I'd like to share some experience on hacking SHARP Android phones.
In the past I have published 102SH unlock and a tool helping users outside Japan to obtain OTA.
About rooting.
We have following preconditions.
a. Locked bootloader.
b. aboot without fastboot facilities.
c. kernel driver preventing read/write to certain partitions.
d. eMMC hardware write protections on certain blocks(including boot, recovery, system, etc.), enforced by power on write protection. This cannot be disabled unless a power off. Please refer document of eMMC datasheet.
For a or b it does not affect rooting.
For c, if we have kernel exploit it's not the case.
For d, you cannot write to protected blocks after the phone booting into Android. So even with temp root and patched kernel you can do nothing making root persist.
Someone mentioned loki. First it's an *old* LK exploit in 2013. Second boot is eMMC write protected. So it's over.
Also someone mentioned fi01's root tools. It's useless here since it's too outdated for this phone. I know every detail of the exploits inside the tool.
Therefore the two ways are all wrong.
What does the right way rooting this phone like?
a. We have to find several exploits and the final one should be kernel exploit. If I'm not going wrong, we could turn off eMMC power and set Qualcomm download magic in SMEM, then a hot reboot should bring the device into download mode with all partition writable.
b. We could try to find exploit or backdoor in sbl1/aboot.
I hope this thread becoming a serious technic discussing thread and more powerful devs joinning in.
2015.4.12
I'm going to give up on this phone.
I still don't have a 306SH SBL1 dump, too lazy to do it. The following result is based on a 305SH SBL1 dump received from someone.
Modem dump here if anyone interested.
https://www.dropbox.com/s/syulmij77qtzb7q/modem.bin.306sh.S8216.tar.xz?dl=0
And a 305SH SBL1 dump is attached.
Power on this phone with Volume Up pressed brings this device boot into FLDR mode, which can load and run code in SBL1. But unfortunately, there are complicated checks(possible RSA protected) before jumping to the code. Code will be loaded to 0x20000000 and the entry point is 0x20000050.
This will show you more on how to talk to the phone over USB cable.
Code:
lsusb -v -d 04dd:933a
The protocol is simple:
op: 1 byte(== 0x00)
size: 4 byte(BE order)
flag: 1 byte(== 0xFF causes loaded address changes to 0xf8002000 other than 0x20000000)
data: size byte(s)
sum: 1 byte(== ~sum of all bytes in from op)
Then the phone replies 010201fb which means failure and reboots, on success it will reply 010200fc.
On success, there is further checking on the outgoing data. If the check fails, the phone will go to EDL mode(aka emergency download mode, USB VID=Qualcomm and PID=9008, some guys may be familiar with it.)
Another simple operation in this mode is displaying the phone's code name.
By sending 3001ce the phone will reply 3109[8 bytes string][1 byte sum]. For my 306SH Boost Mobile variant, this string is "PB25".
Sent from my MI 4C using XDA Free mobile app
goooooooood job!
tewilove said:
I'd like to share some experience on hacking SHARP Android phones.
In the past I have published 102SH unlock and a tool helping users outside Japan to obtain OTA.
I approtiate FlowSwitch's work and he is my idol.
About rooting.
We have following preconditions.
a. Locked bootloader.
b. aboot without fastboot facilities.
c. kernel driver preventing read/write to certain partitions.
d. eMMC hardware write protections on certain blocks(including boot, recovery, system, etc.), enforced by power on write protection. This cannot be disabled unless a power off. Please refer document of eMMC datasheet.
For a or b it does not affect rooting.
For c, if we have kernel exploit it's not the case.
For d, you cannot write to protected blocks after the phone booting into Android. So even with temp root and patched kernel you can do nothing making root persist.
Someone mentioned loki. First it's an *old* LK exploit in 2013. Second boot is eMMC write protected. So it's over.
Also someone mentioned fi01's root tools. It's useless here since it's too outdated for this phone. I know every detail of the exploits inside the tool.
Therefore the two ways are all wrong.
What does the right way rooting this phone like?
a. We have to find several exploits and the final one should be kernel exploit. If I'm not going wrong, we could turn off eMMC power and set Qualcomm download magic in SMEM, then a hot reboot should bring the device into download mode with all partition writable.
b. We could try to find exploit or backdoor in sbl1/aboot.
I hope this thread becoming a serious technic discussing thread and more powerful devs joinning in.
Sent from my MI 4C using XDA Free mobile app
Click to expand...
Click to collapse
you can change DIAG by enter ##3424# and enter MSL code, it need a driver, i think if we change DIAG, we can root it from another mode
Don't spam.
Sent from my MI 4C using XDA Free mobile app
tewilove said:
Don't spam.
Sent from my MI 4C using XDA Free mobile app
Click to expand...
Click to collapse
who ?
tewilove said:
I'd like to share some experience on hacking SHARP Android phones.
In the past I have published 102SH unlock and a tool helping users outside Japan to obtain OTA.
I approtiate FlowSwitch's work and he is my idol.
About rooting.
We have following preconditions.
a. Locked bootloader.
b. aboot without fastboot facilities.
c. kernel driver preventing read/write to certain partitions.
d. eMMC hardware write protections on certain blocks(including boot, recovery, system, etc.), enforced by power on write protection. This cannot be disabled unless a power off. Please refer document of eMMC datasheet.
For a or b it does not affect rooting.
For c, if we have kernel exploit it's not the case.
For d, you cannot write to protected blocks after the phone booting into Android. So even with temp root and patched kernel you can do nothing making root persist.
Someone mentioned loki. First it's an *old* LK exploit in 2013. Second boot is eMMC write protected. So it's over.
Also someone mentioned fi01's root tools. It's useless here since it's too outdated for this phone. I know every detail of the exploits inside the tool.
Therefore the two ways are all wrong.
What does the right way rooting this phone like?
a. We have to find several exploits and the final one should be kernel exploit. If I'm not going wrong, we could turn off eMMC power and set Qualcomm download magic in SMEM, then a hot reboot should bring the device into download mode with all partition writable.
b. We could try to find exploit or backdoor in sbl1/aboot.
I hope this thread becoming a serious technic discussing thread and more powerful devs joinning in.
Sent from my MI 4C using XDA Free mobile app
Click to expand...
Click to collapse
Forgive me as ive never held a sharp android phone let alone worked on on. but i have a few questions regarding the "knowns" of this device. ive worked on many other devices and it was "known" to have a locked bootloader up until i packed teh cwm/twrp correctly and showed them they dont have a locked bootloader.
sprint is fairly open about bootloaders so why would this one be locked? is there a trend in sharp locked bootloader phones? has someone flashed a custom boot.img/recovery and been presented with a locked bootloader warning screen?
trying to find out some more information and this seemed teh most informed one.
shabbypenguin said:
Forgive me as ive never held a sharp android phone let alone worked on on. but i have a few questions regarding the "knowns" of this device. ive worked on many other devices and it was "known" to have a locked bootloader up until i packed teh cwm/twrp correctly and showed them they dont have a locked bootloader.
sprint is fairly open about bootloaders so why would this one be locked? is there a trend in sharp locked bootloader phones? has someone flashed a custom boot.img/recovery and been presented with a locked bootloader warning screen?
trying to find out some more information and this seemed teh most informed one.
Click to expand...
Click to collapse
Hey! I remember you from the galaxy avant forum. Thanks for your work on that phone. Are you interested in trying to obtain root for this phone? I am going to try and make a bounty for this phone, but I am unsure as how to do so.
Let me know if I can be of assistance to you.
Quickdraw996 said:
Hey! I remember you from the galaxy avant forum. Thanks for your work on that phone. Are you interested in trying to obtain root for this phone? I am going to try and make a bounty for this phone, but I am unsure as how to do so.
Let me know if I can be of assistance to you.
Click to expand...
Click to collapse
my buddy autoprime and i used to chat about this phone, we both wanted one when it launched but neither we willing to just get one. i was hoping the price would have died down a bit but its held strong. at any rate right now im just looking for info, ive never worked on a sharp device before and im unfamiliar with how their bootloaders run in comparison to samsung/lg
shabbypenguin said:
my buddy autoprime and i used to chat about this phone, we both wanted one when it launched but neither we willing to just get one. i was hoping the price would have died down a bit but its held strong. at any rate right now im just looking for info, ive never worked on a sharp device before and im unfamiliar with how their bootloaders run in comparison to samsung/lg
Click to expand...
Click to collapse
How would one go about figuring out such things? I have not tried to get to recovery, download mode, etc yet.
Quickdraw996 said:
How would one go about figuring out such things? I have not tried to get to recovery, download mode, etc yet.
Click to expand...
Click to collapse
@parkerlreed on reddit answered a few of my questions. in teh past if i was able to root a device i could just compile recovery and root everyone then for devices like samsung, without knowing the bootloader situation or how to flash software on this device im left a bit clueless atm.
shabbypenguin said:
@parkerlreed on reddit answered a few of my questions. in teh past if i was able to root a device i could just compile recovery and root everyone then for devices like samsung, without knowing the bootloader situation or how to flash software on this device im left a bit clueless atm.
Click to expand...
Click to collapse
How can I test to see if the bootloader is locked?
Quickdraw996 said:
How can I test to see if the bootloader is locked?
Click to expand...
Click to collapse
Without root, the only option is something fairly stupid that could render your device non-booting.
shabbypenguin said:
Without root, the only option is something fairly stupid that could render your device non-booting.
Click to expand...
Click to collapse
****, figured as much.
shabbypenguin said:
Without root, the only option is something fairly stupid that could render your device non-booting.
Click to expand...
Click to collapse
I... might be up for this. Mother is moving over to Verizon prepaid. I would then have a Moto G to use as my main phone, leaving the Aquos for testing. I'll report back if this turns out to be the case.
Well... This is interesting... The day before I get my new phone to replace my Crystal (cracked digitizer), people with Android experience show interest... Oh well... :silly:
What has made things difficult is that it does some weird stuff without any clue to us as to what it's doing.
USB in computer then Vol Up + Pwr: Phone vibrates once, the Notification LED turns White and installs something on my laptop. The install does not finish before the phone turns off roughly 15 seconds later. That install does not happen again when tried a second time.
Vol Up THEN USB in computer THEN when the LED turns Red hold Pwr: Windows audibly cues a device connect and the screen turns on displaying Charging with a battery logo. The screen then turns off and Windows audibly cues a disconnect. After the audio cue the phone vibrates for roughly 6 seconds, stops, vibrates for another 2 (vibrated for 15 seconds on other tries), and LED turns White (another audio connect cue) for about 15 seconds and turns off (audio disconnect cue).
I started a thread here: http://forum.xda-developers.com/aquos-crystal/help/download-mode-306sh-t3005531 but have not been able to recreate it again...
There is another thread where I posted where the Crystal would endlessly vibrate off and on...
I will still keep the Crystal and might stick around to do some experimental stuff to try to figure things out since it won't be my daily driver anymore. Hope this helps.
I have seen that exact behavior on mine. When I got the solid white LED, I quickly ran adb and fastboot but neither showed the device (on Linux so I don't have to worry about drivers installing). I've also seen it show up as a USB device while powered off and charging but same deal there. I think it just does that so it can register charging from Windows.
I'll try to get a writeup of all the exact behavior.
---------- Post added at 10:22 PM ---------- Previous post was at 09:56 PM ----------
Ok here it goes...
Powered off:
Unplugged:
Hold Vol Up + Power + release shortly after = White light for 15 seconds
Hold Vol Down for 5 seconds + Press and hold Power for a few seconds and continue to hold Vol down = Recovery mode
Plugged: Red light for charging. Device shows up to computer under the generic USB VID/PID ID 04dd:933a Sharp Corp.
Hold Vol Up + Power + release shortly after = same as above. adb nor fastboot -i 0x04dd see the device
Hold Vol Down for 5 seconds + Press and hold Power for a few seconds and continue to hold Vol down = Same as above. Plugging it in after entering recovery shows no devices on the computer.
"Vol Up THEN USB in computer THEN when the LED turns Red hold Pwr: " as mentioned above just seems to go into charging mode then does a small reset and goes back into charging mode.
Holding just power and continuing to hold it: Device starts to boot up, turns back off due to long holding power, and then starts to vibrate if you continue to hold power. Doesn't stop until power is released.
I am able to get my device recognized by adb/fastboot, however when I try to do an oem unlock, it says it is "waiting for device" even though it is connected and was just working fine. Any help?
Someone else says that they have possibly unlocked their bootloader via the command I typed, but no matter what I try, it will not stop "waiting for [my] device"
Quickdraw996 said:
I am able to get my device recognized by adb/fastboot, however when I try to do an oem unlock, it says it is "waiting for device" even though it is connected and was just working fine. Any help?
Someone else says that they have possibly unlocked their bootloader via the command I typed, but no matter what I try, it will not stop "waiting for [my] device"
Click to expand...
Click to collapse
Are you sure it's even seeing the device? fastboot devices would show it. Also what device do you have exactly? 04dd is the vendor code for Sharp...
parkerlreed said:
Are you sure it's even seeing the device? fastboot devices would show it. Also what device do you have exactly? 04dd is the vendor code for Sharp...
Click to expand...
Click to collapse
I have a Sharp Aquos Crystal.
Typing in "adb devices" shows my device, I have not tried typing in "fastboot devices" though, will try that later today.
I simply typed what was listed in another Sharp Aquos Crystal thread and it appears that they may have unlocked their bootloader.
Quickdraw996 said:
I have a Sharp Aquos Crystal.
Typing in "adb devices" shows my device, I have not tried typing in "fastboot devices" though, will try that later today.
I simply typed what was listed in another Sharp Aquos Crystal thread and it appears that they may have unlocked their bootloader.
Click to expand...
Click to collapse
If it's showing up under adb then it's not in fastboot mode. That's the issue here. Actually trying to figure out if there is a fastboot mode and how to get to it. And then on top of that seeing if a bootloader unlock works.
Related
Hi there, I've been browsing through the threads related to unbricking of the Nexus 6P stuck in qualcomm hs-usb qdloader 9008 mode, really desperate to get my device working again if even possible however I've tried for about four days now different ways and files and I've had no luck.
My bootloader is locked and no ADB etc managed to get my device showing as the 9008 port so I think it's stuck in EDL.
Following guides, this is the furthest I've yet to get (In screenshot)
Could anyone shed some light and some assistance please? what am I doing wrong!?
attempted to apply for heat some to the device then re flash ?
blackcell1 said:
attempted to apply for heat to the device then re flash ?
Click to expand...
Click to collapse
Sorry, I don't quite understand what you mean?
Clarkeofcurtis said:
Sorry, I don't quite understand what you mean?
Click to expand...
Click to collapse
Use a hairdryer to warm up the back of the phone.
Are you pulling my leg? Warm it up then reflash?
nah im not trying to make you destroy your phone, being rather serious with this method. i use it on a daily basis to solve phones that fail during restoring factory images. i wouldn't know how long to give it with a hair dryer as i have access to a heat gun/heat mats .
just think of it as a cheap mans re balling method
blackcell1 said:
nah im not trying to make you destroy your phone, being rather serious with this method. i use it on a daily basis to solve phones that fail during restoring factory images. i wouldn't know how long to give it with a hair dryer as i have access to a heat gun/heat mats .
just think of it as a cheap mans re balling method
Click to expand...
Click to collapse
Sorry haha, I'm a noob with most of this android stuff bar rooting and flashing a few devices prior! I shall give it a go now and get back to you - thank you for the advice
Clarkeofcurtis said:
Sorry haha, I'm a noob with most of this android stuff bar rooting and flashing a few devices prior! I shall give it a go now and get back to you - thank you for the advice
Click to expand...
Click to collapse
good luck, id give it a good couple of minutes on the highest setting, just so its a little hot to the touch. and attempt the flashing of the files when its still hot/warm.
blackcell1 said:
good luck, id give it a good couple of minutes on the highest setting, just so its a little hot to the touch. and attempt the flashing of the files when its still hot/warm.
Click to expand...
Click to collapse
thank you so much that worked, it has said flash successful, first time I got a google logo but now nothing, what would be my next step please?
if the bootloader is unlocked then you can directly flash the firmware. but if its not google "nexus ota" and then on your phone jump into the recovery and check the firmware model number and download the same ota and adb sideload it.
im not 100% sure on the next step as I've never had a nexus 6p with a dead bootloader. but thats what id do.
---------- Post added at 04:50 PM ---------- Previous post was at 04:49 PM ----------
but from my personal experience with having to heat a phone up to restore factory images, it kinda means the phone is nearing the end of its life and id start thinking about buying your next phone before it sh*ts the bed.
blackcell1 said:
if the bootloader is unlocked then you can directly flash the firmware. but if its not google "nexus ota" and then on your phone jump into the recovery and check the firmware model number and download the same ota and adb sideload it.
im not 100% sure on the next step as I've never had a nexus 6p with a dead bootloader. but thats what id do.
Click to expand...
Click to collapse
Thank you for the reply and continuing to help, after seeing the google logo just once I'm getting nothing again - I'm even more determined now though as It's been dead for 2 months so this is the furthest I've gotten - the application of heat is what did it for me and fixed the error I was getting, can't get into recovery now though holding power + down etc
Clarkeofcurtis said:
Thank you for the reply and continuing to help, after seeing the google logo just once I'm getting nothing again - I'm even more determined now though as It's been dead for 2 months so this is the furthest I've gotten - the application of heat is what did it for me and fixed the error I was getting, can't get into recovery now though holding power + down etc
Click to expand...
Click to collapse
yeah can you access the bootloader at all ? does it say that the bootloader is locked ? from trying to restore LG's it sometimes has to be re heated a few times, but yeah if you need to re heat it to get further into the phone then its pretty much a lost cause. the only reason i do it is to remove the data so we can resell the device.
blackcell1 said:
yeah can you access the bootloader at all ? does it say that the bootloader is locked ? from trying to restore LG's it sometimes has to be re heated a few times, but yeah if you need to re heat it to get further into the phone then its pretty much a lost cause. the only reason i do it is to remove the data so we can resell the device.
Click to expand...
Click to collapse
I can get into the andriod screen where you can select recovery and such, with the BL, Baseband product variation and such, where should I go from here?
Oh right, so even once restored to firmware, will it be useless do you think if I can even manage to?
Clarkeofcurtis said:
I can get into the andriod screen where you can select recovery and such, with the BL, Baseband product variation and such, where should I go from here?
Oh right, so even once restored to firmware, will it be useless do you think if I can even manage to?
Click to expand...
Click to collapse
Sorry if you can't access the recovery from the bootloader and its in locked state then your a member of the lovely group of BLOD (bootloader of death) if you hit recovery does it show a little android logo and sit there?
Sorry for the late reply
blackcell1 said:
Sorry if you can't access the recovery from the bootloader and its in locked state then your a member of the lovely group of BLOD (bootloader of death) if you hit recovery does it show a little android logo and sit there?
Sorry for the late reply
Click to expand...
Click to collapse
I believe so, I can just about get into the bootloader at the best of times and when I do I can select options but once proceeding to start said mode phone freezes so can't get into recovery mode :/
Thank you for your continuous help, only way i can get it into bootloader is by heating it up so does that mean for the device to ever work It'll need heat every time? looking like a spares and repairs listing on ebay
Clarkeofcurtis said:
I believe so, I can just about get into the bootloader at the best of times and when I do I can select options but once proceeding to start said mode phone freezes so can't get into recovery mode :/
Thank you for your continuous help, only way i can get it into bootloader is by heating it up so does that mean for the device to ever work It'll need heat every time? looking like a spares and repairs listing on ebay
Click to expand...
Click to collapse
Hello....
How did you manage to get in to EDL mode..? I'm really curious. With stock bootloader? Since you can't access recovery
Also what is exactly displayed in Windows device manager?
You are using an outdated QFil version... It is from 2014 àr 2015.
Do a google search with: QPST_2.7.453.0 . This version seem to be from 2016.
Use the first link from the result. I analysed the files with virustotal, those seem clean or malware...
Also when plugging your usb cord to your PC, does your phone vibrate? Or does the LED blink in red?
You may have to press power button when plugging the usb cord or press power button for a certain amount of time before you plug the usb cord. I'm not completly sure, but your phone may not be in the "proper" EDL state to accept the QFil flash.
Good luck... :good:
Is it possible to send me the guide you used? Thanks.
Clarkeofcurtis said:
Hi there, I've been browsing through the threads related to unbricking of the Nexus 6P stuck in qualcomm hs-usb qdloader 9008 mode, really desperate to get my device working again if even possible however I've tried for about four days now different ways and files and I've had no luck.
My bootloader is locked and no ADB etc managed to get my device showing as the 9008 port so I think it's stuck in EDL.
Following guides, this is the furthest I've yet to get (In screenshot)
Could anyone shed some light and some assistance please? what am I doing wrong!?
Click to expand...
Click to collapse
Hey there sorry for slow replies, will be back on my desktop in an hour I'll send you links for what I followed and such, I think the only reason my device was in EDL mode was due to a hardware fault? As my device is faulty indefinitely as I had to use a hairdryer to warm it up while flashing this then allowed it to enter firehose state which a lot of people seem to error with - after all my attempts and research I'm to velieve there's a fault with the phone itself the only way I could get it to even power up was applying heat to it after removing the back panel
As blackcell said deballing or something? Worked a treat!
Furthest I've managed to get now is into my boot loader however everything is locked - when I press enter recovery my handset just freezes ?
5.1 said:
Hello....
How did you manage to get in to EDL mode..? I'm really curious. With stock bootloader? Since you can't access recovery
Also what is exactly displayed in Windows device manager?
You are using an outdated QFil version... It is from 2014 àr 2015.
Do a google search with: QPST_2.7.453.0 . This version seem to be from 2016.
Use the first link from the result. I analysed the files with virustotal, those seem clean or malware...
Also when plugging your usb cord to your PC, does your phone vibrate? Or does the LED blink in red?
You may have to press power button when plugging the usb cord or press power button for a certain amount of time before you plug the usb cord. I'm not completly sure, but your phone may not be in the "proper" EDL state to accept the QFil flash.
Good luck... :good:
Click to expand...
Click to collapse
Thanks pal if you check last post I wrote about my EDL mode forgot to tag you my apologies, as for my LED I've never seen that light up since I bricked it, even when google logo came up etc and while in the boot loader
Clarkeofcurtis said:
Thanks pal if you check last post I wrote about my EDL mode forgot to tag you my apologies, as for my LED I've never seen that light up since I bricked it, even when google logo came up etc and while in the boot loader
Click to expand...
Click to collapse
Light usually a red LED blink while in proper EDL state as far as I know. Could be something else on the N6P. Well, it looks like you are SOL. Sorry, I don't know what else to say, since you exhausted all possibilities...
Good luck...
BIG BREAKTHROUGH (at least for myself) :
So for some time now, I've thought that I had hard-bricked my
dwycoff2013 said:
BIG BREAKTHROUGH (at least for myself) :
So for some time now, I've thought that I had hard-bricked my
Click to expand...
Click to collapse
BIG BREAKTHROUGH (at least for myself) :
So for some time now, I've thought that I had hard-bricked my moto XT1609, and I thought what I needed would be best summarized with the words 'blankflash template'. This sent me on a furious wild goose chase for Qualcomm drivers, deactivating driver signature enforcement on a Windows computer, etc., etc. . . You catch my drift. Well, long story short, I ended up coming across another XT1609 (same variant) and since the charger port and screen were all effed up, I just changed out the motherboards and viola! I had my G⁴ Play back in working order. I rooted with auto-init root, and everything was working fine. I took the battery out after powering down, placed my sim and microSD card, and upon attempting the boot, I panicked. It was doing the same thing the last motherboard was doing: showing the "moto" boot screen, vibrating, then black screen, a flash, and it looped. I couldn't load recovery nor kernel. So, I tried to uninstall the init root, and attempted boot, but to no avail.
I was certain all was lost.
However, after reading the PDF of the essay where the bootloader vulnerability was discovered, I decided to utilise fastboot in hopes of saving the kernel from crashing (i assumed the black screen, and the flash was the bootloader attempting to load the kernel). My commands:
fastboot oem config fsg-id vzw (I have the vzw variant)
fastboot oem config carrier vzw
fastboot continue
And success! I saved the kernel from crashing. I urge anyone else having the same problem I described to try fastboot commands using your carrier's id in lieu 'vzw' and let me know the results, please!
Sent from my resurrected vzw xt1609
P.S. I also just had the same problem with this phone again, however this time I set the carrier id blank (as it were from the factory) and let the fsg-id be set by the auto-init root script..
Anyone (senior/recognized members) have any input on what's actually going on here? I'd love to actually be aware of what I'm changing and how it's affecting the boot.
dwycoff2013 said:
BIG BREAKTHROUGH (at least for myself) :
So for some time now, I've thought that I had hard-bricked my moto XT1609, and I thought what I needed would be best summarized with the words 'blankflash template'. This sent me on a furious wild goose chase for Qualcomm drivers, deactivating driver signature enforcement on a Windows computer, etc., etc. . . You catch my drift. Well, long story short, I ended up coming across another XT1609 (same variant) and since the charger port and screen were all effed up, I just changed out the motherboards and viola! I had my G⁴ Play back in working order. I rooted with auto-init root, and everything was working fine. I took the battery out after powering down, placed my sim and microSD card, and upon attempting the boot, I panicked. It was doing the same thing the last motherboard was doing: showing the "moto" boot screen, vibrating, then black screen, a flash, and it looped. I couldn't load recovery nor kernel. So, I tried to uninstall the init root, and attempted boot, but to no avail.
I was certain all was lost.
However, after reading the PDF of the essay where the bootloader vulnerability was discovered, I decided to utilise fastboot in hopes of saving the kernel from crashing (i assumed the black screen, and the flash was the bootloader attempting to load the kernel). My commands:
fastboot oem config fsg-id vzw (I have the vzw variant)
fastboot oem config carrier vzw
fastboot continue
And success! I saved the kernel from crashing. I urge anyone else having the same problem I described to try fastboot commands using your carrier's id in lieu 'vzw' and let me know the results, please!
Sent from my resurrected vzw xt1609
P.S. I also just had the same problem with this phone again, however this time I set the carrier id blank (as it were from the factory) and let the fsg-id be set by the auto-init root script..
Anyone (senior/recognized members) have any input on what's actually going on here? I'd love to actually be aware of what I'm changing and how it's affecting the boot.
Click to expand...
Click to collapse
Hi, dwycoff2013
I'm trying to resurrect my locked bootloader vzn XT1609, as well. I don't think I have a hardware issue. I upgraded to Android 7.1.1 a month or so ago and it was running fine until a few days ago when it started bootlooping much in the way you've described. The blue splash screen comes up for 5 or 10 seconds then the screen goes black, then the blue screen comes up for 5 or 10 seconds, then it goes black, ad infinitum. Well, sometimes it actually goes farther, gets to the screen with the dancing colored dots before rebooting but this is very rarely. I tried installing the auto-init initroot image on it but it sends back a "Permission denied" error for it. I'm wondering if it's because I have 7.1.1 images installed instead of something older?
Anyway, your fastboot commands don't fix anything for me. It continues to bootloop. What version of Android were you running when you tried this?
Thanks!
I was using the 6.0.1 vzw firmware. Can you get to the bootloader with power and vol- ?
I'm assuming you can, considering you're mention of using the fastboot commands. Well, I'd say to install the QFIL & QPST tools, along with the Qualcomm Bulk HS-USB drivers. Once you get to the bootloader, try 'fastboot reboot edl' and it should put the device into Qualcomm's Emergency Download Mode and your computer should recognise the device as QC HS-USB 9008 DL, I believe. If that doesn't work, perhaps try taking the battery out, holding the vol+ button and inserting your USB cable.
dwycoff2013 said:
I'm assuming you can, considering you're mention of using the fastboot commands. Well, I'd say to install the QFIL & QPST tools, along with the Qualcomm Bulk HS-USB drivers. Once you get to the bootloader, try 'fastboot reboot edl' and it should put the device into Qualcomm's Emergency Download Mode and your computer should recognise the device as QC HS-USB 9008 DL, I believe. If that doesn't work, perhaps try taking the battery out, holding the vol+ button and inserting your USB cable.
Click to expand...
Click to collapse
Hi again, dwycoff2013
Sorry I haven't responded earlier. I had to finish my taxes and get my W10 boot working again. I was using Linux Mint in my previous attempts. I'm going to try and install the Qualcomm stuff you recommended but maybe you can answer a few more questions in the meantime:
1. My goal at this point is to get the stock Moto images running again. It appears that this is what you were able to do, from your description. Will running the Qualcomm utilities allow me to do this or will they only allow me to install Qualcomm images?
2. Do the Qualcomm utilities come with a version of fastboot that understand "reboot edl"?
3. My phone has a locked bootloader. I'm assuming that this is why my previous attempts to reflash failed. Can the Qualcomm utilites work when the phone is locked?
4. Can you point me to the pdf document that you were talking about?
Thanks. I'm sorry to sound like a newbie at this Android stuff, but this is what I am
Hello I am posting in Q&A because I'm a new XDA user, I was not allowed to post in the dev channel.
I have an Essential phone that has been working great for the past few years, no issues, and it was running standard build receiving OTA updates, until the very last update, which soft bricked the phone.
The phone was never enabled in developer mode while in Android, and now, I can't boot the phone into android at all. The only thing I can do is get into fastboot.
Fastboot state shows DEVICE STATE - locked
Any commands I try to unlock flashing, or change slots, anything at all, I get the error that the device is locked so all commands to unlock fail.
Is there any way to unlock device state from fastboot? I saw a youtube video showing a way to use a chopped USB cable to enter emergency / EDL mode for Qualcomm-based Android devices, but have not seen anyone post that this was successful with the Essential
Does anyone know of any method to be able to unlock flashing from fastboot? Or any other method to un-brick an essential? I've attempted everything, on both Mac and PC, nothing works.
On mac or PC, I can query the device in fastboot and get a response, I just can't do anything to unlock anything!!
Many thanks in advance for any suggestions!
Same problem
Same thing happened to me. Same day as you. I can get fastboot but not adb but since the device is locked I can't flash. I've only had the phone about 6 months so I contacted customer support and they offered to replace the phone.
It might be a known issue because they didn't even try to address the fact that I could get fastboot connected but not adb. They just offered to replace.
Thanks for the info! I am -at least in this case- unfortunately an early adopter. I bought two essentials at the beginning of the pre-release.
Essential support checked my serial number and said the phone was out of warranty.
Has anyone been able to force the Essential into EDL mode to recover that way? It looks like you have to latch one of the USB pins to ground, or 5V, but I haven't found any detailed instructions on how to make this work on the essential...
Thanks again
Justin
I'm sure things have changed and I'm wrong, but if you can get into the fastboot menu can't you just cycle through the options until you get to recovery and then flash an official release from Essential?
I may be thinking of LG or something but this should be possible as long as it's newer than the current software installed because it will see it as an official update and allow the flash.
Thanks but unfortunately, when I try and do that, the phone just does the same thing, it hangs forever on the initial boot screen white Android text with the circle/square logo...
That's why I've been looking into the more direct hardware version of forcing the phone into EDL mode, which is supposed to be possible with all Qualcomm based phones.
I've just not found the time yet to find a USB-C cable I'd be happy to cut in half and short the pins on! Which is why I was hoping someone might have tried this with an essential before to know if it was successful before I start trashing good cables
Thanks again for your reply!
JB
justinbaird said:
Hello I am posting in Q&A because I'm a new XDA user, I was not allowed to post in the dev channel.
I have an Essential phone that has been working great for the past few years, no issues, and it was running standard build receiving OTA updates, until the very last update, which soft bricked the phone.
The phone was never enabled in developer mode while in Android, and now, I can't boot the phone into android at all. The only thing I can do is get into fastboot.
Fastboot state shows DEVICE STATE - locked
Any commands I try to unlock flashing, or change slots, anything at all, I get the error that the device is locked so all commands to unlock fail.
Is there any way to unlock device state from fastboot? I saw a youtube video showing a way to use a chopped USB cable to enter emergency / EDL mode for Qualcomm-based Android devices, but have not seen anyone post that this was successful with the Essential
Does anyone know of any method to be able to unlock flashing from fastboot? Or any other method to un-brick an essential? I've attempted everything, on both Mac and PC, nothing works.
On mac or PC, I can query the device in fastboot and get a response, I just can't do anything to unlock anything!!
Many thanks in advance for any suggestions!
Click to expand...
Click to collapse
I have the exact same problem,
My phone is stuck on Essential log when I turned it on,
I can access Bootloader normally but the device is locked so I cannot flash it,
Recovery is corrupted, when I try to star it, it shows only the the Essential log and freeze so I can not format or wipe or sideload.
OEM Locked and unchecked
USB Debugging is unchecked
and I can't flash anything,
Did you managed to unlock it through Fastboot command or any other way ?
I wish I can just login to the recovery or unlock it so I can flash it clean,
Kindly help me if you found a way out
Thank you
Hello Guys, beforehand, sorry for bad formatting and some english mistakes.
Let me explain what happened.
I was trying to unlock my Nexus 7 bootloader, but I couldn´t get to the Fastboot mode via adb, so I decided to enter fastboot mode by pressing Power + Volume Down button, but I did this while my tablet was connected to the PC, and after that, it shut down and just don´t turned on anymore. (Never got to fastboot mode)
Now when I connect to windows it only show as an AXP Device and it disconnects and connects when i hold Power button, but never starts.
Also I want to note that.
I didn´t manage to get into fastboot mode.
I didn´t manage to unlock the bootloader.
Didn´t install any Custom Rom.
The device is technically 100% stock, so I don´t expect it to be a Hard Brick, but at the same time, I tried all the button combinations and it still wont turn on.
This happened to anyone? Do you guys have any idea what it could be? Any Sollutions for this?
Thank you.
(Edit: I don´t have the Blobs.bin file in case i need to use the Nvflash.)
Gabu1405 said:
Hello Guys, beforehand, sorry for bad formatting and some english mistakes.
Let me explain what happened.
I was trying to unlock my Nexus 7 bootloader, but I couldn´t get to the Fastboot mode via adb, so I decided to enter fastboot mode by pressing Power + Volume Down button, but I did this while my tablet was connected to the PC, and after that, it shut down and just don´t turned on anymore. (Never got to fastboot mode)
Now when I connect to windows it only show as an AXP Device and it disconnects and connects when i hold Power button, but never starts.
Also I want to note that.
I didn´t manage to get into fastboot mode.
I didn´t manage to unlock the bootloader.
Didn´t install any Custom Rom.
The device is technically 100% stock, so I don´t expect it to be a Hard Brick, but at the same time, I tried all the button combinations and it still wont turn on.
This happened to anyone? Do you guys have any idea what it could be? Any Sollutions for this?
Thank you.
(Edit: I don´t have the Blobs.bin file in case i need to use the Nvflash.)
Click to expand...
Click to collapse
Take a look at this comprehensive listing of Nexus 7 button presses/interrupts. They may be of some use...
https://forum.xda-developers.com/showthread.php?p=37606945#post37606945
Hi, Gabu1405...
APX mode is never a good sign with the Nexus 7. It usually indicates that the bootloader has become corrupted, erased or overwritten (by something that is not a valid bootloader). When this occurs, the device is hardbricked and usually requires a motherboard replacement to resurrect the device, although there is a procedure called 'flatline', but this requires previously generated device unique 'blob' files, which you mention in your post.
Having said all of that though, nothing in your description should have caused the bootloader to have become 'damaged'. In order to erase, corrupt or overwrite the bootloader, your device would need to be bootloader unlocked in the first place, because a locked bootloader prohibits any unauthorised write access - bootloader locked devices can only be system 'modified' by official digitally signed updates from Google, which are flashed via the stock recovery.
Are you certain the Nexus 7 is showing as an APX device in Windows device manager?
What was the battery status/percentage when you attempted to unlock the bootloader? Maybe the tablet just needs a good charge, maybe for several hours!
You don't unlock the bootloader with ADB. Android Debug Bridge only works in fully booted Android and with the stock factory recovery. You need to use fastboot to unlock the bootloader, the command being fastboot oem unlock, whilst the device is in fastboot mode, which you boot into via the Volume Down+Power Button key press combo, as you mention in your post.
How it (may have) got into APX mode is certainly strange, because as I've said, this isn't something that normally happens spontaneously - when it happens, it's often due to people mistakenly flashing an incorrect .IMG file to the bootloader partition, causing the bootloader to be overwritten. A possible explanation is hardware failure, and that the emmc/NAND chip storage has developed a fault, and caused the bootloader to become corrupted. It's worth bearing in mind that the Nexus 7 is now seven years old, and with the best will in the world, these things don't last forever, unfortunately. Components fail and data corruptions occur.
If your Nexus 7 is truly in APX mode, for whatever reason, then I'm afraid it's likely hardbricked, and a motherboard replacement is the only realistic way of resurrecting it.
I can only suggest you try charging your Nexus 7, maybe overnight, or for several hours at least, and maybe try the button presses referenced via the link at the top of this post, and see if you can coax life back into your Nexus 7. It does happen sometimes; a seemingly dead device will suddenly spring back to life, through a combination of serendipity and hitting on doing the right things, in the right order, and at the right time
Good luck, Gabu1405...
Rgrds,
Ged.
GedBlake said:
Take a look at this comprehensive listing of Nexus 7 button presses/interrupts. They may be of some use...
https://forum.xda-developers.com/showthread.php?p=37606945#post37606945
Hi, Gabu1405...
APX mode is never a good sign with the Nexus 7. It usually indicates that the bootloader has become corrupted, erased or overwritten (by something that is not a valid bootloader). When this occurs, the device is hardbricked and usually requires a motherboard replacement to resurrect the device, although there is a procedure called 'flatline', but this requires previously generated device unique 'blob' files, which you mention in your post.
Having said all of that though, nothing in your description should have caused the bootloader to have become 'damaged'. In order to erase, corrupt or overwrite the bootloader, your device would need to be bootloader unlocked in the first place, because a locked bootloader prohibits any unauthorised write access - bootloader locked devices can only be system 'modified' by official digitally signed updates from Google, which are flashed via the stock recovery.
Are you certain the Nexus 7 is showing as an APX device in Windows device manager?
What was the battery status/percentage when you attempted to unlock the bootloader? Maybe the tablet just needs a good charge, maybe for several hours!
You don't unlock the bootloader with ADB. Android Debug Bridge only works in fully booted Android and with the stock factory recovery. You need to use fastboot to unlock the bootloader, the command being fastboot oem unlock, whilst the device is in fastboot mode, which you boot into via the Volume Down+Power Button key press combo, as you mention in your post.
How it (may have) got into APX mode is certainly strange, because as I've said, this isn't something that normally happens spontaneously - when it happens, it's often due to people mistakenly flashing an incorrect .IMG file to the bootloader partition, causing the bootloader to be overwritten. A possible explanation is hardware failure, and that the emmc/NAND chip storage has developed a fault, and caused the bootloader to become corrupted. It's worth bearing in mind that the Nexus 7 is now seven years old, and with the best will in the world, these things don't last forever, unfortunately. Components fail and data corruptions occur.
If your Nexus 7 is truly in APX mode, for whatever reason, then I'm afraid it's likely hardbricked, and a motherboard replacement is the only realistic way of resurrecting it.
I can only suggest you try charging your Nexus 7, maybe overnight, or for several hours at least, and maybe try the button presses referenced via the link at the top of this post, and see if you can coax life back into your Nexus 7. It does happen sometimes; a seemingly dead device will suddenly spring back to life, through a combination of serendipity and hitting on doing the right things, in the right order, and at the right time
Good luck, Gabu1405...
Rgrds,
Ged.
Click to expand...
Click to collapse
Sorry, I expressed myself wrongly, I ran the same command as you said, it was fastboot oem unlock and it just said, "waiting for device..." then I tried fastboot oem unlock-go, also the same thing "waiting for device" so I just disconnected the tablet and restarted it and it was working pretty fine, then I connected to the PC and tried to enter fastboot mode manually, and this is when it shut down and never turned back on.
Also, my battery was at 70% at that time and yes, It's clearly on APX mode.
Well, thank you for your reply, now the only thing I got to do is recharge it and hope for the best.
Regards.
Gabu1405 said:
Sorry, I expressed myself wrongly, I ran the same command as you said, it was fastboot oem unlock and it just said, "waiting for device..." then I tried fastboot oem unlock-go, also the same thing "waiting for device" so I just disconnected the tablet and restarted it and it was working pretty fine, then I connected to the PC and tried to enter fastboot mode manually, and this is when it shut down and never turned back on.
Also, my battery was at 70% at that time and yes, It's clearly on APX mode.
Well, thank you for your reply, now the only thing I got to do is recharge it and hope for the best.
Regards.
Click to expand...
Click to collapse
Probably not much use until, or indeed if, you can get out of APX Mode... But the 'waiting for device' message is usually an indicator of a Windows driver problem - Windows is not able to communicate with the Nexus 7.
The way you'd normally do things is by first running the command fastboot devices
This command does nothing, except to confirm you have a viable fastboot connection, by displaying your Nexus 7's unique serial number in your Windows Command/DOS box. If this serial number fails to appear, you have a driver/connectivity problem and proceeding on to fastboot oem unlock would be pointless until the driver/connectivity problem is resolved.
Anyway, I hope charging the device helps. I'm still inclined to think that your device is recoverable - it would certainly be very unusual for the bootloader to be borked when it hasn't even been unlocked yet. In the seven years I've been a Nexus 7 owner, and being active on these forums for many of those years, I haven't encountered any reports by other XDA members where a locked bootloader has simply quit working... As I say, it'd be very unusual, but I suppose not wholly impossible.
Rgrds,
GB.
GedBlake said:
Probably not much use until, or indeed if, you can get out of APX Mode... But the 'waiting for device' message is usually an indicator of a Windows driver problem - Windows is not able to communicate with the Nexus 7.
The way you'd normally do things is by first running the command fastboot devices
This command does nothing, except to confirm you have a viable fastboot connection, by displaying your Nexus 7's unique serial number in your Windows Command/DOS box. If this serial number fails to appear, you have a driver/connectivity problem and proceeding on to fastboot oem unlock would be pointless until the driver/connectivity problem is resolved.
Anyway, I hope charging the device helps. I'm still inclined to think that your device is recoverable - it would certainly be very unusual for the bootloader to be borked when it hasn't even been unlocked yet. In the seven years I've been a Nexus 7 owner, and being active on these forums for many of those years, I haven't encountered any reports by other XDA members where a locked bootloader has simply quit working... As I say, it'd be very unusual, but I suppose not wholly impossible.
Rgrds,
GB.
Click to expand...
Click to collapse
Well, charged my device for a whole day, and now I tried to do the button combinations which you sent the link, nothing happened.
I thought that my battery could be unplugged or the cable was loose or something, so I opened the tablet and it was fine.
So, I just decided to do the button combinations while plugged into my PC, and I noticed that doesn´t matter which combination I try, the tablet disconnects from the PC and instantly reconnects, but still in APX mode.
I guess it is Game Over for me, gonna recharge it again, and try again tomorrow.
Thanks again.
Gabu1405 said:
Hello Guys, beforehand, sorry for bad formatting and some english mistakes.
Let me explain what happened.
I was trying to unlock my Nexus 7 bootloader, but I couldn´t get to the Fastboot mode via adb, so I decided to enter fastboot mode by pressing Power + Volume Down button, but I did this while my tablet was connected to the PC, and after that, it shut down and just don´t turned on anymore. (Never got to fastboot mode)
Now when I connect to windows it only show as an AXP Device and it disconnects and connects when i hold Power button, but never starts.
Also I want to note that.
I didn´t manage to get into fastboot mode.
I didn´t manage to unlock the bootloader.
Didn´t install any Custom Rom.
The device is technically 100% stock, so I don´t expect it to be a Hard Brick, but at the same time, I tried all the button combinations and it still wont turn on.
This happened to anyone? Do you guys have any idea what it could be? Any Sollutions for this?
Thank you.
(Edit: I don´t have the Blobs.bin file in case i need to use the Nvflash.)
Click to expand...
Click to collapse
Hi!
I had a Nexus 7 stuck in APX mode as well. Without the blobs saved you can't do anything. I tried a lot of thigs but nothing really helped. I ended up searching for an another N7 with a broken screen but with a working motherboard online. I was lucky and find one around $15. I swapped the boards and it was good to go.
Zsolti
Gabu1405 said:
Hello Guys, beforehand, sorry for bad formatting and some english mistakes.
Let me explain what happened.
I was trying to unlock my Nexus 7 bootloader, but I couldn´t get to the Fastboot mode via adb, so I decided to enter fastboot mode by pressing Power + Volume Down button, but I did this while my tablet was connected to the PC, and after that, it shut down and just don´t turned on anymore. (Never got to fastboot mode)
Now when I connect to windows it only show as an AXP Device and it disconnects and connects when i hold Power button, but never starts.
Also I want to note that.
I didn´t manage to get into fastboot mode.
I didn´t manage to unlock the bootloader.
Didn´t install any Custom Rom.
The device is technically 100% stock, so I don´t expect it to be a Hard Brick, but at the same time, I tried all the button combinations and it still wont turn on.
This happened to anyone? Do you guys have any idea what it could be? Any Sollutions for this?
Thank you.
(Edit: I don´t have the Blobs.bin file in case i need to use the Nvflash.)
Click to expand...
Click to collapse
Check out my guide.
Can anyone with this device provide the exact steps to unlock the bootloader. I have tried the many ways offered via google search and none seem to work. I have USB debugging and OEM unlock allowed in the device settings. I can boot into the bootloader via keys and using ADB. I've tried various key combos to get to the page (supposedly available) that allows one to switch the bootloader from locked to unlocked - no luck.
All help appreciated.
Do you mean that the command fastboot oem unlock doesn't work?
Note that: Unlocking bootloader wipes all device's data!
XDHx86 said:
Do you mean that the command fastboot oem unlock doesn't work?
Note that: Unlocking bootloader wipes all device's data!
Click to expand...
Click to collapse
Thanks for your reply and new suggestion. No that does not work either. I go to bootloader download mode, enter the command "fastboot oem unlock" and get "waiting on device". I am connected to the device as I get a response when queried "adb devices". Any other thoughts/suggestions?
[email protected] said:
Thanks for your reply and new suggestion. No that does not work either. I go to bootloader download mode, enter the command "fastboot oem unlock" and get "waiting on device". I am connected to the device as I get a response when queried "adb devices". Any other thoughts/suggestions?
Click to expand...
Click to collapse
You're supposed to boot the device to fastboot/bootloader by adb reboot bootloader not download mode.
Also to detect the device in fastboot the command is fastboot devices
Please if you're new to this stuff then don't do it. May I ask why you're trying to unlock bootloader?
XDHx86 said:
You're supposed to boot the device to fastboot/bootloader by adb reboot bootloader not download mode.
Also to detect the device in fastboot the command is fastboot devices
Please if you're new to this stuff then don't do it. May I ask why you're trying to unlock bootloader?
Click to expand...
Click to collapse
Again, thanks for your reply. I have previously installed Lineage on a Fire HD8. So not quite a newbie but everyone is new once - right? I am trying to install Lineage on this SM-T290.
The command "fastboot devices" is not returning anything but "adb devices" does which leads me to believe my hardware connections are correct. "adb reboot bootloader" does take me to the bootloader but it indicates download mode.
I suspect I am missing something simple. Your help is appreciated. Thanks
You need to enable OEM unlock and debugging mode first. And make sure the PC is allowed to debug on your phone.
Also if fastboot command doesn't return anything then most likely you need the correct device driver, you can get it from here.
Alternatively you can try this method:
Boot to download mode.
Long press volume up. This will wipe your data and automatically reboot.
After reboot you should have unlocked bootloader and OEM unlock option greyed out in the settings.
Installing custom ROM doesn't make your device better.
XDHx86 said:
You need to enable OEM unlock and debugging mode first. And make sure the PC is allowed to debug on your phone.
Also if fastboot command doesn't return anything then most likely you need the correct device driver, you can get it from here.
Alternatively you can try this method:
Boot to download mode.
Long press volume up. This will wipe your data and automatically reboot.
After reboot you should have unlocked bootloader and OEM unlock option greyed out in the settings.
Installing custom ROM doesn't make your device better.
Click to expand...
Click to collapse
Thanks but still no go.
I have enabled usb debugging and enabled OEM unlock (both done previously)
I have (had) installed latest drivers previously
adb devices returns my unit data
adb reboot bootloader command puts device in "download mode !!"
fastboot devices returns "waiting on device"
fastboot oem unlock also returns "waiting on device"
Attempted your alternative method, no go
I understand custom ROM doesn't make device better. I like the learning challenge. Hope you understand. Appreciate your help thus far and any other ideas you might have.
This is 100% driver issue, I already provided the driver link.
The device driver may be different from internet provided driver through windows device manager. Or the driver installed upon connecting the device.
XDHx86 said:
This is 100% driver issue, I already provided the driver link.
The device driver may be different from internet provided driver through windows device manager. Or the driver installed upon connecting the device.
Click to expand...
Click to collapse
Thanks. I had installed a driver from the link you supplied (there were a few options). I'll try others. I appreciate all your help!
Here's how I did it.
Enable Developer mode, usb debug, OEM unlock (you've already done those, by the sound of things).
Power the tablet OFF.
Have your USB cable plugged into the computer but NOT the tablet.
Hold the volume up AND volume down keys simultaneously, then connect the USB cable.
The tablet will vibrate and show a blue-green screen, with Warning at the top and a white triangle with an exclamation mark at the bottom. (This is different from download mode.)
From here, long-press volume up to go into device unlock mode. Follow the instructions.
Heeni said:
Here's how I did it.
Enable Developer mode, usb debug, OEM unlock (you've already done those, by the sound of things).
Power the tablet OFF.
Have your USB cable plugged into the computer but NOT the tablet.
Hold the volume up AND volume down keys simultaneously, then connect the USB cable.
The tablet will vibrate and show a blue-green screen, with Warning at the top and a white triangle with an exclamation mark at the bottom. (This is different from download mode.)
From here, long-press volume up to go into device unlock mode. Follow the instructions.
Click to expand...
Click to collapse
Thanks again but no luck. Let's start with some basics:
My device is a Galaxy Tab A SM-T290 8.0 2019 one UA core version 2.1
Android 10
When I, with power off, press both UP & DOWN volume keys simultaneously, wait a few seconds, insert the USB cable (already in computer), I get a vibration but then a circle with a lightning bolt that shows the battery charge status. The screen does not go blue-green and there is no warning.
I have tried releasing the buttons after the vibration and after I see the battery power circle. No change.
I continue to appreciate your help but feel I am missing something simple or my device is not same as yours.
Let me know if you have given up!
[email protected] said:
Thanks again but no luck. Let's start with some basics:
My device is a Galaxy Tab A SM-T290 8.0 2019 one UA core version 2.1
Android 10
When I, with power off, press both UP & DOWN volume keys simultaneously, wait a few seconds, insert the USB cable (already in computer), I get a vibration but then a circle with a lightning bolt that shows the battery charge status. The screen does not go blue-green and there is no warning.
I have tried releasing the buttons after the vibration and after I see the battery power circle. No change.
I continue to appreciate your help but feel I am missing something simple or my device is not same as yours.
Let me know if you have given up!
Click to expand...
Click to collapse
I see that your tablet has One UA core.
That may make a difference. I can't remember now where I saw it (somewhere on these forums), but I recall seeing that One UI Core is more locked down than the "ordinary" One UI version. Incidentally, I get the same response as you if I plug the tablet into a charger (not computer) while pressing both volume keys.
I'll mention at this point that I'm on the point of going back to stock and relocking the bootloader, because I've not been able to have a custom ROM or recovery and a screenlock (PIN, password, or pattern) at the same time, and no one seems to know any workaround for this. I'm starting to wonder if my tablet is somehow odd.
It's a nice piece of hardware, but a right pain to do any mods to, and Samsung's extra security "features" can cause problems.
Heeni said:
I see that your tablet has One UA core.
That may make a difference. I can't remember now where I saw it (somewhere on these forums), but I recall seeing that One UI Core is more locked down than the "ordinary" One UI version. Incidentally, I get the same response as you if I plug the tablet into a charger (not computer) while pressing both volume keys.
I'll mention at this point that I'm on the point of going back to stock and relocking the bootloader, because I've not been able to have a custom ROM or recovery and a screenlock (PIN, password, or pattern) at the same time, and no one seems to know any workaround for this. I'm starting to wonder if my tablet is somehow odd.
It's a nice piece of hardware, but a right pain to do any mods to, and Samsung's extra security "features" can cause problems.
Click to expand...
Click to collapse
Hey! Once again want to thank you for hangin' in with me on this. So, it seems we have slightly different machines. I purchased mine at COSTCO. They offer a lot of good stuff at low prices. I've noticed, however, they tweak their offerings a little bit so they can honestly say "you can't get this somewhere else." Perhaps the difference in our machines explains that.
I definitely had my unit plugged into the USB port on my computer, not a power supply.
My only purpose in attempting this was the satisfaction of doing it and having two tablets with different operating systems.
Thanks again for your help. All the best!
Here's the reference to One UI Core that I was thinking of: https://forum.xda-developers.com/t/root-for-sm-t290-tab-a-8-0-2019.3965624/post-84355183
I'm not based in North America, and the local market isn't big enough to have retailer-specific variants (or, at least, I've never heard of any), so I probably have a standard item. But from what I've read, specially locked-down items are reasonably common in the US. Which doesn't make it any less frustrating.
Heeni said:
Here's the reference to One UI Core that I was thinking of: https://forum.xda-developers.com/t/root-for-sm-t290-tab-a-8-0-2019.3965624/post-84355183
I'm not based in North America, and the local market isn't big enough to have retailer-specific variants (or, at least, I've never heard of any), so I probably have a standard item. But from what I've read, specially locked-down items are reasonably common in the US. Which doesn't make it any less frustrating.
Click to expand...
Click to collapse
I read the post and tried the extra step of holding the up volume key when the power screen came on. It also didn't work. Unless something new shows up, my quest to unlock this bootlocker is over. I'll find some other technical challenge to chase.
I had the thought of contacting Samsung to see if they would tell me how to do this. My unit is well out of warranty so why should they care? Likely they wouldn't tell me anything but .....
I'm on Denver CO. Where are you? In my work and fun travels I've had the opportunity to visit many parts of the world. Perhaps I've been to your country?
Again thanks for all your help. I could not have gotten as far as I did without it.
I'm in Auckland, New Zealand. It's a good place to live but not if you want cheap tech. Freight costs tend to be high.
Heeni said:
I'm in Auckland, New Zealand. It's a good place to live but not if you want cheap tech. Freight costs tend to be high.
Click to expand...
Click to collapse
Never been to New Zealand. On the bucket list as it seems a beautiful place to live. Been to your close neighbor Austrailia a number of times. Want to go there again to snorkel on the barrier reef. All the best!
[email protected] said:
I read the post and tried the extra step of holding the up volume key when the power screen came on. It also didn't work. Unless something new shows up, my quest to unlock this bootlocker is over. I'll find some other technical challenge to chase.
I had the thought of contacting Samsung to see if they would tell me how to do this. My unit is well out of warranty so why should they care? Likely they wouldn't tell me anything but .....
I'm on Denver CO. Where are you? In my work and fun travels I've had the opportunity to visit many parts of the world. Perhaps I've been to your country?
Again thanks for all your help. I could not have gotten as far as I did without it.
Click to expand...
Click to collapse
Try method below. It worked for me.
Root for SM-T290 (tab a 8.0 2019)
Hi guys, I just bought an SM-T290 for my wife and I was unable to find any info here about rooting it. As most Tab-A tablets "are here", can I use a guide (and twrp) for an older tablet for this newer model?
forum.xda-developers.com
bignikescar said:
Try method below. It worked for me.
Root for SM-T290 (tab a 8.0 2019)
Hi guys, I just bought an SM-T290 for my wife and I was unable to find any info here about rooting it. As most Tab-A tablets "are here", can I use a guide (and twrp) for an older tablet for this newer model?
forum.xda-developers.com
Click to expand...
Click to collapse
Holding vol up and down, with the tablet off, and plugging in the USB from PC to tablet, works. And it makes no difference which end of the cable you plug in last, so long as the buttons are already pressed before both ends are attached.
XDHx86 said:
Do you mean that the command fastboot oem unlock doesn't work?
Note that: Unlocking bootloader wipes all device's data!
Click to expand...
Click to collapse
You do not need a PC to unlock the bootloader. Turn off the device, then you will want to do Volume Up + Volume Down + USB Cable, and then Long Press Volume Up, and then press Volume Up again.