Related
Call PerformCallback4 failed. Error Number = 6. (The handle is invalid.)
But the handle of the cprog.exe process is right.
source code:
Code:
VOID
InjectDllToCprog()
{
WCHAR DllPath[MAX_PATH] = L"";
CallbackInfo ci;
GetModuleFileName(NULL, DllPath, MAX_PATH);
PWCHAR p = wcsrchr(DllPath, L'\\');
DllPath[p - DllPath] = '\0';
wcscat(DllPath, L"\\CprogInject.dll");
ZeroMemory(&ci, sizeof(ci));
g_hCprog = FindCprogProcess(L"Cprog.exe");
if(g_hCprog != NULL)
{
DWORD dwMode = SetKMode(TRUE);
DWORD dwPerm = SetProcPermissions(0xFFFFFFFF);
FARPROC pFunc = GetProcAddress(GetModuleHandle(L"Coredll.dll"), L"LoadLibraryW");
ci.ProcId = (HANDLE)g_hCprog;
ci.pFunc = (FARPROC)MapPtrToProcess(pFunc, g_hCprog);
ci.pvArg0 = MapPtrToProcess(DllPath, GetCurrentProcess());
g_InjectCprog = (HINSTANCE)PerformCallBack4(&ci, 0, 0, 0);
if(GetLastError() != 0)
DbgError(L"PerformCallBack 执行失败", GetLastError());
SetKMode(dwMode);
SetProcPermissions(dwPerm);
}
}
Anyone can help me?
Can someone throw some light on overclocking.
my friend told me that a CPU frequency can not be changed bcos u have to actually change the no. of oscillations per cycle.. which is not possible by coding.. so i have a question that all these overclocking are done on what basis?
Code:
static struct clkctl_acpu_speed acpu_freq_tbl_oc[] = {
{ {1, 1}, 192000, ACPU_PLL_8, 3, 1, 0, 0, L2(1), 800000, 0x03006000},
/* MAX_AXI row is used to source CPU cores and L2 from the AFAB clock. */
{ {0, 0}, MAX_AXI, ACPU_AFAB, 1, 0, 0, 0, L2(0), 825000, 0x03006000},
{ {1, 1}, 384000, ACPU_PLL_8, 3, 0, 0, 0, L2(1), 825000, 0x03006000},
{ {1, 1}, 432000, ACPU_SCPLL, 0, 0, 1, 0x08, L2(1), 850000, 0x03006000},
{ {1, 1}, 486000, ACPU_SCPLL, 0, 0, 1, 0x09, L2(2), 850000, 0x03006000},
{ {1, 1}, 540000, ACPU_SCPLL, 0, 0, 1, 0x0A, L2(3), 875000, 0x03006000},
{ {1, 1}, 594000, ACPU_SCPLL, 0, 0, 1, 0x0B, L2(4), 875000, 0x03006000},
{ {1, 1}, 648000, ACPU_SCPLL, 0, 0, 1, 0x0C, L2(5), 900000, 0x03006000},
{ {1, 1}, 702000, ACPU_SCPLL, 0, 0, 1, 0x0D, L2(6), 900000, 0x03006000},
{ {1, 1}, 756000, ACPU_SCPLL, 0, 0, 1, 0x0E, L2(7), 925000, 0x03006000},
{ {1, 1}, 810000, ACPU_SCPLL, 0, 0, 1, 0x0F, L2(8), 975000, 0x03006000},
{ {1, 1}, 864000, ACPU_SCPLL, 0, 0, 1, 0x10, L2(9), 975000, 0x03006000},
{ {1, 1}, 918000, ACPU_SCPLL, 0, 0, 1, 0x11, L2(10), 1000000, 0x03006000},
{ {1, 1}, 972000, ACPU_SCPLL, 0, 0, 1, 0x12, L2(11), 1025000, 0x03006000},
{ {1, 1}, 1026000, ACPU_SCPLL, 0, 0, 1, 0x13, L2(12), 1025000, 0x03006000},
{ {1, 1}, 1080000, ACPU_SCPLL, 0, 0, 1, 0x14, L2(13), 1050000, 0x03006000},
{ {1, 1}, 1134000, ACPU_SCPLL, 0, 0, 1, 0x15, L2(14), 1075000, 0x03006000},
{ {1, 1}, 1188000, ACPU_SCPLL, 0, 0, 1, 0x16, L2(15), 1100000, 0x03006000},
{ {1, 1}, 1242000, ACPU_SCPLL, 0, 0, 1, 0x17, L2(16), 1125000, 0x03006000},
{ {1, 1}, 1296000, ACPU_SCPLL, 0, 0, 1, 0x18, L2(17), 1150000, 0x03006000},
{ {1, 1}, 1350000, ACPU_SCPLL, 0, 0, 1, 0x19, L2(18), 1150000, 0x03006000},
{ {1, 1}, 1404000, ACPU_SCPLL, 0, 0, 1, 0x1A, L2(19), 1175000, 0x03006000},
{ {1, 1}, 1458000, ACPU_SCPLL, 0, 0, 1, 0x1B, L2(20), 1200000, 0x03006000},
{ {1, 1}, 1512000, ACPU_SCPLL, 0, 0, 1, 0x1C, L2(21), 1225000, 0x03006000},
{ {1, 1}, 1566000, ACPU_SCPLL, 0, 0, 1, 0x1D, L2(22), 1225000, 0x03006000},
{ {1, 1}, 1620000, ACPU_SCPLL, 0, 0, 1, 0x1E, L2(22), 1250000, 0x03006000},
{ {1, 1}, 1674000, ACPU_SCPLL, 0, 0, 1, 0x1F, L2(22), 1275000, 0x03006000},
{ {1, 1}, 1728000, ACPU_SCPLL, 0, 0, 1, 0x20, L2(22), 1300000, 0x03006000},
#ifdef CONFIG_OC_ULTIMATE
{ {1, 1}, 1782000, ACPU_SCPLL, 0, 0, 1, 0x21, L2(22), 1325000, 0x03006000},
{ {1, 1}, 1836000, ACPU_SCPLL, 0, 0, 1, 0x22, L2(22), 1337500, 0x03006000},
{ {1, 1}, 1890000, ACPU_SCPLL, 0, 0, 1, 0x23, L2(22), 1350000, 0x03006000},
{ {1, 1}, 1944000, ACPU_SCPLL, 0, 0, 1, 0x24, L2(22), 1362500, 0x03006000},
{ {1, 1}, 1998000, ACPU_SCPLL, 0, 0, 1, 0x25, L2(22), 1375000, 0x03006000},
{ {1, 1}, 2052000, ACPU_SCPLL, 0, 0, 1, 0x26, L2(22), 1400000, 0x03006000},
for eg. what are these numbers (384000) on the left side of the table? are these frequencies or what?
And pls can someone explain how actually overclocking is done?
@abcdjdj maybe you know something?
anikesh102 said:
Can someone throw some light on overclocking.
my friend told me that a CPU frequency can not be changed bcos u have to actually change the no. of oscillations per cycle.. which is not possible by coding.. so i have a question that all these overclocking are done on what basis?
Code:
static struct clkctl_acpu_speed acpu_freq_tbl_oc[] = {
{ {1, 1}, 192000, ACPU_PLL_8, 3, 1, 0, 0, L2(1), 800000, 0x03006000},
/* MAX_AXI row is used to source CPU cores and L2 from the AFAB clock. */
{ {0, 0}, MAX_AXI, ACPU_AFAB, 1, 0, 0, 0, L2(0), 825000, 0x03006000},
{ {1, 1}, 384000, ACPU_PLL_8, 3, 0, 0, 0, L2(1), 825000, 0x03006000},
{ {1, 1}, 432000, ACPU_SCPLL, 0, 0, 1, 0x08, L2(1), 850000, 0x03006000},
{ {1, 1}, 486000, ACPU_SCPLL, 0, 0, 1, 0x09, L2(2), 850000, 0x03006000},
{ {1, 1}, 540000, ACPU_SCPLL, 0, 0, 1, 0x0A, L2(3), 875000, 0x03006000},
{ {1, 1}, 594000, ACPU_SCPLL, 0, 0, 1, 0x0B, L2(4), 875000, 0x03006000},
{ {1, 1}, 648000, ACPU_SCPLL, 0, 0, 1, 0x0C, L2(5), 900000, 0x03006000},
{ {1, 1}, 702000, ACPU_SCPLL, 0, 0, 1, 0x0D, L2(6), 900000, 0x03006000},
{ {1, 1}, 756000, ACPU_SCPLL, 0, 0, 1, 0x0E, L2(7), 925000, 0x03006000},
{ {1, 1}, 810000, ACPU_SCPLL, 0, 0, 1, 0x0F, L2(8), 975000, 0x03006000},
{ {1, 1}, 864000, ACPU_SCPLL, 0, 0, 1, 0x10, L2(9), 975000, 0x03006000},
{ {1, 1}, 918000, ACPU_SCPLL, 0, 0, 1, 0x11, L2(10), 1000000, 0x03006000},
{ {1, 1}, 972000, ACPU_SCPLL, 0, 0, 1, 0x12, L2(11), 1025000, 0x03006000},
{ {1, 1}, 1026000, ACPU_SCPLL, 0, 0, 1, 0x13, L2(12), 1025000, 0x03006000},
{ {1, 1}, 1080000, ACPU_SCPLL, 0, 0, 1, 0x14, L2(13), 1050000, 0x03006000},
{ {1, 1}, 1134000, ACPU_SCPLL, 0, 0, 1, 0x15, L2(14), 1075000, 0x03006000},
{ {1, 1}, 1188000, ACPU_SCPLL, 0, 0, 1, 0x16, L2(15), 1100000, 0x03006000},
{ {1, 1}, 1242000, ACPU_SCPLL, 0, 0, 1, 0x17, L2(16), 1125000, 0x03006000},
{ {1, 1}, 1296000, ACPU_SCPLL, 0, 0, 1, 0x18, L2(17), 1150000, 0x03006000},
{ {1, 1}, 1350000, ACPU_SCPLL, 0, 0, 1, 0x19, L2(18), 1150000, 0x03006000},
{ {1, 1}, 1404000, ACPU_SCPLL, 0, 0, 1, 0x1A, L2(19), 1175000, 0x03006000},
{ {1, 1}, 1458000, ACPU_SCPLL, 0, 0, 1, 0x1B, L2(20), 1200000, 0x03006000},
{ {1, 1}, 1512000, ACPU_SCPLL, 0, 0, 1, 0x1C, L2(21), 1225000, 0x03006000},
{ {1, 1}, 1566000, ACPU_SCPLL, 0, 0, 1, 0x1D, L2(22), 1225000, 0x03006000},
{ {1, 1}, 1620000, ACPU_SCPLL, 0, 0, 1, 0x1E, L2(22), 1250000, 0x03006000},
{ {1, 1}, 1674000, ACPU_SCPLL, 0, 0, 1, 0x1F, L2(22), 1275000, 0x03006000},
{ {1, 1}, 1728000, ACPU_SCPLL, 0, 0, 1, 0x20, L2(22), 1300000, 0x03006000},
#ifdef CONFIG_OC_ULTIMATE
{ {1, 1}, 1782000, ACPU_SCPLL, 0, 0, 1, 0x21, L2(22), 1325000, 0x03006000},
{ {1, 1}, 1836000, ACPU_SCPLL, 0, 0, 1, 0x22, L2(22), 1337500, 0x03006000},
{ {1, 1}, 1890000, ACPU_SCPLL, 0, 0, 1, 0x23, L2(22), 1350000, 0x03006000},
{ {1, 1}, 1944000, ACPU_SCPLL, 0, 0, 1, 0x24, L2(22), 1362500, 0x03006000},
{ {1, 1}, 1998000, ACPU_SCPLL, 0, 0, 1, 0x25, L2(22), 1375000, 0x03006000},
{ {1, 1}, 2052000, ACPU_SCPLL, 0, 0, 1, 0x26, L2(22), 1400000, 0x03006000},
for eg. what are these numbers (384000) on the left side of the table? are these frequencies or what?
And pls can someone explain how actually overclocking is done?
@abcdjdj maybe you know something?
Click to expand...
Click to collapse
I don't know much about kernel programming but, yes those are the frequencies on the left side of the table. They are measured in kHz (kilo hertz). You must divide the number by 1000 to get the frequency in mHz and divide by 10^6 to get it in GHz. Usually overclocking means extending the array of structures along with the corresponding voltage values. But in our acpuclock-8x60.c file, there are multiple structures which have the frequency table and there is a function called :-
Code:
static __init struct clkctl_acpu_speed *select_freq_plan(void)
which decides which frequency table to chose. So basically there is a switch case block in that function which looks like this -
Code:
switch (pvs) {
case 0x0:
case 0x7:
acpu_freq_tbl =acpu_freq_tbl_1512mhz_slow;
pr_info("ACPU PVS: Slow\n");
break;
case 0x1:
acpu_freq_tbl = acpu_freq_tbl_1512mhz_nom;
pr_info("ACPU PVS: Nominal\n");
break;
case 0x3:
acpu_freq_tbl = acpu_freq_tbl_1512mhz_fast;
pr_info("ACPU PVS: Fast\n");
break;
default:
acpu_freq_tbl = acpu_freq_tbl_1512mhz_slow;
pr_warn("ACPU PVS: Unknown. Defaulting to slow.\n");
break;
}
Here depending on the variable pvs (unfortunately can't figure out what pvs is ), the frequency table is chosen. So we need to assign acpu_freq_table, the new overclocking structure which is acpu_freq_tbl_oc. Please do check out this commit too - https://github.com/deedwar/android_...mmit/d5520b9701591ecec2a3d4e43435bb7980cfea80
abcdjdj said:
I don't know much about kernel programming but, yes those are the frequencies on the left side of the table. They are measured in kHz (kilo hertz). You must divide the number by 1000 to get the frequency in mHz and divide by 10^6 to get it in GHz. Usually overclocking means extending the array of structures along with the corresponding voltage values. But in our acpuclock-8x60.c file, there are multiple structures which have the frequency table and there is a function called :-
Code:
static __init struct clkctl_acpu_speed *select_freq_plan(void)
which decides which frequency table to chose. So basically there is a switch case block in that function which looks like this -
Code:
switch (pvs) {
case 0x0:
case 0x7:
acpu_freq_tbl =acpu_freq_tbl_1512mhz_slow;
pr_info("ACPU PVS: Slow\n");
break;
case 0x1:
acpu_freq_tbl = acpu_freq_tbl_1512mhz_nom;
pr_info("ACPU PVS: Nominal\n");
break;
case 0x3:
acpu_freq_tbl = acpu_freq_tbl_1512mhz_fast;
pr_info("ACPU PVS: Fast\n");
break;
default:
acpu_freq_tbl = acpu_freq_tbl_1512mhz_slow;
pr_warn("ACPU PVS: Unknown. Defaulting to slow.\n");
break;
}
Here depending on the variable pvs (unfortunately can't figure out what pvs is ), the frequency table is chosen. So we need to assign acpu_freq_table, the new overclocking structure which is acpu_freq_tbl_oc. Please do check out this commit too - https://github.com/deedwar/android_...mmit/d5520b9701591ecec2a3d4e43435bb7980cfea80
Click to expand...
Click to collapse
Don't go into coding much... just tell me that the frequency of any CPU is fixed or not?
How does the frequency and oscillations work as the CPU load is increased?
anikesh102 said:
Don't go into coding much... just tell me that the frequency of any CPU is fixed or not?
How does the frequency and oscillations work as the CPU load is increased?
Click to expand...
Click to collapse
Very sorry to tell you but dude, without learning programming not much can be done. Anyway, kindly give me link to the sources which you are using. I need to check some files in the sources. The github link will do.
abcdjdj said:
Very sorry to tell you but dude, without learning programming not much can be done. Anyway, kindly give me link to the sources which you are using. I need to check some files in the sources. The github link will do.
Click to expand...
Click to collapse
https://github.com/DooMLoRD/android_kernel_sony_msm8660
It's DoomLord's github i m studying it for now.
anikesh102 said:
https://github.com/DooMLoRD/android_kernel_sony_msm8660
It's DoomLord's github i m studying it for now.
Click to expand...
Click to collapse
Well the overclocking commit was authored 9 months ago by Doom so the kernel has overclocking support. The CPU frequency scaling depends on the governor which you use. That's all I know about the cpu frequency scaling. You can check this guide for more info on the different governors - http://forum.xda-developers.com/showthread.php?t=1856256
I have a XT1789-04 on TMO and yesterday decided to go with LineageOS 16. I followed the instructions at https://wiki.lineageos.org/devices/nash/install
Anyway, I clearly messed something up, because after rebooting my phone never started up.
I am now in 9008 mode(?) with Qualcomm HS-USB QDLoader 9008 (COM10) in my device manager. After a bit of reading, this seemed pretty straightforward to fix with a blankflash.
Anyway, so far no luck. Device is detected, but the process keeps failing and printing "ReadFile() failed, GetLastError()=0" repeatedly.
If I use blankflash_oreo.zip, I also get "Unexpected command, expecting 3 or 18 or 4, got 1 instead."
My thoughts are that I need a Pie blankflash considering I just flashed LineageOS 16? Either that or my phone's somehow permascrewed.
I have tried two Windows 10 computers with various USB 2.0 and 3.0 ports.
Any help would be appreciated!
Flashing most Z2 Force blankflashes does this:
Code:
[ -0.000] Opening device: \\.\COM10
[ 0.001] Detecting device
[ 2.590] ReadFile() failed, GetLastError()=0
[ 3.155] ...cpu.id = 94 (0x5e)
[ 3.155] ...cpu.sn = 830812879 (0x318532cf)
[ 3.155] Opening singleimage
[ 3.156] Loading package
[ 3.160] ...filename = pkg.xml
[ 3.163] Loading programmer
[ 3.164] ...filename = programmer.elf
[ 3.165] Sending programmer
[ 3.323] Handling things over to programmer
[ 3.324] Identifying CPU version
[ 3.324] Waiting for firehose to get ready
[ 34.704] ReadFile() failed, GetLastError()=0
[ 50.778] ReadFile() failed, GetLastError()=0
[ 66.852] ReadFile() failed, GetLastError()=0
[ 78.432] Waiting for firehose to get ready
[ 82.927] ReadFile() failed, GetLastError()=0
[ 98.996] ReadFile() failed, GetLastError()=0
[115.068] ReadFile() failed, GetLastError()=0
[131.141] ReadFile() failed, GetLastError()=0
[142.618] ...MSM8998 unknown
[142.618] Determining target secure state
[142.618] Waiting for firehose to get ready
[147.215] ReadFile() failed, GetLastError()=0
[163.291] ReadFile() failed, GetLastError()=0
[179.370] ReadFile() failed, GetLastError()=0
[195.442] ReadFile() failed, GetLastError()=0
[259.719] ReadFile() failed, GetLastError()=0
[271.209] ...secure = no
[271.286] Initializing storage
[271.288] Waiting for firehose to get ready
[275.787] ReadFile() failed, GetLastError()=0
[291.856] ReadFile() failed, GetLastError()=0
[307.928] ReadFile() failed, GetLastError()=0
[323.999] ReadFile() failed, GetLastError()=0
[335.482] Configuring device...
[335.482] Waiting for firehose to get ready
[340.068] ReadFile() failed, GetLastError()=0
[356.139] ReadFile() failed, GetLastError()=0
[372.206] ReadFile() failed, GetLastError()=0
[388.277] ReadFile() failed, GetLastError()=0
[399.835] Waiting for firehose to get ready
[404.346] ReadFile() failed, GetLastError()=0
[420.418] ReadFile() failed, GetLastError()=0
[436.491] ReadFile() failed, GetLastError()=0
[452.561] ReadFile() failed, GetLastError()=0
[464.128] Waiting for firehose to get ready
[468.632] ReadFile() failed, GetLastError()=0
[484.708] ReadFile() failed, GetLastError()=0
[500.778] ReadFile() failed, GetLastError()=0
[516.849] ReadFile() failed, GetLastError()=0
[528.327] Waiting for firehose to get ready
[532.919] ReadFile() failed, GetLastError()=0
[548.992] ReadFile() failed, GetLastError()=0
[565.065] ReadFile() failed, GetLastError()=0
[581.138] ReadFile() failed, GetLastError()=0
[592.701] Initializing storage
[592.703] Waiting for firehose to get ready
[597.213] ReadFile() failed, GetLastError()=0
[613.284] ReadFile() failed, GetLastError()=0
[629.356] ReadFile() failed, GetLastError()=0
[645.429] ReadFile() failed, GetLastError()=0
[656.979] Configuring device...
[656.979] Waiting for firehose to get ready
[661.502] ReadFile() failed, GetLastError()=0
[677.573] ReadFile() failed, GetLastError()=0
[693.648] ReadFile() failed, GetLastError()=0
[709.720] ReadFile() failed, GetLastError()=0
[721.202] Waiting for firehose to get ready
[725.793] ReadFile() failed, GetLastError()=0
[741.865] ReadFile() failed, GetLastError()=0
[757.942] ReadFile() failed, GetLastError()=0
[774.018] ReadFile() failed, GetLastError()=0
[785.502] Waiting for firehose to get ready
[790.094] ReadFile() failed, GetLastError()=0
[806.169] ReadFile() failed, GetLastError()=0
[822.242] ReadFile() failed, GetLastError()=0
[838.312] ReadFile() failed, GetLastError()=0
[849.858] Waiting for firehose to get ready
[854.382] ReadFile() failed, GetLastError()=0
[870.451] ReadFile() failed, GetLastError()=0
[886.522] ReadFile() failed, GetLastError()=0
[902.592] ReadFile() failed, GetLastError()=0
[914.145] Waiting for firehose to get ready
[918.662] ReadFile() failed, GetLastError()=0
[934.733] ReadFile() failed, GetLastError()=0
[950.805] ReadFile() failed, GetLastError()=0
[966.880] ReadFile() failed, GetLastError()=0
[978.357] Configuring device...
[978.357] Waiting for firehose to get ready
[982.951] ReadFile() failed, GetLastError()=0
[999.019] ReadFile() failed, GetLastError()=0
[1015.089] ReadFile() failed, GetLastError()=0
[1031.160] ReadFile() failed, GetLastError()=0
[1042.637] Waiting for firehose to get ready
[1047.230] ReadFile() failed, GetLastError()=0
[1063.303] ReadFile() failed, GetLastError()=0
[1079.378] ReadFile() failed, GetLastError()=0
[1095.454] ReadFile() failed, GetLastError()=0
[1107.020] Waiting for firehose to get ready
[1111.526] ReadFile() failed, GetLastError()=0
[1127.610] ReadFile() failed, GetLastError()=0
[1143.668] ReadFile() failed, GetLastError()=0
[1159.737] ReadFile() failed, GetLastError()=0
[1171.214] Waiting for firehose to get ready
[1175.804] ReadFile() failed, GetLastError()=0
[1191.876] ReadFile() failed, GetLastError()=0
[1207.953] ReadFile() failed, GetLastError()=0
[1224.013] ReadFile() failed, GetLastError()=0
[1235.571] ERROR: do_package()->do_recipe()->do_configure()->fh_send()->get_fh()->no response
[1235.571] Check qboot_log.txt for more details
[1235.573] Total time: 1235.575s
[1235.574] There were some hiccups in backup and restore.
[1235.574] Please save the following files and see a Bootloader member.
[1235.575] 1) ./qboot_log.txt
[1235.575] 2) ./backup_0x318532CF_2019-09-03_191355.img
[1235.575]
[1235.576]
[1235.576] qboot version 3.86
[1235.576]
[1235.576] DEVICE {
[1235.576] name = "\\.\COM10",
[1235.576] flags = "0x64",
[1235.576] addr = "0x62FD54",
[1235.576] sahara.current_mode = "0",
[1235.576] api.buffer = "0x2AFD020",
[1235.576] cpu.serial = "830812879",
[1235.576] cpu.id = "94",
[1235.576] cpu.sv_sbl = "0",
[1235.576] cpu.name = "MSM8998",
[1235.576] storage.type = "UFS",
[1235.576] sahara.programmer = "programmer.elf",
[1235.576] module.firehose = "0x748D00",
[1235.576] cpu.ver = "0",
[1235.576] cpu.vername = "unknown",
[1235.576] api.bnr = "0x2A406D8",
[1235.576] }
[1235.576]
[1235.576]
[1235.576] Backup & Restore {
[1235.576] num_entries = 32,
[1235.576] restoring = "false",
[1235.576] restore_error = "not started",
[1235.576] entries[00] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cid"},
[1235.576] entries[01] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="frp"},
[1235.576] entries[02] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="hw"},
[1235.576] entries[03] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="misc"},
[1235.576] entries[04] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="persist"},
[1235.576] entries[05] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="utags"},
[1235.576] entries[06] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="devinfo"},
[1235.576] entries[07] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="sp"},
[1235.576] entries[08] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="abl_a"},
[1235.576] entries[09] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib_a"},
[1235.576] entries[10] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib64_a"},
[1235.576] entries[11] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="devcfg_a"},
[1235.576] entries[12] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="hyp_a"},
[1235.576] entries[13] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="keymaster_a"},
[1235.576] entries[14] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="tz_a"},
[1235.576] entries[15] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="storsec_a"},
[1235.576] entries[16] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="prov_a"},
[1235.576] entries[17] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="rpm_a"},
[1235.576] entries[18] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="pmic_a"},
[1235.576] entries[19] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="xbl_a"},
[1235.576] entries[20] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="abl_b"},
[1235.576] entries[21] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib_b"},
[1235.576] entries[22] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib64_b"},
[1235.576] entries[23] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="devcfg_b"},
[1235.576] entries[24] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="hyp_b"},
[1235.576] entries[25] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="keymaster_b"},
[1235.576] entries[26] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="tz_b"},
[1235.576] entries[27] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="storsec_b"},
[1235.576] entries[28] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="prov_b"},
[1235.576] entries[29] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="rpm_b"},
[1235.576] entries[30] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="pmic_b"},
[1235.576] entries[31] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="xbl_b"},
[1235.576] simg = {
[1235.576] filename = "backup_0x318532CF_2019-09-03_191355.img",
[1235.576] entries[00] = { size = 558096, name = "programmer.elf" },
[1235.576] }
[1235.576] }
[1235.576]
Flashing blankflash_oreo.zip gives this:
Code:
[ 0.000] Opening device: \\.\COM10
[ 0.001] Detecting device
[ 10.584] ReadFile() failed, GetLastError()=0
[ 26.656] ReadFile() failed, GetLastError()=0
[ 27.215] ...cpu.id = 94 (0x5e)
[ 27.216] ...cpu.sn = 830812879 (0x318532cf)
[ 27.219] Opening singleimage
[ 27.261] Loading package
[ 27.263] ...filename = pkg.xml
[ 27.265] Loading programmer
[ 27.265] ...filename = programmer.elf
[ 27.265] Sending programmer
[ 27.338] ReadFile() failed, GetLastError()=0
[ 27.591] Unexpected command, expecting 3 or 18 or 4, got 1 instead.
[ 27.595] ERROR: sahara_download()->general error
[ 27.596] Check qboot_log.txt for more details
[ 27.598] Total time: 27.599s
[ 27.605]
[ 27.605] qboot version 3.86
[ 27.605]
[ 27.605] DEVICE {
[ 27.605] name = "\\.\COM10",
[ 27.605] flags = "0x64",
[ 27.605] addr = "0x62FD54",
[ 27.605] sahara.current_mode = "0",
[ 27.605] api.buffer = "0x2A1F020",
[ 27.605] cpu.serial = "830812879",
[ 27.605] cpu.id = "94",
[ 27.605] cpu.sv_sbl = "0",
[ 27.605] cpu.name = "MSM8998",
[ 27.605] storage.type = "UFS",
[ 27.605] sahara.programmer = "programmer.elf",
[ 27.605] api.bnr = "0x2951CA0",
[ 27.605] }
[ 27.605]
[ 27.605]
[ 27.605] Backup & Restore {
[ 27.605] num_entries = 0,
[ 27.605] restoring = "false",
[ 27.605] backup_error = "not started",
[ 27.605] restore_error = "not started",
[ 27.605] }
[ 27.605]
And if I flash a known wrong blankflash, i.e. a Moto G one (just trying anything now!):
Code:
[ 0.000] Opening device: \\.\COM10
[ 0.001] Detecting device
[ 27.016] ReadFile() failed, GetLastError()=0
[ 27.579] ...cpu.id = 94 (0x5e)
[ 27.584] ...cpu.sn = 830812879 (0x318532cf)
[ 27.592] Opening singleimage
[ 27.611] Loading package
[ 27.625] Failed identify board. Wrong package?
[ 27.629] ERROR: error loading package
[ 27.634] Check qboot_log.txt for more details
[ 27.645] Total time: 27.647s
[ 27.653]
[ 27.653] qboot version 3.86
[ 27.653]
[ 27.653] DEVICE {
[ 27.653] name = "\\.\COM10",
[ 27.653] flags = "0x64",
[ 27.653] addr = "0x62FD54",
[ 27.653] sahara.current_mode = "3",
[ 27.653] api.buffer = "0x29F3020",
[ 27.653] cpu.serial = "830812879",
[ 27.653] cpu.id = "94",
[ 27.653] cpu.sv_sbl = "0",
[ 27.653] api.bnr = "0x2931CA8",
[ 27.653] }
[ 27.653]
[ 27.653]
[ 27.653] Backup & Restore {
[ 27.653] num_entries = 0,
[ 27.653] restoring = "false",
[ 27.653] backup_error = "not started",
[ 27.653] restore_error = "not started",
[ 27.653] }
[ 27.653]
Use the blankflash from this post, and a win7 machine if you can. Win10 is funky and I can't offer advise on it. I don't use it. The drivers in the linked post are win signed, so no need to special boot or disable driver signing. In win10 I believe you need to set permissions on the blankflash files, idk, someone else might,
https://forum.xda-developers.com/showpost.php?p=77623934&postcount=5
41rw4lk said:
Use the blankflash from this post, and a win7 machine if you can. Win10 is funky and I can't offer advise on it. I don't use it. The drivers in the linked post are win signed, so no need to special boot or disable driver signing. In win10 I believe you need to set permissions on the blankflash files, idk, someone else might,
https://forum.xda-developers.com/showpost.php?p=77623934&postcount=5
Click to expand...
Click to collapse
I used this exact Nougat blankflash on a device last night and it went through without a hitch. All of the Oreo blankflash files have never worked for me except for one time. The one time it worked for me the flash still failed but it did something that allowed me to recover with a flash-all I created.
Sent from my Samsung SM-G955U using XDA Labs
Thanks for the advice! Unfortunately that blankflash gives the same as my first error message
I don't have access to Windows 7 but gave it a go on Ubuntu. It still fails, but the message is slightly different.
"serial_write(), line 280: Input/output error"
My guess is it's the same error that I get on Windows, but just printed differently by the linux version of qboot.
Code:
[ 0.000] Opening device: /dev/ttyUSB0
[ 0.000] Detecting device
[ 0.004] ...cpu.id = 94 (0x5e)
[ 0.004] ...cpu.sn = 830812879 (0x318532cf)
[ 0.004] Opening singleimage
[ 0.004] Loading package
[ 0.006] ...filename = pkg.xml
[ 0.007] Loading programmer
[ 0.007] ...filename = programmer.elf
[ 0.007] Sending programmer
[ 0.164] Handling things over to programmer
[ 0.164] Identifying CPU version
[ 0.169] Waiting for firehose to get ready
[ 3.169] serial_write(), line 280: Input/output error
[ 63.772] Waiting for firehose to get ready
[ 66.773] serial_write(), line 280: Input/output error
[128.090] ...MSM8998 unknown
[128.090] Determining target secure state
[128.095] Waiting for firehose to get ready
[131.096] serial_write(), line 280: Input/output error
[192.162] ...secure = no
[192.216] Initializing storage
[192.218] Waiting for firehose to get ready
[195.219] serial_write(), line 280: Input/output error
[256.558] Configuring device...
[256.564] Waiting for firehose to get ready
[259.565] serial_write(), line 280: Input/output error
[320.882] Waiting for firehose to get ready
[323.882] serial_write(), line 280: Input/output error
[384.951] Waiting for firehose to get ready
[387.951] serial_write(), line 280: Input/output error
[449.343] Waiting for firehose to get ready
[452.343] serial_write(), line 280: Input/output error
[513.657] Initializing storage
[513.666] Waiting for firehose to get ready
[516.666] serial_write(), line 280: Input/output error
[577.697] Configuring device...
[577.702] Waiting for firehose to get ready
[580.702] serial_write(), line 280: Input/output error
[642.049] Waiting for firehose to get ready
[645.049] serial_write(), line 280: Input/output error
[706.344] Waiting for firehose to get ready
[709.344] serial_write(), line 280: Input/output error
[770.378] Waiting for firehose to get ready
[773.378] serial_write(), line 280: Input/output error
[834.666] Waiting for firehose to get ready
[837.666] serial_write(), line 280: Input/output error
[898.816] Configuring device...
[898.822] Waiting for firehose to get ready
[901.823] serial_write(), line 280: Input/output error
[962.859] Waiting for firehose to get ready
[965.859] serial_write(), line 280: Input/output error
[1027.194] Waiting for firehose to get ready
[1030.194] serial_write(), line 280: Input/output error
[1091.484] Waiting for firehose to get ready
[1094.484] serial_write(), line 280: Input/output error
[1155.507] ERROR: do_package()->do_recipe()->do_configure()->get_fh()->no response
[1155.507] Check qboot_log.txt for more details
[1155.507] Total time: 1155.507s
[1155.507] There were some hiccups in backup and restore.
[1155.507] Please save the following files and see a Bootloader member.
[1155.507] 1) ./qboot_log.txt
[1155.507] 2) ./backup_0x318532CF_2019-09-04_124029.img
[1155.507]
[1155.507]
[1155.507] qboot version 3.85
[1155.507]
[1155.507] DEVICE {
[1155.507] name = "/dev/ttyUSB0",
[1155.507] flags = "0x60",
[1155.507] addr = "0xE2213560",
[1155.507] serial_nix.device_pathname = "/sys/bus/usb/devices/2-1.2/2-1.2:1.0/ttyUSB0",
[1155.507] sahara.current_mode = "0",
[1155.507] api.buffer = "0x7F4FDBAB9010",
[1155.507] cpu.serial = "830812879",
[1155.507] cpu.id = "94",
[1155.507] cpu.sv_sbl = "0",
[1155.507] cpu.name = "MSM8998",
[1155.507] storage.type = "UFS",
[1155.507] sahara.programmer = "programmer.elf",
[1155.507] module.firehose = "0x1327DF0",
[1155.507] cpu.ver = "0",
[1155.507] cpu.vername = "unknown",
[1155.507] api.bnr = "0x1334DD0",
[1155.507] }
[1155.507]
[1155.507]
[1155.507] Backup & Restore {
[1155.507] num_entries = 31,
[1155.507] restoring = "false",
[1155.507] restore_error = "not started",
[1155.507] entries[00] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cid"},
[1155.507] entries[01] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="frp"},
[1155.507] entries[02] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="hw"},
[1155.507] entries[03] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="misc"},
[1155.507] entries[04] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="persist"},
[1155.507] entries[05] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="utags"},
[1155.507] entries[06] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="devinfo"},
[1155.507] entries[07] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="abl_a"},
[1155.507] entries[08] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib_a"},
[1155.507] entries[09] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib64_a"},
[1155.507] entries[10] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="devcfg_a"},
[1155.507] entries[11] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="hyp_a"},
[1155.507] entries[12] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="keymaster_a"},
[1155.507] entries[13] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="tz_a"},
[1155.507] entries[14] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="storsec_a"},
[1155.507] entries[15] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="prov_a"},
[1155.507] entries[16] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="rpm_a"},
[1155.507] entries[17] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="pmic_a"},
[1155.507] entries[18] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="xbl_a"},
[1155.507] entries[19] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="abl_b"},
[1155.507] entries[20] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib_b"},
[1155.507] entries[21] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib64_b"},
[1155.507] entries[22] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="devcfg_b"},
[1155.507] entries[23] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="hyp_b"},
[1155.507] entries[24] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="keymaster_b"},
[1155.507] entries[25] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="tz_b"},
[1155.507] entries[26] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="storsec_b"},
[1155.507] entries[27] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="prov_b"},
[1155.507] entries[28] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="rpm_b"},
[1155.507] entries[29] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="pmic_b"},
[1155.507] entries[30] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="xbl_b"},
[1155.507] simg = {
[1155.507] filename = "backup_0x318532CF_2019-09-04_124029.img",
[1155.507] entries[00] = { size = 557888, name = "programmer.elf" },
[1155.507] }
[1155.507] }
[1155.507]
aydun said:
Thanks for the advice! Unfortunately that blankflash gives the same as my first error message
Hi aydun. Any luck finding a fix or working blankflash. I am in the same situation. My XT1789-04 hard bricked. I believe I bricked it after multiple failed login attempts (fingerprint).
I get the same results as in your OP when I use blankflash_from_NDX26.183-15_17
Click to expand...
Click to collapse
lobbybee said:
Any luck finding a fix or working blankflash.
Click to expand...
Click to collapse
Unfortunately not. No luck with any available blankflashes. Pretty sure a Pie blankflash is the only solution.
holyheck I got it.
I bought a new phone ages back so had just been giving this a retry on the odd occasion because it saddened me having a dead Z2. But never with any luck.
But today I tried with success!
So same as usual. I'd get "Detecting device" for 30 secs and then "ERROR: sahara_greet_device()->change_mode()->do_hello()->IO error"
This time I ran the command, plugged in my phone, and then on "Detecting device" unplugged and replugged. Nearly instantly things happened. Success!
Just a few extra details about my environment (basically unchanged from my OP), although I think the main thing was the unplug/replug:
Windows 10, latest Qualcomm driver from device update. Front USB 2.0 port. Nintendo Switch USB cable. This blankflash.
It said booting to Fastboot and after a while had a big white square with a battery charging. I couldn't detect it with fastboot, but it was pretty flat so charging it now and we'll see if anything comes of it. Still, pretty neat either way.
This guide aims to recover your G7 power from a hard brick that leaves it in emergency download (EDL) mode.
Will this work with my device?
This should work on any device in EDL mode. To check for this mode, first try entering fastboot by holding the power button and volume down at the same time. If the screen comes on, use this guide instead.
If your device can't enter fastboot, connect it to a computer using it's USB-c cable, and open device manager using the search bar. Scroll down to "Ports" and open it, then look for a device called "qualcomm hs-usb qdloader 9008". if it appears, you might just be in luck.
The fix
Recovering from this brick is quite a simple process, as a blank flash is available.
Connect your device to a computer
Download blankflash.zip from https://mega.nz/#!tVd1VaoZ!epk2yLEqnQBKEwT2QbQaOe8-4675pfj76Hs7pC5kbQE onto your computer, and extract it to it's own folder
Run "blank-flash.bat", and wait for it to finish
If you receive an error message like "ERROR: sahara_greet_device()->change_mode()->do_hello()->IO error" on your computer, try holding the power button on your phone for about 10 seconds and trying again, or unplug and reconnect your phone.
After Running blank-flash.bat
From here, your phone should be able to start. If it enters recovery mode, boot loops or has other problems, but CAN now boot, follow this guide to reset your phone to stock, or you can use Lenovo smart assistant's recovery option.
Thanks to ChampC for finding the blankflash to make this recovery possible.
sluggedlemon said:
This guide aims to recover your G7 power from a hard brick that leaves it in emergency download (EDL) mode.
Will this work with my device?
This should work on any device in EDL mode. To check for this mode, first try entering fastboot by holding the power button and volume down at the same time. If the screen comes on, use this guide instead.
If your device can't enter fastboot, connect it to a computer using it's USB-c cable, and open device manager using the search bar. Scroll down to "Ports" and open it, then look for a device called "qualcomm hs-usb qdloader 9008". if it appears, you might just be in luck.
The fix
Recovering from this brick is quite simple, as a blank flash is available.
Connect your device to a computer
Download blankflash.zip from https://mega.nz/#!5NtCia6a!epk2yLEqn...fj76Hs7pC5kbQE onto your computer, and extract it to it's own folder
Run "blank-flash.bat", and wait for it to finish
If you receive an error message like "ERROR: sahara_greet_device()->change_mode()->do_hello()->IO error" on your computer, try holding the power button on your phone for about 10 seconds and trying again, or unplug and reconnect your phone.
After Running blank-flash.bat
From here, your phone should be able to start. If it enters recovery mode, boot loops or has other problems, but CAN now boot, follow this guide to reset your phone to stock, or you can use Lenovo smart assistant's recovery option.
Thanks to ChampC for finding the blankflash to make this recovery possible.
Click to expand...
Click to collapse
Thank
Work XT1955-4.
:fingers-crossed::fingers-crossed::fingers-crossed:
Decryption Key
sluggedlemon said:
This guide aims to recover your G7 power from a hard brick that leaves it in emergency download (EDL) mode.
Will this work with my device?
This should work on any device in EDL mode. To check for this mode, first try entering fastboot by holding the power button and volume down at the same time. If the screen comes on, use this guide instead.
If your device can't enter fastboot, connect it to a computer using it's USB-c cable, and open device manager using the search bar. Scroll down to "Ports" and open it, then look for a device called "qualcomm hs-usb qdloader 9008". if it appears, you might just be in luck.
The fix
Recovering from this brick is quite simple, as a blank flash is available.
Connect your device to a computer
Download blankflash.zip from https://mega.nz/#!5NtCia6a!epk2yLEqn...fj76Hs7pC5kbQE onto your computer, and extract it to it's own folder
Run "blank-flash.bat", and wait for it to finish
If you receive an error message like "ERROR: sahara_greet_device()->change_mode()->do_hello()->IO error" on your computer, try holding the power button on your phone for about 10 seconds and trying again, or unplug and reconnect your phone.
After Running blank-flash.bat
From here, your phone should be able to start. If it enters recovery mode, boot loops or has other problems, but CAN now boot, follow this guide to reset your phone to stock, or you can use Lenovo smart assistant's recovery option.
Thanks to ChampC for finding the blankflash to make this recovery possible.
Click to expand...
Click to collapse
What's the decyption key to download the file?
Romathon said:
What's the decyption key to download the file?
Click to expand...
Click to collapse
https://mega.nz/#!PHRD1KhI!epk2yLEqnQBKEwT2QbQaOe8-4675pfj76Hs7pC5kbQE
Sent from my Moto E (4) using Tapatalk
Romathon said:
What's the decyption key to download the file?
Click to expand...
Click to collapse
Seems like there was a problem with the link. Not sure why, as it should have been identical to the one I used to download it, but either way it's fixed now.
sluggedlemon said:
This guide aims to recover your G7 power from a hard brick that leaves it in emergency download (EDL) mode.
Will this work with my device?
This should work on any device in EDL mode. To check for this mode, first try entering fastboot by holding the power button and volume down at the same time. If the screen comes on, use this guide instead.
If your device can't enter fastboot, connect it to a computer using it's USB-c cable, and open device manager using the search bar. Scroll down to "Ports" and open it, then look for a device called "qualcomm hs-usb qdloader 9008". if it appears, you might just be in luck.
The fix
Recovering from this brick is quite simple, as a blank flash is available.
Connect your device to a computer
Download blankflash.zip from https://mega.nz/#!tVd1VaoZ!epk2yLEqnQBKEwT2QbQaOe8-4675pfj76Hs7pC5kbQE onto your computer, and extract it to it's own folder
Run "blank-flash.bat", and wait for it to finish
If you receive an error message like "ERROR: sahara_greet_device()->change_mode()->do_hello()->IO error" on your computer, try holding the power button on your phone for about 10 seconds and trying again, or unplug and reconnect your phone.
After Running blank-flash.bat
From here, your phone should be able to start. If it enters recovery mode, boot loops or has other problems, but CAN now boot, follow this guide to reset your phone to stock, or you can use Lenovo smart assistant's recovery option.
Thanks to ChampC for finding the blankflash to make this recovery possible.
Click to expand...
Click to collapse
Another sucessfull resurrection of an 1955-4 Thanks a lot!!! You saved my life... i mean phone
Saved my phone.
Man....I never thought the universe would align for me to
A. Have my phone back after a failed TWRP flash. (Which in ten years I've never bricked a phone.) Thank you so very much for providing the blank flash needed to fix my phone. and B. I mounted a new tire to a rim I had to buy because mine was cracked so my car is also saved.
So thank you. So very very much.
p.s thanks for fixing the download link as well.
EDIT: I'm currently stuck here. This is what I get in the qboot_log:
**** Log buffer [000001] 2019-10-31_05:53:29 ****
[ 0.000] Opening device: \\.\COM3
[ 0.001] Detecting device
[ 4.004] ERROR: sahara_greet_device()->change_mode()->do_hello()->IO error
[ 4.004] Check qboot_log.txt for more details
[ 4.004] Total time: 4.005s
[ 4.004]
[ 4.004] qboot version 3.40
[ 4.004]
[ 4.004] DEVICE {
[ 4.004] name = "\\.\COM3",
[ 4.004] flags = "0x64",
[ 4.004] addr = "0x61FE4C",
[ 4.004] api.bnr = "0xF92F20",
[ 4.004] }
[ 4.004]
[ 4.004]
[ 4.004] Backup & Restore {
[ 4.004] num_entries = 0,
[ 4.004] restoring = "false",
[ 4.004] backup_error = "not started",
[ 4.004] restore_error = "not started",
[ 4.004] }
[ 4.004]
disobey said:
EDIT: I'm currently stuck here. This is what I get in the qboot_log:
**** Log buffer [000001] 2019-10-31_05:53:29 ****
[ 0.000] Opening device: \\.\COM3
[ 0.001] Detecting device
[ 4.004] ERROR: sahara_greet_device()->change_mode()->do_hello()->IO error
[ 4.004] Check qboot_log.txt for more details
[ 4.004] Total time: 4.005s
[ 4.004]
[ 4.004] qboot version 3.40
[ 4.004]
[ 4.004] DEVICE {
[ 4.004] name = "\\.\COM3",
[ 4.004] flags = "0x64",
[ 4.004] addr = "0x61FE4C",
[ 4.004] api.bnr = "0xF92F20",
[ 4.004] }
[ 4.004]
[ 4.004]
[ 4.004] Backup & Restore {
[ 4.004] num_entries = 0,
[ 4.004] restoring = "false",
[ 4.004] backup_error = "not started",
[ 4.004] restore_error = "not started",
[ 4.004] }
[ 4.004]
Click to expand...
Click to collapse
Blankflashes can be temperamental, try disconnecting your phone and holding the power button for 10 seconds to make sure it's off before retrying. I've also heard it can help if you run it quickly after reconnecting it, but I've never needed to.
-ps: sorry for not responding earlier
Hi, does this blank flash flash the bootloader from the unlocked varient so that I can flash the factory image from the unlocked version and relock the bootloader without loading a carrier bootloader?
gigawatt said:
Hi, does this blank flash flash the bootloader from the unlocked varient so that I can flash the factory image from the unlocked version and relock the bootloader without loading a carrier bootloader?
Click to expand...
Click to collapse
I believe that this is the unlocked version, but I don't have experience unlocking phones so I'm not sure if it's what you need.
Thank you in advance
Kindly need help with my phone since I tried for almost 5 hours (google/softwares/threads), but still no success.
I tried installing lineageos and I got a bootloop so silly me wiped everything in twrp and formatted data hoping to repeat the steps all over again and make it work. Now, I'm stuck in fastboot mode (no android logo on top), oem_locked, and barcode IMEI shows zeros. PS Fastboot commands won't work and it gives me (permission denied) every time. When I turn off the phone and plug the cable, fastboot mode comes up right in.
any idea whats going here, or any help with the matter is really appreciated
fawazed said:
Kindly need help with my phone since I tried for almost 5 hours (google/softwares/threads), but still no success.
I tried installing lineageos and I got a bootloop so silly me wiped everything in twrp and formatted data hoping to repeat the steps all over again and make it work. Now, I'm stuck in fastboot mode (no android logo on top), oem_locked, and barcode IMEI shows zeros. PS Fastboot commands won't work and it gives me (permission denied) every time. When I turn off the phone and plug the cable, fastboot mode comes up right in.
any idea whats going here, or any help with the matter is really appreciated
Click to expand...
Click to collapse
Try
Code:
fastboot oem blankflash
That should put the device into
Emergency download mode
Then you can follow instructions in post #1
Sent from my mata using XDA Labs
sd_shadow said:
Try
That should put the device into
Emergency download mode
Then you can follow instructions in post #1
Click to expand...
Click to collapse
Okay, will try that.. thank you :good:
sd_shadow said:
Try
Code:
fastboot oem blankflash
That should put the device into
Emergency download mode
Then you can follow instructions in post #1
Sent from my mata using XDA Labs
Click to expand...
Click to collapse
Thank you it worked now .. much appreciated :victory::good:
For those who might face issue of getting stuck on "waiting for devices" when running the bat file, try updating the moto/qualcomm drivers, and choosing the drivers manually in Device Manager.
Hey, thanks for the guide, but i'm currently stuck here :/
[ -0.000] Opening device: \\.\COM7
[ 0.001] Detecting device
[ 0.004] ...cpu.id = 186 (0xba)
[ 0.004] ...cpu.sn = 3785115971 (0xe19c4943)
[ 0.005] Opening singleimage
[ 0.006] Loading package
[ 0.009] ...filename = singleimage.pkg.xml
[ 0.011] Loading programmer
[ 0.012] ...filename = programmer.mbn
[ 0.012] Sending programmer
[ 0.299] Handling things over to programmer
[ 0.300] Identifying CPU version
[ 0.306] Waiting for firehose to get ready
[ 15.977] ReadFile() failed, GetLastError()=0
[ 15.977] ReadFile() failed, GetLastError()=0
[ 46.784] ReadFile() failed, GetLastError()=0
[ 46.785] ReadFile() failed, GetLastError()=0
[ 60.688] Waiting for firehose to get ready
[ 77.568] ReadFile() failed, GetLastError()=0
[ 77.569] ReadFile() failed, GetLastError()=0
[108.332] ReadFile() failed, GetLastError()=0
[108.332] ReadFile() failed, GetLastError()=0
[122.234] ...MSM8953 unknown
[122.234] Determining target secure state
[122.237] Waiting for firehose to get ready
[139.079] ReadFile() failed, GetLastError()=0
[139.080] ReadFile() failed, GetLastError()=0
[183.065] ...secure = no
[183.128] Initializing storage
[183.132] Waiting for firehose to get ready
[243.246] Configuring device...
[243.252] Waiting for firehose to get ready
[303.367] Waiting for firehose to get ready
[363.491] Waiting for firehose to get ready
[423.612] Waiting for firehose to get ready
[483.723] Initializing storage
[483.733] Waiting for firehose to get ready
[543.852] Configuring device...
[543.858] Waiting for firehose to get ready
[603.982] Waiting for firehose to get ready
[665.300] Waiting for firehose to get ready
[725.423] Waiting for firehose to get ready
[785.534] Waiting for firehose to get ready
[845.642] Configuring device...
[845.647] Waiting for firehose to get ready
[905.768] Waiting for firehose to get ready
[965.888] Waiting for firehose to get ready
[1026.004] Waiting for firehose to get ready
[1086.111] ERROR: do_package()->do_recipe()->do_configure()->buffer_read()->device_read()->IO error
[1086.111] Check qboot_log.txt for more details
[1086.115] Total time: 1086.117s
[1086.118] There were some hiccups in backup and restore.
[1086.120] Please save the following files and see a Bootloader member.
[1086.124] 1) ./qboot_log.txt
[1086.126] 2) ./backup_0xE19C4943_2019-11-14_223756.img
[1086.128]
[1086.132]
[1086.132] qboot version 3.40
[1086.132]
[1086.132] DEVICE {
[1086.132] name = "\\.\COM7",
[1086.132] flags = "0x64",
[1086.132] addr = "0x61FE5C",
[1086.132] sahara.current_mode = "0",
[1086.132] api.buffer = "0x124F020",
[1086.132] cpu.serial = "3785115971",
[1086.132] cpu.id = "186",
[1086.132] cpu.sv_sbl = "0",
[1086.132] cpu.name = "MSM8953",
[1086.132] storage.type = "eMMC",
[1086.132] sahara.programmer = "programmer.mbn",
[1086.132] module.firehose = "0x7DD7A0",
[1086.132] cpu.ver = "0",
[1086.132] cpu.vername = "unknown",
[1086.132] api.bnr = "0x6E83F8",
[1086.132] }
[1086.132]
[1086.132]
[1086.132] Backup & Restore {
[1086.132] num_entries = 27,
[1086.132] restoring = "false",
[1086.132] restore_error = "not started",
[1086.133] entries[00] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cid"},
[1086.133] entries[01] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="frp"},
[1086.133] entries[02] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="hw"},
[1086.133] entries[03] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="misc"},
[1086.133] entries[04] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="persist"},
[1086.133] entries[05] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="persist2"},
[1086.133] entries[06] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="utags"},
[1086.133] entries[07] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="devinfo"},
[1086.133] entries[08] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="sp"},
[1086.133] entries[09] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="aboot_a"},
[1086.133] entries[10] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib_a"},
[1086.133] entries[11] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib64_a"},
[1086.133] entries[12] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="devcfg_a"},
[1086.133] entries[13] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="keymaster_a"},
[1086.133] entries[14] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="tz_a"},
[1086.133] entries[15] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="rpm_a"},
[1086.133] entries[16] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="prov_a"},
[1086.133] entries[17] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="sbl1_a"},
[1086.133] entries[18] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="aboot_b"},
[1086.133] entries[19] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib_b"},
[1086.133] entries[20] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib64_b"},
[1086.133] entries[21] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="devcfg_b"},
[1086.133] entries[22] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="keymaster_b"},
[1086.133] entries[23] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="tz_b"},
[1086.133] entries[24] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="rpm_b"},
[1086.133] entries[25] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="prov_b"},
[1086.133] entries[26] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="sbl1_b"},
[1086.133] simg = {
[1086.133] filename = "backup_0xE19C4943_2019-11-14_223756.img",
[1086.133] entries[00] = { size = 405264, name = "programmer.mbn" },
[1086.133] }
[1086.133] }
[1086.133]
It doesn't seem to work for my XT1955-4.. I get that same error as other people. But I can't seem to restart my phone. I hold the power button hoping it will turn off, then when I connect it to laptop, it instantly pops up in the device manager.
Unbelievable how annoying it is to install custom stuff on this phone.
EDIT: I still had my SD card in it. After I removed it, it worked..
...
---------- Post added at 12:53 AM ---------- Previous post was at 12:52 AM ----------
Ballyeet said:
Hey, thanks for the guide, but i'm currently stuck here :/
[ -0.000] Opening device: \.\COM7
[ 0.001] Detecting device
[ 0.004] ...cpu.id = 186 (0xba)
[ 0.004] ...cpu.sn = 3785115971 (0xe19c4943)
[ 0.005] Opening singleimage
[ 0.006] Loading package
[ 0.009] ...filename = singleimage.pkg.xml
[ 0.011] Loading programmer
[ 0.012] ...filename = programmer.mbn
[ 0.012] Sending programmer
[ 0.299] Handling things over to programmer
[ 0.300] Identifying CPU version
[ 0.306] Waiting for firehose to get ready
[ 15.977] ReadFile() failed, GetLastError()=0
[ 15.977] ReadFile() failed, GetLastError()=0
[ 46.784] ReadFile() failed, GetLastError()=0
[ 46.785] ReadFile() failed, GetLastError()=0
[ 60.688] Waiting for firehose to get ready
[ 77.568] ReadFile() failed, GetLastError()=0
[ 77.569] ReadFile() failed, GetLastError()=0
[108.332] ReadFile() failed, GetLastError()=0
[108.332] ReadFile() failed, GetLastError()=0
[122.234] ...MSM8953 unknown
[122.234] Determining target secure state
[122.237] Waiting for firehose to get ready
[139.079] ReadFile() failed, GetLastError()=0
[139.080] ReadFile() failed, GetLastError()=0
[183.065] ...secure = no
[183.128] Initializing storage
[183.132] Waiting for firehose to get ready
[243.246] Configuring device...
[243.252] Waiting for firehose to get ready
[303.367] Waiting for firehose to get ready
[363.491] Waiting for firehose to get ready
[423.612] Waiting for firehose to get ready
[483.723] Initializing storage
[483.733] Waiting for firehose to get ready
[543.852] Configuring device...
[543.858] Waiting for firehose to get ready
[603.982] Waiting for firehose to get ready
[665.300] Waiting for firehose to get ready
[725.423] Waiting for firehose to get ready
[785.534] Waiting for firehose to get ready
[845.642] Configuring device...
[845.647] Waiting for firehose to get ready
[905.768] Waiting for firehose to get ready
[965.888] Waiting for firehose to get ready
[1026.004] Waiting for firehose to get ready
[1086.111] ERROR: do_package()->do_recipe()->do_configure()->buffer_read()->device_read()->IO error
[1086.111] Check qboot_log.txt for more details
[1086.115] Total time: 1086.117s
[1086.118] There were some hiccups in backup and restore.
[1086.120] Please save the following files and see a Bootloader member.
[1086.124] 1) ./qboot_log.txt
[1086.126] 2) ./backup_0xE19C4943_2019-11-14_223756.img
[1086.128]
[1086.132]
[1086.132] qboot version 3.40
[1086.132]
[1086.132] DEVICE {
[1086.132] name = "\.\COM7",
[1086.132] flags = "0x64",
[1086.132] addr = "0x61FE5C",
[1086.132] sahara.current_mode = "0",
[1086.132] api.buffer = "0x124F020",
[1086.132] cpu.serial = "3785115971",
[1086.132] cpu.id = "186",
[1086.132] cpu.sv_sbl = "0",
[1086.132] cpu.name = "MSM8953",
[1086.132] storage.type = "eMMC",
[1086.132] sahara.programmer = "programmer.mbn",
[1086.132] module.firehose = "0x7DD7A0",
[1086.132] cpu.ver = "0",
[1086.132] cpu.vername = "unknown",
[1086.132] api.bnr = "0x6E83F8",
[1086.132] }
[1086.132]
[1086.132]
[1086.132] Backup & Restore {
[1086.132] num_entries = 27,
[1086.132] restoring = "false",
[1086.132] restore_error = "not started",
[1086.133] entries[00] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cid"},
[1086.133] entries[01] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="frp"},
[1086.133] entries[02] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="hw"},
[1086.133] entries[03] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="misc"},
[1086.133] entries[04] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="persist"},
[1086.133] entries[05] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="persist2"},
[1086.133] entries[06] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="utags"},
[1086.133] entries[07] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="devinfo"},
[1086.133] entries[08] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="sp"},
[1086.133] entries[09] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="aboot_a"},
[1086.133] entries[10] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib_a"},
[1086.133] entries[11] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib64_a"},
[1086.133] entries[12] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="devcfg_a"},
[1086.133] entries[13] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="keymaster_a"},
[1086.133] entries[14] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="tz_a"},
[1086.133] entries[15] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="rpm_a"},
[1086.133] entries[16] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="prov_a"},
[1086.133] entries[17] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="sbl1_a"},
[1086.133] entries[18] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="aboot_b"},
[1086.133] entries[19] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib_b"},
[1086.133] entries[20] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib64_b"},
[1086.133] entries[21] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="devcfg_b"},
[1086.133] entries[22] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="keymaster_b"},
[1086.133] entries[23] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="tz_b"},
[1086.133] entries[24] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="rpm_b"},
[1086.133] entries[25] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="prov_b"},
[1086.133] entries[26] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="sbl1_b"},
[1086.133] simg = {
[1086.133] filename = "backup_0xE19C4943_2019-11-14_223756.img",
[1086.133] entries[00] = { size = 405264, name = "programmer.mbn" },
[1086.133] }
[1086.133] }
[1086.133]
Click to expand...
Click to collapse
I get same exactly as you do on my metro g7 power when running ./blank-flash.sh ??
Did you ever resolve this issue and get yours fixed or still bricked?
Sent from my OnePlus5 using XDA Labs
Update 2: Managed to get it to work this time! Just took a few attempts to run the BAT file successfully immediately after plugging in the device.
Update 1:
Swapped out for another USB cable and it started, but failed in the end. Here's the result:
**** Log buffer [000001] 2020-01-07_18:12:13 ****
[ -0.000] Opening device: \\.\COM3
[ 0.001] Detecting device
[ 0.004] ...cpu.id = 186 (0xba)
[ 0.004] ...cpu.sn = 3681404730 (0xdb6dc73a)
[ 0.004] Opening singleimage
[ 0.008] Loading package
[ 0.010] ...filename = singleimage.pkg.xml
[ 0.011] Loading programmer
[ 0.011] ...filename = programmer.mbn
[ 0.011] Sending programmer
[ 0.298] Handling things over to programmer
[ 0.298] Identifying CPU version
[ 0.299] Waiting for firehose to get ready
[ 60.395] Waiting for firehose to get ready
[120.486] ...MSM8953 unknown
[120.486] Determining target secure state
[120.488] Waiting for firehose to get ready
[180.577] ...secure = no
[180.595] Initializing storage
[180.598] Waiting for firehose to get ready
[240.694] Configuring device...
[240.694] Waiting for firehose to get ready
[300.785] Waiting for firehose to get ready
[360.878] Waiting for firehose to get ready
[420.968] Waiting for firehose to get ready
[481.058] Initializing storage
[481.060] Waiting for firehose to get ready
[541.154] Configuring device...
[541.155] Waiting for firehose to get ready
[601.251] Waiting for firehose to get ready
[661.345] Waiting for firehose to get ready
[721.432] Waiting for firehose to get ready
[781.525] Waiting for firehose to get ready
[841.616] Configuring device...
[841.617] Waiting for firehose to get ready
[901.781] Waiting for firehose to get ready
[961.864] Waiting for firehose to get ready
[1021.956] Waiting for firehose to get ready
[1082.044] ERROR: do_package()->do_recipe()->do_configure()->buffer_read()->device_read()->IO error
[1082.044] Check qboot_log.txt for more details
[1082.044] Total time: 1082.045s
[1082.045] There were some hiccups in backup and restore.
[1082.045] Please save the following files and see a Bootloader member.
[1082.046] 1) ./qboot_log.txt
[1082.046] 2) ./backup_0xDB6DC73A_2020-01-07_181513.img
[1082.046]
[1082.047]
[1082.047] qboot version 3.40
[1082.047]
[1082.047] DEVICE {
[1082.047] name = "\\.\COM3",
[1082.047] flags = "0x64",
[1082.047] addr = "0x61FE4C",
[1082.047] sahara.current_mode = "0",
[1082.047] api.buffer = "0x128D020",
[1082.047] cpu.serial = "3681404730",
[1082.047] cpu.id = "186",
[1082.047] cpu.sv_sbl = "0",
[1082.047] cpu.name = "MSM8953",
[1082.047] storage.type = "eMMC",
[1082.047] sahara.programmer = "programmer.mbn",
[1082.047] module.firehose = "0xF3D680",
[1082.047] cpu.ver = "0",
[1082.047] cpu.vername = "unknown",
[1082.047] api.bnr = "0xE47A40",
[1082.047] }
[1082.047]
[1082.047]
[1082.047] Backup & Restore {
[1082.047] num_entries = 27,
[1082.047] restoring = "false",
[1082.047] restore_error = "not started",
[1082.047] entries[00] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cid"},
[1082.047] entries[01] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="frp"},
[1082.047] entries[02] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="hw"},
[1082.047] entries[03] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="misc"},
[1082.047] entries[04] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="persist"},
[1082.047] entries[05] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="persist2"},
[1082.047] entries[06] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="utags"},
[1082.047] entries[07] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="devinfo"},
[1082.047] entries[08] = { skipped = 0, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="sp"},
[1082.047] entries[09] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="aboot_a"},
[1082.047] entries[10] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib_a"},
[1082.047] entries[11] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib64_a"},
[1082.047] entries[12] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="devcfg_a"},
[1082.047] entries[13] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="keymaster_a"},
[1082.047] entries[14] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="tz_a"},
[1082.047] entries[15] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="rpm_a"},
[1082.047] entries[16] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="prov_a"},
[1082.047] entries[17] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="sbl1_a"},
[1082.047] entries[18] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="aboot_b"},
[1082.047] entries[19] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib_b"},
[1082.047] entries[20] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="cmnlib64_b"},
[1082.047] entries[21] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="devcfg_b"},
[1082.047] entries[22] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="keymaster_b"},
[1082.047] entries[23] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="tz_b"},
[1082.047] entries[24] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="rpm_b"},
[1082.047] entries[25] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="prov_b"},
[1082.047] entries[26] = { skipped = 1, backup_tried = 0, backup_failed = 0, restore_tried = 0, restore_failed = 0, name ="sbl1_b"},
[1082.047] simg = {
[1082.047] filename = "backup_0xDB6DC73A_2020-01-07_181513.img",
[1082.047] entries[00] = { size = 405264, name = "programmer.mbn" },
[1082.047] }
[1082.047] }
[1082.047]
Click to expand...
Click to collapse
--------------------------------------------------------------------------------------------------------------------------------------
Hi all,
I believe I hard bricked my phone when trying to install TWRP earlier today. I had just fastbooted the TWRP image and tried to install the TWRP zip but it did not succeed. I switched over to partition B and accidentally restarted and now it won't boot at all. Tried to use the solution here, but I keep getting the IO error.
**** Log buffer [000001] 2020-01-07_17:39:13 ****
[ -0.000] Opening device: \\.\COM4
[ 0.001] Detecting device
[ 4.008] ERROR: sahara_greet_device()->change_mode()->do_hello()->IO error
[ 4.008] Check qboot_log.txt for more details
[ 4.008] Total time: 4.009s
[ 4.008]
[ 4.008] qboot version 3.40
[ 4.008]
[ 4.008] DEVICE {
[ 4.008] name = "\\.\COM4",
[ 4.008] flags = "0x64",
[ 4.008] addr = "0x61FE4C",
[ 4.008] api.bnr = "0xF12E28",
[ 4.008] }
[ 4.008]
[ 4.008]
[ 4.008] Backup & Restore {
[ 4.008] num_entries = 0,
[ 4.008] restoring = "false",
[ 4.008] backup_error = "not started",
[ 4.008] restore_error = "not started",
[ 4.008] }
[ 4.008]
Click to expand...
Click to collapse
Any ideas on what to try next?
This solution does not work on my XT1995-4
I just get errors about IO over and over, tried 3 different computers and 3 different USB C cables.
Motorola qboot utility version 3.40
[ 0.000] Opening device: /dev/ttyUSB0
[ 0.000] Detecting device
[ 0.004] ...cpu.id = 186 (0xba)
[ 0.004] ...cpu.sn = 802569542 (0x2fd63d46)
[ 0.004] Opening singleimage
[ 0.004] Loading package
[ 0.007] ...filename = singleimage.pkg.xml
[ 0.009] Loading programmer
[ 0.010] ...filename = programmer.mbn
[ 0.010] Sending programmer
[ 0.294] Handling things over to programmer
[ 0.294] Identifying CPU version
[ 0.298] Waiting for firehose to get ready
[ 3.308] ...MSM8953 1.0
[ 3.308] Determining target secure state
[ 3.311] ...secure = yes
[ 3.337] Configuring device...
[ 3.341] Flashing GPT...
[ 3.342] Flashing partition with gpt.bin
[ 3.345] Initializing storage
[ 5.090] Target NAK!
[ 5.090] ...num_partition_sectors=122142720
[ 5.090] ...SECTOR_SIZE_IN_BYTES=512
[ 5.090] ...MFR_ID=19
[ 5.090] ...{"storage_info": {"total_blocks":122142720, "block_size":512, "page_size":512, "num_physical":3, "mfr_id":19, "serial_num":221774116, "fw_version":"4","mem_type":"eMMC", "prod_name":"S0J9N8"}}
[ 5.090] ...XML (0 bytes) not validated
[ 5.090] ERROR: do_package()->do_recipe()->do_flash()->flash_simg()->do_package()->do_recipe()->do_flash()->gpt_flash()->get_storage()->init_storage()->firehose_do_fmt()->do_recipe()->NAK
[ 5.090] Check qboot_log.txt for more details
[ 5.090] Total time: 5.090s
FAILED: qb_flash_singleimage()->do_package()->do_recipe()->do_flash()->flash_simg()->do_package()->do_recipe()->do_flash()->gpt_flash()->get_storage()->init_storage()->firehose_do_fmt()->do_recipe()->NAK
Click to expand...
Click to collapse
GitHub - Markakd/CVE-2021-4154: CVE-2021-4154 exploit
CVE-2021-4154 exploit. Contribute to Markakd/CVE-2021-4154 development by creating an account on GitHub.
github.com
It allows privilege escalation on a LOT of linux kernels. There's a new one: https://github.com/Markakd/CVE-2022-2588 that might be even better for this (exploit demo is not currently available). We theoretically could just make a new su file in /etc/xbin with the required data with cat.
Could be viable on a LOT of androids.
I tried it. But it not working my android tablet TAB-A05-BD.
What's wrong?
Code:
TAB-A05-BD:/data/local/tmp $ ./strace ./dirtycred
execve("./dirtycred", ["./dirtycred"], 0x7fc2bfc8a0 /* 21 vars */) = 0
brk(NULL) = 0x31850000
brk(0x31850f90) = 0x31850f90
uname({sysname="Linux", nodename="localhost", ...}) = 0
set_tid_address(0x318500d0) = 28651
set_robust_list(0x318500e0, 24) = 0
rt_sigaction(SIGRTMIN, {sa_handler=0x406e48, sa_mask=[], sa_flags=SA_SIGINFO}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {sa_handler=0x406f08, sa_mask=[], sa_flags=SA_RESTART|SA_SIGINFO}, NULL, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlinkat(AT_FDCWD, "/proc/self/exe", "/data/local/tmp/dirtycred", 4096) = 25
brk(0x31871f90) = 0x31871f90
brk(0x31872000) = 0x31872000
mprotect(0x49b000, 4096, PROT_READ) = 0
getcwd("/data/local/tmp", 4096) = 16
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
rt_sigaction(SIGINT, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGQUIT, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7ca69bd000
rt_sigprocmask(SIG_BLOCK, ~[], [CHLD], 8) = 0
clone(child_stack=0x7ca69c6000, flags=CLONE_VM|CLONE_VFORK|SIGCHLD) = 28652
munmap(0x7ca69bd000, 36864) = 0
rt_sigprocmask(SIG_SETMASK, [CHLD], NULL, 8) = 0
wait4(28652, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 28652
rt_sigaction(SIGINT, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGQUIT, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=28652, si_uid=2000, si_status=0, si_utime=0, si_stime=0} ---
fchmodat(AT_FDCWD, "exp_dir", 0777) = 0
chdir("exp_dir") = 0
mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EACCES (Permission denied)
getuid() = 2000
getgid() = 2000
mprotect(0x4c0000, 4096, PROT_NONE) = 0
clone(child_stack=0x5bffc0, flags=CLONE_NEWUSER|CLONE_NEWPID) = -1 EINVAL (Invalid argument)
exit_group(1) = ?
+++ exited with 1 +++