This can be valuable for ROM makers only
Bored with welcome screen? Let's play with HKLM\Software\Microsoft\Welcome
Create Key HKLM\Software\Microsoft\Welcome,
create DWORD value Disable, set some values
execute \windows\welcome.exe
and look at the screen names, which doesn't appear
FFFF FF7F - disable everything except 'email setup' screen [WM5 only AKU 3.x]
FFFF FFBF - disable everything except 'password' screen [WM5 only]
FFFF FFDF - disable everything except 'complete' screen and the finishing tap
FFFF FFEF - disable everything except 'location' screen
FFFF FFF7 - disable everything except 'pop-up menus' screen
FFFF FFFB - disable everything except 'stylus' screen
FFFF FFFD - disable everything except 'align' screen
FFFF FFFE - disable everything except tap on the first screen [ignored if any other bit is cleared, the only difference is between FFFF FFFE and FFFF FFFF]
FFFF FFFF - disable everything [displays first 'splash' screen and exits]
Other bits - probably reserved for the future [look at the order of the things above]
There is another value: SystemStart - I have no idea what does it mean
There is another key Software\Microsoft\Shell\Event\Welcome - I have no idea what does it mean
There are references to the files "\Storage Card\Welcome.Not" "welcome.Not" - I have no idea.
Nice work.
V
Great work!
Thank you.
oh!
that is great!
i used another way to delete this entry from inflashfiles.dat and inboj.dat
Directory("\Windows\StartUp"):-File("Welcome.lnk","\Windows\welcome.lnk")
but yours better
and the others tpics,
if just replacing shellres.dll.xxx.mui on RAM
welcome will be come evry boot.
<mainly i used this for testing to make shellress.mui instantly>
i made one cab it can del the welcome.lnk from StartUP folder.
but after hard rest, welcome will come again,
(this is another topic..sorry)
Ok, so i know this post is old and probably out of sight and mind. But I have an issue. This key does not exist in my registry and I only get the alignment and password setup screens. I want the whole thing enabled. Please help a brother out.
FYI, the welcome.not thing skips the entire wizard. We used to use this in the WM2003 days (back then you couldn't skip the stupid Dr's Appointment tutorial). It was handy if you store your touchscreen alignment in the extrom.
You just create a blank text file called welcome.not and put it on the root of your storage card (won't work in extrom, naturally). Then do a hard reset with the card inserted and it will skip the welcome wizard entirely. If you hard reset without the card inserted, the welcome wizard will proceed as normal.
However, the registry entries are far better than that method. Good find!!!
I just wanted to make a little update to this thread for anyone using this information to skip various screens during welcome.
Only the last 8 bits are actually used to select/de-select subroutines when running welcome (at least for WM 6.1).
7F - disable everything except 'email setup' screen [WM5 only AKU 3.x]
BF - disable everything except 'password' screen [WM5 only]
DF - disable everything except 'complete' screen and the finishing tap
EF - disable everything except 'location' screen
F7 - disable everything except 'pop-up menus' screen
FB - disable everything except 'stylus' screen
FD - disable everything except 'align' screen
FE - disable everything except tap on the first screen
FF - disable everything [displays first 'splash' screen and exits]
For my ROM, I wanted to run welcome with align, location & complete screen.
1111 1101 (FD) - align screen
1110 1111 (EF) - location screen
1101 1111 (DF) - complete screen
---------------
1100 1101 (CD) or 205
ends up being....
Code:
<wap-provisioningdoc>
<!--334.05_Welcome-->
<characteristic type="Registry">
<characteristic type="HKLM\Software\Microsoft\Welcome">
<parm name="Disable" datatype="integer" value="205" />
</characteristic>
</characteristic>
</wap-provisioningdoc>
also if you want to skip everying just put the file welcome.not in the root of the storage card. **.not is the file extension **
irus said:
also if you want to skip everying just put the file welcome.not in the root of the storage card. **.not is the file extension **
Click to expand...
Click to collapse
Yes indeed, but make sure you apply the alignment settings by another means (provxml, cab, etc). I just spent a few days trying to figure out why endkey.exe was not working in the most recent version of my ROM (I use it to switch between vibrate/ring on long end key press). Turns out that if you don't do the align and you don't apply the settings some other way, endkey.exe does not work when you do a long press of the end key (at least on my Touch Pro).
I'm reviving this old thread since I'm running into an issue.
I usually disable everything in my ROM, thus:
Disable=dword:ff (or ffffffff)
After customization though, I need to tap on the taskbar to lauch the home screen. Otherwise, it just stays on the welcome splash.
Any ideas?
just bumping this up as i'd really appreciate an assist.
i've been trying to change the first boot in my 6.5.x build rom.
all i want is the 'allign screen' working
the current entry is
[HKEY_LOCAL_MACHINE\Software\Microsoft\Welcome]
"Disable" = dword:00000080
i may be thick but i'm really having trouble getting my head round this. i've tried
"Disable" = dword:FD
"Disable" = dword:1111 1101
"Disable" = dword:FFFF FFFD
which are all from this thread but none of these are working.
does anyone know what the entry actually is for 6.5.x? and if so i'd be grateful if someone could help.
many thanks in advance
Chris
I use
Code:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Welcome]
; only doing screen calibrate
"Disable"=dword:fffffffc
RoryB said:
I use
Code:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Welcome]
; only doing screen calibrate
"Disable"=dword:fffffffc
Click to expand...
Click to collapse
cheers for that. will give it a try when i get home
RoryB said:
I use
Code:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Welcome]
"Disable"=dword:fffffffc
Click to expand...
Click to collapse
i must be doing something wrong.. no matter what i try it's not changing the boot setup
it's still going 'tap', 'calibrate', 'time/date', and 'password'....
all i want is Tap and calibrate!!!!
this is doing my head in. i'd appreciate any other ideas???
many thanks to anyone who may be able to help
Chris
I will try to explain how to get any number you need:
1. Put this table in an excel,
2. Find the 8 digits corresponding to EACH of the screens wanted (eg. tap screen is FD or 253 and align screen is FE or 254 )
3. Tap each digit in a column (one line per screen wanted)
4. calculate the minimum of each column and get the 8 digits (in the example, min of 11111101 and 11111110 is 11111100).
5. If you use provxml go the other way round and with the total calculated find the Dec Value (3rd column) corresponding to the 8 digits (in the example 11111100 would be FFFFFFFC for reg/rgu files or 252 for xml/provxml files)
This way you can get whatever combination of screens you want.
My current rom has only tap screen (no alignment, no password, etc) and works fine.
If you do not get the expected results, most probably is not because you did it wrong but rather there is some other code replacing yours. My recommendation is to calculate the hex dec and binary values corresponding to the combination of screens that get loaded and then use the search function included in a visual kitchen to locate the file hindering your intended customization (Or simply look for the reg keys). Most of the roms will have as much as 3 or 4 places where welcome values are define (sys, oem, ext and yours !!). If you are not so patient create and ext package called zzz_whatever and in the files directory place a app.REG file so all values are overwritten. Make sure your reg or xml file does not mix with other non tested code since it may also happen that the file is not executed correctly and its rollbacked. When using provxml files non tested code should be placed behind so you can call mxipupdate_zzz01_tested and mxipupdate_zzz02_nontested to get the expected order. I think the order things get loaded are provxml, rgu, reg, xml and inside each group, package folder name and then file name.
Hope it helps, regards
Code:
Binary Hex Dec
10000000 80 128
10000001 81 129
10000010 82 130
10000011 83 131
10000100 84 132
10000101 85 133
10000110 86 134
10000111 87 135
10001000 88 136
10001001 89 137
10001010 8A 138
10001011 8B 139
10001100 8C 140
10001101 8D 141
10001110 8E 142
10001111 8F 143
10010000 90 144
10010001 91 145
10010010 92 146
10010011 93 147
10010100 94 148
10010101 95 149
10010110 96 150
10010111 97 151
10011000 98 152
10011001 99 153
10011010 9A 154
10011011 9B 155
10011100 9C 156
10011101 9D 157
10011110 9E 158
10011111 9F 159
10100000 A0 160
10100001 A1 161
10100010 A2 162
10100011 A3 163
10100100 A4 164
10100101 A5 165
10100110 A6 166
10100111 A7 167
10101000 A8 168
10101001 A9 169
10101010 AA 170
10101011 AB 171
10101100 AC 172
10101101 AD 173
10101110 AE 174
10101111 AF 175
10110000 B0 176
10110001 B1 177
10110010 B2 178
10110011 B3 179
10110100 B4 180
10110101 B5 181
10110110 B6 182
10110111 B7 183
10111000 B8 184
10111001 B9 185
10111010 BA 186
10111011 BB 187
10111100 BC 188
10111101 BD 189
10111110 BE 190
10111111 BF 191
11000000 C0 192
11000001 C1 193
11000010 C2 194
11000011 C3 195
11000100 C4 196
11000101 C5 197
11000110 C6 198
11000111 C7 199
11001000 C8 200
11001001 C9 201
11001010 CA 202
11001011 CB 203
11001100 CC 204
11001101 CD 205
11001110 CE 206
11001111 CF 207
11010000 D0 208
11010001 D1 209
11010010 D2 210
11010011 D3 211
11010100 D4 212
11010101 D5 213
11010110 D6 214
11010111 D7 215
11011000 D8 216
11011001 D9 217
11011010 DA 218
11011011 DB 219
11011100 DC 220
11011101 DD 221
11011110 DE 222
11011111 DF 223
11100000 E0 224
11100001 E1 225
11100010 E2 226
11100011 E3 227
11100100 E4 228
11100101 E5 229
11100110 E6 230
11100111 E7 231
11101000 E8 232
11101001 E9 233
11101010 EA 234
11101011 EB 235
11101100 EC 236
11101101 ED 237
11101110 EE 238
11101111 EF 239
11110000 F0 240
11110001 F1 241
11110010 F2 242
11110011 F3 243
11110100 F4 244
11110101 F5 245
11110110 F6 246
11110111 F7 247
11111000 F8 248
11111001 F9 249
11111010 FA 250
11111011 FB 251
11111100 FC 252
11111101 FD 253
11111110 FE 254
11111111 FF 255
chrisd1a1 said:
i must be doing something wrong.. no matter what i try it's not changing the boot setup
it's still going 'tap', 'calibrate', 'time/date', and 'password'....
all i want is Tap and calibrate!!!!
this is doing my head in. i'd appreciate any other ideas???
many thanks to anyone who may be able to help
Chris
Click to expand...
Click to collapse
Check the registry after you flash and the ROM is finished setting up. Does it read the values you set? Maybe there is another provxml or rgu setting it to a wrong value.
cruiserrr said:
I will try to explain how to get any number you need:
1. Put this table in an excel,
2. Find the 8 digits corresponding to EACH of the screens wanted (eg. tap screen is FD or 253 and align screen is FE or 254 )
3. Tap each digit in a column (one line per screen wanted)
4. calculate the minimum of each column and get the 8 digits (in the example, min of 11111101 and 11111110 is 11111100).
5. If you use provxml go the other way round and with the total calculated find the Dec Value (3rd column) corresponding to the 8 digits (in the example 11111100 would be FFFFFFFC for reg/rgu files or 252 for xml/provxml files)
This way you can get whatever combination of screens you want.
My current rom has only tap screen (no alignment, no password, etc) and works fine.
If you do not get the expected results, most probably is not because you did it wrong but rather there is some other code replacing yours. My recommendation is to calculate the hex dec and binary values corresponding to the combination of screens that get loaded and then use the search function included in a visual kitchen to locate the file hindering your intended customization (Or simply look for the reg keys). Most of the roms will have as much as 3 or 4 places where welcome values are define (sys, oem, ext and yours !!). If you are not so patient create and ext package called zzz_whatever and in the files directory place a app.REG file so all values are overwritten. Make sure your reg or xml file does not mix with other non tested code since it may also happen that the file is not executed correctly and its rollbacked. When using provxml files non tested code should be placed behind so you can call mxipupdate_zzz01_tested and mxipupdate_zzz02_nontested to get the expected order. I think the order things get loaded are provxml, rgu, reg, xml and inside each group, package folder name and then file name.
Hope it helps, regards
Code:
Binary Hex Dec
10000000 80 128
10000001 81 129
10000010 82 130
10000011 83 131
10000100 84 132
10000101 85 133
10000110 86 134
10000111 87 135
10001000 88 136
10001001 89 137
10001010 8A 138
10001011 8B 139
10001100 8C 140
10001101 8D 141
10001110 8E 142
10001111 8F 143
10010000 90 144
10010001 91 145
10010010 92 146
10010011 93 147
10010100 94 148
10010101 95 149
10010110 96 150
10010111 97 151
10011000 98 152
10011001 99 153
10011010 9A 154
10011011 9B 155
10011100 9C 156
10011101 9D 157
10011110 9E 158
10011111 9F 159
10100000 A0 160
10100001 A1 161
10100010 A2 162
10100011 A3 163
10100100 A4 164
10100101 A5 165
10100110 A6 166
10100111 A7 167
10101000 A8 168
10101001 A9 169
10101010 AA 170
10101011 AB 171
10101100 AC 172
10101101 AD 173
10101110 AE 174
10101111 AF 175
10110000 B0 176
10110001 B1 177
10110010 B2 178
10110011 B3 179
10110100 B4 180
10110101 B5 181
10110110 B6 182
10110111 B7 183
10111000 B8 184
10111001 B9 185
10111010 BA 186
10111011 BB 187
10111100 BC 188
10111101 BD 189
10111110 BE 190
10111111 BF 191
11000000 C0 192
11000001 C1 193
11000010 C2 194
11000011 C3 195
11000100 C4 196
11000101 C5 197
11000110 C6 198
11000111 C7 199
11001000 C8 200
11001001 C9 201
11001010 CA 202
11001011 CB 203
11001100 CC 204
11001101 CD 205
11001110 CE 206
11001111 CF 207
11010000 D0 208
11010001 D1 209
11010010 D2 210
11010011 D3 211
11010100 D4 212
11010101 D5 213
11010110 D6 214
11010111 D7 215
11011000 D8 216
11011001 D9 217
11011010 DA 218
11011011 DB 219
11011100 DC 220
11011101 DD 221
11011110 DE 222
11011111 DF 223
11100000 E0 224
11100001 E1 225
11100010 E2 226
11100011 E3 227
11100100 E4 228
11100101 E5 229
11100110 E6 230
11100111 E7 231
11101000 E8 232
11101001 E9 233
11101010 EA 234
11101011 EB 235
11101100 EC 236
11101101 ED 237
11101110 EE 238
11101111 EF 239
11110000 F0 240
11110001 F1 241
11110010 F2 242
11110011 F3 243
11110100 F4 244
11110101 F5 245
11110110 F6 246
11110111 F7 247
11111000 F8 248
11111001 F9 249
11111010 FA 250
11111011 FB 251
11111100 FC 252
11111101 FD 253
11111110 FE 254
11111111 FF 255
Click to expand...
Click to collapse
RoryB said:
Check the registry after you flash and the ROM is finished setting up. Does it read the values you set? Maybe there is another provxml or rgu setting it to a wrong value.
Click to expand...
Click to collapse
looks like you guys are right about something messing with this.
i set it to FC as advised but when i checked the reg on the build it's showing AC. i'm going to try a variation to see what happens..
i really appreciate the advice, just wish i could figure the fix
thanks for the help i appreciate it
Chris
hi,
try to search in the rgu of your OEMDrivers.
maybe there is a registry entry that is replacing your registry.
regards,
twisted
i really appreciate the advice, just wish i could figure the fix
Click to expand...
Click to collapse
What are you using for building the rom? I am pretty familiar with Ervius Visual Kitchen and it is quite straigth forward to use the search tool. Even if you use another kitchen you can download evk, put your files in the ext folder and do the search. Good luck!
I find Agent Ransack is a handy tool for searching the contents of files.
As a test you can set the registry the way you like and then run welcome.exe to see if the behaviour is the way you expect.
Related
I just purchased a phone on craigslist (might have made a mistake). I have much experience with WM, but none with android (flashing that is).
The phone has a blank screen, and shows a constant green light (led notification).
I have tried Ominous, but couldn't get it to connect. (I did have a problem with it telling me my username and password didn't match anything in their records, so I don't know if it was the phone couldn't connect, or it wasn't logged in.
I downloaded SEUS, took the battery out for 5 seconds, put it back in, held the back button, and plugged in the USB. No luck.
Does anyone have any advice to give me please?
I have been reading these forums forever, and know how to search. I spent the last two hours on google and XDA looking but all the results were people who had an exclamation point on their phone, and my screen is blank.
Any help that anyone can offer would be greatly appreciated, and I don't mind making a donation to the person that helps me fix it.
Thank you for your time,
David
I got Ominous to connect for a plit second and this is the report it gave me.
Code:
Action journal
19:04:50 Identify
19:04:50 Shows detailed information about the connected phone.
19:04:50 Operating system: Microsoft Windows 7 Home Premium Edition (build 7600), 64-bit
19:04:50 Application version: 0.05.2221 (beta)
19:04:50 . The action name is 'Identification'
19:04:50 Selected phone type: Xperia™ X10
19:04:50 Selected connection method: USB EROM
19:04:50 i Instructions
19:04:50 i 1. Make sure the phone battery is charged to at least 50%.
19:04:50 i 2. Switch off the phone!
19:04:50 i 3. Remove the phone battery and wait at least 5 seconds before reinserting it!
19:04:50 i 4. Press and hold the return back button, then connect the cable to the phone!
19:04:50 . The action started waiting for the user
19:05:01 . The action finished waiting for the user
19:05:01 Connecting via SEMC USB Flash Device (USB1)...
19:05:01 Device driver version: 2.2.0.5
19:05:06 e Error: Failed to start communication
19:05:06 . The action entered shutdown phase
19:05:06 . The action reported failure
Error code
# A662EA2CB5165738
Error details
---
7B 5B 6D 4B D6 66 42 B7 94 EB 86 8E 10 4A 76 B7
D3 77 1C 9A 98 09 2E 13 85 11 ED 28 8E 72 1A 81
7C 81 DB D1 A3 FC 9E 17 74 BF B9 3E D0 11 F8 4E
94 1D 6E D1 6D B1 B7 96 CA EA 36 0D 40 CB 43 0C
C1 A2 AC EA C8 E7 7E 83 2F 6D AC 0C 1E 4E 36 0F
B4 73 72 3B D8 37 12 A7 44 55 04 FE A0 DF A6 CF
3C D2 1E 6B E8 79 AA 84 62 A9 1A 83 90 21 EA 91
2C D9 10 61 76 E7
---
Okay so using a different method for connecting (leave USB plugged in, take battery out, hold down back button, put battery back in) I was able to get SEUS to connect, but it told me I had the latest firmware. I'm making progress though.
4 hours and nothing. Anyone have even some silly advice I can try?
21productionz said:
Okay so using a different method for connecting (leave USB plugged in, take battery out, hold down back button, put battery back in) I was able to get SEUS to connect, but it told me I had the latest firmware. I'm making progress though.
Click to expand...
Click to collapse
Hit repair when it tells you that you already have the latest firmware.
Thank you for taking the time to offer advice, I really appreciate it. I have attached a ss of the screen when it says it's done. Sadly I don't have an option to repair.
Take the sd card out and throw in your media card slot install pc companion and do factory reset
-------------------------------------
Sent via the XDA Tapatalk App
wrongfeifong said:
Take the sd card out and throw in your media card slot install pc companion and do factory reset
-------------------------------------
Sent via the XDA Tapatalk App
Click to expand...
Click to collapse
Forgive my ignorance, but how would I do a factory reset using the SD card? I have PCC installed already.
Hi there, have you tried the X10Flash program? The procedure is the same and you can get it from here: http://forum.xda-developers.com/showpost.php?p=6514704&postcount=3
Or, you can use step 1 from here: http://forum.xda-developers.com/showpost.php?p=6970850&postcount=1
Anyways, it could be a timing issue. Remember that the phone stays in flash mode for only 5 seconds or so... you have to be quick.
This method is a bit tricky because of the nature of the program and the manual procedure to find out device ids, give it a try.
PM me in the next couple of hours and I can try to help you via skype or something.
I tried to download the one in post 3, but everytime it gets to a certain percentage and just dies. I have been downloading hotfile files all night, and that is the only one I cannot get to work. I am downloading the step 1 now. I tried the step 1 for omnious, but no luck. I did try downloading a rom from a WWE carier, and it got pretty far in omnius but failed. I'm wondering if it is a log in problem with omnius.
Code:
Action journal
22:21:47 Flash
22:21:47 Allows to change languages supported by the phone and upgrade its firmware.
22:21:47 Operating system: Microsoft Windows 7 Home Premium Edition (build 7600), 64-bit
22:21:47 Application version: 0.05.2221 (beta)
22:21:47 . The action name is 'Flash'
22:21:47 Selected phone type: Xperia™ X10
22:21:47 i Instructions
22:21:47 i 1. Make sure the phone battery is charged to at least 50%.
22:21:47 i 2. Switch off the phone!
22:21:47 i 3. Remove the phone battery and wait at least 5 seconds before reinserting it!
22:21:47 i 4. Press and hold the return back button, then connect the cable to the phone!
22:21:47 . The action started waiting for the user
22:21:59 . The action finished waiting for the user
22:21:59 Connecting via SEMC USB Flash Device (USB1)...
22:21:59 Device driver version: 2.2.0.5
22:21:59 Detected chipset: QSD8250
22:21:59 Boot mode: EROM
22:21:59 IMEI:
22:21:59 Sending loader...
22:22:01 Establishing connection to the server...
22:22:06 Receiving news...
22:22:07 i No news
22:22:08 Actual credit: 0.00
22:22:14 Writing file FILE_277365972_1273135823000_1273135823000_277365969_114475108_INFILE_LONGTERM.zip...
22:24:46 e Failed!
22:24:46 . The action entered shutdown phase
22:24:46 . The action reported failure
Error code
# 663A586958F60A0C
Error details
---
16 3B 12 50 C1 EB 2F EC 9D E0 A5 2E E9 6A C7 C9
A1 74 23 21 41 BA A1 2E 05 4B CD A5 C9 1F 09 2C
25 B0 BD AA A8 60 21 2D 03 F2 BB A2 03 98 A3 6C
7B 37 2D E0 5F 2C 27 D8 05 06 45 89 F9 DE A9 BE
7D DA 98 F2 FF 77 EF 54 A3 D8 67 06 16 E4 D7 45
35 F6 CD 0A 8E 32 20 E1 A3 7F B5 88 59 4C B7 82
1B 62 9D 3E 62 8A 1F 6D BD 4E 7B 92 D4 21 39 CA
3B F7 93 20 61 EC F9 CB 9F 77 05 49 47 62 17 7E
EF 1D 43 10 41 97 AF 6C 1D 60 25 B8 97 F2 B9 9C
F5 36 A3 ED C1 C6 DF AA CD FF F5 38 19 7E 81 01
F5 6A 23 50 8F 38 0F 4C 83 76 0D 73 5A C1
---
That is the last report I got from omnius
EDIT: deleted
Hmm... well like I said, try the X10Flash tool. By the way, doesnt look like a Omnius login problem because I remember seeing similar stuff on my Omnius logs (except the error message ofcourse)
It may very well be a timing issue, even with omnius it's hit or miss. I will keep trying. Thank you very much for taking your time to help.
It's downloading very slow, so I can't wait to try the flash utility.
Finaly omnius finished successfully.
Code:
Action journal
22:55:06 Flash
22:55:06 Allows to change languages supported by the phone and upgrade its firmware.
22:55:06 Operating system: Microsoft Windows 7 Home Premium Edition (build 7600), 64-bit
22:55:06 Application version: 0.05.2221 (beta)
22:55:06 . The action name is 'Flash'
22:55:06 Selected phone type: Xperia™ X10
22:55:06 i Instructions
22:55:06 i 1. Make sure the phone battery is charged to at least 50%.
22:55:06 i 2. Switch off the phone!
22:55:06 i 3. Remove the phone battery and wait at least 5 seconds before reinserting it!
22:55:06 i 4. Press and hold the return back button, then connect the cable to the phone!
22:55:06 . The action started waiting for the user
22:55:16 . The action finished waiting for the user
22:55:16 Connecting via SEMC USB Flash Device (USB1)...
22:55:16 Device driver version: 2.2.0.5
22:55:16 Detected chipset: QSD8250
22:55:16 Boot mode: EROM
22:55:16 IMEI:
22:55:16 Sending loader...
22:55:18 Establishing connection to the server...
22:55:22 Receiving news...
22:55:23 i No news
22:55:24 Actual credit: 0.00
22:55:30 Writing file FILE_277365972_1273135823000_1273135823000_277365969_114475108_INFILE_LONGTERM.zip...
22:59:16 Writing file FILE_277344165_1277133235000_1271857047000_277344163_16722287_INFILE_LONGTERM.zip...
22:59:55 Actual credit: 0.00
22:59:55 Turning off the phone...
22:59:57 i Please disconnect battery and cable from the phone!
22:59:57 s Successfully done.
22:59:57 . The action entered shutdown phase
22:59:57 . The action reported success
Additional details
---
5C 7F 58 8A E3 41 7F 7A 61 EA 8D C2 35 F8 D9 C2
37 EC CB 57 1D 90 31 04 31 0D 3D CE 05 E8 7F FF
C9 50 15 6A ED 6E 1F 9A FF 00 DB F5 B8 0B
---
However the screen is still black, and now the led is blinking 2 times then pausing, then cycles through that.
21productionz said:
Finaly omnius finished successfully.
Code:
Action journal
22:55:06 Flash
22:55:06 Allows to change languages supported by the phone and upgrade its firmware.
22:55:06 Operating system: Microsoft Windows 7 Home Premium Edition (build 7600), 64-bit
22:55:06 Application version: 0.05.2221 (beta)
22:55:06 . The action name is 'Flash'
22:55:06 Selected phone type: Xperia™ X10
22:55:06 i Instructions
22:55:06 i 1. Make sure the phone battery is charged to at least 50%.
22:55:06 i 2. Switch off the phone!
22:55:06 i 3. Remove the phone battery and wait at least 5 seconds before reinserting it!
22:55:06 i 4. Press and hold the return back button, then connect the cable to the phone!
22:55:06 . The action started waiting for the user
22:55:16 . The action finished waiting for the user
22:55:16 Connecting via SEMC USB Flash Device (USB1)...
22:55:16 Device driver version: 2.2.0.5
22:55:16 Detected chipset: QSD8250
22:55:16 Boot mode: EROM
22:55:16 IMEI:
22:55:16 Sending loader...
22:55:18 Establishing connection to the server...
22:55:22 Receiving news...
22:55:23 i No news
22:55:24 Actual credit: 0.00
22:55:30 Writing file FILE_277365972_1273135823000_1273135823000_277365969_114475108_INFILE_LONGTERM.zip...
22:59:16 Writing file FILE_277344165_1277133235000_1271857047000_277344163_16722287_INFILE_LONGTERM.zip...
22:59:55 Actual credit: 0.00
22:59:55 Turning off the phone...
22:59:57 i Please disconnect battery and cable from the phone!
22:59:57 s Successfully done.
22:59:57 . The action entered shutdown phase
22:59:57 . The action reported success
Additional details
---
5C 7F 58 8A E3 41 7F 7A 61 EA 8D C2 35 F8 D9 C2
37 EC CB 57 1D 90 31 04 31 0D 3D CE 05 E8 7F FF
C9 50 15 6A ED 6E 1F 9A FF 00 DB F5 B8 0B
---
However the screen is still black, and now the led is blinking 2 times then pausing, then cycles through that.
Click to expand...
Click to collapse
Did you do as it instructed? I mean, disconnect battery and cable from the phone?
I didn't do it in that order, I disconnected and then pulled the batt.
it's running through right now again I will reverse the steps this time.
I just went through it again, it completed successfully. I removed the battery, then unplugged it. Left the Battery out for 30 seconds. When I put it back in, and hit the power button I get a blue solid light and still a blank screen. I contacted the guy I bought it from and he said he would return my money. I only wasted 7 hours of my life, not bad I guess. Sorry I wasted some of yours too though. Thanks for you help I appreciate it. If you give me your PayPal email I will buy you lunch tomorrow.
21productionz said:
I didn't do it in that order, I disconnected and then pulled the batt.
Click to expand...
Click to collapse
That should be ok. The order doesn't really matter.
Ok now take a pause. Whats the situation now? What do you have and what do you get? Sorry for sounding a bit weird but forum discussion threads are not the best way to help anyone realtime.
Anyways, the thing is that since your phone shows some activity, there is a chance that it is receptive to a firmware flash that would restore the phone to its function. What is weird in your case is that even if Omnius reports success, your phone is not responding.... could be something bad with the phone itself? who knows?
The thing is... you should try one of the methods: Omnius or X10FlashTool to flash a known good firmware and see if your phone shows life... if not then I'm afraid your are in for some trouble. You see SE or your operator doesn't approve of any third party methods to mess with your firmware so you will have trouble asking for warranty replacements. But, you see your log of Omnious shines a ray of hope... the phone is accepting firmware so all roads are not yet blocked.
Its the back button you hold down when plugging in the usb cable, not power.
SEUS has just updated their program so instead of seeing a long file like this "FILE_277344675_1271909822000_1271909822000_277398125_114906833_INFILE_LONGTERM" , instead of that, it is shortened like this "FILE_277398125".
After overwriting the two files according to the tutorial, the SEUS keeps downloading the firmware files over the ones which have been overwritten.
I thought the SEUS is OK last weekend, but now, they changed their program. Anyone tried and find a solution for this issue?
Man im stuck with the same problem...someone pls help !!
Use Omnius instead? Quick and easy to use.
Download
Set up account online
Enter account details in Omnius
Then follow instructions below on how to flash
http://forum.xda-developers.com/showpost.php?p=6789689&postcount=324
Hope this helps.
wingz85 said:
Use Omnius instead? Quick and easy to use.
Download
Set up account online
Enter account details in Omnius
Then follow instructions below on how to flash
http://forum.xda-developers.com/showpost.php?p=6789689&postcount=324
Hope this helps.
Click to expand...
Click to collapse
yea ur intrustions are for the the SIn reconstructions, what if i want to reinstal using my bak ups from the seus dump (blog.fs) before i debranded??
exekias said:
yea ur intrustions are for the the SIn reconstructions, what if i want to reinstal using my bak ups from the seus dump (blog.fs) before i debranded??
Click to expand...
Click to collapse
i have the same problem . i want brand to my original A1(Austria) branded files.
now i have R2BA023 root + market fix.
and i have the 2 original A1 files ( File_ xxxxxxxxxxxxxxx_infile_longterm).
but how does omnius work with those files?
what is the application file and what the customize file?
kind regards DauL
can someone help me`` how to flash rooted phone back to A1 ( Austria) branded witfh omnius ? i have the two original files, but i dont know which file i should take for the application and the customize file
kind regards
wingz85 said:
Use Omnius instead? Quick and easy to use.
Download
Set up account online
Enter account details in Omnius
Then follow instructions below on how to flash
http://forum.xda-developers.com/showpost.php?p=6789689&postcount=324
Hope this helps.
Click to expand...
Click to collapse
Hi，Thank you for your sugestion. However, I am still failed to flash by Omnius.
Finally got error and Yellow exclamation mark on my phone after reboot it.
Here is the result after I flash the x10 with Omnious.
Code:
Action journal
22:29:08 Flash
22:29:08 Allows to change languages supported by the phone and upgrade its firmware.
22:29:08 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
22:29:08 Application version: 0.07.2279 (beta)
22:29:08 . The action name is 'Flash'
22:29:08 Selected phone type: Xperia™ X10
22:29:08 i Instructions
22:29:08 i 1. Make sure the phone battery is charged to at least 50%.
22:29:08 i 2. Switch off the phone!
22:29:08 i 3. Remove the phone battery and wait at least 5 seconds before reinserting it!
22:29:08 i 4. Press and hold the return back button, then connect the cable to the phone!
22:29:08 . The action started waiting for the user
22:29:25 . The action finished waiting for the user
22:29:25 Connecting via SEMC USB Flash Device (USB3)...
22:29:25 Device driver version: 2.2.0.5
22:29:25 Detected chipset: QSD8250
22:29:25 Boot mode: EROM
22:29:25 IMEI: [email protected]@@
22:29:25 Sending loader...
22:29:26 Establishing connection to the server...
22:29:29 Receiving news...
22:29:34 i No news
22:29:34 Actual credit: 0.00
22:29:40 Writing file phone.zip...
22:30:18 Writing file X10i_GENERIC_1234_8465R8A_R1FB001.zip...
22:33:38 e Failed!
22:33:38 . The action entered shutdown phase
22:33:38 . The action reported failure
Error code
# E39CDD9F86C3082E
Error details
---
61 C6 C0 A4 65 CB CD 00 FF 08 E1 72 F3 9F B5 AE
13 9B E7 8D E5 86 63 FA 78 BD E4 7E ED 5F 85 68
09 52 D0 4B 3E 18 6D E0 61 94 3A D6 3F 7D 06 ED
11 DB BB C5 11 03 FE 12 A2 17 E5 DB 4F B0 1E 0D
C5 5C E6 DF 47 8B A0 93 02 E4 6C 19 80 4D 59 91
46 C1 3B 15 F6 69 01 6B CA 64 A3 13 2E 26 7A 7C
7E AD 9A 9E 1D EB 00 E8 80 F0 7A 96 0F 25 D0 BA
D5 FD 93 6D 4B 5B 30 D9 6C D7 4D 92 B4 C0 04 64
F7 56 66 50 2A AA 3B E5 F3 13 07 8D EE A3 41 61
48 50 E9 72 04 6F 71 F5 55 D4 0A 0C 6D 2F 05 E8
77 58 E8 34 2A 17 BD A1 E1 9A FF 0A ED 48 D5 09
C7 38 25 15 95 C7 43 B0 6F 20 0C E7 BD 5C 0B 29
17 8E 39 EE F3 F9 7F 69 EF 5B A1 DC B3 74 21 FF
19 DE A7 ED 25 46 5D DE 0F B6 8F 34 FD F2 BB 58
E7 3F D9 C4 D5 24 2D E1 A1 DA BF 44 5B 79 BB 34
F9 22 57 42 85 66 03 14 99 C1 7C 7F
---
It still works via SEUS but some steps have changed due to the new SESU release.
Follow THIS revised tutorial and all will work again.
I know it works as I have been doing it and even used this yesterday.
Candy[MAN] said:
It still works via SEUS but some steps have changed due to the new SESU release.
Follow THIS revised tutorial and all will work again.
I know it works as I have been doing it and even used this yesterday.
Click to expand...
Click to collapse
Yes, I know the new method. however, I have already bricked my x10 and now it show me a Yellow exclamation mark after rebooting.
I have tried the new method, it did not work for my case.
Hi guys,
I have a major problem with my X10. Everything worked fine til I tried to update...
I wanted to update from 024 to 026. Battery seemed to be full enough. My PC crashed during update. Ever since then I can't turn on my phone.
I reloaded the battery with an extra charger.
Tried to repair with SEUS and PC Companion. Fails every time.
Tried to falsh the 016 with the flashtool. Said ist was successful, but still can't turn the phone on.
Then tried to falsh with Omnius and got the following error
Code:
Action journal
20:55:32 Flash
20:55:32 Allows to change languages supported by the phone and upgrade its firmware.
20:55:32 Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
20:55:32 Application version: 0.06.2254 (beta)
20:55:32 . The action name is 'Flash'
20:55:32 Selected phone type: Xperia™ X10
20:55:32 i Instructions
20:55:32 i 1. Make sure the phone battery is charged to at least 50%.
20:55:32 i 2. Switch off the phone!
20:55:32 i 3. Remove the phone battery and wait at least 5 seconds before reinserting it!
20:55:32 i 4. Press and hold the return back button, then connect the cable to the phone!
20:55:32 . The action started waiting for the user
20:55:45 . The action finished waiting for the user
20:55:45 Connecting via SEMC USB Flash Device (USB2)...
20:55:45 Device driver version: 2.2.0.5
20:55:45 Detected chipset: QSD8250
20:55:45 Boot mode: EROM
20:55:45 IMEI: 35941903598910
20:55:45 Sending loader...
20:55:46 Establishing connection to the server...
20:55:52 Receiving news...
20:55:55 i No news
20:55:56 Actual credit: 0.00
20:56:04 Writing file R6A_R1FA016_FSP_X10i_CUST_DE_GENERIC_1235_7836_S1_SW_LIVE_AC12_0001_S1_PARTITION_WITH_SPARE.zip...
20:59:04 Writing file R1FA016_APP_SW_RACHAEL_GENERIC_1227_4612_S1_SW_LIVE_AC12_0001_S1_PARTITION.zip...
20:59:18 e Failed!
20:59:18 . The action entered shutdown phase
20:59:18 . The action reported failure
Error code
# E39CDD9F86C3082E
Error details
---
72 3A 36 32 AB 29 89 AE 99 F2 EB 82 13 5B 1F 88
EF E5 43 43 D5 28 39 14 A0 C3 90 D4 13 71 91 2A
2F 1A 9D FA A5 F3 E9 9C D6 52 25 A7 73 40 BF C6
96 EB 18 70 75 B8 67 70 4C 86 89 19 0E 95 A7 0F
23 85 57 AB 78 7A 04 2F 6D 73 79 08 E8 A5 F3 88
1E FF 1F DF B8 CB C4 FC 1A 09 C8 D5 AF A9 0E D5
A3 ED F0 7D C7 43 12 1C D5 03 98 A2 8C 54 48 B9
22 46 45 FF 18 30 F8 E8 0C C6 39 BD D8 A2 E3 D5
F5 D5 0D F3 36 D1 4A EF C5 C2 FC 84 F2 8C BF 7E
1E 08 F2 02 23 CD 35 F7 8F E5 D8 C7 49 59 7E 38
71 0A 82 FB 49 2D 0D 2C 7C 64 5B 2B F3 C0 3F 30
50 6C 0C 7F 5B F9 E7 82 77 5A A5 D2 DD 6B 8F 24
E0 D9 2D 93 C5 D8 37 E4 7A B7 75 E4 FD 41 21 5A
C1 36 AB AD 67 B1 D7 BF 29 CC FB 10 D7 37 AF CA
C1 ED 23 52 65 F6 29 CE F9 DC B5 8A B3 80 2F 2B
9F 1C 73 CC CB 09 D9 3E C9 14 6D 34 B3 DC 31 0A
31 02 C3 32 FB 1C 41 05 F4 D7
---
Still can't turn the phone on.
Do you have any idea what happened and how I can fix that?
By the way, I do not get the yellow exclamation mark, I get nothing...
Phone vibrates and the greed LED goes on shortly and then: nothing!
Anybody who had that problem and solved it somehow?
Your PC crashed during the update? Good lord...
If the bootloader is corrupt you're out of luck.
How can I find out, if the bootloader is ok?
I can get it into flashmode, but after flashing it won't turn on.
Hi.
You could try one of the methods to root your phone which will also update it to 026. - forum.xda-developers.com
Hi
I have slightly modified Daneshm90's deodexer script to be able to deodex honeycomb and ICS roms. this only works for honecomb and ICS.
just place the contents of system/app in the app folder and the contents of the system/framework in the framework folder and run deoall.bat and choose option 1.
i dont know if this works as i dont have ICS and i need tester with ICS rooted and if anything happens to your phone or tablet it is not my responsibility.
please give any feedback.
if you can help then please dont hesitate.
please, i didnt do much its Daneshm90 that made the effort.
http://www.multiupload.com/B5OAAPD9JZ
i have an isc beta running on my sgs i9000
ill give it a go and report back
any one confirm this works with a honeycomb ROM? thanks for this script/tool.
Does not work on ICS
api level
for smali/baksmali 1.3.0 you must set api level see list
suc6
Android 4.0.3 =====> 15 <==== ICE_CREAM_SANDWICH_MR1 Platform Highlights
Android 4.0, 4.0.1, 4.0.2 =====> 14 <===== ICE_CREAM_SANDWICH
Android 3.2 =====> 13 <==== HONEYCOMB_MR2
Android 3.1.x =====> 12 <===== HONEYCOMB_MR1 Platform Highlights
Android 3.0.x =====> 11 <===== HONEYCOMB Platform Highlights
java -Xmx512m -jar baksmali-1.3.0.jar -a 15 -d framework -d app -d deodexed_APK -d deodexed_JAR -x "%~dp0app\%~n1.odex"
java -jar smali-1.3.0.jar -a 15 out -o "%~dp0temp_%~n1\classes.dex"
When deodexing a Honeycomb or earlier odex file, you must specify an api level. Quoted from JesusFreke
You shouldn't have to use the api option on ICS however it shouldn't hurt anything.
So this is working for 4.0.3?
==>So this is working for 4.0.3?<==
It worked for me in dsixda's kitchen when I specified api level 15, no errors occured
sparkienl said:
==>So this is working for 4.0.3?<==
It worked for me in dsixda's kitchen when I specified api level 15, no errors occured
Click to expand...
Click to collapse
Not working with samsung galaxy s2 XXKP8 ics
do it through hex editor
m!k3 said:
Not working with samsung galaxy s2 XXKP8 ics
Click to expand...
Click to collapse
ur wright it's not working with a lot of versions of the smali/baksmali,
but you can always do it by hand with a hex editor, remove the head and tail of the .odex file and rename it to classes.dex file
sparkienl said:
ur wright it's not working with a lot of versions of the smali/baksmali,
but you can always do it by hand with a hex editor, remove the head and tail of the .odex file and rename it to classes.dex file
Click to expand...
Click to collapse
Thanks for that handy tidbit, I didn't know about that.
tidbit
Delgoth said:
Thanks for that handy tidbit, I didn't know about that.
Click to expand...
Click to collapse
Here is an howto for manipulating .odex files with an hex editor.
Open the .odex file with an hex editor like HxD.exe
Search for this: "64 65 78 0A 30 33 35" or "dex.035"
You will find something like this:
"64 65 79 0A 30 33 36 00 28 00 00 00 AC 56 00 00 D8 56 00 00 0E 02 00 00 E8 58 00 00 A8 05 00 00 00 00 00 00 50 66 70 E9 64 65 78 0A 30 33 35"
All before "64 65 78 0A 30 33 35" or "dex.035" you must also delete.
The new head starts also here :"64 65 78 0A 30 33 35 00 D9 31 66 0D D8 BC DE 57 94 07 9C DA C5 1D F3 AD" or "dex.035.Ù1f.ؼÞW”.œÚÅ.ó."
Search for the tail with this:"2F 73 79 73 74 65 6D 2F 66 72 61 6D 65 77 6F 72 6B 2F 63 6F 72 65 2E 6F 64 65 78 00" or "/system/framework/core."
Count an extra 24 hex for your find and now remove the tail from that point on
You will then find something like this:
"1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24" extra 24 hex
"00 00 00 00 76 B7 77 3F 49 0E 2A 24 1B 00 00 00 09 00 00 00 1C 00 00 00 2F 73 79 73 74 65 6D 2F 66 72 61 6D 65 77 6F 72 6B 2F 63 6F 72 65 2E 6F 64 65 78 00"
^ delete the tail from here and rename the rest of the .odex file classes.dex
sparkienl said:
ur wright it's not working with a lot of versions of the smali/baksmali,
but you can always do it by hand with a hex editor, remove the head and tail of the .odex file and rename it to classes.dex file
Click to expand...
Click to collapse
which version of smali/baksmali are you using?
version
m!k3 said:
which version of smali/baksmali are you using?
Click to expand...
Click to collapse
I tried version 1.2.3/1.26/1.2.8 and 1.3.0 on your file "Not working with samsung galaxy s2 XXKP8 ics" but they didn't work for me.
USE THE UPDATED SMALI/BAKSMALI 1.3.2 WITH -a 15 and it will deodex your file
Trying to deodex some honeycomb...how do I change the api. I tried what was listed above, but did not work for me.
Thanks for any help.
pashinator said:
Hi
I have slightly modified Daneshm90's deodexer script to be able to deodex honeycomb and ICS roms. this only works for honecomb and ICS.
just place the contents of system/app in the app folder and the contents of the system/framework in the framework folder and run deoall.bat and choose option 1.
i dont know if this works as i dont have ICS and i need tester with ICS rooted and if anything happens to your phone or tablet it is not my responsibility.
please give any feedback.
if you can help then please dont hesitate.
please, i didnt do much its Daneshm90 that made the effort.
http://www.multiupload.com/B5OAAPD9JZ
Click to expand...
Click to collapse
not working in N7000
Please help me
Thanks
could you reupload the file? I can't download it..
Use dsixda kitchen and set the API level to 15 it will deodex without any problem. I done it successfully with my ICS ROM.
Well like the rest of you I want to unlock and root this device.
I'm sure this is going to be a long road for all of us but I really like this device so personally I will do what i can to help figure out how to unlock and root this thing.
As a single soul this could take months or even a year but with combined efforts of this community I think we can pull it off. We all have our strengths and if we combine them with your help and the help of others it might turn out to be quite easy.
Don't be fooled and believe that fastboot is removed from the bootloader. It is there im sure we just need to figure out how to access it.
On a good note I already have a method to overcome update.zip signing that I developed for the alcatel one touch fierce 2. When using the recovery to flash the phone things actually become simpler. I would expect though that the recovery image is signed as well meaning we dont simply have the ability to flash the recovery. Unless we can unlock the boot loader first.
In reality to do any of this we are going to need temp root. At this time i have no idea how were going to get that but if you can get temp root even just enough to pull a backup from the device that will be a huge step forward.
To do anything useful we need a device backup. Or a update.zip.
If you can find a way to copy the update from this device before it is installed that would be wonderful.
My device already updated so if you have a brand new device that is not updated let us know so we can get our hands on the update.
In the meantime ( Until we get some firmware to reverse engineer ) I will document all the data I can get and how to get it.
The very first thing we need is to know all of the partitions on the device. If I can get the full GPT Partition Table that would be best.
So without further adieu I will start this journey.
Some of my post will be fairly basic to some and very complex to others.
I'm going to start by seeing what all boot modes i can get into.
Then see what I can get with ADB without root permissions.
Map out the partition scheme, and see how much of the security scheme I can determine is in place. All the fun stuff like what files are signed, how the boot chain is verified. I have seen it before where overcoming the initial security mechanism opens up a whole world of possibilities.
Programmers get lazy and to save money if they think your blocked out of a vulnerable area period they may lax on harder to bypass security.
Ok after a day of research and some gleaning of info from my blade x max I have a direction to move in anyway.
The closest device and one of the only devices zte allowed unlocked is the ZTE axom7.
We can study the Axom7 and get some Ideas on what will work on the BladeXMax.
First fastboot is crippled initially.
But this is easily overcome by swapping a few bytes on the right partition.
Thats my theory anyway. I'm in the process of proving it.
After Fastboot receives its prosthetic Limb oem unlock is as simple as 1 command.
Once the bootloader is unlocked the device will allow for a unsigned TWRP to run.
Now of course we need to compile our own TWRP. And then we can root.
Obviously we need the ability to write to this fastboot partition.
And we need to be able to flash TWRP.
Without Root how???
Just like the axon 7. EDL mode.
ZTE seems EDL Mode Friendly.
And the flash programmer (Firehose) is not signed.
Miflash can write partitions on the zte devices.
The only issue right now is we need the files of of the Blade x max.
And the GPT partition table.
Seeing that axom7tool can backup partitions from the axon7 in edl mode.......
Knowing that miflash works.
One of us that knows the protocol of miflash ( saraha ??? )
Can write a tool for linux that uses the same protocol.
Once this tool exists we can backup all the partitions and the GPT without root.
Once i have the files from the blade it should be possible to edit the fastboot partition and un-cripple the Fastboot.
So if any of you know the guys that wrote the axon 7 tool he can help us with a tool.
Other than that were stuck writing the tool ourself.
On a good not the sahara protocol and other edl protocols are very well documented.
If you seriously want in this Blade this is the way to go.
Well my theory about fastboot is correct.
I guess its obvious that versions of the axon 7 fastboot would be different.
The unlocked and the locked fastboot.
I'm going to hexdump and diff all the fastboot images i can find but so far it looks like this.
It seems that ZTE has used the same fastboot partition for a while.
If you boot into recovery on the blade x max and view the recovery log. Last log
You will find a list of all the parttion names on our device.
system
cache
persist
data
sdcard
boot
recovery
misc
aboot
apdp
bluetooth
carrier
cdt
cmnlib
cmnlib64
cryptkey
DDR
devcfg
devcfgbak
devinfo
dip
dpo
dsp
echarge
fastboot
fbop
fingerid
fsc
fsg
hyp
keymaster
keystore
lksecapp
mdtp
modem
msadp
persistent
pmic
reserve
rpm
sbl1
sec
splash
ssd
sti
tz
xbl
xblbak
ztecfg
tmp
Yep you can see we have the fastboot partition.
But the fbop partition is an important important one.
If we look at the updater scripts of the firmware upgrade packages we see.
FROM Partition.xml
<data><program SECTOR_SIZE_IN_BYTES="4096" file_sector_offset="0" filename="fastboot.img" label="fbop" num_partition_sectors="32" partofsingleimage="false" physical_partition_number="0" readbackverify="false" size_in_KB="128.0" sparse="false" start_byte_hex="0x321a8000" start_sector="205224"/></data>
FROM Update Zip
getprop("ro.product.device") == "ailsa_ii" || abort("E3004: This package is for "ailsa_ii" devices; this is a "" + getprop("ro.product.device") + "".");
assert(getprop("ro.product.name") == "P996A01_N");
ui_print("Target: ZTE/P996A01_N/ailsa_ii:7.1.1/NMF26F/20170301.161705:user/release-keys");
show_progress(0.650000, 0);
ui_print("Patching system image unconditionally...");
block_image_update("/dev/block/bootdevice/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat") ||
abort("E1001: Failed to update system image.");
show_progress(0.050000, 5);
package_extract_file("boot.img", "/dev/block/bootdevice/by-name/boot");
package_extract_file("ddr.img", "/dev/block/bootdevice/by-name/ddr");
package_extract_file("keymaster.mbn", "/dev/block/bootdevice/by-name/xblbak");
package_extract_file("lksecapp.mbn", "/dev/block/bootdevice/by-name/lksecapp");
package_extract_file("rpm.mbn", "/dev/block/bootdevice/by-name/rpm");
package_extract_file("tz.mbn", "/dev/block/bootdevice/by-name/tz");
package_extract_file("echarge.img", "/dev/block/bootdevice/by-name/echarge");
package_extract_file("mdtp.img", "/dev/block/bootdevice/by-name/mdtp");
package_extract_file("xbl.elf", "/dev/block/bootdevice/by-name/xbl");
package_extract_file("cmnlib64.mbn", "/dev/block/bootdevice/by-name/cmnlib64");
package_extract_file("adspso.bin", "/dev/block/bootdevice/by-name/dsp");
package_extract_file("recovery.img", "/dev/block/bootdevice/by-name/recovery");
package_extract_file("sec.dat", "/dev/block/bootdevice/by-name/sec");
package_extract_file("NON-HLOS.bin", "/dev/block/bootdevice/by-name/modem");
package_extract_file("pmic.elf", "/dev/block/bootdevice/by-name/pmic");
package_extract_file("devcfg.mbn", "/dev/block/bootdevice/by-name/devcfg");
package_extract_file("emmc_appsboot.mbn", "/dev/block/bootdevice/by-name/aboot");
package_extract_file("fastboot.img", "/dev/block/bootdevice/by-name/fbop");
package_extract_file("splash.img", "/dev/block/bootdevice/by-name/splash");
package_extract_file("hyp.mbn", "/dev/block/bootdevice/by-name/hyp");
package_extract_file("BTFM.bin", "/dev/block/bootdevice/by-name/bluetooth");
package_extract_file("cmnlib.mbn", "/dev/block/bootdevice/by-name/cmnlib");
show_progress(0.200000, 10);
show_progress(0.100000, 10);
format("ext4", "EMMC", "/dev/block/bootdevice/by-name/userdata", "0", "/data");
set_progress(1.000000);
Here we can conclude that the fastboot.img is flashed to the fob partition which is where the flags to enable the full fastboot commands. It's basically a security partition.
Is the Whole Partition different??
Is it just a few bytes difference??
Its actually not much and seeing that this identical partition has been used for several years
We can hope our fastboot image is the same or very similar. But remember it is the fob partition.
Here is the difference.
[email protected]:~$ hexdump -C -v /home/bigcountry907/Desktop/ZTE/FB-UL-EDL/A2017U_FASTBOOT_UNLOCK_EDL/fastboot.img > /home/bigcountry907/Desktop/ZTE/FB-UL-EDL/fbunlck.txt
[email protected]:~$ diff home/bigcountry907/Desktop/ZTE/FB-UL-EDL/fbunlck.txt /home/bigcountry907/Desktop/ZTE/stock/fbstock.txt
diff: home/bigcountry907/Desktop/ZTE/FB-UL-EDL/fbunlck.txt: No such file or directory
[email protected]:~$ hexdump -C -v /home/bigcountry907/Desktop/ZTE/FB-UL-EDL/A2017U_FASTBOOT_UNLOCK_EDL/fastboot.img > /home/bigcountry907/Desktop/ZTE/FB-UL-EDL/fbunlck.txt
[email protected]:~$ diff /home/bigcountry907/Desktop/ZTE/FB-UL-EDL/fbunlck.txt /home/bigcountry907/Desktop/ZTE/stock/fbstock.txt
257c257
< 00001000 01 00 00 00 78 56 34 12 00 00 00 00 01 00 00 00 |....xV4.........|
---
> 00001000 00 00 00 00 78 56 34 12 00 00 00 00 00 00 00 00 |....xV4.........|
579,595c579,595
< 00002420 62 6f 6f 74 02 02 20 00 04 82 01 00 04 e0 4f a3 |boot.. .......O.|
< 00002430 b8 c0 79 df 98 9a ce 8b 47 ed f6 23 61 e8 3e 4d |..y.....G..#a.>M|
< 00002440 7a 43 fc 4b d4 39 60 c5 5a a6 96 ea c0 4d e2 52 |zC.K.9`.Z....M.R|
< 00002450 27 3e b6 d0 21 72 72 c8 59 03 44 90 ff 4a 86 3b |'>..!rr.Y.D..J.;|
< 00002460 29 2c 16 7a 04 2b 36 07 6f 8f 04 8e 35 7c f2 9f |),.z.+6.o...5|..|
< 00002470 cc 29 e5 0b 74 30 e9 0c ec cd 23 4b 19 84 c7 d1 |.)..t0....#K....|
< 00002480 f7 46 9b 7d dc 8b 6b bb 01 d3 f0 0a ab 96 ca 7e |.F.}..k........~|
< 00002490 a2 6e 91 6b d9 38 d6 d6 2e 4f 50 3e 2d 17 55 e3 |.n.k.8...OP>-.U.|
< 000024a0 e5 50 e4 1f dc 03 26 9e e9 22 19 dc 60 e1 0b a0 |.P....&.."..`...|
< 000024b0 b5 06 25 bd e4 08 24 4f 7b dd 42 29 82 55 06 84 |..%...$O{.B).U..|
< 000024c0 a1 5f d7 c1 99 3f 83 30 5d 10 59 5e 9d 2a 31 3f |._...?.0].Y^.*1?|
< 000024d0 f9 87 54 55 1e 82 40 68 5b c8 e4 18 98 80 d1 ec |[email protected][.......|
< 000024e0 df d7 01 d1 ec a5 a2 e4 c1 86 76 63 e0 82 13 35 |..........vc...5|
< 000024f0 61 30 63 d7 cd e8 21 33 73 e9 c4 93 ad 65 68 77 |a0c...!3s....ehw|
< 00002500 3e eb 3e 90 8a bb 8b 07 1b 26 ff d5 0d 37 a4 6c |>.>......&...7.l|
< 00002510 ec c6 69 30 dd 22 1b 9f 69 79 47 69 22 ba 9e c8 |..i0."..iyGi"...|
< 00002520 0c 23 96 f8 cf 66 74 74 11 98 d6 e4 |.#...ftt....|
---
> 00002420 62 6f 6f 74 02 02 20 00 04 82 01 00 a8 e0 dd 69 |boot.. ........i|
> 00002430 5b b2 47 12 bf 74 41 7a 00 37 a0 b8 10 15 d4 4e |[.G..tAz.7.....N|
> 00002440 a6 59 74 9b 7d a4 df 95 eb 3f 1a 29 1c 60 23 7c |.Yt.}....?.).`#||
> 00002450 91 37 2a 07 d3 e9 45 17 ac ac ab a9 ba b4 42 70 |.7*...E.......Bp|
> 00002460 46 5f 67 22 f7 37 1f de 46 f9 67 44 74 d7 26 42 |F_g".7..F.gDt.&B|
> 00002470 49 9c e8 ee 98 78 89 2b b2 1e c3 58 a8 d2 3a 7f |I....x.+...X..:.|
> 00002480 39 7d 22 09 c6 01 c5 0f 95 65 57 1e af 79 d9 d6 |9}"......eW..y..|
> 00002490 8d 99 84 4f 24 ff 55 b2 b0 20 07 00 39 e6 9a 27 |...O$.U.. ..9..'|
> 000024a0 a0 bc 97 dd 27 7d f2 a2 88 b6 b5 53 4a ba 7a 8e |....'}.....SJ.z.|
> 000024b0 65 98 f6 ef 4d 7e 2e 91 01 66 35 9e e1 da 15 c4 |e...M~...f5.....|
> 000024c0 fe a4 d2 26 a1 99 88 a3 55 2f ac 65 71 f8 5f 86 |...&....U/.eq._.|
> 000024d0 a7 79 f8 b5 61 b5 da 2c 7b 89 39 3b ff 45 a3 7f |.y..a..,{.9;.E..|
> 000024e0 dc 92 d5 4e 8b df 68 c0 e9 43 18 7b 60 5a 03 60 |...N..h..C.{`Z.`|
> 000024f0 18 da 96 84 e7 97 a7 09 a9 1a 2d b6 5b d3 d2 f6 |..........-.[...|
> 00002500 c8 33 a2 8f ef 32 5e 6a 45 39 66 b5 a6 a4 35 0f |.3...2^jE9f...5.|
> 00002510 03 0c 9d 57 79 28 43 09 9a 3e 7b 01 8c 6e 66 b2 |...Wy(C..>{..nf.|
> 00002520 1a f3 3d 92 d1 66 91 04 4a 3e 79 69 |..=..f..J>yi|
[email protected]:~$ hexdump -C -v /home/bigcountry907/Desktop/ZTE/Fastboot-UL/fastboot.img > /home/bigcountry907/Desktop/ZTE/Fastboot-UL/fbul2.txt
[email protected]:~$ diff /home/bigcountry907/Desktop/ZTE/FB-UL-EDL/fbunlck.txt /home/bigcountry907/Desktop/ZTE/Fastboot-UL/fbul2.txt
[email protected]:~$
There's definitely more to come but this is enough to think about for now.
Here are all the partition block sizes and labels for the blade x max
30535680 mmcblk0 EMMC CHIP
4096 mmcblk0p1
4096 mmcblk0p2
4096 mmcblk0p3
4096 mmcblk0p4
4096 mmcblk0p5
4096 mmcblk0p6
4096 mmcblk0p7
16384 mmcblk0p8
16384 mmcblk0p9
16384 mmcblk0p10
4096 mmcblk0p11
4096 mmcblk0p12
4096 mmcblk0p13
4096 mmcblk0p14
4096 mmcblk0p15
4096 mmcblk0p16
4096 mmcblk0p17
4096 mmcblk0p18
32768 mmcblk0p19
4096 mmcblk0p20
94208 mmcblk0p21
65536 mmcblk0p22
65536 mmcblk0p23
4096 mmcblk0p24
4096 mmcblk0p25
4096 mmcblk0p26
4096 mmcblk0p27
4096 mmcblk0p28
4096 mmcblk0p29
4096 mmcblk0p30
4096 mmcblk0p31
4096 mmcblk0p32
4096 mmcblk0p33
32768 mmcblk0p34
4096 mmcblk0p35
4096 mmcblk0p36
4096 mmcblk0p37
4096 mmcblk0p38
65536 mmcblk0p39
4096 mmcblk0p40
4096 mmcblk0p41
4096 mmcblk0p42
4096 mmcblk0p43
65536 mmcblk0p44
1048576 mmcblk0p45 cache
5242880 mmcblk0p46 system
23629807 mmcblk0p47 data
4096 mmcblk0rpmb
31166976 mmcblk1 SD CARD
31165935 mmcblk1p1 SD CARD Storage
Old codehead (emphasis on the "old"), and I have this device... unfortunately, it's been updated, so there's not a whole lot I could offer...
With an at least rudimentary how-to provided, though... as long as I can get the device back to square-one, if things go tits-up and it's necessary... bitter experience... not a few Cricket LG G Stylo paperweights at hand... I'l like to offer myself as an alpha-tester for whatever you find out...
Just bought this lovely new home in Albuquerque, and, until a few things settle down, don't have a lot of cash... but I'll offer mine as a test-bed of sorts...
I'm fascinated with the work you are doing, and I really dig this phone for pretty much every reason except Cricket's bullheadedness, and am looking forward to watching you work...
I'm also kinda horrified that, seeing your log dumps upthread, I could actually understand it... can take the boy out of the tech, but some things seem to be stuck in the little grey cells forever.... *chuckle*
My tech chops tended more towards xBASE and Delphi, and still do... was what I learned, along with COBOL and RPig...
Have been trying, over the past few years, to get some C++ and Java under my belt, but it's more important to me to finish my BA in the up coming spring semester, and do UNM School of Law... Renaissance man wanna-be here... *grin*
Just wondering, good madam or sir, what progress you've been able to do... I don't mean to push, as we all have lives away from this forum (at least I do hope so.. *smile*), but, as I love to learn, and now in my 60's, found my Java, C and C++ texts, have downloaded and installed all my preferred tools, and would just really dig seeing some journaling of your progress on this rather fascinating device... more internal RAM than I would have ever expected on a smart phone, and, as such, space is not at such a premium that I'm required to use Apps2SD Pro (although I paid for it), Titanium (although I paid for it), but just damn...
I'm disgusted that Cricket would be so paranoid against their paying customers that they insist on absolute control... just damn...
Sorry... woolgathering on a Friday afternoon, while installing other dev tools... <smile>
Firmware update downloaded
My phone has the firmware downloaded please let me know if there is a way to pull it for R&D
---------- Post added at 03:31 AM ---------- Previous post was at 02:55 AM ----------
This phone just force installed nevermind
Update not installed
I have the update downloaded but not installed. The phone is trying to force update but it can't because my battery is too low, I'll try and leave it that way. Do we have a way to find and extract the update?
Scratch that. Force install starts at 20% battery or so. Accidently over charged haha.
We need to post the way to pull the update
We need to post a way to extract the update so that the next person who has it but it is not installed can pull it for us any help from more experienced individuals would be greatly appreciated
Update ready to dl
Any ideas how to pull it from the phone
If you have an update.zip signing bypass, I could leverage that to get a dump of the partition table.
Z983 Root Method Development
Hello world of XDA,
We want to root this device. Yes? Well, as of right now, 01-27-2018, there is no working method available on the internet. We have to do this ourselves. Ive rooted literally hundereds of phones, but this one, Crickets down played version of the Blade Zmax, re-dubbed Blade XMax Z983..
First, we need the boot loader. I am willing to team up with some people, to make this happen. Any takers?
Has anyone been able to get the last update files, about a week ago i think, off the phone before applying the update. If anyone has those we may be in business, at least further along than we were. That last update was a decent size update, and if it had anything to do with the spectre/meldown patch, that update would have had the partition layout, how the bootloader has been hidden and so on and so fourth. So if anyone was able to grab the update please post here, as the thread creator and a few others seem to know what to do from there.
Can I start by modifying tye system UI apk?
Hey so I've got this device and it's FRP locked. If anybody is willing to work on this still these days (for root, frp, various unlocks, etc) then let's make it happen. Can't say for sure if I'll have the device for very long, but I'm definitely down to try while I have it. Lmk if there's anything I can do to help the progress.
dammi.forza0910 said:
Hello world of XDA,
We want to root this device. Yes? Well, as of right now, 01-27-2018, there is no working method available on the internet. We have to do this ourselves. Ive rooted literally hundereds of phones, but this one, Crickets down played version of the Blade Zmax, re-dubbed Blade XMax Z983..
First, we need the boot loader. I am willing to team up with some people, to make this happen. Any takers?
Click to expand...
Click to collapse
You know how bad I wish I could take you up on this? I just don't have the experience or the knowledge. I'd love to learn but I don't even know where to start.
Okay, so I have successfully copied the boot animation.zip and have attatched it as proof. I believe, i can actuall copy the firmware because I found the file locatiom after an exhausting amount of trial and error with different approaches. Usong Debian (wheezy) ,and a combination of file explores, and modifying apk's through luck patcher, I was able to view the device tree and so on. Anybody willing to guide me to the next step?
Z983 Firmware .img files found and uploaded
Okay, I found the firmware files and when I moved them to my external SD card, they combined automatically and was labled update.zip. This is it guys, help me!
Device Tree
Can anyone let me know if this is helping, or if everyone gave up....?
dammi.forza0910 said:
Okay, I found the firmware files and when I moved them to my external SD card, they combined automatically and was labled update.zip. This is it guys, help me!
Click to expand...
Click to collapse
Downloading the files when I get off work and will look at them as best I can, maybe we can get the bootloader to show up in the recovery, Cricket did something to the flags that bypasses the bootloader, maybe we can reflag and get it to show up again. Good work, hopefully some progress can be made now.