obj addr 0
d
nyyauo ON?data chunk into a non-file
y: exis|uuoyuz?E??*?0,
that has no chunksau?yyyawN•?0 after gc, should be erased
yy?ya)yYx?point device
y=;E‹?checksum |
heckpointed 0
y+iEe?or wrong
~?cw|d not allocate block index!
yxy?from 0 0
rit|en block 0 being set for iyy???ound.
rds ends
yycuyyaffs: yaffs_GutsInitialise() done.
a??e yaffs_nand.c 0
?y±?nate
ext checkpt block: start: blocks 0 next au??yx…?±?0 next 0
ut of c??yy?yµt|i–i±v 1.19 2007/02/14 01:09:06 wookey Exp $y?x?*]ithTagsToNAND chunk 0 data 00000000 tags 00000000
failureay?y™? acc error fix performed on chunk 0:0
yaffs ayyy??ojNY?ecc error unfixed on chunk 0:0
ecc errooay~?—?ad del 0 ser 0 seq I$Id: yaffs_ecc.c,v 1.9 2007i?o?E•?N?to ded; i_?yyau?~o.—oBytes transferred = 0 (0x0)
esizexyyyg—Y…a? ?~:"??*** WARNING: (null) is too long (0 - max: 0) - try~yyyOyuoi INVALID STATE
OTP broadcast 0
??‡i~ot umount
p fail
yy—o??receive the ext_csd.
yoYsyA?EN?any high-speed modes.
8x??y.never released inhibit bit(s).
y?u??has 0 eraseregions
[offset: 0x00000000, erasesize:a?—?yyuu)- 0MB y>y?ayya~|~™?device
yyy?~gXo•a??‘?end of device
ck: Atteo?y?yoy‘}??‰}??±??*e Attempted to read beyond end of device
?~zttempted to write past end of de~uy??+i?•‘?data
d
yynot erased.
onenand?set_boundary: Please erase blocks ~goEyy?OK?Die 0
e for Di} EI«‘?for oobsize 0
can_bbt: Out of memory
?? EE?Ee status check fail: 0x0
rc error
?’]E+Ee?in 32 bit mode
de
uy?ax onknown: 0 . 0) **
i?>yBad magic number
header crc
yziyOaddr - A valid autoscr header must be present
<y—)*??Y??OSnown Image?>‚??/s:
age 0:ay?ainit Ramdisk from multi component Legacy Image at y?yues-Nµ…?•scriptogramyuyer5ppc~oyy?aa|ionaterminated, rc = 0x0
yxa=08lX:
Image at 00000000 ...
a~yye?aA•e yuyEIUnsupported Archotecture 0x0
gg U?y>?uuuncompress or overwrite error - must Ryyyu?~O?U•E)?oyAA±??…N????image stored in memory
passing argumeiuoyyc?e‹?µ‘?
ation ?u?a?a~µ…?•?contents (magic number, header and payload che:?s-RROFFugh) Cache is (null)
yuu?]
- enable or disable data (writethrough) cacho>Yyu‘u~ess 0xlx
yu??uyEa)artiny?y?yyya)‹Ua??u?Yyaio|"•U??•± use `dev[art]' **
uo?Yapartitio?aA•?"(null)" (expect "U-Boot")
y?±•I?in a directory (default /)
ayaY§igname] [bytes]
- load binary file 'filename'a?~?y®e??by ext2 on 'interface'
at^cy<|ev[art]>
ition 0-----
?zayN±?‡‘?<interface> <dev[art]> <addr> <filename> [byuyyyu~?•Iu) - load binary file 'filename' from 'dev' on ?uy?uI™…?oya<dev[art]>
- print information about filesyoy?yiay‘?ad|ress not on sector boundary
??>??…rt and/or end address not on sector boundary
yyy?•|?ASH type
y?i~ for all FLASH memory banks
flinfo N
- print info~iyu?yxyI?sN…EN? to the end of sect w/addr 'start'+'len'-1
eryy?YyySx write protection
start end
- protect FLA?|y?uoI?OF-SL in FLASH bank # N
protect on bank N
-a?yyy?y~…*•?FLASH from addr 'start' to end of sect w/a|o?y?iyyyke all FLASH banks writable
r ''i’YI?yµA•UMNEO?N?returning error when dumping path: , '.ay:rrOr binary (ymodem) download ?yu>>a~ps and press ESC ...
y????E‘?file over serial line
o/—yyuYI•t 'off' and baudrate 'baud'
bi~yyyy???a?08lX, expected 00000000
y toa?yyo?AauWhalfword sao??Ia?modify, auto increment address
???<a - memory copy
.w, .l] source target ¬«iy?ya>??•?*IOµ?[save at addr]
or oau??yy—u .w, .l] address number_of_objects
- loop oao?????for N seconds (N is _decimal_ !!!)
yiy??‹)
yyyoutemaddr blk# cnt
mmc write <dc~?—o|yNgsmage at addr 0x00000000 ...
?INyAy‘‘Ee]bootfilename]
rpboot?eeuirEQUEST to network host
?y< not supported
* Abort
yzyµ•?
nment variables
|{…?•)mands in an environment varia~yyay~?N?a block start address
ERROR: 0 length is not biiai?y~yy0xax, 0
x0,len=0x0,retlen=0x0,addr?yyIB*"? ~eading page 00000000
age 00000000 dump:
y?yI)–OE write:
y?Iy?failed 0x0, 0
failed 0x0, 0
~?‡?yI«99?sub-system?y·~?address 'addr', skipping bad blocks.
onenand writ}.ua~yyyyWst [off size] - test 'size' bytes from
offset 'offo??~Eµation
NW to transmit data
?auy•afor (null) command
e Part
~u|?±oyoUnknown command '(null)' - try 'help' without argume~t>??y«Y±??•)..]
aa?y~^coU? prints online help for the monitor commands.
Wiy?yay·•oaX.
u?Oµ•?NI?
alias for 'help'
o}y•?Uµ--default_environment=0x0,ENV_SIZE=0x0
?EI9Outside available Flash
s not Eyy?oo~!ERROR : memory not allocated
|#yyzyµ?main input shell.
?Iyu?AN?E± error 0
escriptor ooo short (expecte| ~ua—???•?descriptor (error=0)
ort raayyy?y—±apart
error, 0(SOyyyx??II?filewriting(null) 0 0xyy?o?mmc r/w sub system for SMDK board
ze mo_Ey~?{adar} [bytes(hex)] - Read rootfs data from sd/mmc by sizy??yyy?—?{oector#} {bytes(hex)} {addr} - instead of this, you cana?yo?yy¬te/ installation.
on.
o»±•N•‘?kernel image (0 byte) installation.
t ube‹??xoy—?for Android
insdroid zimage - Install zimage image for
?uuyiudmovi write u-boot {address} - Make bootable SD card with ??yuoyy•.a–OWarning can not do hw and sw ecc for partition '(null)'
O?Y??ame for '(null)'
??yagmploy default partition information
yyy^??N•‘)tected
y?a~W‹????does not existyya?–?•±?.
/yx?…EN?N???partition '(null)' flashed
??uayNoI?®V‘)yy?yY‘?Chip)fastbooty·es
sdfuse - read images from FAT partition of SD card an| yyy?aa  erse userdata, ¬<?y^u??• is NOT founded.
/sd device's initializationayya.Ay 0x00
3 0 a?*Au?y??i
create partition.
fdZ?=?y?A~oEEWriting to OneNAND...
®yu?>?y• input address don't need a virtual-to-physicau??u??Na|e??system now!
y~u?©I§?‘}µµ?}‘•U??•?error!
rd OK!?yaI—?dXW?image Error!
yyay00a6a00000affs2 40000000 e00000 6a00????00 300000???‚?Completed kernel image installation.
EyY???o?0000rite 30008000 80000 200000ed licy?00?‚‚‚‚Completed uboot image installation.
y?}?‘E?a‘?zImage images Fail!
I??yWboot images Fail!
Android Log images Fail!
y#####################################
?uyY??123456789abcdefghijklmnopqrstuvwxyzCDEFCoyyyyiany length or distance symbolsxy?lite®±?length codey??ai_submit_job: ENOMEM
need 0 TDs, only have 0
>xz«n?
loada?y|y??yy?©)?N??fastboot ...
LSI0n?oyyy?oint!
d 0x0 from environment
younvalid FAT entry
(null)??y±§‘?on device 0 **
0xax?y???Yy?’??j)x
Au????uu…!!
ataaoo»yyOt make zero buffer~~!!
.u…?y~±§u??: 0
write addr : 0x0
yy~«e=d)~~~!!!
't write rootdata~~~!!!
te ~u?uyyay?>?±esystem...
* ext2fs read block (indir 1) malloc faeyyy~Nnuira2 2) malloc failed. **
read block (invIa?uy>_‹????sector 0
ce Descriptor u®u?u?a TKµe (null) Ser#: (null)
y?aua?yy?Keea device 0 -- Partition Type: (null)
_26?UK14_32lkMsys = 0MHz, PclkMsys = 52494216MHz
A Uyz, PclkPsys = 0MHz
yy?YX‚‚‚‚SS?‚‚‚‚‚onenand read 40000000 8600000 1400000a}ffs_unlink returning error: 0
returning error: 0
??•I•…‘I?.......... 0
nBlockErasures....... 52494216
nGCCopies............ 0
garbageCollections... 52494216
passiveGarbageColl'ns 4087376
u??|d an object to a null pointer directory
g to add an object to a non-directory
€*yaffs bug: yaffs_guts.h 0
undefined state 0
gsInUse 0 counted chunk bits 52494216
suspect sequence number of 0
tags 0 obj 320ff88 oh 3e5e50
yntId 0 obj->parent is NULL
0 header mismatch parentId 52494216 parentObjectId 0
?ft delete chunk 0
struck out
li•yynt block count wrong dev 0 count 0
0 count 52494216
blocks 0 (max is 1)
oz*"?(null) ”y libuP^>
parent pointer 00000000 which does not look like an object
nt is not a directory (type 0)
bj cuaNj 0 has illegaltype 0
etiringmeDirty block 0 state 0 ”y libuP^>
iled 0
a{ounk 0
ine 0 delete of chunk 0
ore eraased blocks
ocated block 0, seq 52494216, 4087376 left
ya!!!!!!!!!!!!!!!!
unk 0 was not erased
d needs retiring
yaffs write required d attempts
yuy9…µ•e non-directory
isCheckpointed 0
ipping checkpoint write
kpoint validity
checkpoint devicyyave exit: isCheckpointed 0
daft chunkId 0 for 52494216
ocate Tnodes
uld not add tnodes to managyyno?a non-file
ting chunk < 0 in scan
alid
lected block 0 with 52494216 free, prioritioyy?a,WEe?block 0 that has no chunks in use
0
d 0 52494216
has no?e«±‘?be erased
unks before 0 after 52494216
im!!! erasedBlocks 0 after try 0 blaiy'0_[Na?file 0
mediate deletion of file 0
space during cache write
Could not allocatycNa)checkpoint objects
ruct size 0 instead of 0 ok 52494216
ead object 0 parent 52494216 ty?}ayoytore exit: isCheckpointed 0
fs: yaffs_GutsInitialise()
ice
ry problems: chunk size 0,a|: device already mounted
chunk group too large
checkpoint
only for YAFFS2!n{k index!
Block scanning block 0 state 0 seq 52494216
canning block 0 has bad sequence number?|i?written block 0 being set for retirement
ot make object for object 0 at chunk 52494216 during scan
?Y…rds ends
ntstartblk 0 intendblk 0...
on block 0 was not highest sequence id: block seq yuotialise() done.
s.c,v 1.52 2007/10/16 00:45:05 charles Exp $nknowncanningty?iting chunk 0 tags 52494216 4087376
g with no tags
affs_nand.c,v 1.7 2007/02/14 01:09:06 wookey Exp $ilableot block: start: blocks 0 next 0
h: block 0 oid 52494216 seq 0 eccr 52494216
pt block 0
…N????checkpt block 0
s
fer nand 0(52494216:4087376) objid 0 chId 52494216
t byte count 0
~E?‚SO‚EO‚????*•a?Exp $_MarkNANDBlockBad 0
nandmtd2_ReadChunkWithTagsFromNAND chunk 0 data 00000000 tags 0320FF88
_QueruIAyy 0 data 0320FF88 tags 00000000
at (null):52494216/4()!
G!/02/14 01:09:06 wookey Exp $?oyofor[Yz??chunk 0:0
ixed on chunk 0:0
error fix performed on chunk 0:1
~gd on chunk 0:0
mtd ecc error fix performed on chunk 0:1
>mtd ecc error unfixed on chunk 0:1
chunkaau?g<0
,v 1.9 2007/02/14 01:09:06 wookey Exp $needed but not set
u•
ARP Retry count exceeded; starting again
ss not given
yyn?= 0 (0x320ff88)
tluoo largeagicoot filya®’ Size is 0x0 Bytes = lx
ed; starting again
MB received
is too long (0 - max: 0) - truncated
Nameng vendor optional boot file
nBOOTP broadcast 0
ARP broadcast 0
2lX00320FF88.imga NFS from server ename '(null)/”y libuP^>'.i.'2?±•?lookup fail
MMC Device 0 not found
bl len failed
mmc r}y_y‘?
XT_CSD on a possible high capacity card. Card will be ignored.
le to read EXT_CSD, performance might su?n modes.
r 00000000init fail!
HSMMC0nnel 0
k neve?y?N?bit(s).
iting for status update.
during transfer: 0xx
mc: ^as}{asesize: 0x00000, numblocks: 0000]
Attempting to recover from uncorrectable read
L 2.65/3.3ND(null) 52494216MB 4V 16-bit (0x00)
n = 0x0000
timeout!ctrl=0x0000 intr=0x'?yynUE…I•e Unaligned address
ngth not block aligned
ase: Failed erase, block 0
nd_bbt_read_oob:0A|u?cg
olock: Attempt read beyond end of device
le_read_ops_nolock: Attempt read beyond end of devic}YY?to read beyond end of device
_oob_nolock: read failed = 0x0
e_oob_nolock: Attempted to start write outsy>>Attempted to write past end of device
ob_nolock: write failed 0
d_write_ops_nolock: Attempt write to past<UuyAI}??±??*e write filaed 0
tatus = 0x0
ma_transfer: DMA error!
nd_set_boundary: Invalid bound?uydset_boundary: Please erase blocks before boundary change
nd_set_boundary: boundary locked
flexonenand_set_boundary: Cxang^yy}‰?O?‘…Eae Failed PI write for Die 0
WN DEVICE ID!!!
rning - OneNAND read mode: async.
an(): Can't allocate?onyy?n_scan_bbt: Out of memory
or bad blocks
t 0x00000000
bbt: Can't scan flash and builduyA•x
rx crc error
error
big
ut
m9000 novooN‚‚O’O??????in 8 bit mode
00: Undefined IO-mode:0x0
02x:00:320ff88:3e5e50:x:00
lish link
…?a args (max. 0) **
efined
wn command '(null)' - try 'help'
yA«µ‰•E)Empty Script
ge format for autoscript
ting script at Aao®,.B•…‘•E?must be present
= 0x00000000
_paramsartethaddr =ip_addryi??N•?NOE•Unknown Imageget_format
x --------
bootm_low:
o)et = 0x00000000
g init Ramdisk from Legacy Image at 00000000 ...
i component Legacy Image at lx ...
ip2ippressedilesystem.W?‘…±??•Standalone Programat_dthaIntel x86kuperHarcckfinR32NetBSDotoO0x0
start application at address 'addr'
- start application at address 'addr'
passing ?yyy?Jµ…?•?at 00000000 ...
Bad Magic Number
Bad Header Checksum
CRC
rmt!
wycompressionData Size: 0 Bytes = 8x
Entry Point: x
xotgcture 0x0
Image Type for (null) command
t for (null) command
kernel image!
unknown yor overwrite error - must RESET board to recover
ompression type 0
RNING: legacy format multi component imagc?iE…?I™•EE????control to NetBSD stage-2 loader (at address 00000000) ...
sferring control to RTEMS (at address 00000000e ...
?•‘?in memory
passing arguments 'arg ...'; when booting a Linux kernel,
'arg' can be the address of an initrd image
yyi - print header information for application image
..]
- print header information for application image startincoa?anwmber, header and payload checksums)
sages found in flash
information about all imageo w|u?O??? Cache is (null)
Cache is (null)
le or disable instruction cache
on, off]
- enable or disqbuyuy~a‰±•?data (writethrough) cache
ilable devices:
le devices and inf?year (null) @ 0x0320ff88 (4087376 bytes)
ot of VxWorks image at address 0x08lx ...
MAC address not cooyoyne (@ 0x0): ”y libuP^>
Starting vxWorks at 0x00000000 ...
terminated
n at 0x00000000 ...
?X–•II?of ELF image.
vxWorks from an ELF image
ess] - load address of vxWorks ELF image.
u…ENu? **
4 **
0 ....
boot file definedua?o2.$B*aA•?N?"U-Boot")
s 0:52494216 **
or disk - (null) 52494216:4087376 **
** Unable to read "(null)" from ao?y?~efault /)
art]> [directory]
- list files from 'dev' on 'interface' in a 'directory'
2load-uynye+‘?binary file 'filename' from 'dev' on 'interface'
to address 'addr' from ext2 filesystem
?boundary
sector precedes start sector
ddress not on sector boundary
r: cannot span across banks whayi~?N?on sector boundary
nd address (0x00000000) not in flash!
# 0
ification
—*M!?type
Erased 0 sectors
e Flash Bank # 0
rase Flash Sectors 0-d in Bank # zu # 0:a?~ks
flinfo N
- print information for FLASH memory bank # N
- erase FLASH memory
FLASH froio?N?w/addr 'start'+'len'-1
erase N:SF[-SL]
- erase sectors SF-SL in FLASH bank # N
erase bank N
- erase FLASH bank # N
eyoouusN…EN?end
- protect FLASH from addr 'start' to addr 'end'
protect on start +len
- protect FLASH from addr 'start' to eiu??r)protect on bank N
- protect FLASH bank # N
protect on all
- protect all FLASH banks
protect off start end
- maogyy? 'start' to end of sect w/addr 'start'+'len'-1 wrtable
protect off N:SF[-SL]
- make sectors SF-SL writable in FLASH bank # Nuu|?itable
nknown operator '(null)'
Invalid data width specifier
=<= true/f}y?grror when dumping path: , (null)
Writing value (0) 320ff88 times to (null)... file (null)
lsotal Siuy?E?binary (ymodem) download to 0x00000000 at 52494216 bps...
# Ready for binary (kermit) download to 0xX at 0 bps...
ary (k}o}?^X
## Last Load Addr = 0x00000000
## Total Size = 0xlX = 0 Bytes
echoxuc??•) load S-Record file over serial line with offset 'off'
oadbnary file over serial line (kary?n'aaud'
file over serial line (ymodem mode)
ress: 0x00000000
r 00000000 ... 0320ff88 ==> 003e5e50
X
ength ???
sh... (0x00000000) != word at 0x00000000 (0x8lx)
8lx (0x0000) != ha|yyal of d (null)”y libuP^> were the same
08lx:d - memory display
.b, .w, .l] address [# of objects]
- memory displament address
- memory modify (constant address)
s
- memory modify, read and keep address
yy?, .w, .l] source target count
- copy memory
[.b, .w, .l] addr1 addr2 count
- compare memory
yIu)address offset
ss offset for memory commands
base off
- set address offsat ow[¬–}?™}?‰©•?NI) - loop on a set of addresses
t [end [pattern]]]
- simple RAM read/~y?os _decimal_ !!!)
Device: (null)
r ID: 0
0
: 0
MMC read: dev # d, block # 0, count 52494216 ...
e: dev # 0, block # d, count 0 ... A52494216u???X–?blk# cnt
mmc write <device num> addr blk# cnt
mmc rescan <device num>
mmc list - list available devices
ping failed; host aiae…?•?at addr 0x00000000 ...
pa network using BootP/TFTP protocol
ilename]
yarpbootrarpboot- boot image via network using RARP/TFTP protocol
CP client to obtain IP/boot params
ypingAddress
nt to (null)...
illegal character '=' in variable name "(null)"
_R
‰?EN)0 bytes
t environment variables
of all environmenta~Xonment variables
me value ...
- set environment variable 'name' to 'value ...'
setenv name
- delete environment variableozymmands in an environment variable
the commands in the environment variable(s) 'var'
lock a ?*II=Ie 0 length is not block aligned
te (0 blocks):
0x0 is skipped.
ne----ofs=0x0,len=xyIx0,len=0x0,retlen=0x320ff88,addr=0x0,oob=0x320ff88
a read (0 blocks):

s' is not a number
e (0x0) exceede|yy…?•?00000000 dump:
02x 00 320ff88 3e5e50 x 00 320ff88 3e5e50 01 00 320ff88 3e5e50 01 x 00 320ff88
x 00 320ff88 &?ua"…N…?-- 0%.ROR: Write failed 0x0, 0 at 0x00000000
s: y failed 0x0, 52494216
Read/Write test failed at 0x0
ittenNOT ma?yyu?y - show available OneNAND devices
onenand bad - show bad blocks
onenand read[.oob] addr off size
onenand write[.oob] addr off om?ung bad blocks.
onenand write.yaffs addr off size - read/write `size' bytes starting
at offset `off' to/from memory address `aday??' bytes from
offset 'off' (entire device if not specified)
onenand dump[.oob] off - dump page
onenand markbad off [...] - maryur<dNW to transmit data
lize USB device and ready to receive for Windows server (specific)
dress]
uqv‚…EN)8lx extract a part of a multi-image
addr part [dest]
- extract uxy?y ?Ea?'help' without arguments for list of all known commands
o monitor version
?test like /bin/sh
- test functionality
- exit script
onality
or<the monitor commands.
Without arguments, it prints a short usage message for all commands.
To get detailed help information vK
±?…I?for 'help'
In: ces available!
vailable!
rr: ces avaeix?oA•x,ENV_SIZE=0x0
default environment is too large
ng - bad CRC, using default environment
out writuuy?*WEN?and/or end address not on sector boundary
f Flash
f Flash
Programming Error
osyyqted
IFS"e is a global environment variable with the same name.
variablenknown cyyuyUEaRhiledoHUB (0) reached
USB Devices, max=0
RROR: ~ua}yc>•I?E?AN?E?too short (expected 0, got 52494216)
et port 0!?
SB device not responding, giving up (status=X)
yW"•U??•?descriptor short read (expected 0, got 52494216)
set default configuration len 0, status 320FF88
mu(?(xyzModem - (null) mode, 52494216(SOH)/0(STX)/52494216(CAN) packets, 0 retries
ksum errormingi?•1A .. 0, 52494216 lx 0x0 0x320ff88 0, 52494216 er.. 0, 52494216 l.. 0, 52494216 0, ||???…E‘)ialize moviNAND and show card info
movi read {u-boot | kernel} {addr} - Read data from sd/mmc
movi write {fw?iy??N™I?data from sd/mmc by size
movi write rootfs {addr} [bytes(hex)] - Write rootfs data to sd/mmc by size
movi read {sector#} {ry|yur} - instead of this, you can use "mmc write"
Android image downloading.
ad' buttiiytzaIN•µ?image installation.
stem image(0 byte) installation.
nstallation.
y|e) installation.
Start uboot image installation.
0 byte) installation.
age}0> - Install zimage image for Android
insdroid ramdisk - Install ramdisk image for Android
insdroid system - Install system imay}<y?a- Make bootable SD card with uboot
ition table on OneNAND]
me='(null)' art=N/A ) and sw ecc for partition '(null)'
ese flags
Adding partitions from environment
STBOOT syyuns…µ•?for '(null)'
r:FASTBOOT no closing c found in partition name
FASTBOOT partition name is too long
y?Eµ…N???)ions!t 0x00000000, size 0xx, flags 0x00000000
ty timeout 0 seconyet}cted
s set of 0 bytes finished
noring
ot?g:.s?
erase partitionion '(null)' erased
adf 0 bytes
FAILdata ?yRyErROR : bootting failed
hould reset the board
FAILinvalid boot imagewnloadedILimage too large foryI?•‘) failed : (null)
rtition '(null)' saveenv-ed
nknown OEM commandition: (null), File: ”y libuP^>/yyyay?e

People, help me somebody unbrick Dropad A8X, please !!!

Helter2 said:
People, help me somebody unbrick Dropad A8X, please !!!
Click to expand...
Click to collapse
I had exactly the same (Dropad A8X) - and many with us as I read on the DX forum and other places ... however, I managed to flash new firmware ...
Here is the description:
slatedroid.com/topic/19685-dropad-a8x-hardware/page__gopid__255906#entry255906
Great thanks to Adam and especially Rebellos for his fantastic hack.
Please read my story completely as I was just to impatient and messed it up after all (if any one can be of any assistance as how to go further .
However, the method lets you flash new firmware using Odin or Adam's One-Click tool.

[Q] Waiting cwm recovery for A100

Let's wait

Me too.waitting!

都是中国人，说中国话

And the wait does begin. I hope it's not long. Any dev attention the A100 gets will be a blessing.

Don't know if he's working on it but :
http://forum.xda-developers.com/showpost.php?p=17406469&postcount=93

sebennett said:
Don't know if he's working on it but :
http://forum.xda-developers.com/showpost.php?p=17406469&postcount=93
Click to expand...
Click to collapse
I don't have one of these.. (yet).. Until someone figures out how to get past the checksuming of the boot and recovery partitions (like itsmagic from sc2k did), then we're just playing the waiting game.
I imagine it's like the new 3.2 bootloader from A500. I think it has a similar message when the checksum fails. I'm sure Acer made it more difficult than than before.
---------- Post added at 09:38 AM ---------- Previous post was at 09:01 AM ----------
Can someone who's rooted dump all the partitions for me?
Run these commands, then zip it up and upload somewhere for me.
It not necessary to include the data partition, which is p8 (assuming it's the same as the A500). Can do a "mount" command and see which one shows as /data.
Code:
dd if=/dev/block/mmcblk0 of=start.img count=13312 bs=512
dd if=/dev/block/mmcblk0p1 of=p1.img
dd if=/dev/block/mmcblk0p2 of=p2.img
dd if=/dev/block/mmcblk0p3 of=p3.img
dd if=/dev/block/mmcblk0p4 of=p4.img
dd if=/dev/block/mmcblk0p5 of=p5.img
dd if=/dev/block/mmcblk0p6 of=p6.img
dd if=/dev/block/mmcblk0p7 of=p7.img
dd if=/dev/block/mmcblk0p8 of=p8.img
Thanks.

not friend with adb but this is via terminal emulator :
$ export PATH=/data/local/bin:$PATH
$ mount
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/mmcblk0p3 /system ext4 ro,relatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p8 /data ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p4 /cache ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p6 /system/vendor ext4 ro,relatime,barrier=1,data=ordered 0 0
/dev/fuse /mnt/sdcard fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
/dev/block/vold/179:33 /mnt/external_sd vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
$

I stopped by a store and rooted the floor model and took a few dumps (specimens) to look at. When I have time, i'll go back and see if i can write the A500 bootloader & cwm and see if it'll still boot....lol
---------- Post added at 03:07 PM ---------- Previous post was at 02:49 PM ----------
Interesting... The first 1mb of mmcblk0 is all 00's.
And it seems that mmcblk_start is bigger than on the a500. I'll need to go bet a bigger dump to see where it leads into the recovery partition..
unless someone here can dump it for me.
can someone run this dd for me and send me the dump. It's about 10MB?
Code:
dd if=/dev/block/mmcblk0 of=start.img count=20000
specifically, i'm looking for where it crosses over into mmcblk0p1 (recovery), which starts with:
Code:
4e41 5244 494f 2144 023c 002d 8000 1000
a931 0007 0000 1100 0000 0000 0000 10f0
0100 1000 0800 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000

Code:
dd if=/dev/block/mmcblk0 of=start.img count=20000
specifically, i'm looking for where it crosses over into mmcblk0p1 (recovery), which starts with:
Code:
4e41 5244 494f 2144 023c 002d 8000 1000
a931 0007 0000 1100 0000 0000 0000 10f0
0100 1000 0800 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
[/QUOTE]
Here it is.
http://dl.dropbox.com/u/35926561/start.img

Thanks..got it
Sent from my A500 using Tapatalk

Dangit.. that still wasn't big enough.. would you mind doing it again, but bigger?
Code:
dd if=/dev/block/mmcblk0 of=start.img count=80000
This one is about 40mb..
I've notice that the recovery partition is also larger.. on the 500 it's 5MB and on the A100 it's 6MB.
Thanks

Euclid's Brother said:
Dangit.. that still wasn't big enough.. would you mind doing it again, but bigger?
Code:
dd if=/dev/block/mmcblk0 of=start.img count=80000
This one is about 40mb..
I've notice that the recovery partition is also larger.. on the 500 it's 5MB and on the A100 it's 6MB.
Thanks
Click to expand...
Click to collapse
Here you go.
http://dl.dropbox.com/u/35926561/start.img

Thanks again...
Sent from my A500 using Tapatalk

Euclid's Brother said:
Thanks again...
Sent from my A500 using Tapatalk
Click to expand...
Click to collapse
I am doing it for selfish reasons. I want a recovery.

Cool.. i found where mmcblk_start ends and recovery (mmcblk0p1) starts.
A100 mmcblk_start size is 22528 blocks * 512 = 11mb
A500 mmcblk_start size is 13312 blocks * 512 = 6mb
mmcblk structures.. i'm not sure what the exact layout of these are, but here's a look at it..
A100 - mmcblk_start
Code:
0000000 - 00fffff = 00's
0100000 - 0100fff = data/code?
0101000 - 02fffff = 00's
0300000 - 04fffff = structured data (partition table?)
0500000 - 05a9b3f = data/code?
05a9b40 - 05a9fff = FF's
05aa000 - 0afffff = 00's
A500 - mmcblk_start
Code:
0000000 - 0000fef = data/code?
0000ff0 - 0000fff = FF's
0001000 - 003ffff = 00's
0040000 - 0040fef = data/code?
0040ff0 - 0040fff = FF's
0041000 - 007ffff = 00's
0080000 - 0080fdf = data/code?
0080ff0 - 0080fff = FF's
0081000 - 00bffff = 00's
00c0000 - 00c0fef = data/code?
00c0ff0 - 00c0fff = FF's
00c1000 - 00fffff = 00's
0100000 - 017ffff = structured data (partition table?)
0180000 - 022efff = data/code?
022f000 - 067ffff = 00's
I've confirmed that mmcblk_start is 5mb bigger and recovery is 1mb bigger. I'm not sure about the other partions. I know mmcblk0p7 size did not change. But since these two are different, it changes the partition structure, which is contained within mmcblk_start.
That kind of throws a wrench into my idea of just writting the a500 mmcblk_start to the A100. It might be possible to write the entire mmcblk0 image, basically turning the A100 into an A500. Then try to put back the /boot and /system images from the A100, assuming the boot image will fit. This would probably have to be done via nvflash, kind of like the A500 downgrade method.
I'm gonna have to learn more about that before i think about attempting this..

I have tried A500 downgrade method but failed. Nvflash wouldn't work without bootloader key.

wrong post, sorry.

@painter_: can you please send me your UID? I would like to try something with your dump.
Sent from my HTC Sensation using XDA App

with sc2k on the job, it's only a matter of time

Euclid's Brother said:
with sc2k on the job, it's only a matter of time
Click to expand...
Click to collapse
I sent him my uid yesterday as he requested. Let me know if there is anything else i can do to help the process.

[CWM][24/01] ClockworkMod 5 Recovery For LG Nitro HD

Cwm v5.0.2.7 For LG Nitro HD (P930) /Optimus LTE
Current Status: Operational
Installation/Update Instructions:
Before installing make sure that your phone is rooted
Code:
Backup your existing recovery:
1) [COLOR="Magenta"]cat /dev/block/mmcblk0p13 > /sdcard/recovery-backup.img[/COLOR]
Flash the new recovery by:
1) Download the bc64-recovery.rar and extract it
2) Copy the extracted bc64-recovery.img to your /sdcard
3) via terminal emulator or adb shell execute:
[COLOR="Magenta"]
su
cd /sdcard
cat bc64-recovery.img > /dev/block/mmcblk0p13[/COLOR]
All Done!
Now to Boot into recovery , press the vol down+pwr button , when it asks you to factory reset , tap twice the pwr button to confirm (dont worry it wont format your device)
Screenshots:
Video:
Code:
http://www.youtube.com/watch?v=okr8PWeQ30E
ChangeLog:
Code:
v0.2 B20120124
Changes:
* Added postrecoveryboot.sh to clear out boot command
* Added Partition/fs Utils (useful for rom dev in formatting/checking ext4 fs)
-e2fsck_static
-mke2fs_static
-resize2fs_static
-tune2fs_static
v0.1 B20120120 (Initial Release)
Known Issues:
Code:
wrong timestamps
Tested On:
Code:
Atnt LG Nitro HD (P930)
LG Optimus LTE (SU640)
Thanks To:
Code:
schwin97
[email protected]
Malnilion
repherb
aquariuz23
gte460z
and everyone else who contributed to this thread :P
Download:
Code:
http://www.mediafire.com/?mnf53sxmp5aifd9
Source Code (Sorry , too lazy for github fttb):
Code:
http://www.mediafire.com/?f27d8j8d7mc8qi8
For Rom Developers:
It seems that default cwm format is messing up (due to ext4 file system) , Please use (edify) the following script to format the data and cache partition (or System)
Code:
#Format Data
/sbin/mke2fs_static -t ext4 -b 4096 /dev/block/mmcblk0p30
#Format Cache
/sbin/mke2fs_static -t ext4 -b 4096 /dev/block/mmcblk0p28
# After Format Verify the FIle System
/sbin/e2fsck_static -y /dev/block/mmcblk0p30
/sbin/e2fsck_static -y /dev/block/mmcblk0p28
Edify (To Format System):
Code:
run_program("/sbin/mke2fs_static", "-t" , "ext4" "/dev/block/mmcblk0p27");
AND
run_program("/sbin/e2fsck_static", "-y", "/dev/block/mmcblk0p27");

/proc/mtd doesn't exist...
Don't know if this any help:
http://forum.xda-developers.com/showpost.php?p=20514396&postcount=32

Images Added based on the info provided :
Code:
http://forum.xda-developers.com/showpost.php?p=20514396&postcount=32

Is this suppose to be Clockwork Mod for the Nitro? Wat's with the 5? Version 5?

Can you teach me how to make the recovery.img.
My device is LG Optimus LTE SU640 which has the most same hardware with P930.

Yes this is version 5
@belth219 ill port it for you once i get confirmation for this image

Ok,thanks.

@belth219 could you do a "cat /proc/partitions" on your cell and post its results?
Also providing the results for the above command for nitro HD would also be very usefull.

This is the result of my lu6200
Another version of p930
# su
su
# cat /proc/partitions
cat /proc/partitions
major minor #blocks name
179 0 3526656 mmcblk0
179 1 32768 mmcblk0p1
179 2 1024 mmcblk0p2
179 3 1024 mmcblk0p3
179 4 1 mmcblk0p4
179 5 1024 mmcblk0p5
179 6 5120 mmcblk0p6
179 7 5120 mmcblk0p7
179 8 10240 mmcblk0p8
179 9 1024 mmcblk0p9
179 10 3072 mmcblk0p10
179 11 3072 mmcblk0p11
179 12 8192 mmcblk0p12
179 13 16384 mmcblk0p13
179 14 32768 mmcblk0p14
179 15 3072 mmcblk0p15
179 16 3072 mmcblk0p16
179 17 3072 mmcblk0p17
179 18 3072 mmcblk0p18
179 19 1024 mmcblk0p19
179 20 8192 mmcblk0p20
179 21 16384 mmcblk0p21
179 22 73728 mmcblk0p22
179 23 8192 mmcblk0p23
179 24 24576 mmcblk0p24
179 25 8192 mmcblk0p25
179 26 1048576 mmcblk0p26
179 27 327680 mmcblk0p27
179 28 1548288 mmcblk0p28
179 29 16384 mmcblk0p29
179 30 1024 mmcblk0p30
179 31 229376 mmcblk0p31
259 0 4096 mmcblk0p32
179 32 7774208 mmcblk1
179 33 7773184 mmcblk1p1
#
$ cat /proc/mounts
cat /proc/mounts
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/mmcblk0p26 /system ext4 rw,relatime,barrier=0,data=ordered 0 0
/dev/block/mmcblk0p1 /firmware vfat ro,relatime,fmask=0000,dmask=0000,allow_utim
e=0022,codepage=cp437,iocharset=iso8859-1,shortname=lower,errors=remount-ro 0 0
/dev/block/mmcblk0p28 /data ext4 rw,nosuid,nodev,relatime,barrier=1,data=ordered
,noauto_da_alloc 0 0
/dev/block/mmcblk0p12 /persist ext4 rw,nosuid,nodev,relatime,barrier=1,data=orde
red 0 0
/dev/block/mmcblk0p27 /cache ext4 rw,nosuid,nodev,relatime,barrier=1,data=ordere
d 0 0
/dev/block/mmcblk0p29 /mpt ext4 rw,nosuid,nodev,relatime,barrier=1,data=ordered
0 0
/dev/block/mmcblk0p31 /lgumsg ext4 rw,nosuid,nodev,relatime,barrier=1,data=order
ed 0 0
/dev/block/mmcblk0p23 /mm ext4 rw,nosuid,nodev,relatime,barrier=1,data=ordered 0
0
/dev/block/mmcblk0p14 /system/etc/firmware/misc_mdm vfat ro,relatime,fmask=0000,
dmask=0000,allow_utime=0022,codepage=cp437,iocharset=iso8859-1,shortname=lower,e
rrors=remount-ro 0 0

My phone is LU6200,too. Could you tell me if I can install this mod on my phone? The only difference of 2 device is the CPU

I dont think it would work on your device as im sure it has diffrent kernel , upload your boot.img , i will port it once i get nitro hd confirmation

SU640
# cat /proc/partitions
cat /proc/partitions
major minor #blocks name
7 0 2111 loop0
179 0 3526656 mmcblk0
179 1 32768 mmcblk0p1
179 2 1024 mmcblk0p2
179 3 1024 mmcblk0p3
179 4 1 mmcblk0p4
179 5 1024 mmcblk0p5
179 6 5120 mmcblk0p6
179 7 5120 mmcblk0p7
179 8 10240 mmcblk0p8
179 9 1024 mmcblk0p9
179 10 3072 mmcblk0p10
179 11 3072 mmcblk0p11
179 12 8192 mmcblk0p12
179 13 16384 mmcblk0p13
179 14 32768 mmcblk0p14
179 15 3072 mmcblk0p15
179 16 3072 mmcblk0p16
179 17 3072 mmcblk0p17
179 18 3072 mmcblk0p18
179 19 1024 mmcblk0p19
179 20 8192 mmcblk0p20
179 21 16384 mmcblk0p21
179 22 73728 mmcblk0p22
179 23 8192 mmcblk0p23
179 24 24576 mmcblk0p24
179 25 8192 mmcblk0p25
179 26 1024 mmcblk0p26
179 27 860160 mmcblk0p27
179 28 327680 mmcblk0p28
179 29 3072 mmcblk0p29
179 30 1957638 mmcblk0p30
179 31 16384 mmcblk0p31
259 0 2048 mmcblk0p32
179 32 15622144 mmcblk1
179 33 15618048 mmcblk1p1
254 0 2110 dm-0
# cat /proc/mounts
cat /proc/mounts
rootfs / rootfs rw,relatime 0 0
tmpfs /dev tmpfs rw,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/mmcblk0p27 /system ext4 ro,relatime,barrier=0,data=ordered 0 0
/dev/block/mmcblk0p22 /tombstones ext4 rw,nosuid,nodev,relatime,barrier=1,data=o
rdered 0 0
/dev/block/mmcblk0p1 /firmware vfat ro,relatime,fmask=0000,dmask=0000,allow_utim
e=0022,codepage=cp437,iocharset=iso8859-1,shortname=lower,errors=remount-ro 0 0
/dev/block/mmcblk0p30 /data ext4 rw,nosuid,nodev,relatime,barrier=1,data=ordered
,noauto_da_alloc 0 0
/dev/block/mmcblk0p12 /persist ext4 rw,nosuid,nodev,relatime,barrier=1,data=orde
red 0 0
/dev/block/mmcblk0p28 /cache ext4 rw,nosuid,nodev,relatime,barrier=1,data=ordere
d 0 0
/dev/block/mmcblk0p31 /mpt ext4 rw,nosuid,nodev,relatime,barrier=1,data=ordered
0 0
/dev/block/mmcblk0p23 /mm ext4 rw,nosuid,nodev,relatime,barrier=1,data=ordered 0
0
/dev/block/mmcblk0p14 /system/etc/firmware/misc_mdm vfat ro,relatime,fmask=0000,
dmask=0000,allow_utime=0022,codepage=cp437,iocharset=iso8859-1,shortname=lower,e
rrors=remount-ro 0 0
/dev/block/vold/179:33 /mnt/sdcard vfat rw,dirsync,nosuid,nodev,noexec,relatime,
uid=1000,gid=1015,fmask=0002,dmask=0002,allow_utime=0020,codepage=cp437,iocharse
t=iso8859-1,shortname=mixed,utf8,tz=UTC,errors=remount-ro 0 0
/dev/block/vold/179:33 /mnt/secure/asec vfat rw,dirsync,nosuid,nodev,noexec,rela
time,uid=1000,gid=1015,fmask=0002,dmask=0002,allow_utime=0020,codepage=cp437,ioc
harset=iso8859-1,shortname=mixed,utf8,tz=UTC,errors=remount-ro 0 0
tmpfs /mnt/sdcard/.android_secure tmpfs ro,relatime,size=0k,mode=000 0 0
/dev/block/dm-0 /mnt/asec/com.cyandroid.pianofull-1 vfat ro,dirsync,nosuid,nodev
,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shor
tname=mixed,utf8,tz=UTC,errors=remount-ro 0 0

OK...
I just ran 'cat /dev/zero > /dev/block/mmcblk0p27', remounted my system partition as read/write and copied the recovery.img into the directory. Just rebooted in hopes it will flash the recovery image to the recovery partition p27 above. Will now attempt rebooting into recovery to see if anything happened...
---------- Post added at 09:05 AM ---------- Previous post was at 09:01 AM ----------
Upon using anreboot to boot into recovery I get...
Code:
Enter the fastboot...
Enter the fastboot...
Long time no see!
And the LG logo beneath it... It also attempted to install a new driver 'android', but couldn't find it on my computer. Very excited that we are moving closer to getting a 'real' recovery mode on the phone...
Now to see if I can reboot normally?
---------- Post added at 09:09 AM ---------- Previous post was at 09:05 AM ----------
And it still boots normally and is fully functional when it does boot!!! Good progress so far. Now, does anyone know how to determine the driver it is looking for? I think if I find the right driver I can get into fastboot mode and do anything else that is necessary?

schwin97 said:
OK...
I just ran 'cat /dev/zero > /dev/block/mmcblk0p27', remounted my system partition as read/write and copied the recovery.img into the directory. Just rebooted in hopes it will flash the recovery image to the recovery partition p27 above. Will now attempt rebooting into recovery to see if anything happened...
---------- Post added at 09:05 AM ---------- Previous post was at 09:01 AM ----------
Upon using anreboot to boot into recovery I get...
Code:
Enter the fastboot...
Enter the fastboot...
Long time no see!
And the LG logo beneath it... It also attempted to install a new driver 'android', but couldn't find it on my computer. Very excited that we are moving closer to getting a 'real' recovery mode on the phone...
Now to see if I can reboot normally?
Click to expand...
Click to collapse
Why did you ran cat /dev/zero > /dev/block/mmcblk0p27?
as of this http://forum.xda-developers.com/showpost.php?p=20514396&postcount=32 post your recovery partition should be /dev/block/mmcblk0p27
so To be me steps would have been:
1) Backing up recovery partition using dd
2) Remounting System partiton as read write
3) copying recovery.img to /system and flashing the recovery.img
4) booting into recovery

For fastboot you should have andriod sdk installed , get it at :
Code:
http://developer.android.com/sdk/download.html

I agree, but when I miss the part about putting the recovery image in the system directory for it to automatically reflash, I started running the steps to flash the recovery image as people flash the boot image...
An extra step that luckily didn't have any bad consequences...
---------- Post added at 09:18 AM ---------- Previous post was at 09:16 AM ----------
bytecode64 said:
For fastboot you should have andriod sdk installed , get it at :
Code:
http://developer.android.com/sdk/download.html
Click to expand...
Click to collapse
I have the sdk installed - but my laptop is asking for a driver - is the driver within the sdk download? If I don't give it the driver then it says the device didn't get installed correctly and fastboot doesn't see it.

what about USB drivers and Modem?
Did you installed http://s3.amazonaws.com/lgforum.com/resources/assets/680/original/LGP930.zip?1322664514
?

I have uploaded my boot.img & recovery.img to dropbox.
But I can not post any links now.It needs 8 posts.

Sure did. I have the drivers that are needed when the phone boots up normally? Just when it boots up in this new recovery mode that it is asking for a new driver? It shouldn't be asking for anything new, but it is... Another question - after it loads up the new recovery image from the /system directory should it remove the recovery image? If so, then if the recovery image is still in the system directory we may have a problem?
---------- Post added at 09:44 AM ---------- Previous post was at 09:39 AM ----------
As I had thought - recovery.img is still in the system directory... Does this indicate a problem?

schwin97 said:
I have the sdk installed - but my laptop is asking for a driver - is the driver within the sdk download? If I don't give it the driver then it says the device didn't get installed correctly and fastboot doesn't see it.
Click to expand...
Click to collapse
You should install the LGMobile update which can be downloaded from LG official website.
That is a useful tool.

[Q] HTC Desire Z Temporary root has disappeared very quickly.

Hi, guys!
I've tried rooting my DesireZ using "Downgrading guide from gingerbread to froyo" (link was destroyed by forum rules)
It is really clear and easy to do guide. But I ran into a problem because I can't make a root backup after gaining Temporary root on HTC DESIRE Z (2.42.405.2). When fixsu.sh ends I am starting "Root check basic" app and it has show me the result is OK. Then I starts MyBackupPro. The first time it shows me new menu item with root operations, but after that it refusing do anything instead of message "There is no properly root access". Titanium Backup behaves in the same way: it properly starts, but does not work with system applications. The only step in the guide I have missed is "Changing version number", but I think the problem is not the case, is it true? Could you tell me please, what may be a reason?
I really fear to begin change the ROM before to have full backup...

Try a full power off. turn the phone off, pull the battery out for a minute, then turn it back on and retry the temp-root.
Sometimes the 'fastboot' feature of sense roms messes with the temp-root.
-Nipqer

Nipqer said:
Try a full power off. turn the phone off, pull the battery out for a minute, then turn it back on and retry the temp-root.
Sometimes the 'fastboot' feature of sense roms messes with the temp-root.
-Nipqer
Click to expand...
Click to collapse
unfortunately, did not help.
Here is log after I turned device:
C:\Documents and Settings\htc>adb devices
List of devices attached
HT0BHRT01025 device
C:\Documents and Settings\htc>adb shell
$ /data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF
/data/local/tmp/fre3vo -debug -start FAA90000 -end FFFFFFFF
fre3vo by #teamwin
Please wait...
Attempting to modify ro.secure property...
fb_fix_screeninfo:
id: msmfb
smem_start: 802160640
smem_len: 3145728
type: 0
type_aux: 0
visual: 2
xpanstep: 0
ypanstep: 1
line_length: 1920
mmio_start: 0
accel: 0
fb_var_screeninfo:
xres: 480
yres: 800
xres_virtual: 480
yres_virtual: 1600
xoffset: 0
yoffset: 800
bits_per_pixel: 32
activate: 16
height: 80
width: 48
rotate: 0
grayscale: 0
nonstd: 0
accel_flags: 0
pixclock: 0
left_margin: 0
right_margin: 0
upper_margin: 0
lower_margin: 0
hsync_len: 0
vsync_len: 0
sync: 0
vmode: 0
Buffer offset: 00000000
Buffer size: 8192
Scanning region faa90000...
Scanning region fab80000...
Scanning region fac70000...
Scanning region fad60000...
Scanning region fae50000...
Scanning region faf40000...
Scanning region fb030000...
Scanning region fb120000...
Scanning region fb210000...
Scanning region fb300000...
Scanning region fb3f0000...
Scanning region fb4e0000...
Scanning region fb5d0000...
Scanning region fb6c0000...
Scanning region fb7b0000...
Scanning region fb8a0000...
Scanning region fb990000...
Scanning region fba80000...
Potential exploit area found at address fbb52000:1000.
Exploiting device...
C:\Documents and Settings\htc>adb shell
# cd /data/local/tmp
cd /data/local/tmp
# ./fixsu.sh
./fixsu.sh
# cat /system/etc/passwd
cat /system/etc/passwd
root::0:0:root:/data/local:/system/bin/sh !!ROOT is really getting!
# cat /system/etc/passwd
cat /system/etc/passwd
keychar xV4 9 0 0 0 # !!After MyBackup Pro start
#
I think the problem is the destruction of the memory area, where exploit works.
Maybe there are other ideas?

Develop Bugs

welcome