Develop Bugs

Roto Backup! UPDATED Dec 5 2010

I've been trying to recreate a flashable firmware based on the stock TMobile flash dumps and I have complete success.
Heres how to save your current firmware. It will be saved with all apps and settings except for whats on /sdcard.
I recommend reseting to defaults using "Settings->Privacy->Factory data reset" if you want to give these files to someone else to build a flashable rom for you. That will delete all your personal information.
Note: I just backed up a completely setup AT&T Tab, with tons of apps and customizations and restored it to my stock T-Mobile Tab, perfectly! Every app works, home screen is setup perfect, everything!
Effectively this is equivalent to a nandroid backup.
I'll call it "Roto Backup"!
Code:
mkdir backup
cd backup
adb shell su -c "dd if=/dev/block/bml1 of=/sdcard/boot.bin bs=4096"
adb shell su -c "dd if=/dev/block/bml2 of=/sdcard/pit.pit bs=4096"
adb shell su -c "dd if=/dev/block/stl3 of=/sdcard/efs.rfs bs=4096"
adb shell su -c "dd if=/dev/block/bml4 of=/sdcard/Sbl.bin bs=4096"
adb shell su -c "dd if=/dev/block/stl6 of=/sdcard/param.lfs bs=4096"
adb shell su -c "dd if=/dev/block/bml7 of=/sdcard/zImage bs=4096"
adb shell su -c "dd if=/dev/block/stl9 of=/sdcard/factoryfs.rfs bs=4096"
adb shell su -c "dd if=/dev/block/stl10 of=/sdcard/dbdata.rfs bs=4096"
adb shell su -c "dd if=/dev/block/stl11 of=/sdcard/cache.rfs bs=4096"
adb shell su -c "dd if=/dev/block/bml12 of=/sdcard/modem.bin bs=4096"
adb shell su -c "tar -czvf /sdcard/data.tar.gz /data"
adb pull /sdcard/param.lfs .
adb pull /sdcard/zImage .
adb pull /sdcard/factoryfs.rfs .
adb pull /sdcard/dbdata.rfs .
adb pull /sdcard/cache.rfs .
adb pull /sdcard/modem.bin .
adb pull /sdcard/efs.rfs .
adb pull /sdcard/boot.bin .
adb pull /sdcard/Sbl.bin .
adb pull /sdcard/pit.pit .
adb pull /sdcard/data.tar.gz .
Note you will be prompted for superuser permissions on the Tabs LCD on every dd command.
If you don't have the tar command on your tab, install Busybox Installer from the market.
I just paste the above commands into my command shell window and when im done all the files are siting in my current (backup) directory.
Roto Restore:
First flash the data back:
Code:
adb push data.tar.gz /sdcard/data.tar.gz
adb shell su -c "tar -zxvf /sdcard/data.tar.gz"
adb reboot download
Now flash the dumps with Heimdall:
Code:
heimdall flash --kernel zImage --factoryfs factoryfs.rfs --modem modem.bin --cache cache.rfs --dbdata dbdata.rfs --param param.lfs
Of course you could tar the files right n the Tab and flash via Odin if you really want to:
Code:
adb shell
cd /sdcard
tar -cf mybackup.tar cache.rfs dbdata.rfs factoryfs.rfs modem.bin param.lfs zImage
exit
adb pull /sdcard/mybackup.tar .

Nice
This interesting work, im curious though, what is your ultimate goal?
You want a Tmo firmware dump? to what end?

alias_neo said:
This interesting work, im curious though, what is your ultimate goal?
You want a Tmo firmware dump? to what end?
Click to expand...
Click to collapse
The Tmo dump/restore is a test. I want a solid backup/restore and custom rom creation solution.

Fair enough. But is the custom recovery being developed (and progressing nicely) not a solid enough solution?

I won't know till its functional.

rotohammer said:
I won't know till its functional.
Click to expand...
Click to collapse
Do you not have other android devices? I know of none where it doesn't function. So there is no reason i wouldn't wait a little longer for this to be ported.

alias_neo said:
Do you not have other android devices? I know of none where it doesn't function. So there is no reason i wouldn't wait a little longer for this to be ported.
Click to expand...
Click to collapse
A nandroid backup of my rom isn't something I can post publicly on the net. Regardless, I need to create full custom roms that can be flashed using Odin and Heimdall.

rotohammer said:
A nandroid backup of my rom isn't something I can post publicly on the net. Regardless, I need to create full custom roms that can be flashed using Odin and Heimdall.
Click to expand...
Click to collapse
Exactly, you post update.zips and then people use clockwork to flash the full ROM. On device recovery is much better than Odin method and more accessible to noobs that have an aneurism when they see the Odin iterface.
As for dumping your ROM to customise, well, yes, either this way using dd or decrypt the Odin flash files.

Now we're talking:
http://forum.xda-developers.com/showthread.php?t=850995

It sounds like this guy is new to android and iz trying to reinvent the wheel
Sent from my SGH-T849 using XDA App

miketaylor00 said:
It sounds like this guy is new to android and iz trying to reinvent the wheel
Sent from my SGH-T849 using XDA App
Click to expand...
Click to collapse
No, it sounds like he's trying to do exactly what he says he's doing, and that is to recreate the base TMo firmware from DD dumps!
Why? So that if necessary he could return to complete stock if he wished, and because there is no stock TMo image available.
A Nandroid backup doesn't cut the mustard in this case.
Remember guys - just because you don't see a need for something, it doesn't mean that that need doesn't exist for others!
Regards,
Dave
P.S. If you'd read any of Rotohammers posts in these forums, and looked back over previous activity in other sections, you'd know that he's not new to Android at all!

foxmeister said:
No, it sounds like he's trying to do exactly what he says he's doing, and that is to recreate the base TMo firmware from DD dumps!
Why? So that if necessary he could return to complete stock if he wished, and because there is no stock TMo image available.
A Nandroid backup doesn't cut the mustard in this case.
Remember guys - just because you don't see a need for something, it doesn't mean that that need doesn't exist for others!
Regards,
Dave
P.S. If you'd read any of Rotohammers posts in these forums, and looked back over previous activity in other sections, you'd know that he's not new to Android at all!
Click to expand...
Click to collapse
I forgot entirely that the Tab some people have might be carrier customised, mines a generic one so I can flash any of the generic dumps to put it back to "stock".
So yes, a Tmo stock firmware is useful for you guys.

miketaylor00 said:
It sounds like this guy is new to android and iz trying to reinvent the wheel
Click to expand...
Click to collapse
Yes, I am new to Android but I don't enjoy reinventing the wheel.
Perhaps you can point me to the code that I'm re-inventing that you are obviously familiar with?
Thanks in advance!

rotohammer: I've been looking for the ways to dump the firmware like you are suggesting for the AT&T version, mainly because the only available dump is an older version that stock. So far all I've found is this from another post by you:
I would like to get various Vibrant radio dumps if someone would be so kind to do so. The command from adb shell is:
Code:
dd if=/dev/block/bml12 of=/sdcard/bml12.dump bs=4096
Lets discuss what we've tried in this thread.
Click to expand...
Click to collapse
The instructions seem straightforward enough for anyone who has used dd before. How were you able to ascertain the location of this (and other) pieces of the firmware? (Interested to know prior to trying to enable voice on my Tab by swapping modems and reflashing. I'm familiar with Samsung devices since I have a Captivate, but not too reassured that the newest firmware available to restore to is older than launch date.)

The instructions seem straightforward enough for anyone who has used dd before. How were you able to ascertain the location of this (and other) pieces of the firmware? (Interested to know prior to trying to enable voice on my Tab by swapping modems and reflashing. I'm familiar with Samsung devices since I have a Captivate, but not too reassured that the newest firmware available to restore to is older than launch date.)
Click to expand...
Click to collapse
The Tab follows the flash layout of other previous Samsung phones, so just google them, the info is out there. I stare at hexdumps to identify/prove what each partition contains, no big deal.
I feel that once some more official firmware is released all the need for reconstruction of dumps will eliminated.

Figured I'd chime in here from my experience, since I've gone through it with the Epic 4G....
The .rfs files and .lfs files won't restore with redbend... and don't touch bml1 and bml4... that's the boot.bin and sbl.bin... screwing with those can lead to brick...
Current roms for the Epic 4g use update-script or updater-script (different formats, updater-script requires update-binary. The scripts get flashed with clockworkmod... first, system is formatted, then the system files copied over, then permissions given to the files. The kernel is flashed using redbend, along with modem (ours require updater-scripts and a modem_delta file if not using odin).
I browse .rfs system images by first creating a /mnt folder on the sd card. With busybox, use the following command:
Code:
Busybox mount /sdcard/factoryfs.rfs /sdcard/mnt
[/card]
I've gotten the factoryfs.rfs from the stock tars...
Maybe this is reinventing the wheel, but maybe it'll help.
Sent from my SPH-D700 using Tapatalk

rotohammer said:
The Tab follows the flash layout of other previous Samsung phones, so just google them, the info is out there. I stare at hexdumps to identify/prove what each partition contains, no big deal.
I feel that once some more official firmware is released all the need for reconstruction of dumps will eliminated.
Click to expand...
Click to collapse
Gotcha. Thanks. So, for restores, do you use redbend_ua or does a simple reversal of the dd command work? (admittedly this is an area where I haven't quite dug into yet)

maniac3389 said:
Gotcha. Thanks. So, for restores, do you use redbend_ua or does a simple reversal of the dd command work? (admittedly this is an area where I haven't quite dug into yet)
Click to expand...
Click to collapse
You must use redbend_ua, Odin or Heimdall (theres others too). You can't write to these partitions with dd alone, although there is an app that allows you to use dd too.

DRockstar said:
Figured I'd chime in here from my experience, since I've gone through it with the Epic 4G....
The .rfs files and .lfs files won't restore with redbend... and don't touch bml1 and bml4... that's the boot.bin and sbl.bin... screwing with those can lead to brick...
Current roms for the Epic 4g use update-script or updater-script (different formats, updater-script requires update-binary. The scripts get flashed with clockworkmod... first, system is formatted, then the system files copied over, then permissions given to the files. The kernel is flashed using redbend, along with modem (ours require updater-scripts and a modem_delta file if not using odin).
I browse .rfs system images by first creating a /mnt folder on the sd card. With busybox, use the following command:
Code:
Busybox mount /sdcard/factoryfs.rfs /sdcard/mnt
[/card]
I've gotten the factoryfs.rfs from the stock tars...
Maybe this is reinventing the wheel, but maybe it'll help.
Sent from my SPH-D700 using Tapatalk[/QUOTE]
I'll give that a look, don't know why it didn't dawn on me to give a look at the ROMs for my Captivate again. I've looked inside an update.zip file before, but didn't really delve into the script inside.
As for the actual dumping of the images, when dumping the .rfs files, what's the difference between using, say, /dev/block/stl9 versus /dev/block/bml9? Will one work and not the other?
What I'd like to be able to do is dump a current stock AT&T ROM since the one posted is older (and possibly an engineering ROM from what I recall reading.)
My current resources are:
[URL="http://forum.xda-developers.com/wiki/index.php?title=Samsung_Galaxy_S_Series#Partitions"]http://forum.xda-developers.com/wiki/index.php?title=Samsung_Galaxy_S_Series#Partitions[/URL]
[URL="http://forum.xda-developers.com/showthread.php?t=794425&page=2"]http://forum.xda-developers.com/showthread.php?t=794425&page=2[/URL]
[URL="http://androidforums.com/behold-2-all-things-root/54424-creating-custom-roms-backups-odin.html"]http://androidforums.com/behold-2-all-things-root/54424-creating-custom-roms-backups-odin.html[/URL]
Click to expand...
Click to collapse

rotohammer said:
Why the failure?
Probably because the file systems were still mounted at the time the dumps were made, the zImage partition and the modem partition are not mounted at runtime.
Click to expand...
Click to collapse
Here is a thought, although I may be completely off base:
I noticed that you can access the ADB shell if you boot into stock recovery, perhaps you can mount the SD and dump a few more RFS images?

ADB pull

I've never used adb push or pull successfully. I'm trying to pull my CWM backups from the phone to mac. Im on 4.2.1, and CWM backups store in data/media/clockworkmod. No matter how I try [/data/media/clockworkmod/, etc.], I get terminal output of "remote object does not exist". I wonder if this is because it is not the sdcard, and it is protected? Do I need to mount as writable, and how would i issue the pull command in a shell (seems unlikely)? Anybody have any idea why i cannot get this to work?

bodh said:
I've never used adb push or pull successfully. I'm trying to pull my CWM backups from the phone to mac. Im on 4.2.1, and CWM backups store in data/media/clockworkmod. No matter how I try [/data/media/clockworkmod/, etc.], I get terminal output of "remote object does not exist". I wonder if this is because it is not the sdcard, and it is protected? Do I need to mount as writable, and how would i issue the pull command in a shell (seems unlikely)? Anybody have any idea why i cannot get this to work?
Click to expand...
Click to collapse
Since you are on 4.2, your CWM backups should be moved to /data/media/0.
Code:
[I]adb pull /sdcard/clockworkmod[/I]
^should work.
Alternatively,
Code:
adb pull /data/media/0/clockworkmod
^should work as well.

Old ones, yes. New ones will be in /data/media/clockworkmod
Sent from my Galaxy Nexus using xda premium

"Macintosh:3 x09177310519$ ./adb devices
List of devices attached
...002 device
Macintosh:3 x09177310519$ ./adb pull /data/media/0/2LatinImeGoogle.odex
remote object '/data/media/0/2LatinImeGoogle.odex' does not exist
Macintosh:3 x09177310519$ ./adb pull /sdcard/2LatinImeGoogle.odex
2890 KB/s (642672 bytes in 0.217s)
Macintosh:3 x09177310519$ "
I have a backup of my stock keyboard .odex on the sdcard. So why can i pull it from the directory sdcard, but not /data/media/0? This is the essence of my question, since the backups are in data/media.

SOLVED
So after browsing the CWM image thread, I've got a working solution, in case others need this:
./adb pull /mnt/shell/emulated/clockworkmod/
pull: building file list...
Finally, I've been waiting on this for a while.
Again, in case anyone else is looking for this, I've got a second solution: adbd insecure by chainfire.

bodh said:
So after browsing the CWM image thread, I've got a working solution, in case others need this:
./adb pull /mnt/shell/emulated/clockworkmod/
pull: building file list...
Finally, I've been waiting on this for a while.
Again, in case anyone else is looking for this, I've got a second solution: adbd insecure by chainfire.
Click to expand...
Click to collapse
Thanks man, just what i needed

bodh said:
So after browsing the CWM image thread, I've got a working solution, in case others need this:
./adb pull /mnt/shell/emulated/clockworkmod/
pull: building file list...
Finally, I've been waiting on this for a while.
Again, in case anyone else is looking for this, I've got a second solution: adbd insecure by chainfire.
Click to expand...
Click to collapse
Thanks,I'm it,but i dont know why cannot copy /data/media/clockworkmod?

bodh said:
So after browsing the CWM image thread, I've got a working solution, in case others need this:
./adb pull /mnt/shell/emulated/clockworkmod/
pull: building file list...
Finally, I've been waiting on this for a while.
Again, in case anyone else is looking for this, I've got a second solution: adbd insecure by chainfire.
Click to expand...
Click to collapse
Old but still helpful ! Thanks!
It worked for me using "adb pull /mnt/shell/emulated/clockworkmod/backup C:\nandroid"

bodh said:
./adb pull /mnt/shell/emulated/clockworkmod/
pull: building file list...
Click to expand...
Click to collapse
Still helpful! I wonder why the intuitive command does not work?! Something to do with permissions maybe?

SM-T320 Hard Brick Recovery

Could someone run
Code:
dd if=/dev/block/mmcblk0 of=/sdcard/unbrick.img bs=512 count=524288
and upload it? Flashing unbrick in a 'raw' fashion will allow you to hard brick most Qualcomm devices. Unfortunately I lost my backup and I can't boot my device. This file will allow me to recover. Thanks!

I can
Will it safe to run and guide me how to run it ??? Dont know where it goes............ I also have my stock recovery file saved by flashify https://drive.google.com/file/d/0B3i0YJU831QXTHctYWphX2Y0aE0/view?usp=sharing

vincowoo said:
Will it safe to run and guide me how to run it ??? Dont know where it goes............ I also have my stock recovery file saved by flashify https://drive.google.com/file/d/0B3i0YJU831QXTHctYWphX2Y0aE0/view?usp=sharing
Click to expand...
Click to collapse
I messed up, here's the correct command
Code:
dd if=/dev/block/mmcblk0 of=/sdcard/unbrick.img bs=512 count=524288
Thank you very much!

Still not found .... run the command without error ... dont know where required file goes ... checked the root of both external and internal sd...

vincowoo said:
Still not found .... run the command without error ... dont know where required file goes ... checked the root of both external and internal sd...
Click to expand...
Click to collapse
Make sure you're running as root, from adb shell or terminal emulator. Try this one instead
Code:
dd if=/dev/block/mmcblk0 of=/storage/extSdCard/unbrick.img bs=512 count=31250
That command should have created 'unbrick.img' on your external SD card. I am extremely thankful for you doing this. My device is bricked and sitting in QHSUSB_BULK mode. You may want to save this file in case you ever need it! Thanks again, it is very much appreciated!

It is my pleasure. this forum helped me many times m trying to return something.That command completed successfully i am uploading it ?
https://docs.google.com/file/d/0B3i0YJU831QXUmViWGMyMGE1eHM/edit?usp=docslist_api

Data Recovery via Download Mode

Afternoon all,
My G4 has hit the bootloop for the last few days. Periodically, it has powered up to the main screen, but not for long enough for me to recover data.
I just spoke to a data recovery place that told me that if I can put my phone into download mode, they can recover the data. Lo and behold, my phone is currently next to me in download mode!
I'm quite keen to avoid dropping that amount of money if possible, so does anyone know of a way to recover the internal memory of the phone via download mode?
Apologies if I'm duplicating a previous thread - I had a quick look, but couldn't see any with the same issue.

Probably when the phone is in download mode they can copy the partitions bit by bit then try to do data recovery from those partition images.
So if the phone doesn't boot, it doesn't mean the data partition is corrupted so in theory you could try to copy the data partition and mount it and see what files you can recover.
I do not know the exact commands to dump the data partition but I think that's the way it can be done.
Anyone else willing to give a hand here?

Thanks for the help so far. I believe the data is intact - when the phone starts up, the data is all there. It's just accessing it that is the issue.
Sent from my Nexus 5 using Tapatalk

something similar to
Code:
dd if=/dev/block/mmcblk0p55 bs=8192 skip=65536 count=548352 of=/mnt/media_rw/external_SD/data.img
OR
Code:
dd if=/dev/block/mmcblk0p55 bs=8192 skip=65536 count=548352 of=/dev/block/mmcblk1/data.img
don't quote me on that but in theory this should work...
make SURE you have a 32gb SDCard in the phone first

Where would that command be entered mate? Sorry, only ever used my phone stock before.
Sent from my Nexus 5 using Tapatalk

I thought the OP title said download mode?
Use the LG Root method as if you were going to root..
I'm mobile ATM but if I remember correctly...
Send_Command \\.\Com# [# meaning your com port number]
Then insert that command.
Tomorrow at work I can get a common list of partition names and the command to back it up with.

je2854 said:
I thought the OP title said download mode?
Use the LG Root method as if you were going to root..
I'm mobile ATM but if I remember correctly...
Send_Command \\.\Com# [# meaning your com port number]
Then insert that command.
Tomorrow at work I can get a common list of partition names and the command to back it up with.
Click to expand...
Click to collapse
You need to mount the partition first.
Also, you could mount data if it is not encrypted (is it?)
Do this:
Code:
mkdir /temp
mkdir /temp/sd /temp/data
mount /dev/block/mmcblk1p1 /temp/sd
mount /dev/block/bootdevice/by-name/userdata /temp/data
mkdir /temp/sd/recoverydata
cp -R /temp/data/media/ /temp/sd/recoverydata/

A little tip that should work :
Take the battery off your phone
Put both phone and battery in the fridge
Wait till the phone is cold and boot the device.
The bootloop trouble is due to an abnormal warm so this way you can have a one shot normal boot to backup your data before send for warranty.

terisse said:
A little tip that should work :
Take the battery off your phone
Put both phone and battery in the fridge
Wait till the phone is cold and boot the device.
The bootloop trouble is due to an abnormal warm so this way you can have a one shot normal boot to backup your data before send for warranty.
Click to expand...
Click to collapse
If you try this, please put the phone in a ziploc bag 1st and seal it so humidity won't get inside the phone while in the fridge.

nagalun said:
You need to mount the partition first.
Also, you could mount data if it is not encrypted (is it?)
Do this:
Code:
mkdir /temp/sd /temp/data
mount /dev/block/mmcblk1p1 /temp/sd
mount /dev/block/bootdevice/by-name/userdata /temp/data
mkdir /temp/sd/recoverydata
cp -R /temp/data/media/ /temp/sd/recoverydata/
Click to expand...
Click to collapse
just a question though... How can you use this command if it will not boot?
---------- Post added at 08:59 AM ---------- Previous post was at 08:50 AM ----------
to get into download mode do the following...
Pull Battery
Hold Volume Up
Plug in USB Cable (make sure it's plugged in the computer)
Release button after 5 seconds
follow the link to grab the files needed for "Send_Command"
Grab LG Root here
once you are in the mode and you followed directions you can copy the command I wrote
above to copy your data partition. The reason you must have a 32gb+ SDCard is you will
be making an exact copy of the /data partition where you can remove the SDCard and recover
whatever is needed.

je2854 said:
just a question though... How can you use this command if it will not boot?
Click to expand...
Click to collapse
Hmm... With the Send_Command.............? dd is a command too :silly:

nagalun said:
Hmm... With the Send_Command.............? dd is a command too :silly:
Click to expand...
Click to collapse
there is no need to mount the partition first..
the dd command will copy the partition as a RAW image.
you must then take it to a computer and mount it as an EXT4 or use it with ext2explore

je2854 said:
there is no need to mount the partition first..
the dd command will copy the partition as a RAW image.
you must then take it to a computer and mount it as an EXT4 or use it with ext2explore
Click to expand...
Click to collapse
in that case the command you have given him will copy 4492 mb only.
Here is why:
Code:
dd if=/dev/block/mmcblk0p55 bs=8192 skip=65536 count=548352 of=/dev/block/mmcblk1/data.img
input_file=(some partition) block_size=8192 skip_this_much_data=65536 how_many_data=548352 output_file=(somewhere)
actual data copied is 8192 * 548352 = 4492099584 bytes, and you are skipping some data from the beggining with 'skip'
you do still need to mount the sdcard, the "mmcblk1" is not treated as a directory, and it is very unlikely the sd card is mounted automatically in download mode.

nagalun said:
in that case the command you have given him will copy 4492 mb only.
Click to expand...
Click to collapse
remember me saying (if you read) above that I said "something similar to"

Hi all. Firstly, thanks for all your responses!
I've not got much of a clue what I'm doing unfortunately, I've never really messed with Android before - I'm typically fairly computer literate, but I've steered clear of messing with and rooting phones for the most part.
So to clarify, I've downloaded LG Root, Running either of the exes just leads to a cmd box that's open for about a second before closing, so I'm presuming I've missed a step. Is there a guide already in existence on how to use it?
But once in, ensure there's a sizeable Micro SD card in (it's a 64gb so I should be okay!) and use the send_command exe to send:
Code:
mkdir /temp/sd /temp/data
mount /dev/block/mmcblk1p1 /temp/sd
mount /dev/block/bootdevice/by-name/userdata /temp/data
mkdir /temp/sd/recoverydata
cp -R /temp/data/media/ /temp/sd/recoverydata/
And then the entire image should be on the Micro SD card.
How would I then mount the data image to be readable? I've only used .iso for mounting before.
Apologies for my ignorance - I'm probably making helping me quite difficult!

Sorry all, correction to my previous:- Do I basically follow http://forum.xda-developers.com/android/development/guide-root-method-lg-devices-t3049772
And replace step 10 with the above command?

Shift+Right Click the folder you extracted "open command prompt here" for starters...
Run ports.bat first...
It'll tell you your DIAG and communication port...
The second com port is the one you are looking for.
Send_Command \\.\Com"#" (don't insert quotes, # being the number you found)

je2854 said:
Shift+Right Click the folder you extracted "open command prompt here" for starters...
Run ports.bat first...
It'll tell you your DIAG and communication port...
The second com port is the one you are looking for.
Send_Command \\.\Com"#" (don't insert quotes, # being the number you found)
Click to expand...
Click to collapse
I'm having the same issue and actually tried this earlier today. Ports.bat didn't show a DIAG communication port even when I had the phone stably sitting in Download Mode.
Going to try the freezer trick. I already bought a Nexus 6P, just want to unlock the locked content on my SD card. lol.
EDIT: Holy crap! It worked. I chilled it in a baggie, then stood in front of the freezer as I unlocked all of my locked gallery files (1,411 files totaling 900MB). As soon as I was done, 30 seconds after stepping away from the freezer, it started to bootloop again.
Got the only information I needed off my phone...nice! I might give it another go tomorrow and see if I can't run ROM Toolbox and backup all my apps so it'll be easier to push to my N6P.
Awesome suggestion!

IlyaKol said:
I'm having the same issue and actually tried this earlier today. Ports.bat didn't show a DIAG communication port even when I had the phone stably sitting in Download Mode.
Going to try the freezer trick. I already bought a Nexus 6P, just want to unlock the locked content on my SD card. lol.
EDIT: Holy crap! It worked. I chilled it in a baggie, then stood in front of the freezer as I unlocked all of my locked gallery files (1,411 files totaling 900MB). As soon as I was done, 30 seconds after stepping away from the freezer, it started to bootloop again.
Got the only information I needed off my phone...nice! I might give it another go tomorrow and see if I can't run ROM Toolbox and backup all my apps so it'll be easier to push to my N6P.
Awesome suggestion!
Click to expand...
Click to collapse
Mine will only get to optimising Apps, even if still in the freezer.
Sent from my Nexus 5 using Tapatalk

Hi all, sorry for the double posting, but just to make certain before I do something that will accidentally brick my phone. I'm intending to do the following:
Put phone in download mode and connect device.
Open LG_Root folder
Run a command window in LG_Root
Code:
Send_Command.exe \\.\Com4
Then, line by line, command:
Code:
mkdir /temp/sd /temp/data
mount /dev/block/mmcblk1p1 /temp/sd
mount /dev/block/bootdevice/by-name/userdata /temp/data
mkdir /temp/sd/recoverydata
cp -R /temp/data/media/ /temp/sd/recoverydata/
Once I've done all this, what happens next? Will I see responses on the screen etc?
Again, I apologise for the probably stupid questions. I don't want to brick my phone and lose all of the data, but I'm going away with work so would like to square it before I go if I can.
Many thanks to you all so far.

Fire TV Gen 1 Bricked

Hi All,
First, i'd like to thank you all in advance for your help.
I have Gen 1 FIre TV that was working fine, so i thought i'd update the firmware to latest using rbox prerooted image. I was running bueller-5.2.6.7-rooted_r1 but YouTube wasn't working. So i downloaded the latest and just adb pushed into the box. Then i issued adb reboot command, and somehow the box bricked.
Now No Power Light, No HDMI signals, when i connect with Computer, it shows as Qualcomm hs-usb qdloader 9006 fire and opens the drive with files in it.
I did some research and came across, that i need to manually dd=if all 8 partitions and i need to have linux installed. I managed to download a firmware update-kindle-bueller-51.6.3.2_user_632552020 extracted it all.
Question - Can i use the update-kindle-bueller-51.6.3.2_user_632552020 to dd=if?
Second, can someone please confirm the partition layout or provide commands to view the layout.
Or Perhaps guide me to a direction which i can follow to fix this.
Thank you,

I bricked my FireTV twice and just resurrected it with the expert/relentless help from "Sus_i" using rbox's https://forum.xda-developers.com/showpost.php?p=66961740&postcount=676.
I read thru page 55 to 110 of rbox's thread https://forum.xda-developers.com/fire-tv/development/prerooted-stock-images-t2882337 and those with unlocked bootloader and have an "Image" folder with a bunch of files inside the FireTV are most likely to bring their FireTV back but losing the unlocked bootloader in the process (mine included). https://forum.xda-developers.com/fire-tv/help/firetv-1-gen-rooted-running-pre-rooted-t4035609/page6
1st gen FireTV is built tough, don't give up and all the best to you.
Question - Can i use the update-kindle-bueller-51.6.3.2_user_632552020 to dd=if?
I used this one "update-kindle-bueller-51.6.4.8_user_648594820.bin" credit to "Sus_i"
https://d1s31zyz7dcc2d.cloudfront.n...te-kindle-bueller-51.6.4.8_user_648594820.bin

@Matt_7 when I connect to Linux box, I'm terminal
Do I just issue dd=if NON-HLOS.bin of=/dev/sda3
Or do I need to do additional commands to make sure it is connected like adb stuff.
And thank you very much for replying

nycelitemaster said:
@Matt_7 when I connect to Linux box, I'm terminal
Do I just issue dd=if NON-HLOS.bin of=/dev/sda3
Or do I need to do additional commands to make sure it is connected like adb stuff.
And thank you very much for replying
Click to expand...
Click to collapse
For mine, I entered:
Sudo su
dd if=NON-HLOS.bin of=/dev/sdb3
dd if=sbl1.mbn of=/dev/sdb4
dd if=sbl2.mbn of=/dev/sdb5
dd if=sbl3.mbn of=/dev/sdb6
dd if=tz.mbn of=/dev/sdb7
dd if=rpm.mbn of=/dev/sdb8
dd if=emmc_appsboot.mbn of=/dev/sdb9
dd if=boot.img of=/dev/sdb10
sudo eject /dev/sdb
Make sure you read rbox post https://forum.xda-developers.com/showpost.php?p=66961740&postcount=676 regarding the correct partitions (in my case /dev/sdb (sdb1 to sdb20). Details instructions provided by "Sus_i" here https://forum.xda-developers.com/fire-tv/help/firetv-1-gen-rooted-running-pre-rooted-t4035609/page5, just make sure to check and double check which partition is OK to ignore (if mounted).

Thank you very much. I'll try today.

@Matt_7; thank you so much. I used the Ubuntu Live USB.
Sudo SU did not work, so i used sudo bash which did the job
When i did df -h, it showed my fire tv as sdc1
then i ejected those, and did the commands, it did not work.
I replugged them, some drives populated and i ran the commands it worked
At the end, i issued command eject /dev/sdc, it didn't work, but i ejected by right clicking, then i powered the fire tv box and it booted.
Luckily it showed TWRP as recovery.
I ran the command in adb
C:\Program Files (x86)\Minimal ADB and Fastboot>adb shell
SU prompted on fire tv to accept, which i did then it showed
C:\Program Files (x86)\Minimal ADB and Fastboot>adb shell
[email protected]:/ $ su
[email protected]:/ # cat /proc/cmdline
androidboot.hardware=qcom user_debug=22 msm_rtb.filter=0x3F ehci-hcd.park=3 maxcpus=2 androidboot.selinux=enforcing androidboot.emmc=true androidboot.serialno=709xxxxxxxx301G7 androidboot.prod=1 androidboot.baseband=apq
[email protected]:/ #
Does this mean, it is unlocked?
a) if it is not unlocked, is it possible for me to unlock bootloader again?
b) if not, can I go restore to stock w/o root?
if yes, can i follow the guide on aftvnews?
http://www.aftvnews.com/how-to-fully-unlock-the-amazon-fire-tv-bootloader/
Btw, i was able to update to 5.2.7.2 r1 latest using pre-rooted from TWRP.

Hey, great to hear that you got your FireTV back, another success story! (credit to Sus_i & rbox)
This is what Sus_i told me:
For checking bootloader status, simply run
adb shell
su
cat /proc/cmdline
Bootloader is unlocked if you see: androidboot.unlocked_kernel=true
Yes, its good to have unlocked bootloader (I've no clue if that's possible again after doing the dd). Sus_i will most likely give us an answer on this thread or mine.
Best regards.

Matt_7 said:
Hey, great to hear that you got your FireTV back, another success story! (credit to Sus_i & rbox)
This is what Sus_i told me:
For checking bootloader status, simply run
adb shell
su
cat /proc/cmdline
Bootloader is unlocked if you see: androidboot.unlocked_kernel=true
Yes, its good to have unlocked bootloader (I've no clue if that's possible again after doing the dd). Sus_i will most likely give us an answer on this thread or mine.
Best regards.
Click to expand...
Click to collapse
I can't thank you enough for guiding me into the right direction. You saved me lot of aggravation and going out and spending money on new crappy versions.
Thank you sooooo much to you and sus_i and rbox.