Develop Bugs

Smartwatch 2 firmware hacking

Sorry if this is stupid or something but I have the smartwatch 2 firmware dump file (dumped using dfu-util's upload utility (-u)) from messing around trying to get into the dfu. I succeeded. I don't know if I am allowed to upload the file so I won't yet.
So is there any linux/ubuntu based software I can use to decompile or to edit resources such as icons, images ect.?
If you would like to obtain the file I am talking about use the open smartwatch (1) project. similar way applies:
1. Have dfu-util installed
2. remove smartwatch 2 from power (miniusb plug)
3. plug in usb end that goes into computer but NOT miniusb.
4. my way to enter the dfu is to plug in the miniusb end and then hold power a split-second after you should see a blank screen but sony does not come up. let go of power.
5. you are now in dfu mode. Note: there will probably be no green bar at bottom of screen.
The command I used to dump the firmware was (I am on ubuntu-linux) dfu-util -a 0 -U -s 0x08000000
UPDATE: Find dump files at post #10

UPDATES
Update 15Jun14: files dumped are not in dfu format. No file extension is included.
Does this matter?
Also can someone find out if some dfu sample files are compatible (such as the arduino hack)?
Update: on ubuntu try using strings <FIRMWARE FILE PATH> it shows lots of jumbled text and near bottom there are random things such as things that look like version numbers etc.????

may be mod at file sw2.apk
i think it better way

Well maybe using this data we can find a way to create custom code modules for the apk file. This would mean android code could be ported to smartwatch 2 code through a heavily modded version of the app.
Like people said before me in the decompiled app there is support for firmware upgrades over Bluetooth maybe. So if the firmware is reverse engineered maybe we could program native apps or settings mods etc.
Sent from my C1505

I need help on this so if anyone can help such as convert it to source code that would be greatly appreciated
Sent from my C1505

Hi
Xtreme_FIRMWARE said:
I need help on this so if anyone can help such as convert it to source code that would be greatly appreciated
Sent from my C1505
Click to expand...
Click to collapse
Hi extreme I'm interested to help you to reverse the smartwatch 2 firmware, if you are interested I have the source of the smartwatch 2 host app

if you phone root already
you can backup apk by titanium backup
or if non root
use this link for download apk from play store
http://apps.evozi.com/apk-downloader
and insert com.sonymobile.smartconnect.smartwatch2 in web
you're got apk file and then use Android Multitool for extract and compile apk
which i extract it already but i don't know what is file i must mod
my problem is sw2 show Thai language 100%
if we found file in apk about show language in your country
i think it fix other language too.

I will attach the version I have straight from Google play soon
Edit: manu0466 is going the source shortly. so we will not need do download this.
Sent from my C1505

Hi there
manu0466 said:
Hi extreme I'm interested to help you to reverse the smartwatch 2 firmware, if you are interested I have the source of the smartwatch 2 host app
Click to expand...
Click to collapse
Any source code at all would be greatly appreciated. as I am having trouble decompiling the smartwatch 2 apk anyways.
Hope to see more. Thanks!

The Dump
This is the internal memory(soldered sdcard) and firmware dumps I made just in case anybody couldn't get them to examine.
They are attached to this post
If you use these in any other thread please credit me.
the password (just in case) is: xtreme_firmware
Hope this is useful! :good: :good:

Research
For those interested in the reverse engineering [URL="http://www.devttys0.com/2011/05/reverse-engineering-firmware-linksys-wag120n/"This[/URL] seems promising. Checking out a few and trying hard to crack into this firmware. Sony did a good job. I also learnt that my dump might not be full firmware but once we have a method I can always dump the full firmware somehow. The dumps I have now are good enough to test for ways and maybe start with some small mods. Of course it might actually be the full firmware anyway.

Good news and keep going. Thanks for the idea and your support.

One problem. the file does not seem to be the firmware. I will try to dump the full firmware soon.
This isn't a setback! we still have the process ready!

Hmm
Hi all.
I am confused. I am not sure how to know if it is the firmware or not. at the end of this post is the latest dump (sd and firm) that I have done. Can someone find a way to make sure this is the firmware. Thanks!
again: this isn't a setback!

Xtreme_FIRMWARE said:
Sorry if this is stupid or something but I have the smartwatch 2 firmware dump file (dumped using dfu-util's upload utility (-u)) from messing around trying to get into the dfu. I succeeded. I don't know if I am allowed to upload the file so I won't yet.
So is there any linux/ubuntu based software I can use to decompile or to edit resources such as icons, images ect.?
If you would like to obtain the file I am talking about use the open smartwatch (1) project. similar way applies:
1. Have dfu-util installed
2. remove smartwatch 2 from power (miniusb plug)
3. plug in usb end that goes into computer but NOT miniusb.
4. my way to enter the dfu is to plug in the miniusb end and then hold power a split-second after you should see a blank screen but sony does not come up. let go of power.
5. you are now in dfu mode. Note: there will probably be no green bar at bottom of screen.
The command I used to dump the firmware was (I am on ubuntu-linux) dfu-util -a 0 -U -s 0x08000000
UPDATE: Find dump files at post #10
Click to expand...
Click to collapse
This is a dump from the 1st partition called "@Internal Flash". I think you also need to specify the length which should be 2MB. So that would make the command line:
./dfu-util -c 1 -i 0 a 0 -U memdump.raw -s 0x08000000:0x200000
NOTE: this is not a dfu image as it's just a HEX dump and doesn't include the ID tags to make it a valid dfu image. However if you want you can write this RAW image back to the device with:
./dfu-util -c 1 -i 0 a 0 -D memdump.raw -s 0x08000000
If memory serves me well.
The query I have is
1) what's in 0x00000000 - 0x08000000 in partition - a 0?
It seems to show values which I don't know if they are meaningful.
2) what about the eMMC partition -a 1 which is 512MB in size?
I have dumps for these too but can't flash these back as a RAW image as dfuse-address of 0x00000000 passed into the -s option are not valid.
I think that the FileSystem to the SW2 is in either of these locations above but I don't know which or how to restore from a good device to a bad device.
: )

From the scarce amount of information about their firmware and dfu the emmc is a soldered sd card and also to NEVER try to flash older versions of it. No idea why.
We may need to somehow mod the dfu to establish a connection to the areas we cannot access. But first try inputting the -s as one of the id's between. Maybe?
Sent from my C1505 using XDA Free mobile app

I get invalid dfuse address for the first command you gave. can you please tell me what I am doing wrong:
sudo dfu-util -c 1 -i 0 a 0 -U memdump.raw -s 0x08000000:0x200000
[sudo] password for ??????:
invalid dfuse address: 0x08000000:0x200000

I am working on reverse engineering the dump while also reverse engineering the protocol used for fota updates to try and get the full dfu file!!!!!!
Sent from my C1505 using XDA Free mobile app

Just for everyone's information dfu-util sees on the SW2:
Found DFU: [0fce:f0fa] devnum=0, cfg=1, intf=0, alt=0, name="@Internal Flash /0x08000000/03*016Kg,01*016Kg,01*064Kg,07*128Kg,03*016Kg,01*016Kg,01*064Kg,07*128Kg"
Found DFU: [0fce:f0fa] devnum=0, cfg=1, intf=0, alt=1, name="@eMMC /0x00000000/01*512Mg"
:good:
---------- Post added at 09:26 AM ---------- Previous post was at 09:17 AM ----------
Xtreme_FIRMWARE said:
I get invalid dfuse address for the first command you gave. can you please tell me what I am doing wrong:
sudo dfu-util -c 1 -i 0 a 0 -U memdump.raw -s 0x08000000:0x200000
[sudo] password for ??????:
invalid dfuse address: 0x08000000:0x200000
Click to expand...
Click to collapse
Looking at my exact command line I executed a couple of months back, I have to upgrade to dfu-utils release 0.7 (dfu-util.gnumonks.org/releases) and then I could execute:
sudo ./dfu-util -v -c 1 -i 0 -a 0 -s 0x08000000:0x200000 -U InternalFlash.hex -R
Hope this helps.
:good::good:

Hey all,
Anyone look at the com.sonymobile.smartconnect.smartwatch2.apk, these files in the apk look sort of interesting:
res/raw/asw.bin 607KB -- Firmware?
res/raw/bl.bin 31KB -- BootLoader?
res/raw/fat.bin 545KB -- FlashFS?
Not really sure if these can be useful in the quest to get a working firmware together. I wish we had a memory map of this thing.
AL

[TUTORIAL]How to setup SP_Flash_Tool_Linux (MTK/MediaTek Soc)

This works only on Linux 64-bit
DISCLAIMER: It is always risky to flash your mobile device. I do not and will not take any responsibility for bootloops and bricks.
Please check carefully that the ROM or recovery.img you want to flash is suitable for your specific device and for the sp_flash_tool. The firmware directory should neither contain meta-inf nor system folder, but something_with_a_scatter.txt and a system.img
Backup your phone before flashing!
Your phone's battery should be at least half charged (50 percent) before you start this.
I successfully ran these steps on my UMI Hammer with Linux Ubuntu 14.04 and 16.04. I do not have other devices or Linux derivates and do not plan to buy/install any.
CREDITS and a zillion thanks to Sergio Rivero for his excellent tutorial on mibqyyo.com!!!!
Also many thanks to N2K1 for giving me some more background information!
So here we go:
Step 1:
If you haven't done so before, install the Linux generic usb-drivers package:
Code:
sudo apt-get update
sudo apt install libusb-dev
Download SP Flash Tool Linux (latest version): http://mtk2000.ucoz.ru/load/soft/soft_mtk/sp_flash_tool/5-1-0-14 (Password to extract currently is mtk2000v3)
or here https://androidmtk.com/smart-phone-flash-tool
In case you haven't done before, install unrar:
Code:
sudo apt install unrar
Extract the downloaded file -> graphic file manager (e.g. Nautilus): double-click and extract. Terminal:
Code:
unrar x path_to_file
(from now on: please adapt paths to your own settings)
Move the new folder „sp_flash_tool“ to a directory of your choice.
Code:
mv /home/username/Downloads/sp_flash_tool /home/username/...
You might also need to install libqtwebkit4 (it just happened to me on Linux Ubuntu 16.04):
Code:
sudo apt install libqtwebkit4
[Only For Ubuntu 16.10 and newer]
Run
Code:
dpkg -x libpng12-0_1.2.54-1ubuntu1.1_amd64.deb /tmp/libpng2
cp /tmp/libpng2/lib/x86_64-linux-gnu/libpng12.so.0.54.0 lib
cd lib
ln -s libpng12.so.0.54.0 libpng12.so.0
These libraries are still required for the flash tool but have been removed from new Ubuntu versions.
Thanks @hanalinqu, @z3r0c00l_2k https://forum.xda-developers.com/showpost.php?p=73484473&postcount=216 and @opticyclic https://forum.xda-developers.com/showpost.php?p=81543495&postcount=285 for this information!
Step 2:
Change into the newly created directory:
Code:
cd /sp_flash_tool
We make one file executable by typing:
Code:
chmod +x flash_tool
In order to avoid running the flash_tool as root user, you need to add a standard user to the usergroup "dialout" (thanks to @egalus for this bit!)
Code:
sudo adduser username dialout
For Arch Linux:
Code:
gpasswd -a username uucp
and activate the membership immediately
Code:
newgrp - dialout
(Arch Linux):
Code:
newgrp - uucp
Step 3:
Now you can open the tool:
Code:
./flash_tool
or double-click on the flash_tool icon.
You can try at this stage if the flash tool connects to your phone:
In the user interface, choose tab „Download“. Hit "scatter-loading", navigate to a directory with a valid firmware for your device and choose the scatter-file.
For testing purposes uncheck "name" and check one of the smaller files in the list below (for example "logo")
Switch off your device. Hit the "Download" button in SP_Flash_Tool and connect your phone to the computer. Some devices require you to take off the battery for about 10 seconds, with others you need to press Vol+ or Vol- while plugging the cable into the phone. Please look up device-specific threads and try out different options.
If nothing happens at all, open a second terminal, run
Code:
dmesg | grep usb
and look out for a MediaTek entry. If there is none → did you install libusb-dev (Step 1?)
If the answer is yes, you might need to create a persistent udev rule for the MTK Preloader:
Code:
sudo gedit /etc/udev/rules.d/80-persistent-usb.rules
Add the following line to the file:
Code:
SUBSYSTEM=="usb", ACTION=="add", ATTR{idVendor}=="0e8d", ATTR{idProduct}=="*"
Save the file and exit.
Reload the usb-rules:
Code:
sudo service udev restart
Disconnect the usb data cable from the computer and the smartphone. Close the flash tool. Switch on your phone (fastboot mode will do). Repeat the first paragraph of Step 3.
If the tool connects, within a few seconds a red progress bar will appear. Unfortunately, in my case an error message came along with it:
S_BROM_CMD_JUMP_DA_FAIL (2035)
There is a connection, but also one more obstacle to overcome...
Step 4:
Now we come to the interesting part, which cost me 2 weeks of (futile) research and frustration. Finally I found Sergio Riveros tutorial on mibqyyo. Thanks to him again and again and again for this priceless piece of information
The “modemmanager” package integrated by default within Linux Ubuntu 14.04 and later is not compatible with the MTK Flash Tool for Linux
Click to expand...
Click to collapse
To put it in different words: The modem manager controls port /dev/ttyACM0 and disables the Flash Tool. So we blacklist it for the two MTK vendor IDs the flash tool uses:
Code:
sudo gedit /etc/udev/rules.d/20-mm-blacklist-mtk.rules
You insert these two lines:
Code:
ATTRS{idVendor}=="0e8d", ENV{ID_MM_DEVICE_IGNORE}="1"
ATTRS{idVendor}=="6000", ENV{ID_MM_DEVICE_IGNORE}="1"
Save the file, exit and restart udev:
Code:
sudo service udev restart
Switch your phone on (fastboot mode will suffice) and off again.
Step 5:
Code:
./flash_tool
or double-click on the flash_tool icon.
Now everything should run smoothly. In case you encounter
Code:
BROM ERROR : S_SECURITY_SF_CODE_FORMAT_FORBIDDEN (6012) , MSP ERROE CODE : 0x00
change the download agent to MTK_AllInOne_DA.bin (screenshot #4)
There are plenty of tutorials on the web for the further steps.
Happy flashing! When a green circle with a white checkmark appears, you are done. You can close the flash tool and disconnect your phone. For a clean start with a new ROM boot into recovery and wipe data/factory reset.

Kudos for the udev rules, I finally managed to root my phone and disable some vendor crap thanks to you!

Thanks, I'm glad to read that it worked for you as well

Great post!
Just wanted to say you saved me HOURS OR DAYS OR WEEKS of time on the modemmanager thing. I have Arch Linux, successfully ported over this tutorial, but I had no idea the modemmanager package was causing the issue. SP Flash Tool was the last frontier for using my Android devices on Linux. Thanks so much!

You are very welcome! Since it took me two weeks to find the cause for "S_BROM_Error [2035]" I wanted to spare other "victims" the experience

This is a very nice, HQ post. Keep up the good work.
But I would like to suggest two corrections:
1) The mv command is unnecessary. you don't have to copy the folder to the root directory to run it as root.
2) Please also add a final step to delete the udev rules so as to re-enable the modem manager after rooting.
Though most of the people who would be reading your thread would be knowledgeable linux users, they won't need these suggestions, but anyways, it would make your guide complete.

Thanks for your feedback @daltonfury42
1) Of course you don't need to move to move the folder to / .As I wrote, you can also use your /home/user directory. But you shouldn't keep it in "/Downloads" or "/tmp", since you might have deleted the folder by the next time you want to use the flash-tool.
Step 2), as you suggest it, is redundant on a private computer, because you blacklist the modemmanager for the flash-tool only, and for nothing else. SP_Flash_Tool uses different Vendor and Product IDs than MTP/USB/ADB/Fastboot mode, and these IDs are not related to your specific device. So the modem manager is up and running - even while you flash - on every other active (network-relevant) usb-port of your computer And it will be up and running on the usb-port you use for the flash-tool when you disconnect the phone and then plug in something else - or the same phone in a different mode... But due to the permanent
Code:
/etc/udev/rules.d/20-mm-blacklist-mtk.rules
entry the modem manager will be automatically blocked if you connect your phone to the SP_Flash_Tool a second time - no matter which port: no further preparations necessary
If you want to check it out, take a look the output of
Code:
dmesg | grep usb
connecting your phone "normally" and compare it with the same command -> output connecting your phone to the SP_Flash_Tool - and/or to the contents of the file "usb_setting.xml" in the SP_Flash_Tool directory My udev rule simply tells the modem manager to ignore two vendor IDs named in that file.
edit: if you "flash" your linux computer more often than your Android device, you should remember to backup the folder and the udev rules

Miss Montage said:
Thanks for your feedback @daltonfury42
1) Of course you don't need to move to move the folder to / .As I wrote, you can also use your /home/user directory. But you shouldn't keep it in "/Downloads" or "/tmp", since you might have deleted the folder by the next time you want to use the flash-tool.
Step 2), as you suggest it, is redundant on a private computer, because you blacklist the modemmanager for the flash-tool only, and for nothing else. SP_Flash_Tool uses different Vendor and Product IDs than MTP/USB/ADB/Fastboot mode, and these IDs are not related to your specific device. So the modem manager is up and running - even while you flash - on every other active (network-relevant) usb-port of your computer And it will be up and running on the usb-port you use for the flash-tool when you disconnect the phone and then plug in something else - or the same phone in a different mode... But due to the permanent
Code:
/etc/udev/rules.d/20-mm-blacklist-mtk.rules
entry the modem manager will be automatically blocked if you connect your phone to the SP_Flash_Tool a second time - no matter which port: no further preparations necessary
If you want to check it out, take a look the output of
Code:
dmesg | grep usb
connecting your phone "normally" and compare it with the same command -> output connecting your phone to the SP_Flash_Tool - and/or to the contents of the file "usb_setting.xml" in the SP_Flash_Tool directory My udev rule simply tells the modem manager to ignore two vendor IDs named in that file.
edit: if you "flash" your linux computer more often than your Android device, you should remember to backup the folder and the udev rules
Click to expand...
Click to collapse
@Miss Montage, very informative. Thankyou.

You're welcome - but please do not post full quotes

Hi. Thanks for the tutorial :good:
I'm getting "PMT changed" error with the right scatter when tried to flash bootimg/recovery only.

Where did you get the scatter file? Generally this error code means that the partition table is different to the one on your device. This should only be the case - occasionally - if you flash a complete firmware.
(Or replace Android through Ubuntu / vc. vs.)

Miss Montage said:
Where did you get the scatter file? Generally this error code means that the partition table is different to the one on your device. This should only be the case - here and then - if you flash a complete firmware.
(Or replace Android through Ubuntu / vc. vs.)
Click to expand...
Click to collapse
I know this error, so I am surprised
scatter is from my stock rom. Same i used to flash.

Hmm, dunno why that is. Can you compare the scatter.txt to the /proc/emmc file on your phone?
And at what stage do you get the error? Immediately after connecting or later?

Miss Montage said:
Hmm, dunno why that is. Can you compare the scatter.txt to the /proc/emmc file on your phone?
And at what stage do you get the error? Immediately after connecting or later?
Click to expand...
Click to collapse
Right now I remembered in windows long ago got the same problem.
This happens if I try to use flash sp tool new versions
In windows:
Working: v5.1352.01
Not Working: v5.1512.00.000
Click to expand...
Click to collapse

The sp_flash_tool_linux 5.1520..... worked perfect for me though... Have you tried an earlier version?

Miss Montage said:
The sp_flash_tool_linux 5.1520..... worked perfect for me though... Have you tried an earlier version?
Click to expand...
Click to collapse
SP_Flash_Tool_Linux_v5.1452.00.100 tested, same problem.
SP_Flash_Tool_Linux_v5.1436.00.100 also tested and same.
No older versions found

The version v5.1504.00.100 works on my 64-bit-system, too... But the error seems to be caused by something else. Have you checked the SP logfile?

Have you also tried the newest version? I just involuntarily re-flashed my UMI Hammer with it... Wanted to choose the twrp only, but too much multi-tasking leads to no good

Miss Montage said:
The 32bit-version v5.1504.00.100 works on my 64-bit-system, too... But the error seems to be caused by something else. Have you checked the SP logfile?
Click to expand...
Click to collapse
Tested and same.
Here logs

Hmm, I will compare these lines to a successful log:
08/13/15 23:57:01.942 BROM_DLL[6767][6774]: FlashTool_ReadPartitionInfo(0x7f7b840038a0,0x7f7b84013310,0x7f7b00000013): mutex: LOCK ... (mutex.cpp:151)
08/13/15 23:57:01.942 BROM_DLL[6767][6774]: FlashTool_ReadPartitionInfo(0x7f7b840038a0,0x7f7b84013310,0x7f7b00000013): mutex: UNLOCK. (mutex.cpp:166)
08/13/15 23:57:01.943 BROM_DLL[6767][6774]: FlashTool_Disconnect(0x840038A0): mutex: LOCK ... (mutex.cpp:151)
Click to expand...
Click to collapse

LG G4 H815 with Android 6.0 - Volume too low, Send_Command.exe "FAILS"

Hi everyone.
I bought LG G4 H815 (this is whole version code I guess). Bought in Poland.
It installed some upgrades at first boot. Phone is very nice I like it, but It has only one issue that makes me pissed - music volume on headphones is terribly low.
I tried to use volume boosters, but none of them worked.
I learned that I must edit XML file placed on /system/etc
I downloaded this using adb and opened in text editor on PC. I saw exactly what I need to change in this file and it's 2 values.
Rooting new device only for this isn't actually well seen by me. I don't require Xposed and a lot of tweaks. I just want my phone to play music louder.
I have Linux skills (I'm user for years), so walking through rooting tutorials I thought "maybe I just dd system partition, mount, replace what it needs and dd back to the phone".
Idea ended here
Code:
C:\Users\domin\Downloads\LG_Root>Send_Command.exe \\.\COM5
Author : blog.lvu.kr
SPECIAL COMMAND : ENTER, LEAVE
#id
FAIL
#ENTER
C:\Users\domin\Downloads\LG_Root>Send_Command.exe \\.\COM5
Author : blog.lvu.kr
SPECIAL COMMAND : ENTER, LEAVE
#LEAVE
C:\Users\domin\Downloads\LG_Root>Send_Command.exe \\.\COM5
Author : blog.lvu.kr
SPECIAL COMMAND : ENTER, LEAVE
#id
FAIL
#LEAVE
For now only thing I see possible to do is
Unlock bootloader
Install TWRP
Flash SuperSu or do anything that TWRP allows me to do
Any other ideas? Maybe less risky stuff?
Or can someone answer for questions:
After unlocking bootloader is there bootloop?
Binary flash from LG to unlock bootloader... Is this the same for every device or I need to order specific one for my phone?
Is there any way to enter fastboot other than adb reboot bootloader?
Thanks for any help in advice!

baldpale said:
Hi everyone.
I bought LG G4 H815 (this is whole version code I guess). Bought in Poland.
It installed some upgrades at first boot. Phone is very nice I like it, but It has only one issue that makes me pissed - music volume on headphones is terribly low.
I tried to use volume boosters, but none of them worked.
I learned that I must edit XML file placed on /system/etc
I downloaded this using adb and opened in text editor on PC. I saw exactly what I need to change in this file and it's 2 values.
Rooting new device only for this isn't actually well seen by me. I don't require Xposed and a lot of tweaks. I just want my phone to play music louder.
I have Linux skills (I'm user for years), so walking through rooting tutorials I thought "maybe I just dd system partition, mount, replace what it needs and dd back to the phone".
Idea ended here
Code:
C:\Users\domin\Downloads\LG_Root>Send_Command.exe \\.\COM5
Author : blog.lvu.kr
SPECIAL COMMAND : ENTER, LEAVE
#id
FAIL
#ENTER
C:\Users\domin\Downloads\LG_Root>Send_Command.exe \\.\COM5
Author : blog.lvu.kr
SPECIAL COMMAND : ENTER, LEAVE
#LEAVE
C:\Users\domin\Downloads\LG_Root>Send_Command.exe \\.\COM5
Author : blog.lvu.kr
SPECIAL COMMAND : ENTER, LEAVE
#id
FAIL
#LEAVE
For now only thing I see possible to do is
Unlock bootloader
Install TWRP
Flash SuperSu or do anything that TWRP allows me to do
Any other ideas? Maybe less risky stuff?
Or can someone answer for questions:
After unlocking bootloader is there bootloop?
Binary flash from LG to unlock bootloader... Is this the same for every device or I need to order specific one for my phone?
Is there any way to enter fastboot other than adb reboot bootloader?
Thanks for any help in advice!
Click to expand...
Click to collapse
Unlocking bootloader does not cause bootlooop.
The unlock file is unique . It is provide it by imei and phone unique id.
I dont think there is another way to enter fasboot mode. Just by adb commands

Thanks for your reply.
Is there any way to boot TWRP without flashing it?

baldpale said:
Hi everyone.
I bought LG G4 H815 (this is whole version code I guess). Bought in Poland.
It installed some upgrades at first boot. Phone is very nice I like it, but It has only one issue that makes me pissed - music volume on headphones is terribly low.
I tried to use volume boosters, but none of them worked.
I learned that I must edit XML file placed on /system/etc
I downloaded this using adb and opened in text editor on PC. I saw exactly what I need to change in this file and it's 2 values.
Rooting new device only for this isn't actually well seen by me. I don't require Xposed and a lot of tweaks. I just want my phone to play music louder.
I have Linux skills (I'm user for years), so walking through rooting tutorials I thought "maybe I just dd system partition, mount, replace what it needs and dd back to the phone".
Idea ended here
Code:
C:\Users\domin\Downloads\LG_Root>Send_Command.exe \\.\COM5
Author : blog.lvu.kr
SPECIAL COMMAND : ENTER, LEAVE
#id
FAIL
#ENTER
C:\Users\domin\Downloads\LG_Root>Send_Command.exe \\.\COM5
Author : blog.lvu.kr
SPECIAL COMMAND : ENTER, LEAVE
#LEAVE
C:\Users\domin\Downloads\LG_Root>Send_Command.exe \\.\COM5
Author : blog.lvu.kr
SPECIAL COMMAND : ENTER, LEAVE
#id
FAIL
#LEAVE
For now only thing I see possible to do is
Unlock bootloader
Install TWRP
Flash SuperSu or do anything that TWRP allows me to do
Any other ideas? Maybe less risky stuff?
Or can someone answer for questions:
After unlocking bootloader is there bootloop?
Binary flash from LG to unlock bootloader... Is this the same for every device or I need to order specific one for my phone?
Is there any way to enter fastboot other than adb reboot bootloader?
Thanks for any help in advice!
Click to expand...
Click to collapse
Did you manage to fix the low microphone volume?

It wasn't about microphone volume and also you necrobumping this thread...

Tiki Thorsen said:
Hi everyone.
I bought LG G4 H815 (this is whole version code I guess). Bought in Poland.
It installed some upgrades at first boot. Phone is very nice I like it, but It has only one issue that makes me pissed - music volume on headphones is terribly low.
I tried to use volume boosters, but none of them worked.
I learned that I must edit XML file placed on /system/etc
I downloaded this using adb and opened in text editor on PC. I saw exactly what I need to change in this file and it's 2 values.
Rooting new device only for this isn't actually well seen by me. I don't require Xposed and a lot of tweaks. I just want my phone to play music louder.
I have Linux skills (I'm user for years), so walking through rooting tutorials I thought "maybe I just dd system partition, mount, replace what it needs and dd back to the phone".
Idea ended here
Did you manage to fix the low microphone volume?
Click to expand...
Click to collapse
Same problem bro :crying:

[! DISCONTINUED !] [TUTORIAL][LOCKED][UNLOCKED][ANY G4] DLM Backup

This thread is superseeded by: https://tinyurl.com/SALTatXDA
NO FURTHER SUPPORT HERE!
DLM Backup is a NANDROID BACKUP IN DOWNLOAD MODE!
(DLM Backup = [D]own[l]oad [M]ode Backup)
The following does not require an unlocked device and so even no TWRP.
Believe it or not but you are able to backup full partitions nevertheless!!! :victory:
.. and all this even for partitions you usually have NO ACCESS TO (e.g. laf, aboot etc) and all this even without root ! wtf its not a dream its true! :victory:
It's really awesome especially for those having a locked device but still wanted to have a nandroid backup
or for those encountering the ILAPO (Infinite Loop Auto Power off or just called "bootloop issue") wanting to save their data!
The following will make full disk dumps of all or only the system essential ones of your device. Choose whichever option you need.
Preparation
First of all you should download FWUL ( https://tinyurl.com/FWULatXDA ).
Every other Linux is fine as well as long as you can handle it! (do not expect support from me then - I support FWUL only)
You may still should consider FWUL as it has everything onboard and is preconfigured to work with Android devices out-of-the-box.
Keep in mind the FWUL password as you need it for the sudo commands within the terminal later.
Once FWUL is running open a terminal (little black icon in the panel):
Code:
git clone [url]https://github.com/steadfasterX/lglaf.git[/url]
cd lglaf
Leave this terminal window open - we need it in the next step.
Then boot your phone into download mode --> the following guide is 100% working and bulletproof:
take out battery and unplug USB cable
plugin USB cable to your PC (while battery ist still out)
wait until you see the missing battery icon (question mark within a battery symbol)
press Volume up and while keeping it pressed put battery in (take care that you do not press the power button)
keep pressing Volume up until you see "Download mode"
If that does not work for you try it this way instead:
unplug USB cable
power down device or pull out battery
put battery back
press Volume up and while keeping it pressed plugin USB cable to your PC (take care that you do not press the power button)
keep pressing Volume up until you see "Download mode"
Your phones screen should look similar to this afterwards:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
You need a USB stick or disk which is big enough to hold the backup.
Depending on the method you need either a ~8 GB one or a 64 GB..
Plugin the USB stick and find out the path to it by just double clicking on the USB stick icon which appears on the desktop after plugging in the stick.
Then write down / copy the path to the stick as shown in the screenshot:
If you encounter problems with the above (e.g. no icon appears after plugging in the USB stick) you can do this in a terminal instead:
Code:
df
Filesystem 1K-blocks Used Available Use%[COLOR="Red"] Mounted on[/COLOR]
dev 16439340 264744 16174596 2% /dev
[............]
/dev/sdd3 2978320 9532 2797780 1%[COLOR="red"] [B]/run/media/android/myusb-stick[/B][/COLOR]
When you are running LL you can skip this step but when you are on MM (or higher...) you need to do the following:
Execute this in your terminal left open from the "Preparation" topic:
Code:
sudo python2 auth.py
you should see something like:
LGLAF.py: DEBUG: Detaching kernel driver for intf 0
LGLAF.py: DEBUG: Using endpoints 83 (IN), 02 (OUT)
auth: DEBUG: Challenge: c0:45:6c:78
auth: DEBUG: Response: b4:1d:1e:cd:e8:f1:5f:b5:fa:78:9e:f8:2d:c6:83:86
Click to expand...
Click to collapse
Now you are authenticated with the download mode and we can continue:
Option A) FULL backup (includes everything e.g. system, cache and userdata / internal storage)
When to use:
if you want to flash new ROMs or bootloader stacks
if you want to backup all your internal storage (e.g. pictures, videos and stuff) - keep in mind TWRP does NOT backup your internal storage!!
if you want to have a real FULL NANDROID (e.g. TWRP will not backup partitions like misc, persistent, persistent-lg etc)
Requirements:
- FWUL
- a 64 GB or bigger USB stick / disk
Execute this in your terminal left open from the "Preparation" topic:
Code:
sudo python2 extract-partitions.py --max-size 0 -d [I]YOURUSBSTICKpath[/I]
(replace YOURUSBSTICKpath with the path you discovered in the Preparation topic!)
Be patient.. this can take a loooong time!
You can watch the progress e.g with executing this in a NEW terminal (just click the terminal icon in the panel again):
Code:
watch 'ls -lathr [I]YOURUSBSTICKpath[/I] | tail '
(replace YOURUSBSTICKpath with the path you discovered in the Preparation topic!)
Once finished you can reboot by either taking out the battery or typing:
Code:
sudo python2 lglaf.py --skip-hello -c '!CTRL RSET'
Option B) system essentials backup (does *NOT* include system, cache and userdata / internal storage!!)
When to use:
if you want to flash new bootloader stacks
if you want to backup your current lock/unlock state
if you want to backup your IMEI and EFS
Requirements:
FWUL
a 4 - 8 GB or bigger USB stick / disk
Execute this in your terminal left open from the "Preparation" topic:
Code:
sudo python2 extract-partitions.py -d [I]YOURUSBSTICKpath[/I]
(replace YOURUSBSTICKpath with the path you discovered in the Preparation topic!)
Be patient.. this can take some time!
You can watch the progress e.g with executing this in a NEW terminal (just click the terminal icon in the panel again):
Code:
watch 'ls -lathr [I]YOURUSBSTICKpath[/I] | tail '
(replace YOURUSBSTICKpath with the path you discovered in the Preparation topic!)
Once finished you can reboot by either taking out the battery or typing:
Code:
sudo python2 lglaf.py --skip-hello -c '!CTRL RSET'
... and the last 2 things which need to be done
1) Click the thanks button here
2) Enjoy
Restore a DLM Backup
Checkout Post #2 for the restore howto
Credits
Peter Wu for his absolutely awesome job on reverse engineering the LAF protocol and offering the lglaf code as python code.
Main thread for lglaf: https://forum.xda-developers.com/android/software-hacking/tool-lg-download-mode-laf-t3285946/page1
Donations: https://forum.xda-developers.com/member.php?u=4790426
.

Restore a previously taken backup or partitions of an already extracted KDZ
There are 2 methods available - choose the one matching your needs:
A) Restore a previously taken DLM Backup
B) Flash a KDZ / LGUP NG by sfX
Unfortunately this may not work on every firmware so you may try different firmwares then and you will receive the same error regarding communication port closing but in general it should work this way.
A) Restore a previously taken DLM Backup / Restore partitions from an extracted KDZ
To restore single partitions use the following
sudo python2 auth.py
sudo python2 partitions.py --restore /path/to/dumpfile partitionname
e.g.
sudo python2 auth.py
sudo python2 partitions.py --restore /tmp/misc misc (would restore the misc partition)
To restore ALL partitions in a folder
For this the best is to use the new LGUP NG kdzmanager which is explained in the next topic.
Install LGUP NG but skip the steps to extract a KDZ if you don't need it.
Then:
bash kdzmanager.sh --test --flash /path/to/imagefiles
(/path/to/imagefiles must contain your previously taken DLM backup files or an extracted KDZ)
This will just test flashing and not actually flash.
If that looks fine do it again but without --test parameter:
bash kdzmanager.sh --flash /path/to/imagefiles
B) Flash a KDZ / LGUP NG (next generation) by sfX
Forget LGUP to flash a KDZ from now on!
Just use my KDZManager
Features:
No worries anymore about those crappy DLL issues
Extract a KDZ
Test flashing partitions (dry run without actually flashing anything)
Flash partitions from a KDZ
when flashing avoid erasing/wiping userdata (keep your data between KDZ flashes)
Hint: not wiping userdata can occur in a bootloop when its not compatible with the ROM! So use that option with care.
will work on any Linux (but FWUL is the only supported)
Keep in mind that this is an early release and there are NO CHECKS like ARB or even if the device model matches with the KDZ but THIS WILL ALL COME (even with an option to override and flash regardless)
Roadmap:
GUI
Check for matching device model
Check for ARB
Instructions:
Boot FWUL (or your Linux but keep in mind that only FWUL is supported), choose language & login
Download the KDZ file you want to flash (we need to know the path later e.g. /home/android/Downloads/)
Open the folder LG
Connect device in download mode to the PC
Double click "LG laf NG" icon
Type in the new opened terminal:
sudo python2 auth.py
[*]sudo python2 partitions.py --list
If this lists your partitions then we can proceed with flashing.
Download my brand new kdzmanager tool in FWUL: (right click and save as)
When you are not using the persistent mode of FWUL: plug in a big USB stick (e.g. 32 GB or more) into FWUL and extract the attached file there
When you are using the persistent mode of FWUL: just extract it in your download folder
You need to know the full path so best is copying the path from the file manager (e.g. /home/android/Downloads/ ) or leave the file manager open there
Open another terminal (black little icon in the panel)
cd and directly behind this paste the path you copied (e.g. cd /home/android/Downloads/ )
press ENTER
bash kdzmanager.sh -x FILLINFULLPATH-TO-DOWNLOADED-KDZ
(e.g. bash kdzmanager.sh -x /home/android/Downloads/h811blablubb.kdz)
WARNING-1: Keep in mind that atm kdzmanager is not able to proof if you choose a compatible KDZ file for your device!
Check your device model and the KDZ twice!
WARNING-2: Keep in mind that atm kdzmanager is not able to proof your current ARB version so flashing an smaller ARB then your current one will BRICK your device.
Check ARB first: CLICK
If you understood the above 2 warnings proceed like this:
bash kdzmanager.sh --test --flash extracteddz/
(just like this as "extracteddz" is the path generated by the kdzmanager)
This will just test flashing and not actually flash. Let me know the results of this (copy & paste output)
if you can't wait the next step would be actually flashing ofc:
WARNING: by default the kdzmanager will not overwrite userdata (which would be like a factory reset) and I would recommend to leave it out always and better choose the LG factory reset menu (after flashing completed) if required. If you still want to flash it use --with-userdata as a parameter (can take a loooong time then btw).
bash kdzmanager.sh --flash extracteddz/
last step ( will be included in the next release): wipe your userdata:
sudo partitions.py --wipe userdata
Or just use the factory reset hardware key combo to do the same.
If you skip this step you may encounter a bootloop. If that happens you can at any time use the hardware key combo to boot into factory reset to fix that.
sfX

FAQ
1. Q: You get the error message: "Expected arrow in ls output" when executing lglaf
A: update to the latest version of lglaf (thx to @tulen_kobi for this patch!). For updating lglaf on FWUL check Q4.
If the error still persists your download mode version is not supported by lglaf. Its very likely that your carrier has a very strict policy activated in download mode. The only chance is to try other download mode version meaning to flash different KDZ files (on locked devices) or just the laf.img in fastboot (on unlocked devices).
On Nougat and when unlocked it is enough to just flash the laf.img of MM and you can use lglaf again.
2. Q: You get not an error but messages or files containing just "Hello, I am LAF. Nice to meet you."
A: your download mode version is not supported by lglaf. Its very likely that your carrier has a very strict policy activated in download mode. The only chance is to try other download mode version meaning to flash different KDZ files (on locked devices) or just the laf.img in fastboot (on unlocked devices).
On Nougat and when unlocked it is enough to just flash the laf.img of MM and you can use lglaf again.
3. Q: All seems fine but at the end of a command you see: "comm.call(close_cmd) [....someotherstuff...] Command failed with error code 0x8000010a"
A: This is known and not a serious issue. Once I have the time I will fix it but in the meanwhile pls ignore..
This has been fixed. please update your LGlaf like described in the next FAQ
4. Q: I want to update lglaf on FWUL v2 or higher
ok here is the correct way to achieve this on FWUL v2:
cd ~programs/lglafng/
git pull
git checkout g4
then you're up2date and can try again while in this folder!
sfX

I'm so happy that you were able to finally get this working. It's dumping my system partition right now. I'll report back when it's done.
Also. You should note that the sudo password is "linux" and to view progress on the dump, you should specify that the command should be opened in a new terminal window.
Over all. Awesome tutorial!
EDIT: Was able to retrieve 7gb of lost pictures thanks to this method! Thank you!

How to restore? Is it possible?

mateus.sc said:
How to restore? Is it possible?
Click to expand...
Click to collapse
Yes even that.. I will write down a restore guide soon.
.
Sent from my LG-H815 using XDA Labs

I cannot Auth with my device.
I get the first 2 lines from the auth.py command
No challenge or response.
Using Virtualbox.

OllieD said:
I cannot Auth with my device.
I get the first 2 lines from the auth.py command
No challenge or response.
Using Virtualbox.
Click to expand...
Click to collapse
what Android version is installed currently?
.

steadfasterX said:
what Android version is installed currently?
.
Click to expand...
Click to collapse
20G Stock Locked Bootloader.
Rebooted into live environment and worked.
Extract partitions errored out
Traceback (most recent call last):
File "extract-partitions.py", line 63, in <module>
main()
File "extract-partitions.py", line 60, in main
dump_partitions(comm, disk_fd, args.outdir, args.max_size * 1024)
File "/usr/lib/python2.7/contextlib.py", line 24, in __exit__
self.gen.next()
File "/home/android/lglaf/partitions.py", line 78, in laf_open_disk
comm.call(close_cmd)
File "/home/android/lglaf/lglaf.py", line 176, in call
raise RuntimeError('Command failed with error code %#x' % errCode)
RuntimeError: Command failed with error code 0x8000010a
After Dumping, Option B
Also the Firefox installer although it installs Firefox it wont launch and gives a SQLite Version Error so it will not run.
Chromium works fine.
Now i've backed up i can try and install V29

OllieD said:
20G Stock Locked Bootloader.
Rebooted into live environment and worked.
Extract partitions errored out
Traceback (most recent call last):
File "extract-partitions.py", line 63, in <module>
main()
File "extract-partitions.py", line 60, in main
dump_partitions(comm, disk_fd, args.outdir, args.max_size * 1024)
File "/usr/lib/python2.7/contextlib.py", line 24, in __exit__
self.gen.next()
File "/home/android/lglaf/partitions.py", line 78, in laf_open_disk
comm.call(close_cmd)
File "/home/android/lglaf/lglaf.py", line 176, in call
raise RuntimeError('Command failed with error code %#x' % errCode)
RuntimeError: Command failed with error code 0x8000010a
After Dumping, Option B
Also the Firefox installer although it installs Firefox it wont launch and gives a SQLite Version Error so it will not run.
Chromium works fine.
Now i've backed up i can try and install V29
Click to expand...
Click to collapse
well it sounds like u have not much RAM attached to your VM then. 4 GB are recommended.
The dump error can be ignored as long as auth.py has worked before and everything gets dumped..
.

steadfasterX said:
Just a quick note:
I completely re-worked the guide and fixed an issue for devices running MM!
Just re-do the guide if you encountered an issue before.
.
Click to expand...
Click to collapse
what if .. i dont have USB.? am planning of backing up my IMEI. as i been reading this on the new N roms..
what can i do.?

raptorddd said:
what if .. i dont have USB.? am planning of backing up my IMEI. as i been reading this on the new N roms..
what can i do.?
Click to expand...
Click to collapse
If you have an unlocked device you have luck and you could use dd commands in TWRP. I know that yours is unlocked so you could use dd on every partition available on your device.
Tbh the most important seems to be persistent, fsg, misc but until I know for sure I would just backup EVERY partition. It's only needed once in the phones life usually so it doesn't hurt..
I need to have my device repaired before I can test it further so this can take a while.. Until then the backup of every partition is the best choice.
if the device is locked and on LL then TWRP in FIsH plus the mentioned dd commands can be used as well. I would still recommend the download mode backup though..
if the device is locked and on MM or N (haven't tested N in download mode though) then USB plus download mode is the only choice.
.
Sent from my LG-H815 using XDA Labs

Similar question. What's the quick and dirty way to backup these partitions from terminal app / busybox?
Dd if=??? Etc
not sure if different between models but mines h815 international running 'stock' nougat

steadfasterX said:
If you have an unlocked device you have luck and you could use dd commands in TWRP. I know that yours is unlocked so you could use dd on every partition available on your device.
Tbh the most important seems to be persistent, fsg, misc but until I know for sure I would just backup EVERY partition. It's only needed once in the phones life usually so it doesn't hurt..
I need to have my device repaired before I can test it further so this can take a while.. Until then the backup of every partition is the best choice.
if the device is locked and on LL then TWRP in FIsH plus the mentioned dd commands can be used as well. I would still recommend the download mode backup though..
if the device is locked and on MM or N (haven't tested N in download mode though) then USB plus download mode is the only choice.
.
Sent from my LG-H815 using XDA Labs
Click to expand...
Click to collapse
OMG so basically if this works in locked N, can I flash the korean v30 kdz and then restore a backup the modem.img from v29a made for my H815 with this method?
The possibilities are amazing

obvious said:
Similar question. What's the quick and dirty way to backup these partitions from terminal app / busybox?
Dd if=??? Etc
not sure if different between models but mines h815 international running 'stock' nougat
Click to expand...
Click to collapse
I will add it in the TWRP thread ASAP
mateus.sc said:
OMG so basically if this works in locked N, can I flash the korean v30 kdz and then restore a backup the modem.img from v29a made for my H815 with this method?
The possibilities are amazing
Click to expand...
Click to collapse
Technically this method can provide that (as said I can't test N atm though so I don't know if this works in general for N but if LG hasn't changed anything.. )
but:
keep in mind that cross flashing partitions can result in a soft brick on locked devices!! I don't know how N behaves here tbh so it may just work or it may soft brick in the specific case of modem.
So it would be nice to have someone trying to use the auth command on a N bootloader stack. This will not harm anything but then we know for sure if this is usable for N or not
.
Sent from my LG-H815 using XDA Labs

steadfasterX said:
If you have an unlocked device you have luck and you could use dd commands in TWRP. I know that yours is unlocked so you could use dd on every partition available on your device.
Tbh the most important seems to be persistent, fsg, misc but until I know for sure I would just backup EVERY partition. It's only needed once in the phones life usually so it doesn't hurt..
I need to have my device repaired before I can test it further so this can take a while.. Until then the backup of every partition is the best choice.
if the device is locked and on LL then TWRP in FIsH plus the mentioned dd commands can be used as well. I would still recommend the download mode backup though..
if the device is locked and on MM or N (haven't tested N in download mode though) then USB plus download mode is the only choice.
.
Sent from my LG-H815 using XDA Labs
Click to expand...
Click to collapse
yes unlocked.. i downloaded FWUL but on step to place the command for python i had directiry not found and gave up use twrp for EFS.
for DD what are commands is this using ternimal? where can i find all the command to extract say boot ,system modem ect.?

raptorddd said:
yes unlocked.. i downloaded FWUL but on step to place the command for python i had directiry not found and gave up use twrp for EFS.
for DD what are commands is this using ternimal? where can i find all the command to extract say boot ,system modem ect.?
Click to expand...
Click to collapse
just try my new twrp version which will be uploaded in 5 minutes..
.

Hey I'm getting an error in running this - phone is in download mode and connected. Using FWUL on my machine and trying to dump to an extrernal HD (path below in first line).
Code:
[[email protected] lglaf]$ sudo python2 extract-partitions.py --max-size 0 -d /run/media/android/16a064ee-96de-4c4d-8c30-29cbcc2e5441/
Traceback (most recent call last):
File "extract-partitions.py", line 63, in <module>
main()
File "extract-partitions.py", line 60, in main
dump_partitions(comm, disk_fd, args.outdir, args.max_size * 1024)
File "extract-partitions.py", line 24, in dump_partitions
parts = partitions.get_partitions(comm)
File "/home/android/lglaf/partitions.py", line 41, in get_partitions
assert arrow == '->', "Expected arrow in ls output"
AssertionError: Expected arrow in ls output

ReeS86 said:
Hey I'm getting an error in running this - phone is in download mode and connected. Using FWUL on my machine and trying to dump to an extrernal HD (path below in first line).
Click to expand...
Click to collapse
Yea... I saw that on another phone as well. Weird.
I need your help to fix it..
Could you come into IRC on Monday?
sfX
Sent from my LG-H815 using XDA Labs

steadfasterX said:
Yea... I saw that on another phone as well. Weird.
I need your help to fix it..
Could you come into IRC on Monday?
sfX
Sent from my LG-H815 using XDA Labs
Click to expand...
Click to collapse
Ya I'll try to pop on after work. Can also see if the secure boot thing works once I get that backup.

[Tutorial] Install Windows 10 for ARM32 on your Surface 2

Hi guys, following the recent release of a Windows 10 ARM32 install tutorial in Chinese to install it on the Surface RT 1 and Surface RT 2, I've decided to come and try my luck by using google translate to follow the procedure and then decided to refine it and to make it into this tutorial for the Surface 2 (The procedure for the Surface 1 should not be much different aside from the files you have to use but as I don't have one, I haven't tried out the files for it...).
Download: https://yadi.sk/d/mnCUeGKWm1XTXA
Requires:
- The files available in the Yandex Repo
- A recovery USB Disk for Surface 2: Surface2_BMR_20.2.19.0.zip (https://support.microsoft.com/en-hk/help/4023512/surface-creating-and-using-a-usb-recovery-drive)
- A keyboard
1. Copy the following files from the yandex repo to the root directory of your recovery disk:
- Disabling_UAC.reg
- SecureBootPatch.zip (extract it)
- APPX1.rar (extract it)
- surface2_win10_zh_cn_new.wim
- Microsoft.NET.Native.Framework.1.1.appx
- Microsoft.NET.Native.Runtime.1.1.appx
- Camera_fix.reg
2. Boot into Recovery mode (insert the recovery disk, hold the "vol dow" button then press the "power" button and release the "vol down" button when the surface logo appears)
Open a command prompt and type the following commands:
- diskpart
- list disk
- sel disk 0
- list part
- sel part 4
- for quick fs = ntfs override
- exit
- dism /apply-image /imagefile:d:\sources\install.wim /applydir:c: /index:1
3. Reboot the device and Disable UAC, then run "Disabling_UAC.reg" as admin and reboot the device once again
Once the device has rebooted open regedit and go to "HKEY_LOCAL_MACHINE\BCD00000000" select "BCD00000000", click on file and select "unload hive"
Once this is done extract "SecureBootPatch.zip" and open the "SecureBootPatch" folder to run "InstallPolicy.cmd" as admin and then reboot the device once again (l If the secure boot debug policy interface appears after restarting, it means normal. Select accept and install to install)
Open a command prompt as admin and enter the following command to enable test mode :
- bcdedit /set {default} testsigning on && bcdedit /set {bootmgr} testsigning on
4. Now we can start serious business and install Windows 10 on the device, to do so, we'll start by rebooting the device in recovery mode (Check the lower right corner to indicate that secureboot is not configured correctly and it will succeed)
Once in recovery mode open a command prompt and type the following commands:
- diskpart
- list disk
- sel disk 0
- list part
- sel part 4
- for quick fs = ntfs override
- exit
- dism /apply-image /imagefile:d:\surface2_win10_zh_cn_new.wim /applydir:c: /index:1
5. Plugin your keyboard and reboot the device, you should get an error message related to the boot configuration, at this moment press shift+f10 and open regedit
Go to the following registry entry: HKEY_Local machine/SYSTEM/Setup/Status/ChildCompletion and then select the "setup.exe" entry, modify it to "3", exit regedit and commandline and click "Ok" on the error dialog box, the device should reboot(don't reboot the device in any other way), and configure correctly now
Configure the system the way you want it
Once on the desktop open a powershell command prompt and type in the following commands:
- slmgr.vbs /upk
- slmgr /ipk NPPR9-FWDCX-D2C8J-H872K-2YT43
- slmgr /skms kms.03k.org
- slmgr /ato
- slmgr /skms zhang.yt
Your device is now activated
6. We must then proceed to install the runtime environment and store app
Select the APPX1 folder and copy it to the Desktop, open it and select "APPX.ps1",and choose "Run with powershell", once done press "enter" reboot the system, go back to where you were and do the same with "AppxBundle.ps1"
Then Select "Microsoft.windowsStore.appxbundle" and install it (this will install a chinese version of the Microsoft Store (better than nothing I guess? Maybe someone can provide and english version?)
Finally install the following files from the root of your recovery disk:
- Microsoft.NET.Native.Framework.1.1.appx
- Microsoft.NET.Native.Runtime.1.1.appx
7. Now all we need is a few tweaks to remove usability quirks and then your device will work like a shine :
7.1. You might have noticed than when you boot your device you get a message telling you that the licence is about to expire and that you also get a paging file error popping up at every login, this kinda ruins the experience, so we're gonna get rid of those.
- To remove the licensing popup first it go to " C:\Windows\System32" and take ownership of "LicensingUI.exe", then rename it to "LicensingUI-old.exe"
- To remove the paging file popup just manually set the page cache to 16 MB min and 512 MB max.
(Thanks to betanu701 for indicating us these tricks)
7.2. We're also gonna get totally rid of the Chinese language pack to favor any language you might want, this will also change the Store language to whatever language pack you put in.
- Go to Settings>Time & language>Region & language, and then set the whatever language pack you want as the default and remove the Chinese one (that's of course if you don't speak Chinese ^^)
(Thanks to ShotSkydiver for this trick)
7.3. We'll also make the camera work simply by applying the "Camera_fix.reg" registry entry as admin.
Your device is now ready to use.
Bonus: You can download and install the following apps from our fellow community member _CNR_, you'll get a bunch of stock apps that'll work for this build like mail, maps, solitaire...etc and Office 2013, here's the link : https://mega.nz/#F!ivwlHKaZ!hFwEHZnyw_nNTe4b3TN4wA
Quirks: at the moment I am getting a paging file error at every login along with an expired version warning, if anyone knows how to get rid of those two things, that'd be very helpful, I'd update the tutorial and mention your help in here of course...
(Edit: the quirks have been ironed out thanks to fellow community members)
I think this is only the beginning, we can probably improve this, first of all, we need an english store app (done), we'll also need to get rid of the error and warnings at every bootup(done), then we'll need to compile some apps and update existing ones and then list them, I hope the community on this forum will be helpful for these tasks :angel: For the time being enjoy what you get

Will this work in Asus winRT?
Enviado desde mi G8441 mediante Tapatalk

notass said:
Will this work in Asus winRT?
Enviado desde mi G8441 mediante Tapatalk
Click to expand...
Click to collapse
No, there are two images available, one made for the Surface 1 and one for the Surface 2, maybe it could work if you make a custom image from the leaked build but certainly not that way...

Hey !
I do have a problem with the "bcdedit /set {default} testsigning on && bcdedit /set {bootmgr} testsigning on" step... it don't work for me I don't understand why..

Are there any difference in the procedure for the Surface RT, other then using the corresponding W10 image?

Kiba85 said:
Are there any difference in the procedure for the Surface RT, other then using the corresponding W10 image?
Click to expand...
Click to collapse
No difference, if you try, tell me if you can install the secure boot patch and if the command "bcdedit ....." works for you. Because i'm stuck at this step

First off, thanks for the guide; it worked perfectly for my Surface 2! Also, I stumbled across a simple way to get the Store to display in English rather than Chinese: just go into Settings, then Time & language, then Region & language, and then set the English language pack as the default (optionally you can also remove the Chinese language pack as well). From there, open the Store, and it'll be in English!

AlGaib said:
Once this is done extract "SecureBootPatch.zip" and open the "SecureBootPatch" folder to run "InstallPolicy.cmd" as admin and then reboot the device once again (l If the secure boot debug policy interface appears after restarting, it means normal. Select accept and install to install)
Open a command prompt as admin and enter the following command to enable test mode :
- bcdedit /set {default} testsigning on && bcdedit /set {bootmgr} testsigning on
Now we can start serious business and install Windows 10 on the device, to do so, we'll start by rebooting the device in recovery mode (Check the lower right corner to indicate that secureboot is not configured correctly and it will succeed)
Click to expand...
Click to collapse
I would like to give a little warning to people following this guide - don't try to see what happens if you flash the Win10 WIM without having secure boot disabled. I just did that, and my Surface 2 is now bricked. If you want to be super sure that SecureBoot is off, run this cmdlet in PowerShell: Confirm-SecureBootUEFI
If it returns True, SecureBoot is still enabled.
I have an official Windows RT 8.1 recovery stick from Microsoft (but I also tried to make my own stick from the provided ZIP), but when I try to boot into Recovery (Volume Down + Power), I get the following error:
"A required device isn't connected or can't be accessed.
Error code: 0xc000000f"
When I just turn on the Surface, the boot fails, because the Windows 10 installation I flashed fails the SecureBoot test:
"The digital signature for this file couldn't be verified.
File:\Windows\system32\winload.efi
Error code: 0xc0000428"
Bloody hell, I was looking forward to having a more functional Surface and I ended up with a bricked one. Not sure what else can be done, when it refuses to boot even from official recovery stick :crying:

AlGaib said:
Following the recent release of a Windows 10 ARM32 install tutorial in chinese, I've used google translate to follow the procedure and then refined it, here is my tutorial for the Surface 2...
Download: https://yadi.sk/d/mnCUeGKWm1XTXA
Requires:
- The files available in the Yandex Repo
- A recovery USB Disk for Surface 2: Surface2_BMR_20.2.19.0.zip (https://support.microsoft.com/en-hk/help/4023512/surface-creating-and-using-a-usb-recovery-drive)
- A keyboard
Copy the following files from the yandex repo to the root directory of your recovery disk:
- Disabling_UAC.reg
- SecureBootPatch.zip (extract it)
- APPX1.rar (extract it)
- surface2_win10_zh_cn_new.wim
- Microsoft.NET.Native.Framework.1.1.appx
- Microsoft.NET.Native.Runtime.1.1.appx
Boot into Recovery mode (insert the recovery disk, hold the "vol dow" button then press the "power" button and release the "vol down" button when the surface logo appears)
Open a command prompt and type the following commands:
- diskpart
- list disk
- sel disk 0
- list part
- sel part 4
- for quick fs = ntfs override
- exit
- dism /apply-image /imagefile:d:\sources\install.wim /applydir:c: /index:1
Reboot the device and Disable UAC, then run "Disabling_UAC.reg" as admin and reboot the device once again
Once the device has rebooted open regedit and go to "HKEY_LOCAL_MACHINE\BCD00000000" select "BCD00000000", click on file and select "unload hive"
Once this is done extract "SecureBootPatch.zip" and open the "SecureBootPatch" folder to run "InstallPolicy.cmd" as admin and then reboot the device once again (l If the secure boot debug policy interface appears after restarting, it means normal. Select accept and install to install)
Open a command prompt as admin and enter the following command to enable test mode :
- bcdedit /set {default} testsigning on && bcdedit /set {bootmgr} testsigning on
Now we can start serious business and install Windows 10 on the device, to do so, we'll start by rebooting the device in recovery mode (Check the lower right corner to indicate that secureboot is not configured correctly and it will succeed)
Once in recovery mode open a command prompt and type the following commands:
- diskpart
- list disk
- sel disk 0
- list part
- sel part 4
- for quick fs = ntfs override
- exit
- dism /apply-image /imagefile:d:\surface2_win10_zh_cn_new.wim /applydir:c: /index:1
Plugin your keyboard and reboot the device, you should get an error message related to the boot configuration, at this moment press shift+f10 and open regedit
Go to the following registry entry: HKEY_Local machine/SYSTEM/Setup/Status/ChildCompletion and then select the "setup.exe" entry, modify it to "3", exit regedit and commandline and click "Ok" on the error dialog box, the device should reboot(don't reboot the device in any other way), and configure correctly now
Configure the system the way you want it
Once on the desktop open a powershell command prompt and type in the following commands:
- slmgr.vbs /upk
- slmgr /ipk NPPR9-FWDCX-D2C8J-H872K-2YT43
- slmgr /skms kms.03k.org
- slmgr /ato
- slmgr /skms zhang.yt
Your device is now activated
We must then proceed to install the runtime environment and store app
Select the APPX1 folder and copy it to the Desktop, open it and select "APPX.ps1",and choose "Run with powershell", once done press "enter" reboot the system, go back to where you were and do the same with "AppxBundle.ps1"
Then Select "Microsoft.windowsStore.appxbundle" and install it (this will install a chinese version of the Microsoft Store (better than nothing I guess? Mybae someone can provide and english version?)
Finally install the following files from the root of your recovery disk:
- Microsoft.NET.Native.Framework.1.1.appx
- Microsoft.NET.Native.Runtime.1.1.appx
Your device is now ready to use.
Quirks : at the moment I getting a paging file error at every login along with an expired version warning, if anyone knows how to get rid of those two things, that'd be very helpful, I'd update the tutorial and mention your help in here of course...
I think this is only the beginning, we can probably improve this, first of all, we need an english store app, we'll also need to get rid of the error and warnings at every bootup, then we'll need to compile some apps and update existing ones and then list them, I hope the community on this forum will be helpful for these tasks :angel: For the time being enjoy what you get
Click to expand...
Click to collapse
To get the Store in english: Start > Settings > Language > Region & Language > Remove chinese
To get rid of the popup (old Windows version): C:\Windows\System32\LogonUI.exe > Right Click > Properties > Security > Advanced > Owner...Change > Add your username > Check Names. Close all popups and rename the file to whatever you want

Do i have to Downgrade to 8.0?

I have a problem. I cant disable Secure Boot. Therefore this command doesn't work:
bcdedit /set {default} testsigning on && bcdedit /set {bootmgr} testsigning on
I already launched SecureBootPatch 100 times. I get the screen on boot where I need to press Agree.
I completely restored with USB recovery Windows 8 RT. Non success
this doesn't change anything. Secureboot stays on.

Avonlady said:
I would like to give a little warning to people following this guide - don't try to see what happens if you flash the Win10 WIM without having secure boot disabled. I just did that, and my Surface 2 is now bricked. If you want to be super sure that SecureBoot is off, run this cmdlet in PowerShell: Confirm-SecureBootUEFI
If it returns True, SecureBoot is still enabled.
I have an official Windows RT 8.1 recovery stick from Microsoft (but I also tried to make my own stick from the provided ZIP), but when I try to boot into Recovery (Volume Down + Power), I get the following error:
"A required device isn't connected or can't be accessed.
Error code: 0xc000000f"
When I just turn on the Surface, the boot fails, because the Windows 10 installation I flashed fails the SecureBoot test:
"The digital signature for this file couldn't be verified.
File:\Windows\system32\winload.efi
Error code: 0xc0000428"
Bloody hell, I was looking forward to having a more functional Surface and I ended up with a bricked one. Not sure what else can be done, when it refuses to boot even from official recovery stick :crying:
Click to expand...
Click to collapse
Hmmm... are the flash drives formatted to Fat32? I don’t really understand how applying an image could cause this much damage...
Do you get any options when you try to boot into 10? If you can find a way to get to the command line, you can restore a Windows RT image from the restore disk

Evandarkfire said:
I don’t really understand how applying an image could cause this much damage...
Click to expand...
Click to collapse
It's quite simple, really. The sole purpose of SecureBoot is to prevent booting of non-signed operating systems. Like this leaked Windows 10. And since I removed the recovery partition (containing command prompt, etc.), the device is now toast. And yes, the recovery sticks are FAT32.

Avonlady said:
It's quite simple, really. The sole purpose of SecureBoot is to prevent booting of non-signed operating systems. Like this leaked Windows 10. And since I removed the recovery partition (containing command prompt, etc.), the device is now toast. And yes, the recovery sticks are FAT32.
Click to expand...
Click to collapse
Are you sure you booted from usb stick? You should still be able to boot from usb. I broke my efs partition, but could still boot from usb stick and recover everything.

I have to ask and I'm sorry for sounding like a noob..... but will this tutorial work for a Microsoft surface 2 running 8.1rt? I saw theres another post that says windows rt but I'm confused...... also when one of the requirements is a keyboard does that mean a USB keyboard or can the type keyboard work?

Fix quirks
Quirks : at the moment I getting a paging file error at every login along with an expired version warning, if anyone knows how to get rid of those two things, that'd be very helpful, I'd update the tutorial and mention your help in here of course...
Click to expand...
Click to collapse
To solve the 2 quirks. For the page caching. Manually set the page cache to min 16 MB and max 512 MB.
For the Build is about the expire. Go to C:\Windows\System32. Find the file LicensingUI.exe. Take complete ownership. Then rename it to LicensingUI-old.exe (or anything).
That will prevent the popups from showing up

Anybody have a working adblocker for the included version of Edge? Also does anybody where to get one of the old UWP arm32 versions of Kodi? They've all been removed from the official servers. Other than that it's amazing, so much better than 8.1!

Avonlady said:
I would like to give a little warning to people following this guide - don't try to see what happens if you flash the Win10 WIM without having secure boot disabled. I just did that, and my Surface 2 is now bricked. If you want to be super sure that SecureBoot is off, run this cmdlet in PowerShell: Confirm-SecureBootUEFI
If it returns True, SecureBoot is still enabled.
I have an official Windows RT 8.1 recovery stick from Microsoft (but I also tried to make my own stick from the provided ZIP), but when I try to boot into Recovery (Volume Down + Power), I get the following error:
"A required device isn't connected or can't be accessed.
Error code: 0xc000000f"
When I just turn on the Surface, the boot fails, because the Windows 10 installation I flashed fails the SecureBoot test:
"The digital signature for this file couldn't be verified.
File:\Windows\system32\winload.efi
Error code: 0xc0000428"
Bloody hell, I was looking forward to having a more functional Surface and I ended up with a bricked one. Not sure what else can be done, when it refuses to boot even from official recovery stick :crying:
Click to expand...
Click to collapse
When I first attempted to flash win10 on my device I did not follow completely the chinese tutorial and therefore I had not disabled secureboot, the Tablet wouldn't boot but I could easily just reflash win8.1 from a recovery drive, your issue sure sounds weird my friend... I'm sadly not knowledgeable enough to help you solve this
Cnnrduncan said:
Anybody have a working adblocker for the included version of Edge? Also does anybody where to get one of the old UWP arm32 versions of Kodi? They've all been removed from the official servers. Other than that it's amazing, so much better than 8.1!
Click to expand...
Click to collapse
I'd love to find a working adblocker too, I really don't understand why ublock won't work, this kindof thing should be platform agnostic, how weird... Also we need to start a thread with a collection of usable software...
Edit: I've updated the tutorial and thanked the users who indicated us how to iron the quirks out, Win10 ARM32 bits on the surface 2 is now as usable as it can get, we just need to make a collection of useful apps and list them (find some and compile others) and everything will be as great as it can be...

Will this work if my surface 2 is running 8.1rt?
---------- Post added at 03:00 AM ---------- Previous post was at 02:57 AM ----------
AlGaib said:
When I first attempted to flash win10 on my device I did not follow completely the chinese tutorial and therefore I had not disabled secureboot, the Tablet wouldn't boot but I could easily just reflash win8.1 from a recovery drive, your issue sure sounds weird my friend... I'm sadly not knowledgeable enough to help you solve this
I'd love to find a working adblocker too, I really don't understand why ublock won't work, this kindof thing should be platform agnostic, how weird... Also we need to start a thread with a collection of usable software...
Edit: I've updated the tutorial and thanked the users who indicated us how to iron the quirks out, Win10 ARM32 bits on the surface 2 is now as usable as it can get, we just need to make a collection of useful apps and list them (find some and compile others) and everything will be as great as it can be...
Click to expand...
Click to collapse
Would there. E any possible way of making a video tutorial????
---------- Post added at 03:01 AM ---------- Previous post was at 03:00 AM ----------
AlGaib said:
When I first attempted to flash win10 on my device I did not follow completely the chinese tutorial and therefore I had not disabled secureboot, the Tablet wouldn't boot but I could easily just reflash win8.1 from a recovery drive, your issue sure sounds weird my friend... I'm sadly not knowledgeable enough to help you solve this
I'd love to find a working adblocker too, I really don't understand why ublock won't work, this kindof thing should be platform agnostic, how weird... Also we need to start a thread with a collection of usable software...
Edit: I've updated the tutorial and thanked the users who indicated us how to iron the quirks out, Win10 ARM32 bits on the surface 2 is now as usable as it can get, we just need to make a collection of useful apps and list them (find some and compile others) and everything will be as great as it can be...
Click to expand...
Click to collapse
Would there. E any possible way of making a video tutorial????

trollingwhovian said:
Will this work if my surface 2 is running 8.1rt?
---------- Post added at 03:00 AM ---------- Previous post was at 02:57 AM ----------
Would there. E any possible way of making a video tutorial????
---------- Post added at 03:01 AM ---------- Previous post was at 03:00 AM ----------
Would there. E any possible way of making a video tutorial????
Click to expand...
Click to collapse
I don't have time or the ressources to do that, sorry, also I don't wanna redo the whole thing again on my device just to make a video tutorial, the text one is good enough...