Develop Bugs

[Q] Screenshot option in Power menu not working.

Hello, I apologize if this has been answered elsewhere. I did look / read alot of threads and did not find anything yet.
ROM:------------Juggernaut 2.0
KERNEL:---------Jugs 0.3
OC, min/max:----1080/1836 MHz
**No Tweaks / scripts**
Here is what I noticed. I held down the "power" button to get the power menu options and selected "Screenshot". The phone went back to the previous screen as if it took the screenshot. Then 2 Seconds later I got an error/message saying:
"Error: Unable to save screenshot
mBitmap = null"
Immediately another message appeared saying:
"Screenshot saved at null"
===========================================================
I've looks in my Gallery and don't see a folder called NULL, I've plugged the phone in via USB and looked through the folders trying to find it and I cant seem to locate NULL.
Do you think this could be an issue with ROM I've installed or a One user bug that can be resolved?

Much better to just post in the ROM thread as this is a specific question to the ROM.
You need to make sure the screenshot app has proper superuser permissions. Open up Superuser and make sure it's set properly. Someone had this issue earlier today and that resolved their issue.

thats exactly what it was. I wonder how it got in the Deny list. Hmmm Well its fixed not. thanks alot bud.

I wonder how to solve this problem...

Sorry for reviving this old thread but may I know what could be the possible error for this? Any error in libs or something?

aniket.lamba said:
Sorry for reviving this old thread but may I know what could be the possible error for this? Any error in libs or something?
Click to expand...
Click to collapse
Have you tried the hard key solution? (Volume Down + Power)
On another unrelated note you really shouldn't 1080mhz your min clock as your phone is never truly idle and can cause unneeded battery drain and/or excessive heat.

LG G4 CRCWIZARD Test under ServiceMenu of HiddenMenu using *#546368#*<Model># -Err

LG G4 CRCWIZARD Test under ServiceMenu of HiddenMenu using *#546368#*<Model># -Err
Hi
I have been having problems with H812 and found out under CRCWIZARD test, that DB is not stable and I also have been having problems with SDCard State failing.
So my questions is : I get the error after enabling CRC Wizard to ON and run it by reentering the test..... CRC Wizard checking shows that all 5 stages .and DB getting fixed BUT I am not able to copy those fixed CRC Values to FileSystem..... the option at the end of CRC Wizard test does not work.
Any one can help me understand how to fix unstable DB and SIM and SD Card State using Service Menu???
Regards!

NO RESPONSE?? or is this only for LG Service Personnel ???
glenrocks said:
Hi
I have been having problems with H812 and found out under CRCWIZARD test, that DB is not stable and I also have been having problems with SDCard State failing.
So my questions is : I get the error after enabling CRC Wizard to ON and run it by reentering the test..... CRC Wizard checking shows that all 5 stages .and DB getting fixed BUT I am not able to copy those fixed CRC Values to FileSystem..... the option at the end of CRC Wizard test does not work.
Any one can help me understand how to fix unstable DB and SIM and SD Card State using Service Menu???
Click to expand...
Click to collapse
NO RESPONSE?? or is this only for LG Service Personnel who are already over-reaching their phones with carriers with ROLLBACK restrictions ???
Unless solution is not to be disclosed in open thread, then do share it privately.

glenrocks said:
NO RESPONSE?? or is this only for LG Service Personnel who are already over-reaching their phones with carriers with ROLLBACK restrictions ???
Unless solution is not to be disclosed in open thread, then do share it privately.
Click to expand...
Click to collapse
Not sure what you are talking about? Most people don't either probably
Sound like something a developer would know

Try Hidden LG Menu is accessed thru #*546368*#812#
deltadiesel said:
Not sure what you are talking about? Most people don't either probably
Sound like something a developer would know
Click to expand...
Click to collapse
Excuse me for late response... was away.
Well, its the LG Service Menu accessible through call pad #*546368*#812# (812 is my model-u can use your model). Try it.
CRCWizard is under Service Menu.
I will also try to post some images.

glenrocks said:
Excuse me for late response... was away.
Well, its the LG Service Menu accessible through call pad #*546368*#812# (812 is my model-u can use your model). Try it.
CRCWizard is under Service Menu.
I will also try to post some images.
Click to expand...
Click to collapse
On 810 dirty unicorns for 811
Can't try

deltadiesel said:
On 810 dirty unicorns for 811
Can't try
Click to expand...
Click to collapse
lol..ok.. I think you can still access the menu... cant you?
I wish I could use 810 image on this 812 (after I can correct this problem).

glenrocks said:
lol..ok.. I think you can still access the menu... cant you?
I wish I could use 810 image on this 812 (after I can correct this problem).
Click to expand...
Click to collapse
Service codes work lg ROMs only
No you cant

deltadiesel said:
Service codes work lg ROMs only
No you cant
Click to expand...
Click to collapse
O ok.
Let me attach images to share what I meant.

CRC wizard run and fails to write FS
When I run the CRCWizard and ignore pre-condition error, here are some snapshots... it runs through 5 stages and changes the DB Stable but does not write to FileSystem.

glenrocks said:
When I run the CRCWizard and ignore pre-condition error, here are some snapshots... it runs through 5 stages and changes the DB Stable but does not write to FileSystem.
Click to expand...
Click to collapse
That would seem to point to a file system permissions issue - it may be setup currently as read only - see if you can change it to read/write - it may not hold on reboot, so would suggest doing the permission changes in TWRP-in-FiSH using adb chmod - reference my post # 357 in the TWRP-in-FiSH thread and open the link I have referenced there, paying attention to the permission re-set at the end of the piece but using the read/write permissions numbers. Doing it in TWRP-in-FiSH helps getting around the selinux enforcing issue.

Uconnect 8.4 ver 17.11.07 trying to "root"

I was posting some questions in the "Rooted Jeep Cherokee '14 Uconnect" thread but I've started this new thread for the 17.xx versions because the methods (if we are able to identify them) aren't the same as the 16.33.29 and earlier firmwares...
I am still trying to crack into that unit with the 17.11.07 software. I have a D-Link USB Ethernet but its a HW revision D and I believe I would need a B if we can get ethernet enabled at all.
Also, if we can get Ethernet enabled we will still need to get SSH password or key.
devmihkel said:
For good or for bad NOT everything appears correct, except the running 17.x version... As of now neither the "commercial jailbreak" supports new versions (well yes they were using exactly the same file to start with Also 16.51.x or newer appears to be no go: uconnect-8-4-8-4an-update
EDIT: haven't got 17.09.07 to try, but on 17.11.07 manifest.lua has changed and the last block/ search keyword is "ota_update" instead. Otherwise all the same, image valid after the edit and script.sh gets fired - at least on 16.33.29 that is @HanJ67 Did you actually try to mount installer.iso after the edit and checked /etc/manifest.lua for the end result before?
Click to expand...
Click to collapse
devmihkel said:
Yeah, 2nd attempt is much better as last lua block is correctly terminated and your script might actually run, but unfortunately no successful 17.x runs have been reported so far SWF scripts are not involved in update/jail-breaking run, these ones become relevant only once you are in (and need to enable some app or wifi or navi features etc). Afaik 17.x blocks ethernet dongle usage as well, but let's see if even the USB driver/link gets activated at all?
Click to expand...
Click to collapse
Do you have a 16.33.29 version I can try this on? I'm wondering if it will get me far enough to execute the "manifest.lua HD_Update" hack you and @HanJ67 were discussing.
I've used the 17.43.01, then finally found a 17.11.07 and had no luck there either.
In my latest attempts on the 17.11.07, I was able to hex edit the "ifs-cmc.bin" on the UPD and replaced the SSH-RSA key with my own. I think this bin will be flashed to the MMC during an update.
That SWDL.UPD got past the initial check and rebooted into update mode, but then it fails the second ISO check and loops. I had to use an unmodified image to finish the update and get back up and running.
I keep reading about making changes only after the 2048 Byte mark in the older versions with the "S" at 0x80. Is this still relevant
in later ISO/UPD images and to the second ISO check?
Right now, I'm looking to find a way to disable that check so that my modified .bin will be written to disk? I think this route would work to also modifying and getting WiFi enabled after a flash of the edited image.
If I had I 16.33.29 or similar older UPD version to attempt the HD_UPDATE hack in the Manifest.lua file I would give that a shot to be thorough.

Do You have an idea how to connect by USB2LAN adapter to uConnect ?
Do You know if there is an UART pins on the mainboard ?

itsJRod said:
I was posting some questions in the "Rooted Jeep Cherokee '14 Uconnect" thread but I've started this new thread for the 17.xx versions because the methods (if we are able to identify them) aren't the same as the 16.33.29 and earlier firmwares...
I am still trying to crack into that unit with the 17.11.07 software. I have a D-Link USB Ethernet but its a HW revision D and I believe I would need a B if we can get ethernet enabled at all.
Also, if we can get Ethernet enabled we will still need to get SSH password or key.
Do you have a 16.33.29 version I can try this on? I'm wondering if it will get me far enough to execute the "manifest.lua HD_Update" hack you and @HanJ67 were discussing.
I've used the 17.43.01, then finally found a 17.11.07 and had no luck there either.
In my latest attempts on the 17.11.07, I was able to hex edit the "ifs-cmc.bin" on the UPD and replaced the SSH-RSA key with my own. I think this bin will be flashed to the MMC during an update.
That SWDL.UPD got past the initial check and rebooted into update mode, but then it fails the second ISO check and loops. I had to use an unmodified image to finish the update and get back up and running.
I keep reading about making changes only after the 2048 Byte mark in the older versions with the "S" at 0x80. Is this still relevant
in later ISO/UPD images and to the second ISO check?
Right now, I'm looking to find a way to disable that check so that my modified .bin will be written to disk? I think this route would work to also modifying and getting WiFi enabled after a flash of the edited image.
If I had I 16.33.29 or similar older UPD version to attempt the HD_UPDATE hack in the Manifest.lua file I would give that a shot to be thorough.
Click to expand...
Click to collapse
Hello, any news about it?

hi,
can you explain how to change SSH key in "ifs-cmc.bin" file?
thanks a lot
itsJRod said:
I was posting some questions in the "Rooted Jeep Cherokee '14 Uconnect" thread but I've started this new thread for the 17.xx versions because the methods (if we are able to identify them) aren't the same as the 16.33.29 and earlier firmwares...
I am still trying to crack into that unit with the 17.11.07 software. I have a D-Link USB Ethernet but its a HW revision D and I believe I would need a B if we can get ethernet enabled at all.
Also, if we can get Ethernet enabled we will still need to get SSH password or key.
Do you have a 16.33.29 version I can try this on? I'm wondering if it will get me far enough to execute the "manifest.lua HD_Update" hack you and @HanJ67 were discussing.
I've used the 17.43.01, then finally found a 17.11.07 and had no luck there either.
In my latest attempts on the 17.11.07, I was able to hex edit the "ifs-cmc.bin" on the UPD and replaced the SSH-RSA key with my own. I think this bin will be flashed to the MMC during an update.
That SWDL.UPD got past the initial check and rebooted into update mode, but then it fails the second ISO check and loops. I had to use an unmodified image to finish the update and get back up and running.
I keep reading about making changes only after the 2048 Byte mark in the older versions with the "S" at 0x80. Is this still relevant
in later ISO/UPD images and to the second ISO check?
Right now, I'm looking to find a way to disable that check so that my modified .bin will be written to disk? I think this route would work to also modifying and getting WiFi enabled after a flash of the edited image.
If I had I 16.33.29 or similar older UPD version to attempt the HD_UPDATE hack in the Manifest.lua file I would give that a shot to be thorough.
Click to expand...
Click to collapse

sofro1988 said:
Hello, any news about it?
Click to expand...
Click to collapse
I have not had had much time to work on this.
I actually had an idea last week that brought me back to this. I plan to use a custom flash drive to present an unmodified ISO for verification, then swap nand to an identical image that has been he's edited to enable usb Ethernet and add a custom key for ssh access.
I thought to stack a NAND on top of the original on a is flash drive, then breakout the Chip Enable pin to a switch. I've seen this done for with guys modifying game consoles to be able to run modified firmware.
Once the 2nd NAND is in place I will restore an image of the original nand containing the unmodified update, then hex edit the required portions to allow access after updating.
If this method works, I should be able to pass the verification with the original nand chip, then switch it (hopefully there's a big enough window to do this by hand) then present the modified nand before it begins the flash procedure.
Hopefully someone more intimately familiar with the update scripts can verify I'm not missing anything in the process

Tajadela said:
hi,
can you explain how to change SSH key in "ifs-cmc.bin" file?
thanks a lot
Click to expand...
Click to collapse
I used a hex editor to find the Ssh RSA key and replace it. This passed the initial check to reboot into update mode, but wouldn't pass the full check in update mode. I'm hoping my attempt below will pass that check and still update with the modifications.

itsJRod said:
I used a hex editor to find the Ssh RSA key and replace it. This passed the initial check to reboot into update mode, but wouldn't pass the full check in update mode. I'm hoping my attempt below will pass that check and still update with the modifications.
Click to expand...
Click to collapse
thanks for answer.
I saw an ssh key with the hex editor, but I would like to see exactly what you have replaced.
if it's not too much trouble, it would be interesting to see with some screenshots the changes you've made.
So we could work on two fronts. The idea of the double nand is good, but not very simple to make ...

Just thinking out loud here, when you say it passes the initial check, does it then give you any confirmation of that or any message on the screen before rebooting to upgrade mode?
Sent from my CLT-L09 using Tapatalk

SquithyX said:
Just thinking out loud here, when you say it passes the initial check, does it then give you any confirmation of that or any message on the screen before rebooting to upgrade mode?
Sent from my CLT-L09 using Tapatalk
Click to expand...
Click to collapse
I tried much the same thing -- the swdl.upd is another CDROM filesystem:
martinb$ file swdl.upd
swdl.upd: ISO 9660 CD-ROM filesystem data 'CDROM'
It contains three more .iso files : installer.iso, primary.iso, and secondary.iso
installer.iso is a CDROM image, but is not mountable on my linux system
primary.iso is a CDROM image, and has the usual /bin, /etc/, and /usr filesystem for an install
the /bin directory has one file - update_nand
the /etc directory has the usual mfgVersiontxt, nand_partion.txt, system_etfs_postinstall.txt, system_mmc_postinstall.txt and version.txt
the /usr/share directory is all the firmware for various components - EQ, HD_FIRMWARE, IFS, MMC_IFS_EXTENSION,OTA,SIERRA_WIRELESS,V850, and XM_FIRMWARE
What's interesting to me is that they did update the SIERRA_WIRELESS firmware -- and have done some housecleaning:
Code:
#---------------------------------
# sierra_wireless_disable_flowcontrol.file
# \d == 1 second delay
SAY " Send AT \n"
'' AT\r
OK \d
SAY "Disable flow control\n"
'' at+ifc=0,0\r
OK \d
SAY "Send SMS command CNMI\n"
'' at+cnmi=2,1,0,1,0\r
OK \d
SAY "Clear emergency number list\n"
'' AT!NVENUM=0\r
OK \d
SAY "Set emergency number to 911\n"
'' AT!NVENUM=1,"911"\r
OK \d
SAY "Save Setting\n"
'' at&w\r
OK \d
#---------------------------------
Also in the IFS directory, when you hexedit the ifs-cmc.bin file it reveals another little treat... an SSH root public key ( not as nice as a private key, but hey )
(Sorry about the formatting, this is cut/paste right out of the hex editor)
Code:
ssh-rsa [email protected]
2E..IwU.Q....njle8r9nrJ7h8atg4WfqswU0C0Rk/Ezs/sQs5ZA6ES82MQONjHBd7mw
uo8h0xfj3KeeSHMXCEBpmU26guNE4EqfvdioLFCDUxtvMYswlUZjsvd/NYz9lnUZg2hy
pwzFQjXgSzmHVrHjkKKvq7Rak/85vGZrJKxlvHnowA8JIl1tVNVQjPMNgDDJabaETtfw
LL1KlvAzI81cKOG/3IRn9lU6qyYqyG+zYoza0nN\..7/AtxdL481k81Go5c3NQTnkl2U
68lbu8CpnwrYCU098owLmxdI4kF5UOL4R61ItJuwz30JSESgT..!8RDgM6XEiHUpK9yW
vvRg+vbGWT/oQn0GQ== [email protected]
in /usr/share/MMC_IFS_EXTENSION/bin/cisco.sh and dlink.sh there's another good hint - what adapter you need for USB ethernet
Code:
#!/bin/sh
# Handle an Ethernet connection via the CISCO Linksys USB300M adapter
or
Code:
#!/bin/sh
# Handle an Ethernet connection via the D-Link DUB-E100 adapter
The static IP it brings up if no DHCP is offered is : 192.168.6.1
There's tons more in there -- like the V850 chip has access to the Sierra Wireless CDMA modem, but can configure it for voice calls through the car speakers:
"AT!AVSETPROFILE=8,1,1,0,5" ( embedded in the cmcioc.bin update file )
secondary.iso is a CDROM image and only has /etc/ and /usr
the /etc/ directory has speech_mmc_preinstall.txt and xlets_mmc1_preinstall.txt
the /usr/ directory has /usr/share/speech and /usr/share/xlets ( tons of information about sensors in the car, etc in xlets )

martinbogo1 said:
I tried much the same thing -- the swdl.upd is another CDROM filesystem:
martinb$ file swdl.upd
swdl.upd: ISO 9660 CD-ROM filesystem data 'CDROM'
It contains three more .iso files : installer.iso, primary.iso, and secondary.iso
installer.iso is a CDROM image, but is not mountable on my linux system
primary.iso is a CDROM image, and has the usual /bin, /etc/, and /usr filesystem for an install
the /bin directory has one file - update_nand
the /etc directory has the usual mfgVersiontxt, nand_partion.txt, system_etfs_postinstall.txt, system_mmc_postinstall.txt and version.txt
the /usr/share directory is all the firmware for various components - EQ, HD_FIRMWARE, IFS, MMC_IFS_EXTENSION,OTA,SIERRA_WIRELESS,V850, and XM_FIRMWARE
What's interesting to me is that they did update the SIERRA_WIRELESS firmware -- and have done some housecleaning:
Code:
#---------------------------------
# sierra_wireless_disable_flowcontrol.file
# \d == 1 second delay
SAY " Send AT \n"
'' AT\r
OK \d
SAY "Disable flow control\n"
'' at+ifc=0,0\r
OK \d
SAY "Send SMS command CNMI\n"
'' at+cnmi=2,1,0,1,0\r
OK \d
SAY "Clear emergency number list\n"
'' AT!NVENUM=0\r
OK \d
SAY "Set emergency number to 911\n"
'' AT!NVENUM=1,"911"\r
OK \d
SAY "Save Setting\n"
'' at&w\r
OK \d
#---------------------------------
Also in the IFS directory, when you hexedit the ifs-cmc.bin file it reveals another little treat... an SSH root public key ( not as nice as a private key, but hey )
(Sorry about the formatting, this is cut/paste right out of the hex editor)
Code:
ssh-rsa [email protected]
2E..IwU.Q....njle8r9nrJ7h8atg4WfqswU0C0Rk/Ezs/sQs5ZA6ES82MQONjHBd7mw
uo8h0xfj3KeeSHMXCEBpmU26guNE4EqfvdioLFCDUxtvMYswlUZjsvd/NYz9lnUZg2hy
pwzFQjXgSzmHVrHjkKKvq7Rak/85vGZrJKxlvHnowA8JIl1tVNVQjPMNgDDJabaETtfw
LL1KlvAzI81cKOG/3IRn9lU6qyYqyG+zYoza0nN\..7/AtxdL481k81Go5c3NQTnkl2U
68lbu8CpnwrYCU098owLmxdI4kF5UOL4R61ItJuwz30JSESgT..!8RDgM6XEiHUpK9yW
vvRg+vbGWT/oQn0GQ== [email protected]
in /usr/share/MMC_IFS_EXTENSION/bin/cisco.sh and dlink.sh there's another good hint - what adapter you need for USB ethernet
Code:
#!/bin/sh
# Handle an Ethernet connection via the CISCO Linksys USB300M adapter
or
Code:
#!/bin/sh
# Handle an Ethernet connection via the D-Link DUB-E100 adapter
The static IP it brings up if no DHCP is offered is : 192.168.6.1
There's tons more in there -- like the V850 chip has access to the Sierra Wireless CDMA modem, but can configure it for voice calls through the car speakers:
"AT!AVSETPROFILE=8,1,1,0,5" ( embedded in the cmcioc.bin update file )
secondary.iso is a CDROM image and only has /etc/ and /usr
the /etc/ directory has speech_mmc_preinstall.txt and xlets_mmc1_preinstall.txt
the /usr/ directory has /usr/share/speech and /usr/share/xlets ( tons of information about sensors in the car, etc in xlets )
Click to expand...
Click to collapse
Have you tried connecting to it?
Sent from my iPhone using Tapatalk

sofro1988 said:
Have you tried connecting to it?
Sent from my iPhone using Tapatalk
Click to expand...
Click to collapse
I managed to connect with the cisco adapter (usb / ethernet), but I don't know the root password. is the problem at the moment insurmountable ..

Using a cisco connector, I have gotten the ethernet to come up, but that's it. At the moment, there doesn't seem to be anything I can connect to.
@Tajadela - sounds like you at least were able to either SSH or telnet in to a port... I'm on software version 17.43.01 .. which are you on, and what year vehicle? ( Jeep Grand Cherokee, 2015, Uconnect 8.4AN with the 3G Sierra Aircard modem for Sprint )

martinbogo1 said:
Using a cisco connector, I have gotten the ethernet to come up, but that's it. At the moment, there doesn't seem to be anything I can connect to.
@Tajadela - sounds like you at least were able to either SSH or telnet in to a port... I'm on software version 17.43.01 .. which are you on, and what year vehicle? ( Jeep Grand Cherokee, 2015, Uconnect 8.4AN with the 3G Sierra Aircard modem for Sprint )
Click to expand...
Click to collapse
I connected in telnet on a uconnect 6.5 with firmware 15.xx.xx. You can connect to Uconnect with static IP it brings up if no DHCP is offered is: 192.168.6.1

itsJRod said:
I used a hex editor to find the Ssh RSA key and replace it. This passed the initial check to reboot into update mode, but wouldn't pass the full check in update mode. I'm hoping my attempt below will pass that check and still update with the modifications.
Click to expand...
Click to collapse
after rsa key replaced, do you have recalculate the checksum of UPD file?
have you replaced the first 64 bytes of the file?
thanks

@itsJRod, isn't it that you would like to explain the procedure to replace the RSA key in the swdl file? thank you

Hello,
have you made any progress? I am a bit lost. I put the EU uconnect MY15 to US dodge charger MY16 and Perf Pages were working fine even on 16.16.13, although after upgrade to 17.x (17.46.0.1 right now) I am meeting the problem of expired subscription (which is not possible to have on EU radio).
I am considering basically three solutions:
a) going back to US radio, but modify the language pack/nav/FM frequencies (it is doable, but I do not know how, although I can pay for it relatively less than time invested)
b) downgrade to 16.16.13 - I have no clue how to do it, I tried to put swdl.upd with swdl.iso as and installer.iso with no luck of course.
c) take xlets from KIM2/ of 16.16.13 to KIM23 of 17.46.0.1 secondary.iso - this is probably preferred way but I do not know how to make it to pass ISO validation.
Of course root on uconnect is extremely nice to have but I will be fully satisfied with Perf Pages working again.

Hello.
I'm hoping the community can help me out. I have a RAM 1500 with the RA4 (was running the 17.11.07 software that I got pushed to me OTS style a couple years ago. Since them problems, radio turn on delay, no GPS and cellular phone warning popup.
I was told to do the 18.45 update which I got from driveuconnect.com, but this has essentially bricked my radio with the "bolo update failed" error and it is looping continuously
I have tried many ways to modify the update software's manifest.lua script to try to get rid of the sierra wireless portion by manually editing, hex editing, etc but always get the "please insert the USB card" screen.
Uconnect is obviously completely worthless to help me and the dealer wants me to pay them money to tell me what I already know. I know I can pay 300 and send my radio to infotainemnt.com to get it repaired, but I would like to solve this on my own is possible, because I would like to further modify the software to make it more custom and unique.
From my reading the 17x version keeps you from downgrading to a version that can be hacked easily.
Everything seems like it should be pretty straight forward as I have a lot of experience in programming and embedded devices.
It seems they are validating the ISOs using some mechanism, I believe I have tried all of tricks/methods
I have searched the code to see if I can find the iso MD5 or SHA256 hashes that ioc_check is probably using to figure out I changed somethign but nothing work.
I have even tried the swapping the flash drives after validation but it seems they are using the ISos they already copied to continue the process, I then end u getting some invalid errors or the update just crashes out
I got other updates from the link: http://www.mydrive.ch/
http://www.mydrive.ch/http://www.mydrive.ch/
username: [email protected]
Password: gasolio
Havent tried all of them yet, but pretty sure they wont work, due to the 17x security changes.
Any help would be appreciated grealty, I really dont want to shell out any cash for something a company told me to to and due to their screw up with bricking modems, this is now bricking my radio.
Thanks to all in advance !!!

djmjr77 said:
Hello.
I'm hoping the community can help me out. I have a RAM 1500 with the RA4 (was running the 17.11.07 software that I got pushed to me OTS style a couple years ago. Since them problems, radio turn on delay, no GPS and cellular phone warning popup.
I was told to do the 18.45 update which I got from driveuconnect.com, but this has essentially bricked my radio with the "bolo update failed" error and it is looping continuously
I have tried many ways to modify the update software's manifest.lua script to try to get rid of the sierra wireless portion by manually editing, hex editing, etc but always get the "please insert the USB card" screen.
Uconnect is obviously completely worthless to help me and the dealer wants me to pay them money to tell me what I already know. I know I can pay 300 and send my radio to infotainemnt.com to get it repaired, but I would like to solve this on my own is possible, because I would like to further modify the software to make it more custom and unique.
From my reading the 17x version keeps you from downgrading to a version that can be hacked easily.
Everything seems like it should be pretty straight forward as I have a lot of experience in programming and embedded devices.
It seems they are validating the ISOs using some mechanism, I believe I have tried all of tricks/methods
I have searched the code to see if I can find the iso MD5 or SHA256 hashes that ioc_check is probably using to figure out I changed somethign but nothing work.
I have even tried the swapping the flash drives after validation but it seems they are using the ISos they already copied to continue the process, I then end u getting some invalid errors or the update just crashes out
I got other updates from the link: http://www.mydrive.ch/
http://www.mydrive.ch/http://www.mydrive.ch/
username: [email protected]
Password: gasolio
Havent tried all of them yet, but pretty sure they wont work, due to the 17x security changes.
Any help would be appreciated grealty, I really dont want to shell out any cash for something a company told me to to and due to their screw up with bricking modems, this is now bricking my radio.
Thanks to all in advance !!!
Click to expand...
Click to collapse
Just to follow up for anyone who reads this in the future.
I was able to get my uconnect working again a few minutes ago.
As my previous post stated I got stuck in the "bolo update failed" loop.
I downloaded the UCONNECT_8.4AN_RA4_16.33.29_MY16.exe update from the url posted in my previous comment.
I did the S Byte HEX Mod to the swdl.iso file, loaded it and the swdl.upd file on a thumb drive. Used Hxd on windows. Followed the section in the Uconnect exploitation PDF:
https://www.google.com/url?sa=t&source=web&rct=j&url=http://illmatics.com/Remote%2520Car%2520Hacking.pdf&ved=2ahUKEwjZsOGNl5nyAhWhGVkFHZy2AnAQFnoECAcQAg&usg=AOvVaw0NAi3a1eh-IRd3n1VHv-ys
When I plugged it in, it started with the update process, after the first unit, the screen said the Uconnect had to restart, please wait..
And whalaa my radio worked again!!! It even says it has the 18.45 firmware on it.. go figure.. Navigation still does not work, but thats most likely because the sierra wireless card is bad.
I cannot say for sure the S Byte thing did anything, because I'm not messing with this anymore, almost had to buy a new radio.
I would say try it with out, then with it if it doesn't work.
This could also be a fluke with my particular unit, but at least its something else to try than pay 600+ dollars!!
Good luck to anyone else who goes through this mess!!!

djmjr77 said:
Just to follow up for anyone who reads this in the future.
I was able to get my uconnect working again a few minutes ago.
As my previous post stated I got stuck in the "bolo update failed" loop.
I downloaded the UCONNECT_8.4AN_RA4_16.33.29_MY16.exe update from the url posted in my previous comment.
I did the S Byte HEX Mod to the swdl.iso file, loaded it and the swdl.upd file on a thumb drive. Used Hxd on windows. Followed the section in the Uconnect exploitation PDF:
https://www.google.com/url?sa=t&source=web&rct=j&url=http://illmatics.com/Remote%2520Car%2520Hacking.pdf&ved=2ahUKEwjZsOGNl5nyAhWhGVkFHZy2AnAQFnoECAcQAg&usg=AOvVaw0NAi3a1eh-IRd3n1VHv-ys
When I plugged it in, it started with the update process, after the first unit, the screen said the Uconnect had to restart, please wait..
And whalaa my radio worked again!!! It even says it has the 18.45 firmware on it.. go figure.. Navigation still does not work, but thats most likely because the sierra wireless card is bad.
I cannot say for sure the S Byte thing did anything, because I'm not messing with this anymore, almost had to buy a new radio.
I would say try it with out, then with it if it doesn't work.
This could also be a fluke with my particular unit, but at least its something else to try than pay 600+ dollars!!
Good luck to anyone else who goes through this mess!!!
Click to expand...
Click to collapse
I created an account just to reply to this and All I have to say is you're literally an absolute life saver. I've been working on this every day for two weeks now, trying every trick people said, trying every USB, every format, every version and nothing ever worked from me. Uconnect support was absolutely no help and it was a lot of back-and-forth finger pointing and no you need to reach out to this person between them and the dealership. Dealership tried to charge me for a Proxy Alignment when I asked to just update my damn radio stuck in this loop.
I have a 2015 Jeep Cherokee 8.4AN VP4 NA Head Unit 68238619AJ. I was updating from 17.11.07 to 18.45.01 and got stuck at the step 11 1% and would get a failed sierra wireless every time and then got in that "bolo update failed" loop..Well to fix it just now all I did was download the UCONNECT_8.4AN_RA4_16.33.29_MY16.exe update from the url posted in the previous comment and quick format to FAT32 on a 16GB Micro Center USB extracted the files from 16.33.29 to the USB with 7ZIP, plugged in like normal and BOOM it ran the first step restarted and I had a working radio again showing update 18.45.01.
(So i'm assuming you don't have to do the S Byte thing I didn't even mess with it I just used the 16.33.29 to bypass step 11 since that version only has 14 steps and 18.45.01 was already preloaded from attempting before. My navigation still is the wrong address but I don't care about all that just thankful to have my radio back before my wife killed me for trying to update it by myself. )
I hope this helps someone else one day because it took some deep research and hours on hours of forum hoping to finally find the solution. <3

djmjr77 said:
Just to follow up for anyone who reads this in the future.
I was able to get my uconnect working again a few minutes ago.
As my previous post stated I got stuck in the "bolo update failed" loop.
I downloaded the UCONNECT_8.4AN_RA4_16.33.29_MY16.exe update from the url posted in my previous comment.
I did the S Byte HEX Mod to the swdl.iso file, loaded it and the swdl.upd file on a thumb drive. Used Hxd on windows. Followed the section in the Uconnect exploitation PDF:
https://www.google.com/url?sa=t&source=web&rct=j&url=http://illmatics.com/Remote%2520Car%2520Hacking.pdf&ved=2ahUKEwjZsOGNl5nyAhWhGVkFHZy2AnAQFnoECAcQAg&usg=AOvVaw0NAi3a1eh-IRd3n1VHv-ys
When I plugged it in, it started with the update process, after the first unit, the screen said the Uconnect had to restart, please wait..
And whalaa my radio worked again!!! It even says it has the 18.45 firmware on it.. go figure.. Navigation still does not work, but thats most likely because the sierra wireless card is bad.
I cannot say for sure the S Byte thing did anything, because I'm not messing with this anymore, almost had to buy a new radio.
I would say try it with out, then with it if it doesn't work.
This could also be a fluke with my particular unit, but at least its something else to try than pay 600+ dollars!!
Good luck to anyone else who goes through this mess!!!
Click to expand...
Click to collapse
Do you have another link to download the UCONNECT_8.4AN_RA4_16.33.29_MY16.exe files? I am trying to help a friend of mine they way this helped me. Thank you again for this!

How to solve sahara protocol problem flashed on QFIL?

Good day.
I have one problem.
Can anyone please tell me how to solve this problem?
Now, i have a bricked mobile of "IQOO3 5G(V1955A)".
This mobile working only fastboot mode.
(But, It does not accept the command.)
Therefore, I'd like to flash the rom by myself.
i tried it by QPFL.
But, i found the below error message.
-----------------------------------------------------------------------------------------------------------
ERROR: function: sahara_rx_data:277 Unable to read packet header. Only read 0 bytes.
ERROR: function: sahara_main:983 Sahara protocol error
ERROR: function: main:320 Uploading Image using Sahara protocol failed
Download Fail:Sahara Fail:QSaharaServer Failrocess fail
-----------------------------------------------------------------------------------------------------------
could you give me some advice how to solve this problem?
*Sorry, My mother language is not English.
Therefore, I think my English is not clear.
I am grateful for your support.

How you managed to enter edl mode in this phone, through test points or via commands or buttons?

Ryü[email protected] said:
How you managed to enter edl mode in this phone, through test points or via commands or buttons?
Click to expand...
Click to collapse
+1

Ryü[email protected] said:
How you managed to enter edl mode in this phone, through test points or via commands or buttons?
Click to expand...
Click to collapse
I used test point.
First, I tried EDL cable and command.
but, It were not run.

gengas10 said:
I used test point.
First, I tried EDL cable and command.
but, It were not run.
Click to expand...
Click to collapse
Ok fine any success for now, because my phone has weird problem with VoLTE calling.

Send this phone to customer care as your phone is in warrenty
gengas10 said:
Good day.
I have one problem.
Can anyone please tell me how to solve this problem?
Now, i have a bricked mobile of "IQOO3 5G(V1955A)".
This mobile working only fastboot mode.
(But, It does not accept the command.)
Therefore, I'd like to flash the rom by myself.
i tried it by QPFL.
But, i found the below error message.
-----------------------------------------------------------------------------------------------------------
ERROR: function: sahara_rx_data:277 Unable to read packet header. Only read 0 bytes.
ERROR: function: sahara_main:983 Sahara protocol error
ERROR: function: main:320 Uploading Image using Sahara protocol failed
Download Fail:Sahara Fail:QSaharaServer Failrocess fail
-----------------------------------------------------------------------------------------------------------
could you give me some advice how to solve this problem?
*Sorry, My mother language is not English.
Therefore, I think my English is not clear.
I am grateful for your support.
Click to expand...
Click to collapse
I think customer care will fix the phone for free

gengas10 said:
Good day.
I have one problem.
Can anyone please tell me how to solve this problem?
Now, i have a bricked mobile of "IQOO3 5G(V1955A)".
This mobile working only fastboot mode.
(But, It does not accept the command.)
Therefore, I'd like to flash the rom by myself.
i tried it by QPFL.
But, i found the below error message.
-----------------------------------------------------------------------------------------------------------
ERROR: function: sahara_rx_data:277 Unable to read packet header. Only read 0 bytes.
ERROR: function: sahara_main:983 Sahara protocol error
ERROR: function: main:320 Uploading Image using Sahara protocol failed
Download Fail:Sahara Fail:QSaharaServer Failrocess fail
-----------------------------------------------------------------------------------------------------------
could you give me some advice how to solve this problem?
*Sorry, My mother language is not English.
Therefore, I think my English is not clear.
I am grateful for your support.
Click to expand...
Click to collapse
Maybe this may work press power and volume up and you Can then choose option repair os or something like that and you can connect your phone to wifi and your phone will download rom and fix itself.

tejHackerDev said:
Ok fine any success for now, because my phone has weird problem with VoLTE calling.
Click to expand...
Click to collapse
Now, I don't success the ROM flash.
If i will success it, I will write the method in this page.

kartikgupta599 said:
I think customer care will fix the phone for free
Click to expand...
Click to collapse
Thank you for your suggestion.
Actually, My country doesn't have a customer center.
Therefore, I'll communicate customer center any other country by mail.

kartikgupta599 said:
Maybe this may work press power and volume up and you Can then choose option repair os or something like that and you can connect your phone to wifi and your phone will download rom and fix itself.
Click to expand...
Click to collapse
Thank you for your suggestion.
First, i tried it.
But, My mobile didn't catch any AP.
Maybe, Wifi driver has broken or erased I think.
Therefore, I think If i can success the below things, I can install the ROM(OS).
1. Install the Wifi driver by any method(Command of fastboot moder or any method).
2. Put on the Rom file in the SDCARD folder by any method.
3. Install the OS with dedicated software.
If you have any idea, Please suggest to me.
Thank you for your cooperation.

gengas10 said:
Thank you for your suggestion.
First, i tried it.
But, My mobile didn't catch any AP.
Maybe, Wifi driver has broken or erased I think.
Therefore, I think If i can success the below things, I can install the ROM(OS).
1. Install the Wifi driver by any method(Command of fastboot moder or any method).
2. Put on the Rom file in the SDCARD folder by any method.
3. Install the OS with dedicated software.
If you have any idea, Please suggest to me.
Thank you for your cooperation.
Click to expand...
Click to collapse
Theres no sd card slot in iqoo 3
Theres a option in fastboot to repair system in which you can connect your phone to wifi and the fone will download the rom and install it.

kartikgupta599 said:
Theres no sd card slot in iqoo 3
Theres a option in fastboot to repair system in which you can connect your phone to wifi and the fone will download the rom and install it.
Click to expand...
Click to collapse
Thanks for your suggestion.
I tried it from recovery mode.
But, My phone can't find any AP address.
Could you advice me how to connect wifi from My phone?

gengas10 said:
Thanks for your suggestion.
I tried it from recovery mode.
But, My phone can't find any AP address.
Could you advice me how to connect wifi from My phone?
Click to expand...
Click to collapse
Contact me on insta @Beasttechnerd

FingerPrint Fix for CN version and For the people having difficulty to calibrate the FP sensor VIA (*#808#)

Step 1: Use the MSMTool to restore your device to 10.5.4.
Step 2: Root with Magisk Manager ( Try to use this image https://doc-0k-bo-docs.googleuserco...6963965&hash=okighskqqr3fv666mjfvlr07i771asga)
Note: Don't update the magisk manager after using this image. (Use only fastboot flash boot magisk_patched.img and reboot)
Step 3: Use Unlock Factory Mode *root* https://forum.xda-developers.com/t/guide-unlock-factory-mode-root.4118527/
Step 4: Enter Factory Mode as shown in the previous guide. (*#808# in the stock dialer)
Step 5: Swipe over to "Device Debugging"
Step 6: Select "Finger print test"
Step 7: Select "Finger print calibration test(Pure White - 90% Blue) (DOesnt matter whether you use your finger or not)
Step 8: Select "Reliability Test"
Step 9:Select Calibration result and check if there are multiple red error lines
Step 10: Download the persist.zip and Extract the file.
Step 11: Move the 'DATA' folder and the 'ENGINEERMODE' folder to the root of your sdcard.
Step 12: Select the 'DATA' and 'ENGINEERMODE' folders you just put on the device and Copy them at /mnt/vendor/persist/
Step 6: Reboot
It should Start Working .

kemesh said:
Step 1: Use the MSMTool to restore your device to 10.5.4.
Step 2: Root with Magisk Manager ( Try to use this image https://doc-0k-bo-docs.googleuserco...6963965&hash=okighskqqr3fv666mjfvlr07i771asga)
Note: Don't update the magisk manager after using this image.
Step 3: Download the persist.zip and Extract the file.
Step 4: Move the 'DATA' folder and the 'ENGINEERMODE' folder to the root of your sdcard.
Step 5: Select the 'DATA' and 'ENGINEERMODE' folders you just put on the device and Copy them at /mnt/vendor/persist/
Step 6: Reboot
It should Start Working .
Click to expand...
Click to collapse
You do know that the persist.img is device specific right? Meaning you need your own persist.img to restore it. You cannot use someone else's. That's exactly why there is a whole thread already covering this.
[GUIDE] Fix PERSIST.IMG Loss Of Finger Print Sensor
New video guide below VIDEO GUIDE 1. *VERY IMPORTANT* We need to back up your broken persist.img and store it in a safe place. PC preferred. We will need this later. Do not leave the backup on the device as the next step will wipe the device...
forum.xda-developers.com

FreshlyBaked 420 said:
You do know that the persist.img is device specific right? Meaning you need your own persist.img to restore it. You cannot use someone else's. That's exactly why there is a whole thread already covering this.
[GUIDE] Fix PERSIST.IMG Loss Of Finger Print Sensor
New video guide below VIDEO GUIDE 1. *VERY IMPORTANT* We need to back up your broken persist.img and store it in a safe place. PC preferred. We will need this later. Do not leave the backup on the device as the next step will wipe the device...
forum.xda-developers.com
Click to expand...
Click to collapse
I did think that myself
But hey imagine it worked??

dladz said:
I did think that myself
But hey imagine it worked??
Click to expand...
Click to collapse
If it
dladz said:
I did think that myself
But hey imagine it worked??
Click to expand...
Click to collapse
If it does it would have saved me an RMA on my phone haha.

FreshlyBaked 420 said:
You do know that the persist.img is device specific right? Meaning you need your own persist.img to restore it. You cannot use someone else's. That's exactly why there is a whole thread already covering this.
[GUIDE] Fix PERSIST.IMG Loss Of Finger Print Sensor
New video guide below VIDEO GUIDE 1. *VERY IMPORTANT* We need to back up your broken persist.img and store it in a safe place. PC preferred. We will need this later. Do not leave the backup on the device as the next step will wipe the device...
forum.xda-developers.com
Click to expand...
Click to collapse
It solved my FP problem .

kemesh said:
It solved my FP problem .
Click to expand...
Click to collapse
And where did you get the persist file? Was it yours? Or was it someone else's?

FreshlyBaked 420 said:
And where did you get the persist file? Was it yours? Or was it someone else's?
Click to expand...
Click to collapse
It from one the forum in here as mine also didnt work.
I have updated the steps once more try it . It worked for me 100%.

FreshlyBaked 420 said:
You do know that the persist.img is device specific right? Meaning you need your own persist.img to restore it. You cannot use someone else's. That's exactly why there is a whole thread already covering this.
[GUIDE] Fix PERSIST.IMG Loss Of Finger Print Sensor
New video guide below VIDEO GUIDE 1. *VERY IMPORTANT* We need to back up your broken persist.img and store it in a safe place. PC preferred. We will need this later. Do not leave the backup on the device as the next step will wipe the device...
forum.xda-developers.com
Click to expand...
Click to collapse
Persist.img file is only a system file while is not technically a hardware . So as boot img and other image work for the others then obivously persist.img also should work like a charm as we are only using 2 folders 'DATA' folder and the 'ENGINEERMODE' . I have realized few things for some people this is not working as there are some file missing from their persist.img. Check the image for file comparision .

Well I'll be damned. Interesting.

kemesh said:
Persist.img file is only a system file while is not technically a hardware . So as boot img and other image work for the others then obivously persist.img also should work like a charm as we are only using 2 folders 'DATA' folder and the 'ENGINEERMODE' . I have realized few things for some people this is not working as there are some file missing from their persist.img. Check the image for file comparision .
Click to expand...
Click to collapse
If it works it works.
@bassamanator
Have a brand new guide that may help you buddy. Give it a shot.
Thanks to the OP if it does, it'll be a first I've seen if it does.
@kemesh he's got a borked fingerprint.
Should be a good test.

@kemesh @dladz This worked for me. I was able to register a fingerprint. (Side note: before I followed this guide, I did the fingerprint calibration and I kept my finger ON the sensor for the Black rubber test. The test failed as was the case when I followed the other guide, however, this time around I only had 2 red lines vs having pages worth of red lines. Did this play a role in making the fingerprint sensor work?)
In any case, I was hoping that fixing the fingerprint sensor may fix my Wifi and Bluetooth as well (both cannot be turned on). Unfortunately, Wifi and Bluetooth are still not working on my phone, buy hey, progress is progress!

bassamanator said:
@kemesh @dladz This worked for me. I was able to register a fingerprint. (Side note: before I followed this guide, I did the fingerprint calibration and I kept my finger ON the sensor for the Black rubber test. The test failed as was the case when I followed the other guide, however, this time around I only had 2 red lines vs having pages worth of red lines. Did this play a role in making the fingerprint sensor work?)
In any case, I was hoping that fixing the fingerprint sensor may fix my Wifi and Bluetooth as well (both cannot be turned on). Unfortunately, Wifi and Bluetooth are still not working on my phone, buy hey, progress is progress!
Click to expand...
Click to collapse
BOOOOOOM!!!
@kemesh
You!!
Are!!!
The!!!
Man!!!!!!

@bassamanator
AHH I'm gutted for you dude, I still believe that it can be fixed.
Have you backed up your EFS partition? Also now that you have a functional fingerprint reader get it backed up.
Perhaps reach out to OnePlus and see if there's anything that they can offer remotely.
Also my experience with RMA has been amazing from sending to receiving was 4 days.
I am based in the UK so it may vary but I'd imagine OnePlus would want to have a certain standard they'd like to adhere to, at least by reaching out you can get the information.
I'm at a loss in regards to WiFi and Bluetooth now.
It must be lower level but I've never heard of what it may be. Will look into it for you but I've drawn a blank offhand.

bassamanator said:
@kemesh @dladz This worked for me. I was able to register a fingerprint. (Side note: before I followed this guide, I did the fingerprint calibration and I kept my finger ON the sensor for the Black rubber test. The test failed as was the case when I followed the other guide, however, this time around I only had 2 red lines vs having pages worth of red lines. Did this play a role in making the fingerprint sensor work?)
In any case, I was hoping that fixing the fingerprint sensor may fix my Wifi and Bluetooth as well (both cannot be turned on). Unfortunately, Wifi and Bluetooth are still not working on my phone, buy hey, progress is progress!
Click to expand...
Click to collapse
Cheers
Does your wifi and bluetooth work after using the msdownload tool without fixing the finger print?

dladz said:
@bassamanator
AHH I'm gutted for you dude, I still believe that it can be fixed.
Have you backed up your EFS partition? Also now that you have a functional fingerprint reader get it backed up.
Perhaps reach out to OnePlus and see if there's anything that they can offer remotely.
Also my experience with RMA has been amazing from sending to receiving was 4 days.
I am based in the UK so it may vary but I'd imagine OnePlus would want to have a certain standard they'd like to adhere to, at least by reaching out you can get the information.
I'm at a loss in regards to WiFi and Bluetooth now.
It must be lower level but I've never heard of what it may be. Will look into it for you but I've drawn a blank offhand.
Click to expand...
Click to collapse
I am using a CN version with international rom and I'm currently residing in Australia so I dont have any support available sadly.

kemesh said:
Cheers
Does your wifi and bluetooth work after using the msdownload tool without fixing the finger print?
Click to expand...
Click to collapse
Wifi and bluetooth never work unfortunately. I've tried MSM to get me to 10.5.4 and 11.0.2.2, nothing helps. It might be a hardware problem. Taking a short break from all of this, I've done about 20-30 flashes/resets... in the past few days. It's tiring. Thanks for this guide, the other one didn't work for me.

bassamanator said:
Wifi and bluetooth never work unfortunately. I've tried MSM to get me to 10.5.4 and 11.0.2.2, nothing helps. It might be a hardware problem. Taking a short break from all of this, I've done about 20-30 flashes/resets... in the past few days. It's tiring. Thanks for this guide, the other one didn't work for me.
Click to expand...
Click to collapse
Few check if you dont mind :
Does your device show mac id for wifi and bluetooth? ( Settings>About Phone>Status)
If yes
I think you can test the hardware through the same *#808# mode

kemesh said:
Few check if you dont mind :
Does your device show mac id for wifi and bluetooth? ( Settings>About Phone>Status)
If yes
I think you can test the hardware through the same *#808# mode
Click to expand...
Click to collapse
Oh no problem, I'm absolutely open to new ideas. Unfortunately, I have no mac address/address for wifi/bluetooth.
Just because you mentioned it, I decided to go back in with *#808# and on the last page I found a test called Check CTSFingerPrint. At the top it says This check can only be performed after the CTS test is passed. There's a button below that reads CHECK CTSFINGERPRINT. When I click it, it immediately prints the following below the button: fingerprint check failed! it need connect to internet secure property check pass! I'll have another look but I couldnt' find this CTSFINGERPRINT Test, and also, I currently have a fingerprint registered. Anyone have any clues?
Thanks again for this guide! Fixed 1/3 of my problems.

I can't download the file for Magisk manager error code 403 for google docs. Can someone help me here? Tried some fixes on the net but none have worked. Thanks.

@GolfislikeLife Not sure what you need. What are you looking for? Magisk manager? https://github.com/topjohnwu/Magisk/releases