Database Users

Problem with unbricking Lumia 520

I have problem with unbricking Lumia 520. I've bricked it while flashing engineering SBL3 on Windows 10 with Windows 8.1 FFU. Phone was stuck on 05C6:F006 mode. I switched mode by shorting fourth JTAG pin, now it boots in QHSUSB_DLOAD (05C6:9008). But i can't flash firmware. Tried many .hex files, same effect...
Log:
Code:
c:\Lumia>thor2 -mode emergency -hexfile hex.hex -mbnfile GPT0.bin -orig_gpt
THOR2 1.8.2.18
Built for Windows @ 13:36:46 Jun 16 2015
Thor2 is running on Windows of version 6.2
thor2 -mode emergency -hexfile hex.hex -mbnfile GPT0.bin -orig_gpt
Process started Sat Aug 13 20:03:36 2016
Logging to file C:\Users\gabixdev\AppData\Local\Temp\thor2_win_20160813200336_ThreadId-2248.log
Debugging enabled for emergency
Initiating emergency download
Using default emergency protocol
ALPHA EMERGENCY FLASH START
Emergency Programmer V1 version 2014.10.31.001
Hex download selected
Check if device in Dload
Connection to DLOAD mode succeeded
Get Dload parameters
Sending HEX flasher to the device
Sending GO command if HEX flasher successfully uploaded.
Emergency Programmer V1 version 2014.10.31.001
Mbn download selected
Waiting for connection to flash programmer
Connecting to flash programmer
Received valid HELLO_RSP
Safe version=true, transfer size=15360
Received valid SECURITY_RSP
Successfully connected to flash programmer
Connection to flash programmer succeeded
Uploading bootloader(s), UEFI, etc from MBN image to the eMMC. This will take up to 20 seconds
Reading GPT from binary
-- GPT STARTs--
name: DPP
startLBA: 4096
endLBA: 20479
size: 0x0000000000800000 bytes
attributes: 0x0
name: MODEM_FSG
startLBA: 20480
endLBA: 26623
size: 0x0000000000300000 bytes
attributes: 0x0
name: SSD
startLBA: 28672
endLBA: 28703
size: 0x0000000000004000 bytes
attributes: 0x0
name: SBL1
startLBA: 32768
endLBA: 35767
size: 0x0000000000177000 bytes
attributes: 0x0
name: SBL2
startLBA: 36864
endLBA: 39863
size: 0x0000000000177000 bytes
attributes: 0x0
name: SBL3
startLBA: 40960
endLBA: 45055
size: 0x0000000000200000 bytes
attributes: 0x0
name: UEFI
startLBA: 45056
endLBA: 50055
size: 0x0000000000271000 bytes
attributes: 0x0
name: RPM
startLBA: 53248
endLBA: 54247
size: 0x000000000007d000 bytes
attributes: 0x0
name: TZ
startLBA: 57344
endLBA: 58343
size: 0x000000000007d000 bytes
attributes: 0x0
name: WINSECAPP
startLBA: 61440
endLBA: 62463
size: 0x0000000000080000 bytes
attributes: 0x0
name: BACKUP_SBL1
startLBA: 65536
endLBA: 68535
size: 0x0000000000177000 bytes
attributes: 0x0
name: BACKUP_SBL2
startLBA: 69632
endLBA: 72631
size: 0x0000000000177000 bytes
attributes: 0x0
name: BACKUP_SBL3
startLBA: 73728
endLBA: 77823
size: 0x0000000000200000 bytes
attributes: 0x0
name: BACKUP_UEFI
startLBA: 77824
endLBA: 82823
size: 0x0000000000271000 bytes
attributes: 0x0
name: BACKUP_RPM
startLBA: 86016
endLBA: 87015
size: 0x000000000007d000 bytes
attributes: 0x0
name: BACKUP_TZ
startLBA: 90112
endLBA: 91111
size: 0x000000000007d000 bytes
attributes: 0x0
name: BACKUP_WINSECAPP
startLBA: 94208
endLBA: 95231
size: 0x0000000000080000 bytes
attributes: 0x0
name: UEFI_BS_NV
startLBA: 98304
endLBA: 98815
size: 0x0000000000040000 bytes
attributes: 0x0
name: UEFI_NV
startLBA: 102400
endLBA: 102911
size: 0x0000000000040000 bytes
attributes: 0x0
name: PLAT
startLBA: 106496
endLBA: 122879
size: 0x0000000000800000 bytes
attributes: 0x0
name: EFIESP
startLBA: 131072
endLBA: 262143
size: 0x0000000004000000 bytes
attributes: 0x0
name: MODEM_FS1
startLBA: 262144
endLBA: 268287
size: 0x0000000000300000 bytes
attributes: 0x0
name: MODEM_FS2
startLBA: 270336
endLBA: 276479
size: 0x0000000000300000 bytes
attributes: 0x0
name: UEFI_RT_NV
startLBA: 278528
endLBA: 279039
size: 0x0000000000040000 bytes
attributes: 0x0
name: UEFI_RT_NV_RPMB
startLBA: 282624
endLBA: 282879
size: 0x0000000000020000 bytes
attributes: 0x0
-- GPT ENDs --
Sending OPEN_MULTI_REQ
Message send failed with error code -1
Failed to get response to OPEN_MULTI_REQ
ALPHA EMERGENCY FLASH END
Emergency messaging closed successfully
Operation took about 18.00 seconds.
THOR2_EMERGENCYFLASHV1_ERROR_MSG_SEND_RECEIVE_FAILED
THOR2 1.8.2.18 exited with error code 85021 (0x14C1D)
SHA-1 of HEX.hex: 868570B59B84852AFE74DEF65C166AF2EC054742

you can teamview me?

Is there a result by now?

Hello Guy, Can you use teamviewer?
download it and tell me to my mail - [email protected]
i will fix it. or just go to http://forum.xda-developers.com/win...nt/fix-dead-phone-bricked-bootloader-t3496232 maybe it can help you

Samsung S7 Edge Crashing - Not sure why?!

Hi guys
I have a problem with my phone crashing/freezing and I have no idea why!!
I cant replicate the problem either it just happens one or two times a day - And I usually dont know about it until 30mins to a few hours later when I goto use my phone and its frozen !!! (The Always on display shows the time of the crash)
Have a few log files - which I looked at straight after my phone booted up
Code:
--------- beginning of main
W/SELinux (15587): SELinux: seapp_context_lookup: seinfo=default, level=s0:c512,c768, pkgname=org.jtb.alogcat
I/InjectionManager(15587): Inside getClassLibPath caller
W/System (15587): ClassLoader referenced unknown path: /data/app/org.jtb.alogcat-1/lib/arm64
D/RelationGraph(15587): garbageCollect()
--------- beginning of system
D/ContextRelationManager(15587): ContextRelationManager() : FEATURE_ENABLED=true
I/InjectionManager(15587): Inside getClassLibPath + mLibMap{0=, 1=}
W/ResourcesManager(15587): getTopLevelResources: /data/app/org.jtb.alogcat-1/base.apk / 1.0 running in org.jtb.alogcat rsrc of package org.jtb.alogcat
D/ResourcesManager(15587): For user 0 new overlays fetched Null
D/InjectionManager(15587): InjectionManager
D/InjectionManager(15587): fillFeatureStoreMap org.jtb.alogcat
I/InjectionManager(15587): Constructor org.jtb.alogcat, Feature store :{}
I/InjectionManager(15587): featureStore :{}
D/RelationGraph(15587): garbageCollect()
W/ResourcesManager(15587): getTopLevelResources: /data/app/org.jtb.alogcat-1/base.apk / 1.0 running in org.jtb.alogcat rsrc of package org.jtb.alogcat
W/ResourcesManager(15587): getTopLevelResources: /data/app/org.jtb.alogcat-1/base.apk / 1.0 running in org.jtb.alogcat rsrc of package org.jtb.alogcat
D/AbsListView(15587): Get MotionRecognitionManager
E/MotionRecognitionManager(15587): mSContextService = [email protected]
E/MotionRecognitionManager(15587): motionService = [email protected]760cf22
E/MotionRecognitionManager(15587): motionService = com.samsung.android.[email protected]
D/Activity(15587): performCreate Call Injection manager
I/InjectionManager(15587): dispatchOnViewCreated > Target : org.jtb.alogcat.LogActivity isFragment :false
D/ViewRootImpl(15587): #1 mView = com.android.internal.policy.MultiPhoneWindow$MultiPhoneDecorView{dd0ca46 I.E...... R.....ID 0,0-0,0}
D/SecWifiDisplayUtil(15587): Metadata value : SecSettings2
D/OpenGLRenderer(15587): Use EGL_SWAP_BEHAVIOR_PRESERVED: true
D/ViewRootImpl(15587): #1 mView = android.widget.LinearLayout{4792934 V.E...... ......I. 0,0-0,0}
D/MultiPhoneWindow(15587): performUpdateVisibility, same visibility false
W/ActivityThread(15587): AppLock checkAppLockState isAppLocked = false pkgName = org.jtb.alogcat
D/libEGL (15587): eglInitialize EGLDisplay = 0x7f74100178
I/OpenGLRenderer(15587): Initialized EGL, version 1.4
D/mali_winsys(15587): EGLint new_window_surface(egl_winsys_display*, void*, EGLSurface, EGLConfig, egl_winsys_surface**, egl_color_buffer_format*, EGLBoolean) returns 0x3000, [1440x2560]-format:1
I/InjectionManager(15587): dispatchCreateOptionsMenu :org.jtb.alogcat.LogActivity
I/InjectionManager(15587): dispatchPrepareOptionsMenu :org.jtb.alogcat.LogActivity
W/DisplayListCanvas(15587): DisplayListCanvas is started on unbinded RenderNode (without mOwningView)
D/libGLESv1(15587): DTS_GLAPI : DTS is not allowed for Package : org.jtb.alogcat
D/ViewRootImpl(15587): MSG_RESIZED_REPORT: ci=Rect(0, 96 - 0, 0) vi=Rect(0, 96 - 0, 0) or=1
D/ViewRootImpl(15587): MSG_RESIZED_REPORT: ci=Rect(0, 0 - 0, 0) vi=Rect(0, 0 - 0, 0) or=1
I/Timeline(15587): Timeline: Activity_idle id: [email protected] time:137109
D/ViewRootImpl(15587): #3 mView = null
D/ViewRootImpl(15587): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(15587): ViewPostImeInputStage processPointer 1
I/InjectionManager(15587): dispatchPrepareOptionsMenu :org.jtb.alogcat.LogActivity
D/AbsListView(15587): Get MotionRecognitionManager
D/ViewRootImpl(15587): #1 mView = android.widget.PopupWindow$PopupDecorView{7fdb5fd V.E...... ......I. 0,0-0,0}
D/mali_winsys(15587): EGLint new_window_surface(egl_winsys_display*, void*, EGLSurface, EGLConfig, egl_winsys_surface**, egl_color_buffer_format*, EGLBoolean) returns 0x3000, [848x841]-format:1
W/DisplayListCanvas(15587): DisplayListCanvas is started on unbinded RenderNode (without mOwningView)
D/ViewRootImpl(15587): MSG_RESIZED_REPORT: ci=Rect(0, 0 - 0, 0) vi=Rect(0, 0 - 0, 0) or=1
Code:
--------- beginning of main
D/mali_winsys(17024): EGLint new_window_surface(egl_winsys_display*, void*, EGLSurface, EGLConfig, egl_winsys_surface**, egl_color_buffer_format*, EGLBoolean) returns 0x3000, [1440x2560]-format:1
D/ViewRootImpl(17024): #1 mView = android.widget.LinearLayout{dade76a V.E...... ......I. 0,0-0,0}
D/ViewRootImpl(17024): MSG_RESIZED_REPORT: ci=Rect(0, 0 - 0, 0) vi=Rect(0, 0 - 0, 0) or=1
I/Timeline(17024): Timeline: Activity_idle id: [email protected] time:4666967
D/ViewRootImpl(17024): #3 mView = null
D/mali_winsys(17024): EGLint new_window_surface(egl_winsys_display*, void*, EGLSurface, EGLConfig, egl_winsys_surface**, egl_color_buffer_format*, EGLBoolean) returns 0x3000, [1440x2560]-format:1
D/ViewRootImpl(17024): #1 mView = android.widget.LinearLayout{8a6449c V.E...... ......I. 0,0-0,0}
D/ViewRootImpl(17024): MSG_RESIZED_REPORT: ci=Rect(0, 0 - 0, 0) vi=Rect(0, 0 - 0, 0) or=1
I/Timeline(17024): Timeline: Activity_idle id: [email protected] time:4829125
D/ViewRootImpl(17024): #3 mView = null
D/ViewRootImpl(17024): #1 mView = android.widget.LinearLayout{bc6e0df V.E...... ......I. 0,0-0,0}
D/ViewRootImpl(17024): MSG_RESIZED_REPORT: ci=Rect(0, 0 - 0, 0) vi=Rect(0, 0 - 0, 0) or=1
I/Timeline(17024): Timeline: Activity_idle id: [email protected] time:5051016
D/ViewRootImpl(17024): #3 mView = null
D/ViewRootImpl(17024): #1 mView = android.widget.LinearLayout{4a7e98a V.E...... ......I. 0,0-0,0}
D/ViewRootImpl(17024): MSG_RESIZED_REPORT: ci=Rect(0, 0 - 0, 0) vi=Rect(0, 0 - 0, 0) or=1
I/Timeline(17024): Timeline: Activity_idle id: [email protected] time:5053842
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): #3 mView = null
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
I/InjectionManager(17024): dispatchPrepareOptionsMenu :org.jtb.alogcat.LogActivity
D/AbsListView(17024): Get MotionRecognitionManager
D/ViewRootImpl(17024): #1 mView = android.widget.PopupWindow$PopupDecorView{6720ef9 V.E...... ......I. 0,0-0,0}
D/mali_winsys(17024): EGLint new_window_surface(egl_winsys_display*, void*, EGLSurface, EGLConfig, egl_winsys_surface**, egl_color_buffer_format*, EGLBoolean) returns 0x3000, [848x841]-format:1
W/DisplayListCanvas(17024): DisplayListCanvas is started on unbinded RenderNode (without mOwningView)
D/ViewRootImpl(17024): MSG_RESIZED_REPORT: ci=Rect(0, 0 - 0, 0) vi=Rect(0, 0 - 0, 0) or=1
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): #3 mView = null
W/InputEventReceiver(17024): Attempted to finish an input event but the input event receiver has already been disposed.
W/InputEventReceiver(17024): Attempted to finish an input event but the input event receiver has already been disposed.
E/ViewRootImpl(17024): sendUserActionEvent() mView == null
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
I/InjectionManager(17024): dispatchOptionsItemSelected :org.jtb.alogcat.LogActivity
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
I/InjectionManager(17024): dispatchOptionsItemSelected :org.jtb.alogcat.LogActivity
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
I/InjectionManager(17024): dispatchOptionsItemSelected :org.jtb.alogcat.LogActivity
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/AbsListView(17024): Get MotionRecognitionManager
D/ViewRootImpl(17024): #1 mView = com.android.internal.policy.PhoneWindow$DecorView{5303338 V.E...... R.....I. 0,0-0,0}
D/mali_winsys(17024): EGLint new_window_surface(egl_winsys_display*, void*, EGLSurface, EGLConfig, egl_winsys_surface**, egl_color_buffer_format*, EGLBoolean) returns 0x3000, [1336x451]-format:1
W/DisplayListCanvas(17024): DisplayListCanvas is started on unbinded RenderNode (without mOwningView)
D/ViewRootImpl(17024): MSG_RESIZED_REPORT: ci=Rect(0, 0 - 0, 0) vi=Rect(0, 0 - 0, 0) or=1
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): #3 mView = null
W/InputEventReceiver(17024): Attempted to finish an input event but the input event receiver has already been disposed.
E/ViewRootImpl(17024): sendUserActionEvent() mView == null
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
I/InjectionManager(17024): dispatchPrepareOptionsMenu :org.jtb.alogcat.LogActivity
D/AbsListView(17024): Get MotionRecognitionManager
D/ViewRootImpl(17024): #1 mView = android.widget.PopupWindow$PopupDecorView{84db9d6 V.E...... ......I. 0,0-0,0}
D/mali_winsys(17024): EGLint new_window_surface(egl_winsys_display*, void*, EGLSurface, EGLConfig, egl_winsys_surface**, egl_color_buffer_format*, EGLBoolean) returns 0x3000, [848x841]-format:1
W/DisplayListCanvas(17024): DisplayListCanvas is started on unbinded RenderNode (without mOwningView)
D/ViewRootImpl(17024): MSG_RESIZED_REPORT: ci=Rect(0, 0 - 0, 0) vi=Rect(0, 0 - 0, 0) or=1
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
I/InjectionManager(17024): dispatchOptionsItemSelected :org.jtb.alogcat.LogActivity
I/Timeline(17024): Timeline: Activity_launch_request id:org.jtb.alogcat time:5075640
D/ViewRootImpl(17024): #3 mView = null
E/ViewRootImpl(17024): sendUserActionEvent() mView == null
D/RelationGraph(17024): garbageCollect()
D/AbsListView(17024): Get MotionRecognitionManager
E/MotionRecognitionManager(17024): mSContextService = [email protected]
E/MotionRecognitionManager(17024): motionService = [email protected]eafdf27
E/MotionRecognitionManager(17024): motionService = [email protected]eafdf27
I/InjectionManager(17024): dispatchBuildHeader > Target : org.jtb.alogcat.PrefsActivity
D/AbsListView(17024): Get MotionRecognitionManager
D/Activity(17024): performCreate Call Injection manager
I/InjectionManager(17024): dispatchPreferences > Target : org.jtb.alogcat.PrefsActivity
I/InjectionManager(17024): dispatchOnViewCreated > Target : org.jtb.alogcat.PrefsActivity isFragment :false
D/ViewRootImpl(17024): #1 mView = com.android.internal.policy.MultiPhoneWindow$MultiPhoneDecorView{6bc2c96 I.E...... R.....ID 0,0-0,0}
W/System.err(17024): remove failed: ENOENT (No such file or directory) : /data/user/0/org.jtb.alogcat/shared_prefs/org.jtb.alogcat_preferences.xml.bak
D/MultiPhoneWindow(17024): performUpdateVisibility, same visibility false
D/mali_winsys(17024): EGLint new_window_surface(egl_winsys_display*, void*, EGLSurface, EGLConfig, egl_winsys_surface**, egl_color_buffer_format*, EGLBoolean) returns 0x3000, [1440x2560]-format:1
I/InjectionManager(17024): dispatchCreateOptionsMenu :org.jtb.alogcat.PrefsActivity
I/InjectionManager(17024): dispatchPrepareOptionsMenu :org.jtb.alogcat.PrefsActivity
W/DisplayListCanvas(17024): DisplayListCanvas is started on unbinded RenderNode (without mOwningView)
D/ViewRootImpl(17024): MSG_RESIZED_REPORT: ci=Rect(0, 96 - 0, 0) vi=Rect(0, 96 - 0, 0) or=1
I/Timeline(17024): Timeline: Activity_idle id: [email protected] time:5075924
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
D/ViewRootImpl(17024): ViewPostImeInputStage processKey 0
D/ViewRootImpl(17024): ViewPostImeInputStage processKey 1
D/mali_winsys(17024): EGLint new_window_surface(egl_winsys_display*, void*, EGLSurface, EGLConfig, egl_winsys_surface**, egl_color_buffer_format*, EGLBoolean) returns 0x3000, [1440x2560]-format:1
D/ViewRootImpl(17024): #1 mView = android.widget.LinearLayout{1d8e790 V.E...... ......I. 0,0-0,0}
D/ViewRootImpl(17024): MSG_RESIZED_REPORT: ci=Rect(0, 0 - 0, 0) vi=Rect(0, 0 - 0, 0) or=1
I/Timeline(17024): Timeline: Activity_idle id: [email protected] time:5078913
D/MultiPhoneWindow(17024): performUpdateVisibility, same visibility false
D/ViewRootImpl(17024): #3 mView = null
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 0
D/ViewRootImpl(17024): #3 mView = null
D/ViewRootImpl(17024): ViewPostImeInputStage processPointer 1
I/InjectionManager(17024): dispatchOptionsItemSelected :org.jtb.alogcat.LogActivity
I/WebViewFactory(17024): Loading com.google.android.webview version 53.0.2785.124 (code 278512450)
I/InjectionManager(17024): Inside getClassLibPath caller
I/art (17024): Rejecting re-init on previously-failed class java.lang.Class<com.android.webview.chromium.ServiceWorkerControllerAdapter>
I/art (17024): Rejecting re-init on previously-failed class java.lang.Class<com.android.webview.chromium.ServiceWorkerControllerAdapter>
I/art (17024): Rejecting re-init on previously-failed class java.lang.Class<com.android.webview.chromium.TokenBindingManagerAdapter>
I/art (17024): Rejecting re-init on previously-failed class java.lang.Class<com.android.webview.chromium.TokenBindingManagerAdapter>
I/cr_LibraryLoader(17024): Time to load native libraries: 3 ms (timestamps 9715-9718)
I/cr_LibraryLoader(17024): Expected native library version number "53.0.2785.124", actual native library version number "53.0.2785.124"
V/WebViewChromiumFactoryProvider(17024): Binding Chromium to main looper Looper (main, tid 1) {48a479a}
I/cr_LibraryLoader(17024): Expected native library version number "53.0.2785.124", actual native library version number "53.0.2785.124"
I/chromium(17024): [INFO:library_loader_hooks.cc(151)] Chromium logging enabled: level = 0, default verbosity = 0
W/System.err(17024): remove failed: ENOENT (No such file or directory) : /data/user/0/org.jtb.alogcat/shared_prefs/WebViewChromiumPrefs.xml.bak
I/cr_BrowserStartup(17024): Initializing chromium process, singleProcess=true
D/libEGL (17024): eglInitialize EGLDisplay = 0x7fdc176518
W/cr_media(17024): Requires BLUETOOTH permission
D/ViewRootImpl(17024): #1 mView = com.android.internal.policy.PhoneWindow$DecorView{1c08f52 V.E...... R.....I. 0,0-0,0}
D/mali_winsys(17024): EGLint new_window_surface(egl_winsys_display*, void*, EGLSurface, EGLConfig, egl_winsys_surface**, egl_color_buffer_format*, EGLBoolean) returns 0x3000, [1336x1062]-format:1
W/ClipboardExManager(17024): hasData : 2, -1, null
W/DisplayListCanvas(17024): DisplayListCanvas is started on unbinded RenderNode (without mOwningView)
W/DisplayListCanvas(17024): DisplayListCanvas is started on unbinded RenderNode (without mOwningView)
D/ViewRootImpl(17024): MSG_RESIZED_REPORT: ci=Rect(0, 0 - 0, 0) vi=Rect(0, 0 - 0, 0) or=1
W/DisplayListCanvas(17024): DisplayListCanvas is started on unbinded RenderNode (without mOwningView)
D/ViewRootImpl(17024): MSG_RESIZED_REPORT: ci=Rect(0, 0 - 0, 0) vi=Rect(0, 0 - 0, 0) or=1
D/ViewRootImpl(17024): #1 mView = android.widget.LinearLayout{f7265c3 V.E...... ......I. 0,0-0,0}
W/DisplayListCanvas(17024): DisplayListCanvas is started on unbinded RenderNode (without mOwningView)
--------- beginning of system
W/ActivityThread(17024): AppLock checkAppLockState isAppLocked = false pkgName = org.jtb.alogcat
D/ViewRootImpl(17024): MSG_RESIZED_REPORT: ci=Rect(0, 0 - 0, 0) vi=Rect(0, 0 - 0, 0) or=1
V/ActivityThread(17024): updateVisibility : ActivityRecord{ada7795 [email protected] {org.jtb.alogcat/org.jtb.alogcat.LogActivity}} show : true
I/Timeline(17024): Timeline: Activity_idle id: [email protected] time:5279980
D/ViewRootImpl(17024): #3 mView = null
D/ViewRootImpl(17024): #1 mView = android.widget.LinearLayout{58d5c35 V.E...... ......I. 0,0-0,0}
W/ActivityThread(17024): AppLock checkAppLockState isAppLocked = false pkgName = org.jtb.alogcat
D/ViewRootImpl(17024): MSG_RESIZED_REPORT: ci=Rect(0, 0 - 0, 0) vi=Rect(0, 0 - 0, 0) or=1
I/Timeline(17024): Timeline: Activity_idle id: [email protected] time:5305291
W/DisplayListCanvas(17024): DisplayListCanvas is started on unbinded RenderNode (without mOwningView)
D/ViewRootImpl(17024): ViewPostImeInputStage processKey 0
Hopefully someone can help me from the above log? Or give me another suggestion!?!
I could be wrong but I seem to see this 'error' a bit?
E/MotionRecognitionManager(17024): mSContextService = [email protected]
E/MotionRecognitionManager(17024): motionService = [email protected]eafdf27
E/MotionRecognitionManager(17024): motionService = [email protected]eafdf27
Using Superman Rom v1.13.1
Baseband: G935FXXU1APD1
Android 6.0.1
Kernal 3.18.41-SuperKern_SM-G935F_V1.7.1 [email protected] #1
Build: MMB29K.G935FXXU1BPHJ

There's your problem your on another rom goto the rom thread and ask there it's probably related maybe you flashed a custom kernel as well and it's conflicting with crashes

102skysx said:
There's your problem your on another rom goto the rom thread and ask there it's probably related maybe you flashed a custom kernel as well and it's conflicting with crashes
Click to expand...
Click to collapse
I will do that - but nothing can be taken from the above logs ?

ExodusNZ said:
I will do that - but nothing can be taken from the above logs ?
Click to expand...
Click to collapse
Not me I'm not someone who can read that stuff not a developer
Your best bet would be to goto the main thread and hopefully the developer is still active to respond to your issue

102skysx said:
Not me I'm not someone who can read that stuff not a developer
Your best bet would be to goto the main thread and hopefully the developer is still active to respond to your issue
Click to expand...
Click to collapse
Thanks - Ive done that now , hopefully he reads its - Or hopefully someone else replies on this page

Debricking my Rockchip Device

I would like to share my experience from the weekend to help others.
At first let me explain the situation:
I got my A5X Max+ 64GB eMMC preinstalled with Android 8.1 but I thought that the latest firmware available on the net can maybe make a positive difference to the shipped one.
Seraching the web I found 3 different firmware version I thoght it would be good to give it a try.
An A5X MAX+ Android 8.1 firmware
An A5X MAX+ Android 7 firmware
An A5X MAX Android 9 firmware (non "+" uses a dirfferent WiFi Chipset,....)
Next Step folowing the firmware upgrade guides:
1. Trying to directly flash a new firmware via a SD card and SD_Firmware_Tool_v146_eng_AndroidPC failed
2. Trying to flash with a computer using RK_Batch_tool_v1_8_AndroidPC in combination with Rockchip_DriverAssitant_v4.4 is working
Ok no difference to the preinstalled one so next step flashing a different firmware.
The most interesting was the Android 9.0 firmware even when I know that it is for the non "+" version using a slightly different peripheral hardware.
So I use the Batch tool again and start flashing. ==> Do not flash similar firmware on any device.
The flash process abort after flashing only parts of the whole image.
My Box is not starting anymore, and there is no video output when booting and it is not recognized by my computer anymore via USB
My process to debrick my Device:
My luck when starting into Recovery it is still recognized via USB
Also there a dedicated test pins marked with TX, GND and RX so I connect a Serial to USB converter and check if I can find the problem.
I could not find out what kind of baud rate the serial is using neither Start/Stop Bit configuration.
A oscilloscope (Red Pitaya) helped a lot to see that the serial interface is working at a abnormal high baud rate: ~1350000 baud per second / 8N1
find here the current bootloop log:
normal boot
Code:
Wed Oct 31 06:28:55 UTC 2018 aarch64)
INF [0x0] TEE-CORE:init_primary_helper:338: Release version: 1.4
INF [0x0] TEE-CORE:init_teecore:83: teecore inits done
INFO: BL31: Preparing for EL3 exit to normal world
INFO: Entry point address = 0x200000
INFO: SPSR = 0x3c9
U-Boot 2017.09-02211-gd8ce1d0-dirty (Nov 27 2018 - 09:57:42 +0800)
Model: Rockchip RK3328 EVB
DRAM: 4 GiB
Relocation Offset is: fcbda000
Using default environment
[email protected]: 1, [email protected]: 0
Card did not respond to voltage select!
mmc_init: -95, time 10
switch to partitions #0, OK
mmc0(part 0) is current device
boot mode: normal
bad resource image magic: oint (current EL)
DTB: rk-kernel.dtb
bad resource image magic: oint (current EL)
Can't find file:rk-kernel.dtb
init_kernel_dtb dtb in resource read fail
In: serial
Out: serial
Err: serial
Model: Rockchip RK3328 EVB
rockchip_set_serialno: could not find efuse device
CLK: apll 400000000 Hz
dpll 664000000 Hz
cpll 1200000000 Hz
gpll 491009999 Hz
npll 600000000 Hz
armclk 600000000 Hz
aclk_bus 150000000 Hz
hclk_bus 75000000 Hz
pclk_bus 75000000 Hz
aclk_peri 150000000 Hz
hclk_peri 75000000 Hz
pclk_peri 75000000 Hz
Net: Net Initialization Skipped
No ethernet found.
Hit any key to stop autoboot: 0
ca head not found
ANDROID: reboot reason: "(none)"
get share memory, arg0=0x0 arg1=0x9e08000 arg2=0x3f8000 arg3=0x1
read_is_device_unlocked() ops returned that device is UNLOCKED
avb_slot_verify.c:637: ERROR: vbmeta: Error verifying vbmeta image: OK_NOT_SIGNE D
get share memory, arg0=0x0 arg1=0x9e08000 arg2=0x3f8000 arg3=0x1
DDR version 1.13 20180428
ID:0x805 N
In
DDR3
333MHz
Bus Width=32 Col=11 Bank=8 Row=16 CS=1 Die Bus-Width=16 Size=4096MB
ddrconfig:3
OUT
Boot1 Release Time: Sep 7 2018 15:49:55, version: 2.49
ChipType = 0x11, 193
mmc2:cmd19,100
SdmmcInit=2 0
BootCapSize=2000
UserCapSize=59640MB
FwPartOffset=2000 , 2000
SdmmcInit=0 NOT PRESENT
StorageInit ok = 286281
Raw SecureMode = 0
SecureInit read PBA: 0x4
SecureInit read PBA: 0x404
SecureInit read PBA: 0x804
SecureInit read PBA: 0xc04
SecureInit read PBA: 0x1004
SecureInit ret = 0, SecureMode = 0
GPT part: 0, name: uboot, start:0x4000, size:0x2000
GPT part: 1, name: trust, start:0x6000, size:0x2000
GPT part: 2, name: misc, start:0x8000, size:0x2000
GPT part: 3, name: baseparameter, start:0xa000, size:0x800
GPT part: 4, name: resource, start:0xa800, size:0x8000
GPT part: 5, name: kernel, start:0x12800, size:0x10000
GPT part: 6, name: dtb, start:0x22800, size:0x2000
GPT part: 7, name: dtbo, start:0x24800, size:0x2000
GPT part: 8, name: logo, start:0x26800, size:0x8000
GPT part: 9, name: vbmeta, start:0x2e800, size:0x800
GPT part: 10, name: boot, start:0x2f000, size:0x10000
GPT part: 11, name: recovery, start:0x3f000, size:0x20000
GPT part: 12, name: backup, start:0x5f000, size:0x8000
GPT part: 13, name: cache, start:0x67000, size:0x80000
GPT part: 14, name: system, start:0xe7000, size:0x400000
GPT part: 15, name: metadata, start:0x4e7000, size:0x8000
GPT part: 16, name: vendor, start:0x4ef000, size:0x60000
GPT part: 17, name: oem, start:0x54f000, size:0x20000
GPT part: 18, name: frp, start:0x56f000, size:0x400
GPT part: 19, name: security, start:0x56f400, size:0x1000
GPT part: 20, name: userdata, start:0x570400, size:0x6f0bbdf
find partition:uboot OK. first_lba:0x4000.
find partition:trust OK. first_lba:0x6000.
LoadTrust Addr:0x6000
No find bl30.bin
HashBits:256, HashData:
6cf28742
2df532aa
1ea29e7b
85e4e128
9675b550
859f84c1
c47158c4
9373e8ea
CalcHash:
2a0cacfb
655bd8b6
09989b08
c0ff4464
9d525d13
47eb7212
89197119
20d1a938
bl31.bin_0:CheckImage Fail!
LoadTrust Addr:0x6400
LoadTrust Addr:0x6800
LoadTrust Addr:0x6c00
LoadTrust Addr:0x7000
No find bl30.bin
Load uboot, ReadLba = 4000
hdr 000000000337a380 + 0x0:0x50,0x41,0x52,0x4d,0x66,0x03,0x00,0x00,0x46,0x49,0x52,0x4d,0x57,0x41,0x52,0x45,
Load OK, addr=0x200000, size=0xeb934
RunBL31 0x10000
NOTICE: BL31: v1.3(debug):9d3f591
NOTICE: BL31: Built : 14:39:02, Jan 17 2018
NOTICE: BL31:Rockchip release version: v1.3
INFO: ARM GICv2 driver initialized
INFO: Using opteed sec cpu_context!
INFO: boot cpu mask: 1
INFO: plat_rockchip_pmu_init: pd status 0xe
INFO: BL31: Initializing runtime services
INFO: BL31: Initializing BL32
ERR [0x0] TEE-CORE:atags_get_tag:146: atags_get_tag: find unknown magic(d7f5f65b)
INF [0x0] TEE-CORE:init_primary_helper:337: Initializing (1.1.0-187-g3f0aafa6 #9 Wed Oct 31 06:28:55 UTC 2018 aarch64)
pressing and holding reset (without connecting to USB)
Code:
Wed Oct 31 06:28:55 UTC 2018 aarch64)
INF [0x0] TEE-CORE:init_primary_helper:338: Release version: 1.4
INF [0x0] TEE-CORE:init_teecore:83: teecore inits done
INFO: BL31: Preparing for EL3 exit to normal world
INFO: Entry point address = 0x200000
INFO: SPSR = 0x3c9
U-Boot 2017.09-02211-gd8ce1d0-dirty (Nov 27 2018 - 09:57:42 +0800)
Model: Rockchip RK3328 EVB
DRAM: 4 GiB
Relocation Offset is: fcbda000
Using default environment
[email protected]: 1, [email protected]: 0
Card did not respond to voltage select!
mmc_init: -95, time 10
switch to partitions #0, OK
mmc0(part 0) is current device
boot mode: normal
bad resource image magic: oint (current EL)
DTB: rk-kernel.dtb
bad resource image magic: oint (current EL)
Can't find file:rk-kernel.dtb
init_kernel_dtb dtb in resource read fail
In: serial
Out: serial
Err: serial
Model: Rockchip RK3328 EVB
rockchip_set_serialno: could not find efuse device
CLK: apll 400000000 Hz
dpll 664000000 Hz
cpll 1200000000 Hz
gpll 491009999 Hz
npll 600000000 Hz
armclk 600000000 Hz
aclk_bus 150000000 Hz
hclk_bus 75000000 Hz
pclk_bus 75000000 Hz
aclk_peri 150000000 Hz
hclk_peri 75000000 Hz
pclk_peri 75000000 Hz
Net: Net Initialization Skipped
No ethernet found.
Hit any key to stop autoboot: 0
ca head not found
ANDROID: reboot reason: "(none)"
get share memory, arg0=0x0 arg1=0x9e08000 arg2=0x3f8000 arg3=0x1
read_is_device_unlocked() ops returned that device is UNLOCKED
avb_slot_verify.c:637: ERROR: vbmeta: Error verifying vbmeta image: OK_NOT_SIGNE D
get share memory, arg0=0x0 arg1=0x9e08000 arg2=0x3f8000 arg3=0x1
DDR version 1.13 20180428
ID:0x805 N
In
DDR3
333MHz
Bus Width=32 Col=11 Bank=8 Row=16 CS=1 Die Bus-Width=16 Size=4096MB
ddrconfig:3
OUT
Boot1 Release Time: Sep 7 2018 15:49:55, version: 2.49
ChipType = 0x11, 193
mmc2:cmd19,100
SdmmcInit=2 0
BootCapSize=2000
UserCapSize=59640MB
FwPartOffset=2000 , 2000
SdmmcInit=0 NOT PRESENT
StorageInit ok = 286281
Raw SecureMode = 0
SecureInit read PBA: 0x4
SecureInit read PBA: 0x404
SecureInit read PBA: 0x804
SecureInit read PBA: 0xc04
SecureInit read PBA: 0x1004
SecureInit ret = 0, SecureMode = 0
GPT part: 0, name: uboot, start:0x4000, size:0x2000
GPT part: 1, name: trust, start:0x6000, size:0x2000
GPT part: 2, name: misc, start:0x8000, size:0x2000
GPT part: 3, name: baseparameter, start:0xa000, size:0x800
GPT part: 4, name: resource, start:0xa800, size:0x8000
GPT part: 5, name: kernel, start:0x12800, size:0x10000
GPT part: 6, name: dtb, start:0x22800, size:0x2000
GPT part: 7, name: dtbo, start:0x24800, size:0x2000
GPT part: 8, name: logo, start:0x26800, size:0x8000
GPT part: 9, name: vbmeta, start:0x2e800, size:0x800
GPT part: 10, name: boot, start:0x2f000, size:0x10000
GPT part: 11, name: recovery, start:0x3f000, size:0x20000
GPT part: 12, name: backup, start:0x5f000, size:0x8000
GPT part: 13, name: cache, start:0x67000, size:0x80000
GPT part: 14, name: system, start:0xe7000, size:0x400000
GPT part: 15, name: metadata, start:0x4e7000, size:0x8000
GPT part: 16, name: vendor, start:0x4ef000, size:0x60000
GPT part: 17, name: oem, start:0x54f000, size:0x20000
GPT part: 18, name: frp, start:0x56f000, size:0x400
GPT part: 19, name: security, start:0x56f400, size:0x1000
GPT part: 20, name: userdata, start:0x570400, size:0x6f0bbdf
find partition:uboot OK. first_lba:0x4000.
find partition:trust OK. first_lba:0x6000.
LoadTrust Addr:0x6000
No find bl30.bin
HashBits:256, HashData:
6cf28742
2df532aa
1ea29e7b
85e4e128
9675b550
859f84c1
c47158c4
9373e8ea
CalcHash:
2a0cacfb
655bd8b6
09989b08
c0ff4464
9d525d13
47eb7212
89197119
20d1a938
bl31.bin_0:CheckImage Fail!
LoadTrust Addr:0x6400
LoadTrust Addr:0x6800
LoadTrust Addr:0x6c00
LoadTrust Addr:0x7000
No find bl30.bin
Load uboot, ReadLba = 4000
hdr 000000000337a380 + 0x0:0x50,0x41,0x52,0x4d,0x66,0x03,0x00,0x00,0x46,0x49,0x52,0x4d,0x57,0x41,0x52,0x45,
Load OK, addr=0x200000, size=0xeb934
RunBL31 0x10000
NOTICE: BL31: v1.3(debug):9d3f591
NOTICE: BL31: Built : 14:39:02, Jan 17 2018
NOTICE: BL31:Rockchip release version: v1.3
INFO: ARM GICv2 driver initialized
INFO: Using opteed sec cpu_context!
INFO: boot cpu mask: 1
INFO: plat_rockchip_pmu_init: pd status 0xe
INFO: BL31: Initializing runtime services
INFO: BL31: Initializing BL32
ERR [0x0] TEE-CORE:atags_get_tag:146: atags_get_tag: find unknown magic(d7f5f65b)
INF [0x0] TEE-CORE:init_primary_helper:337: Initializing (1.1.0-187-g3f0aafa6 #9 Wed Oct 31 06:28:55 UTC 2018 aarch64)
INF [0x0] TEE-CORE:init_primary_helper:338: Release version: 1.4
INF [0x0] TEE-CORE:init_teecore:83: teecore inits done
INFO: BL31: Preparing for EL3 exit to normal world
INFO: Entry point address = 0x200000
INFO: SPSR = 0x3c9
U-Boot 2017.09-02211-gd8ce1d0-dirty (Nov 27 2018 - 09:57:42 +0800)
Model: Rockchip RK3328 EVB
DRAM: 4 GiB
Relocation Offset is: fcbda000
Using default environment
[email protected]: 1, [email protected]: 0
Card did not respond to voltage select!
mmc_init: -95, time 9
switch to partitions #0, OK
mmc0(part 0) is current device
boot mode: None
bad resource image magic: oint (current EL)
DTB: rk-kernel.dtb
bad resource image magic: oint (current EL)
Can't find file:rk-kernel.dtb
init_kernel_dtb dtb in resource read fail
In: serial
Out: serial
Err: serial
Model: Rockchip RK3328 EVB
rockchip_set_serialno: could not find efuse device
CLK: apll 400000000 Hz
dpll 664000000 Hz
cpll 1200000000 Hz
gpll 491009999 Hz
npll 600000000 Hz
armclk 600000000 Hz
aclk_bus 150000000 Hz
hclk_bus 75000000 Hz
pclk_bus 75000000 Hz
aclk_peri 150000000 Hz
hclk_peri 75000000 Hz
pclk_peri 75000000 Hz
Net: Net Initialization Skipped
No ethernet found.
Hit any key to stop autoboot: 0
ca head not found
ANDROID: reboot reason: "(none)"
get share memory, arg0=0x0 arg1=0x9e08000 arg2=0x3f8000 arg3=0x1
read_is_device_unlocked() ops returned that device is UNLOCKED
avb_slot_verify.c:637: ERROR: vbmeta: Error verifying vbmeta image: OK_NOT_SIGNED
get share memory, arg0=0x0 arg1=0x9e08000 arg2=0x3f8000 arg3=0x1
Booting kernel at 0x207f800 with fdt at f4dcfca0...
## Booting Android Image at 0x0207f800 ...
Kernel load addr 0x02080000 size 19005 KiB
## Flattened Device Tree blob at f4dcfca0
Booting using the fdt blob at 0xf4dcfca0
XIP Kernel Image ... OK
Loading Device Tree to 00000000081fb000, end 00000000081ff0f8 ... OK
Adding bank: 0x00200000 - 0x08400000 (size: 0x08200000)
Adding bank: 0x0a200000 - 0xff000000 (size: 0xf4e00000)
Starting kernel ...
"Synchronous Abort" handler, esr 0x02000000
* Relocate offset = 00000000fcbda000
* ELR(PC) = ffffffff064c6000
* LR = 0000000000201f00
* SP = 00000000f4dcf2a0
* ESR_EL2 = 0000000002000000
EC[31:26] == 000000, Exception with an unknown reason
IL[25] == 1, 32-bit instruction trapped
* DAIF = 00000000000003c0
D[9] == 1, DBG masked
A[8] == 1, ABORT masked
I[7] == 1, IRQ masked
F[6] == 1, FIQ masked
* SPSR_EL2 = 00000000600003c9
D[9] == 1, DBG masked
A[8] == 1, ABORT masked
I[7] == 1, IRQ masked
F[6] == 1, FIQ masked
M[4] == 0, Exception taken from AArch64
M[3:0] == 1001, EL2h
* SCTLR_EL2 = 0000000030c50830
I[12] == 0, Icache disabled
C[2] == 0, Dcache disabled
M[0] == 0, MMU disabled
* HCR_EL2 = 0000000000000002
* VBAR_EL2 = 00000000fcdda800
* TTBR0_EL2 = 00000000feff0000
x0 : 00000000081fb000 x1 : 0000000000000000
x2 : 0000000000000000 x3 : 0000000000000000
x4 : 0000000002080000 x5 : 0000000000000001
x6 : 0000000000000008 x7 : 0000000000000000
x8 : 00000000f4dcf320 x9 : 0000000001008000
x10: 000000000a200023 x11: 0000000000000002
x12: 0000000000000002 x13: 00000000f4dcf36c
x14: 00000000081fb000 x15: 00000000fcddb5a8
x16: 0000000000000002 x17: 00000000081ff0f9
x18: 00000000f4dd1da0 x19: 0000000000000400
x20: 00000000fcec52e0 x21: 0000000000000000
x22: 0000000000000003 x23: 00000000f4dcf630
x24: 0000000000000000 x25: 0000000002080000
x26: 00000000fcddbea4 x27: 0000000000000400
x28: 0000000002080000 x29: 00000000f4dcf480
SP:
f4dcf2a0: 00000000 00000000 00000000 00000000
f4dcf2b0: 00000000 00000000 fcea3759 00000000
f4dcf2c0: 00000000 00000000 00000000 00000000
f4dcf2d0: fcea37a0 00000000 fcea37c6 00000000
f4dcf2e0: fcea3813 00000000 fcea3860 00000000
f4dcf2f0: fcea38a0 00000000 fcea38e0 00000000
f4dcf300: fcea391d 00000000 00000000 00000000
f4dcf310: 00000000 00000000 fcea395a 00000000
f4dcf320: f4dcf480 00000000 fcddaa0c 00000000
f4dcf330: 00000400 00000000 fce9d415 00000000
f4dcf340: feff0000 00000000 00000002 00000000
f4dcf350: 30c50830 00000000 f4dcf2a0 00000000
f4dcf360: 600003c9 00000000 fcdda800 00000000
f4dcf370: 000003c0 00000000 02000000 00000000
f4dcf380: 030a0000 00000000 081fb000 00000000
f4dcf390: 00000000 00000000 00000000 00000000
Resetting CPU ...
WARN: PSCI sysreset is disabled
DDR version 1.13 20180428
ID:0x805 N
In
SRX
DDR3
333MHz
Bus Width=32 Col=11 Bank=8 Row=16 CS=1 Die Bus-Width=16 Size=4096MB
ddrconfig:3
OUT
Boot1 Release Time: Sep 7 2018 15:49:55, version: 2.49
ChipType = 0x11, 261
mmc2:cmd19,100
SdmmcInit=2 0
BootCapSize=2000
UserCapSize=59640MB
FwPartOffset=2000 , 2000
SdmmcInit=0 NOT PRESENT
StorageInit ok = 285008
Raw SecureMode = 0
SecureInit read PBA: 0x4
SecureInit read PBA: 0x404
SecureInit read PBA: 0x804
SecureInit read PBA: 0xc04
SecureInit read PBA: 0x1004
SecureInit ret = 0, SecureMode = 0
GPT part: 0, name: uboot, start:0x4000, size:0x2000
GPT part: 1, name: trust, start:0x6000, size:0x2000
GPT part: 2, name: misc, start:0x8000, size:0x2000
GPT part: 3, name: baseparameter, start:0xa000, size:0x800
GPT part: 4, name: resource, start:0xa800, size:0x8000
GPT part: 5, name: kernel, start:0x12800, size:0x10000
GPT part: 6, name: dtb, start:0x22800, size:0x2000
GPT part: 7, name: dtbo, start:0x24800, size:0x2000
GPT part: 8, name: logo, start:0x26800, size:0x8000
GPT part: 9, name: vbmeta, start:0x2e800, size:0x800
GPT part: 10, name: boot, start:0x2f000, size:0x10000
GPT part: 11, name: recovery, start:0x3f000, size:0x20000
GPT part: 12, name: backup, start:0x5f000, size:0x8000
GPT part: 13, name: cache, start:0x67000, size:0x80000
GPT part: 14, name: system, start:0xe7000, size:0x400000
GPT part: 15, name: metadata, start:0x4e7000, size:0x8000
GPT part: 16, name: vendor, start:0x4ef000, size:0x60000
GPT part: 17, name: oem, start:0x54f000, size:0x20000
GPT part: 18, name: frp, start:0x56f000, size:0x400
GPT part: 19, name: security, start:0x56f400, size:0x1000
GPT part: 20, name: userdata, start:0x570400, size:0x6f0bbdf
find partition:uboot OK. first_lba:0x4000.
find partition:trust OK. first_lba:0x6000.
LoadTrust Addr:0x6000
No find bl30.bin
HashBits:256, HashData:
6cf28742
2df532aa
1ea29e7b
85e4e128
9675b550
859f84c1
c47158c4
9373e8ea
CalcHash:
2a0cacfb
655bd8b6
09989b08
c0ff4464
9d525d13
47eb7212
89197119
20d1a938
bl31.bin_0:CheckImage Fail!
LoadTrust Addr:0x6400
LoadTrust Addr:0x6800
LoadTrust Addr:0x6c00
LoadTrust Addr:0x7000
No find bl30.bin
Load uboot, ReadLba = 4000
hdr 000000000337a380 + 0x0:0x50,0x41,0x52,0x4d,0x66,0x03,0x00,0x00,0x46,0x49,0x52,0x4d,0x57,0x41,0x52,0x45,
Load OK, addr=0x200000, size=0xeb934
RunBL31 0x10000
NOTICE: BL31: v1.3(debug):9d3f591
NOTICE: BL31: Built : 14:39:02, Jan 17 2018
NOTICE: BL31:Rockchip release version: v1.3
INFO: ARM GICv2 driver initialized
INFO: Using opteed sec cpu_context!
INFO: boot cpu mask: 1
INFO: plat_rockchip_pmu_init: pd status 0xe
INFO: BL31: Initializing runtime services
INFO: BL31: Initializing BL32
INF [0x0] TEE-CORE:init_primary_helper:337: Initializing (1.1.0-187-g3f0aafa6 #9 Wed Oct 31 06:28:55 UTC 2018 aarch64)
When connecting USB for flashing the Log shows the detection and do not loop anymore, it is waiting for the process to be initiated by the computer
I try to flash the Android 8.1 firmware without luck because the automatic checks stopped the process before starting
So I tried to flash with Factory Tool 1.6 but also without success, it is checking also before starting the flash process
Searching all over the web I found different versions of these tools and test newer ones but also without success.
After a while I found a Tool called Rockchip Android Tool 2.1 for Rockchip based single board computers.
This tool has much more options to check and flash a Rockchip board over USB.
Most of the checks failed and I figured out that a normal flashing process will always reboot the board into Maskrom mode
It seems that my device is not able to go into Maskrom Mode anymore because after starting the flash process it is reseting and booting normal (bootloop) instead of switching to Maskrom Mode.
A bit of evaluation tells me that the Maskrom Mode can also be achieved by shorting the Flash CLK to ground during boot. (I know a similar process for my Fire HD8 Tablet)
I checked if I can find the CLK line on the board but it seems that it is not accessably from the surface of the PCB.
After minutes of reaserch I figured out that there are also newer version of the Android Tool available and I tested all I can find.
Also Device drivers shall be updated due to a problem report of an Rockchip device singel board computer owner that has also some difficulties working with the tools.
My luck I found RKDevTool 2.52 (The new name of the Android Tool), in this tool a few of the tests for Rockchip devices are working and I was able to flash Android 8.1 and enter the Maskrom Mode sucessfully.
Now that my Device is back alive I will also post some logs and pictures of my device to help others when trying to debrick/reacticate from an unexpected state.

@sandman01
Try this

thanks for your post.
I think I was a bit to euphoric because my box is working again and I only want to share my experiance for others runnign in the same Situation.
It was hard to get all the Information out of the web, from multiple places.

sandman01 said:
thanks for your post.
I think I was a bit to euphoric because my box is working again and I only want to share my experiance for others runnign in the same Situation.
It was hard to get all the Information out of the web, from multiple places.
Click to expand...
Click to collapse
Ok no probs

Can't find those files on Drive anymore, can you please share them? Can't find a place to download RKDevtool
Thanks in advance

boot image repackaged with abootimg fails with "error boot prepare"

Device: Pixel4
Build number: QQ2A.200501.001.B2
Extracted boot.img from factory image.
$ abootimg -i boot.img
Android Boot Image Info:
* file name = boot.img
* image size = 67108864 bytes (64.00 MB)
page size = 4096 bytes
* Boot Name = ""
* kernel size = 20975335 bytes (20.00 MB)
ramdisk size = 10529977 bytes (10.04 MB)
* load addresses:
kernel: 0x00008000
ramdisk: 0x01000000
tags: 0x00000100
* cmdline = console=ttyMSM0,115200n8 androidboot.console=ttyMSM0 printk.devkmsg=on msm_rtb.filter=0x237 ehci-hcd.park=3 service_locator.enable=1 androidboot.memcg=1 cgroup.memory=nokmem usbcore.autosuspend=7 androidboot.usbcontroller=a600000.dwc3 swiotlb=2048 androidboot.boot_devices=soc/1d84000.ufshc buildvariant=user
* id = 0x622e458e 0xec0f5ea0 0x0f7f2da1 0xf8943ad5 0xa963b0ec 0x00000000 0x00000000 0x00000000
I repackaged the boot image with
$ abootimg --create myboot.img -f bootimg.cfg -k zImage -r initrd.img
and I get
$ abootimg -i myboot.img
Android Boot Image Info:
* file name = myboot.img
* image size = 67108864 bytes (64.00 MB)
page size = 4096 bytes
* Boot Name = ""
* kernel size = 20975335 bytes (20.00 MB)
ramdisk size = 10513203 bytes (10.03 MB)
* load addresses:
kernel: 0x00008000
ramdisk: 0x01000000
tags: 0x00000100
* cmdline = console=ttyMSM0,115200n8 androidboot.console=ttyMSM0 printk.devkmsg=on msm_rtb.filter=0x237 ehci-hcd.park=3 service_locator.enable=1 androidboot.memcg=1 cgroup.memory=nokmem usbcore.autosuspend=7 androidboot.usbcontroller=a600000.dwc3 swiotlb=2048 androidboot.boot_devices=soc/1d84000.ufshc buildvariant=user
* id = 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
I have not modified the ramdisk. I am just trying to extract and repackage the boot image, in order to test abootimg.
When flashing new boot image, on boot I get "error boot prepare".
Anyone knows why the abootimg tool is not working? Anything I am doing wrong?

H96 Max X4 superimage

Hi!
I have some problems And sorry for my english.
I bought a H96 Max X4 Android TV box from Geekbuying. I have factory firmwares for it, so i start to modify the device. It has Android TV 11 version.
The device has root shell on adb, but the device not rooted itself.
The problems are:
I can unpack superimage from stock firmware, and able to do dd backup super from device. But i can not use fastboot flashing because of "FAILED (remote: 0ffff13c)" error.
The number changes depending on which superimage I am trying to write.
This is not real problem, beacuse of i can use dd for flash back the images.
But...
If i try to write back the backuped superimage or what extracted from stock FW, everything is okay. But the unpacked and repacked image causes bootloop.
The lpdump says the device's metadata and the repacked superimage's metadata are the same:
ohm:/ # lpdump
Slot 0:
Metadata version: 10.2
Metadata size: 1104 bytes
Metadata max size: 65536 bytes
Metadata slot count: 3
Header flags: virtual_ab_device
Partition table:
------------------------
Name: system_a
Group: amlogic_dynamic_partitions_a
Attributes: readonly
Extents:
0 .. 1839895 linear super 2048
------------------------
Name: system_b
Group: amlogic_dynamic_partitions_b
Attributes: readonly
Extents:
------------------------
Name: vendor_a
Group: amlogic_dynamic_partitions_a
Attributes: readonly
Extents:
0 .. 357943 linear super 1843200
------------------------
Name: vendor_b
Group: amlogic_dynamic_partitions_b
Attributes: readonly
Extents:
------------------------
Name: product_a
Group: amlogic_dynamic_partitions_a
Attributes: readonly
Extents:
0 .. 854999 linear super 2201600
------------------------
Name: product_b
Group: amlogic_dynamic_partitions_b
Attributes: readonly
Extents:
------------------------
Name: odm_a
Group: amlogic_dynamic_partitions_a
Attributes: readonly
Extents:
0 .. 1559 linear super 3057664
------------------------
Name: odm_b
Group: amlogic_dynamic_partitions_b
Attributes: readonly
Extents:
------------------------
Name: system_ext_a
Group: amlogic_dynamic_partitions_a
Attributes: readonly
Extents:
0 .. 133159 linear super 3059712
------------------------
Name: system_ext_b
Group: amlogic_dynamic_partitions_b
Attributes: readonly
Extents:
------------------------
Super partition layout:
------------------------
super: 2048 .. 1841944: system_a (1839896 sectors)
super: 1843200 .. 2201144: vendor_a (357944 sectors)
super: 2201600 .. 3056600: product_a (855000 sectors)
super: 3057664 .. 3059224: odm_a (1560 sectors)
super: 3059712 .. 3192872: system_ext_a (133160 sectors)
------------------------
Block device table:
------------------------
Partition name: super
First sector: 2048
Size: 2415919104 bytes
Flags: none
------------------------
Group table:
------------------------
Name: default
Maximum size: 0 bytes
Flags: none
------------------------
Name: amlogic_dynamic_partitions_a
Maximum size: 1876951040 bytes
Flags: none
------------------------
Name: amlogic_dynamic_partitions_b
Maximum size: 1876951040 bytes
Flags: none
------------------------
I use this command to repack the superimage:
./lpmake --metadata-size 65536\
--device-size=2415919104\
--metadata-slots=3\
--super-name=super\
--group=amlogic_dynamic_partitions_a:1876951040\
--group=amlogic_dynamic_partitions_b:1876951040\
--partition=system_a:readonly:942026752:amlogic_dynamic_partitions_a\
--partition=system_b:readonly:0:amlogic_dynamic_partitions_b\
--partition=vendor_a:readonly:183267328:amlogic_dynamic_partitions_a\
--partition=vendor_b:readonly:0:amlogic_dynamic_partitions_b\
--partition=product_a:readonly:437760000:amlogic_dynamic_partitions_a\
--partition=product_b:readonly:0:amlogic_dynamic_partitions_b\
--partition=odm_a:readonly:798720:amlogic_dynamic_partitions_a\
--partition=odm_b:readonly:0:amlogic_dynamic_partitions_b\
--partition=system_ext_a:readonly:68177920:amlogic_dynamic_partitions_a\
--partition=system_ext_b:readonly:0:amlogic_dynamic_partitions_b\
--image=system_a=/super/system_a.img\
--image=system_b=/super/system_b.img\
--image=vendor_a=/super/vendor_a.img\
--image=vendor_b=/super/vendor_b.img\
--image=product_a=/super/product_a.img\
--image=product_b=/super/product_b.img\
--image=odm_a=/super/odm_a.img\
--image=odm_b=/super/odm_b.img\
--image=system_ext_a=/super/system_ext_a.img\
--image=system_ext_b=/super/system_ext_b.img\
--virtual-ab\
--output /super/supernew.img
The unpacked modified superimage and the unpacked stock superimage gives the same files.
Any idea for what is the problem?
Thanks!

For more information here are the imjtool results:
Original, factory superimage:
./imjtool /mnt/rawsuper.img
MMapped: 0x7f9606303000, imgMeta 0x7f9606304000
liblp dynamic partition (super.img) - Blocksize 0x1000, 3 slots
LP MD Header @0x3000, version 10.2, with 10 logical partitions @0x0 on block device of 2304 GB, at partition super, first sector: 0x800
Partitions @0x3100 in 3 groups:
Group 0: default
Group 1: amlogic_dynamic_partitions_a
Name: system_a (read-only, Linux Ext2/3/4/? Filesystem Image, @0x100000 spanning 1 extents of 898 MB)
Name: vendor_a (read-only, Linux Ext2/3/4/? Filesystem Image, @0x38400000 spanning 1 extents of 174 MB)
Name: product_a (read-only, Linux Ext2/3/4/? Filesystem Image, @0x43300000 spanning 1 extents of 417 MB)
Name: odm_a (read-only, Linux Ext2/3/4/? Filesystem Image, @0x5d500000 spanning 1 extents of 780 KB)
Name: system_ext_a (read-only, Linux Ext2/3/4/? Filesystem Image, @0x5d600000 spanning 1 extents of 65 MB)
Group 2: amlogic_dynamic_partitions_b
Name: system_b (read-only, empty)
Name: vendor_b (read-only, empty)
Name: product_b (read-only, empty)
Name: odm_b (read-only, empty)
Name: system_ext_b (read-only, empty)
And the repacked superimage:
./imjtool /mnt/supernew.img
MMapped: 0x7f3a9dc5b000, imgMeta 0x7f3a9dc5c000
liblp dynamic partition (super.img) - Blocksize 0x1000, 3 slots
LP MD Header @0x3000, version 10.2, with 10 logical partitions @0x0 on block device of 2304 GB, at partition super, first sector: 0x800
Partitions @0x3100 in 3 groups:
Group 0: default
Group 1: amlogic_dynamic_partitions_a
Name: system_a (read-only, Linux Ext2/3/4/? Filesystem Image, @0x100000 spanning 1 extents of 898 MB)
Name: vendor_a (read-only, Linux Ext2/3/4/? Filesystem Image, @0x38400000 spanning 1 extents of 174 MB)
Name: product_a (read-only, Linux Ext2/3/4/? Filesystem Image, @0x43300000 spanning 1 extents of 417 MB)
Name: odm_a (read-only, Linux Ext2/3/4/? Filesystem Image, @0x5d500000 spanning 1 extents of 780 KB)
Name: system_ext_a (read-only, Linux Ext2/3/4/? Filesystem Image, @0x5d600000 spanning 1 extents of 65 MB)
Group 2: amlogic_dynamic_partitions_b
Name: system_b (read-only, empty)
Name: vendor_b (read-only, empty)
Name: product_b (read-only, empty)
Name: odm_b (read-only, empty)
Name: system_ext_b (read-only, empty)

There Is no any idea?