Related
Hi.
Has anyone tried to make linux/familiar boot on the Wizard yet?
Any luck?
mind said:
Hi.
Has anyone tried to make linux/familiar boot on the Wizard yet?
Any luck?
Click to expand...
Click to collapse
Oh this looks interesting. What could you do with a linux boot?
mind said:
Has anyone tried to make linux/familiar boot on the Wizard yet?
Click to expand...
Click to collapse
Have you tried to run haret ?
If it works, can you post the
framebuffer address and 'dump mmu' here ?
It might take a bit longer for anything like this to appear, but it would be interesting when it does.
I haven't tried it. The reason for my question was that I'm going to do some development work for Opie (opie.handhelds.org), and need a machine that boots and runs familiar to test stuff. And I would like to get me a wizard
Familiar has a list of machines tested on familiar ( booting or not ). But only Wallaby (XDA), Himalaya (XDA II), Blueangel (XDA III) and Universal (MDA Pro) are listed.
So if anyone in this forum wich has a wizard and would like to try out linux/opie on it; please let me know if it boots!!!
There are a lot of advantages having linux on you're XDA instead of windows mobile. The most obvious being that if you're stuck in some corner ( lets say mp3 audio over bt isn't working ), you could always do some work on the ( BlueZ ) code you're self to try to fix the problem. Also there's alot of cool software available that you don't have on WM.
And oh, you're free
Best regards,
mind said:
Familiar has a list of machines tested on familiar ( booting or not ). But only Wallaby (XDA), Himalaya (XDA II), Blueangel (XDA III) and Universal (MDA Pro) are listed.
Click to expand...
Click to collapse
The only machine where Linux WORKS right now
is Blueangel (with GPE, never seen reports about opie). Himalaya, Universal and Magician need some work. Alpine should work with some
effort too.
Wallaby is not really working (no SD) because
nobody is interested in writing this driver.
Power management (i.e. suspend) is missing now.
So if anyone in this forum wich has a wizard and would like to try out linux/opie on it; please let me know if it boots!!!
Click to expand...
Click to collapse
To run opie, you need a running kernel, which does not exist. To write the kernel it is necessary to run 'haret'. So, the first step
is to try 'haret' !
To run opie, you need a running kernel, which does not exist. To write the kernel it is necessary to run 'haret'. So, the first step
is to try 'haret' !
Click to expand...
Click to collapse
Just tried it. Haret starts, but prints out the message "Exception reading coprocessor 15 register .." I can connect to Haret on port 9999 and can issue some commands like "dump mmu" but there's not much info there...:
Code:
descriptor flags legend:
C: Cacheable
B: Bufferable
0..3: Access Permissions (for up to 4 slices):
0: Supervisor mode Read
1: Supervisor mode Read/Write
2: User mode Read
3: User mode Read/Write
Error: EXCEPTION reading coprocessor 15 register 2
MMU 1st level descriptor table is at FFFFC000
Virtual | Physical | Descr | Description
address | address | flags |
----------+----------+---------+-----------------------------
00000000 | | | UNMAPPED
ffffffff | | | End of virtual address sp
richardt007 said:
Haret starts, but prints out the message "Exception reading coprocessor 15 register .." I can connect to Haret on port 9999 and can issue some commands like "dump mmu" but there's not much info there...:
Click to expand...
Click to collapse
Then you need to sign haret with the "priviledged certificate". Read more here:
http://forum.xda-developers.com/viewtopic.php?t=30399&start=0
Can you tell me how to do that in a little more detail than what's described in the thread? I managed to compile the latest haret.exe using wine and the msvc package. Do I need to alter the asm-files (and which one?) with the code-snippet in that thread or is it a little more complicated than that? Would like to contribute though...
richardt007 said:
Can you tell me how to do that in a little more detail than what's described in the thread?
Click to expand...
Click to collapse
No, it seems that you don't need to change anything, only to sign the executable.
Don't ask me how, i don't know exactly
I've tried makecert.exe with wine-0.9.1 and
it works. You should look into the archives
on this site or read the microsoft documentation.
cr2 said:
Don't ask me how, i don't know exactly
Click to expand...
Click to collapse
There is an explanation now at the end of this
thread.
I managed to get some output from haret, although don't know the validity of the output.
1. I had to modify the asmstuff.asm to include the cp_0, cp_2 and cp_13 calls in order to get rid of the exception ( GetLastError returned 120=ERROR_CALL_NOT_IMPLEMENTED)
2. Called the cp_2 from _cpu_get_cp.
3. Signed the executable using signcode.exe from the Smartphone 2003 SDK (have no clue if this was needed at all)
Here is some output from the output, can somebody help out to interpret it?
Code:
HaRET(3)# dump gpio
GPIO# D S A INTER | GPIO# D S A INTER | GPIO# D S A INTER | GPIO# D S A INTER
------------------+-------------------+-------------------+------------------
0 O 1 0 | 21 I 0 0 | 42 O 0 0 | 63 O 0 2
1 O 0 0 | 22 I 0 0 | 43 I 0 0 | 64 I 0 0
2 I 1 0 | 23 I 0 0 | 44 I 0 0 | 65 I 0 2 FE
3 I 0 0 | 24 I 0 0 | 45 I 0 0 | 66 I 0 3
4 I 0 0 | 25 I 0 0 | 46 I 0 0 | 67 I 0 3
5 I 0 0 | 26 I 0 0 | 47 O 0 0 | 68 I 0 3
6 I 0 0 | 27 I 0 0 | 48 I 0 0 | 69 I 0 1
7 I 0 0 | 28 I 0 0 | 49 I 0 2 | 70 I 0 0
8 I 0 0 | 29 I 0 0 | 50 I 0 3 | 71 I 0 2
9 I 0 0 | 30 I 0 0 | 51 O 0 3 | 72 I 0 0
10 I 0 0 | 31 I 0 0 | 52 O 0 3 | 73 I 0 2
11 I 0 0 | 32 I 0 0 FE | 53 O 0 1 | 74 I 0 3
12 I 0 0 | 33 I 1 0 | 54 O 0 0 | 75 I 0 3
13 I 0 0 | 34 I 0 0 FE | 55 O 0 2 | 76 I 0 3
14 I 0 0 | 35 O 0 0 | 56 O 0 0 | 77 I 0 1
15 I 0 0 | 36 O 0 0 | 57 O 0 2 | 78 I 0 0
16 I 0 3 | 37 O 0 0 | 58 O 0 3 | 79 I 0 2
17 I 0 3 | 38 O 0 0 | 59 I 0 3 | 80 I 0 0
18 I 0 3 | 39 O 0 0 | 60 I 0 3 | 81 I 0 2
19 I 0 1 | 40 O 0 0 | 61 I 0 1 | 82 I 0 3
20 I 0 0 | 41 O 0 0 | 62 I 0 0 | 83 I 0 3
Code:
HaRET(2)# print "%x" VRAM
20001020
Dump mmu gives a lot of lines, have no idea what the most relevant part of it is, so here a snippet:
Code:
HaRET(7)# dump mmu
----- Virtual address map -----
Descriptor flags legend:
C: Cacheable
B: Bufferable
0..3: Access Permissions (for up to 4 slices):
0: Supervisor mode Read
1: Supervisor mode Read/Write
2: User mode Read
3: User mode Read/Write
MMU 1st level descriptor table is at 10360000
Virtual | Physical | Descr | Description
address | address | flags |
----------+----------+---------+-----------------------------
00000000 | | | UNMAPPED
02000000 | | | UNMAPPED
02101000 | 10463000 | CB0000 | Small page (4K)
...
...
29fff000 | 12b4b000 | CB3 | Small page (4K)
2a000000 | | | UNMAPPED
Then it stops, with the progress bar somewhere at 40%. had to give it a soft reset. So what's the next step...?
richardt007 said:
I managed to get some output from haret, although don't know the validity of the output.
Here is some output from the output, can somebody help out to interpret it?
Click to expand...
Click to collapse
I have looked in the docs, wizard has TI OMAP processor, and haret 'gpio' knows only about
PXA. So , this table is probably useless.
Code:
HaRET(2)# print "%x" VRAM
20001020
From omap730.h:
#define OMAP730_SRAM_START 0x20000000
So your VRAM is in the OMAP built-in SRAM.
Code:
HaRET(7)# dump mmu
MMU 1st level descriptor table is at 10360000
Your RAM starts at 0x10000000.
At least 4MB for the kernel & stuff.
Code:
Virtual | Physical | Descr | Description
address | address | flags |
----------+----------+---------+-----------------------------
02101000 | 10463000 | CB0000 | Small page (4K)
The page in RAM mapped for some system purposes.
Then it stops, with the progress bar somewhere at 40%. had to give it a soft reset.
Click to expand...
Click to collapse
It's normal, "dump mmu" in haret is buggy
So what's the next step...?
Click to expand...
Click to collapse
It is interesting to find out where is your ROM mapped.
You can also sign the itsutils and try to dump the memory with these tools.
Read the linux-omap documentation and code
and dump the OMAP registers. You can also
try to find out from the wince dlls what other
chips are used in this phone.
You can also sign the itsutils and try to dump the memory with these tools.
Click to expand...
Click to collapse
Signing itsutils was not enough unfortunately, as I had to change the security policy (policy ID=4097) from 1 to 2 to allow RAPI calls.
(see http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnppcgen/html/wmdeploy.asp)
After that, itsutils ran like a charm:
Code:
c:\src\itsutils\build>pmemmap
v82000000-83000000 -> p00000000-01000000
v8a000000-8a400000 -> p13c00000-14000000
v8c000000-8fc00000 -> p10000000-13c00000
v90000000-90100000 -> p20000000-20100000
v98000000-98100000 -> pfff00000-00000000 (huh?)
v98100000-98200000 -> p04000000-04100000
v98400000-98500000 -> p06000000-06100000
v98500000-98600000 -> p40000000-40100000
A simple process list, 'pps -t' showed _alot_ of .dll's being used (mainly by device.exe, naturally)
Code:
c:\src\itsutils\build>pps
handle n base kern user heap exe
0ddf5fba 5 20000000 0.0 8.2 0 rapiclnt -drndis_peer
0dfb5706 2 0e000000 0.0 0.0 0 elatepushservice.exe
0dfdf8ce 11 1a000000 0.0 0.5 0 repllog.exe /sched /remote /h
0e0f03ba 2 10000000 0.0 0.0 0 sddaemon.exe
0fbb4002 2 c2000000 0.0 0.0 0 NK.EXE
2e0a2402 8 14000000 0.0 0.0 0 srvtrust.exe 80
4de65d06 10 18000000 0.0 0.0 0 cprog.exe -n
4e3767c2 10 08000000 0.0 2.1 0 shell32.exe 50
6fba4bfa 12 04000000 0.0 37.8 0 filesys.exe
8dfb56e2 2 1c000000 0.0 0.0 0 PowerTray.exe
8e91ce1a 107 06000000 0.0 1.8 0 device.exe 20
adf78e9e 1 1e000000 0.0 0.0 0 WiFiTray.exe
ae0b6dc2 11 12000000 0.0 0.0 0 connmgr.exe 70
ae54049a 15 0a000000 0.0 0.0 0 gwes.exe 30
ce376c4a 20 0c000000 0.0 0.0 0 services.exe 60
edc4dd32 9 22000000 0.0 0.0 0 tmail.exe -RunInBKG
ee040e02 1 16000000 0.0 0.0 0 poutlook.exe
0 ........ 0.0 50.4 0 total
The list of partitions is completely unclear to me:
Code:
c:\src\itsutils\build>pdocread -l
57.00M TrueFFS
| 3.06M Part00
| 2.88M Part01
| 51.06M Part02
48.23M TrueFFS
| 3.06M Part00
| 2.88M Part01
| 51.06M Part02
10.00M TRUEFFS
| 3.06M Part00
| 2.88M Part01
| 51.06M Part02
483.88M DSK1:
| 483.70M Part00
STRG handles: afb7d5fe
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
(483.70M) ce9ec2da
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 10.00M) 0eae8ede
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 48.23M) 0fb2bf42
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 fe 04 01 02 1c 32 08 ee 0d 07 05 4d
( 51.06M) efb2bd82
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 fe 04 01 02 1c 32 08 ee 0d 07 05 4d
( 2.88M) cfb2bd5e
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 fe 04 01 02 1c 32 08 ee 0d 07 05 4d
( 3.06M)
This machine has 128Mb of ROM, is there anyway I can read this using itsutils? pmemdump can successfully read only after 0x82000000 and prints out "Attempt to access invalid address"...
I dumped the first 16Megs after 0x82000000 and there's all kind of garbage, same like on the maui device. (marxx printed the first 8192 bytes in the above thread). Unfortunately, arm-wince-pe-objdump says "File format not recognized" on both dumps... What am I missing here?
richardt007 said:
arm-wince-pe-objdump says "File format not recognized" on both dumps... What am I missing here?
Click to expand...
Click to collapse
arm-wince-pe-objdump expects a PE binary, so
it is necessary to tell it that we have a raw binary dump.
arm-wince-pe-objdump -D -b binary -m arm dump.file
I have found this information about Linux
on HTC Typhoon:
http://vivien.chappelier.free.fr/typhoon/index.html
I was going to recomend a kernel built with omap 730 support, since the 850 seems to just be a 730 with edge. TI's site isn't to informational about the other circuits built into the omap850, or 730.
I have not been able to get the bootloader thing to do a single useful thing. I only get the tricolored screen. When pluged into the usb I get it saying usb in the corner. I set my mini sd up for the omap 730 image off the above site, but no dice.
My phone is the wiza 100 I beleive (cingular 8125).
YAY! PROGRESS! i will join you guys, when i find out more about how memory is organised. TI supports linux on the omap, maybe if we asked... :/
I never have any luck with the installing the damn toolchains, they never come with any instructions, or limited instructions. But I think I may have it. I nticed a lot of you are better coders and embedded developers than I I hope to learn a lot from you. Also, if there are any tutorials you can provide links to to help me learn, that would be perfect.
Can anyone help me: I was do everything by the book (http://forum.xda-developers.com/viewtopic.php?t=24779&postdays=0&postorder=asc&start=0); I first run unlock tool v1.5, and I had "Input unlock code" problem after soft reset (code 00000000 does not work for me!), then I tried v1.6 using command prompt and prun with command: prun \xdadev_all_unlock-v1.6.exe -q -f, and I'm still getting this stupid "Input network code" messages. I tried this last step many times with and without SIM card, and nothing helped.. I can use PDA functions, but when I try to turn off flight mode...
This is c/p of log file:
xdadev_all_unlock started
xdadev_all_unlock started
device=PM10A
key found
ril ioctl 0xc2: 00000000
simlock answer: %SIMLOCK= 01
0
current lock status: 01
security answer:
000
security answer2:
at%LISTNETWORKCODE answer: 0
at%LISTNETSUBCODE answer: 0
at%LISTSPCODE answer: 0
at%LISTCORPORATECODE answer: 0
at%LISTSIMCODE answer: 0
+CFUN: 1
0
at%LISTIMSIRANGECODE answer: 0
at%CLEARNETWORKCODE answer:
at%CLEARNETSUBCODE answer:
at%CLEARSPCODE answer:
at%CLEARCORPORATECODE answer:
at%CLEARSIMCODE answer:
at%CLEARIMSIRANGECODE answer:
removing lock 01
htclock answer:
simlock answer:
invalid sim lock answer
xdadev_all_unlock done
ril ioctl 0xc2: 00000000
ril ioctl 0xc6: 00000000
Please help someone!!
Thanks.
P.S. Sorry on my bad English.
Have tried this one from the ftp as well: 07/13/2005 09:35 16,384 xdadev_all_unlock-v1.0.exe
Can't remember which one I used, but it worked perfectly.
Cheers, M
ThanX to everyone, I tried xdadev_all_unlock-v1.6 using prun about 15 times more, and I finally fix the problem!
Here's the last (Winner) log file:
xdadev_all_unlock started
device=PM10A
key found
ril ioctl 0xc2: 00000000
simlock answer: %SIMLOCK= 01
0
current lock status: 01
security answer:
000
security answer2:
at%LISTNETWORKCODE answer: 0
at%LISTNETSUBCODE answer: 0
at%LISTSPCODE answer: 0
at%LISTCORPORATECODE answer: 0
at%LISTSIMCODE answer: 0
at%LISTIMSIRANGECODE answer: 0
at%CLEARNETWORKCODE answer:
at%CLEARNETSUBCODE answer:
at%CLEARSPCODE answer:
at%CLEARCORPORATECODE answer:
at%CLEARSIMCODE answer:
at%CLEARIMSIRANGECODE answer:
removing lock 01
htclock answer:
simlock answer: 0
0
0
0
0
0
%SIMLOCK= 00
0
xdadev_all_unlock done
ril ioctl 0xc2: 00000000
ril ioctl 0xc6: 00000000
I need help badly to unlock my Blue Angel. After running the xda_allunlock 1.6_138, I got the following message and the device is waiting for me to type in valid code:
xdadev_all_unlock started
device=PH20B
key found
ril ioctl 0xc2: 00000000
simlock answer:
invalid sim lock answer
error getting current lock status
xdadev_all_unlock failed
ril ioctl 0xc2: 00000000
ril ioctl 0xc6: 00000000
Detail of my Blue Angel:
Orange M2000
Model: PH20B
R: 1.04.00
Orginal SIM card: Orange
Deeply appreciate your advise and help, many thanks.
I wrote this guide because i got frustrated at the seeming impossibility of downgrading a 2.21+ SPL ROM on my Wizard to CID unlock it, and the fact that lokiwiz did not work either.
After a day of research it became apparent that this was far from the truth, and that it was easily unlockable. All the tools were out there, just there wasn't a guide to help direct someone through all the steps.
Well this is that guide.
I've tried to make it newbie friendly, and although this has only been tested on my wizard, i see no reason why this wouldn't work on the Typhoon(infact most of the tools used are originally for the Typhoon) and Tornado seeing as they have almost identical boot loaders.
The guide comes with the usual warning:
“If you manage to brick your phone, it wasn't my fault ”
I cant stress this point enough though, get a few numbers wrong in some of the commands in the guide, and you could break your phone, tripple check everything you type in!!
Attached is the guide in a zipped version in html and .doc format (html for those of you that cant be arsed with MS Word files)
Enjoy
This guide works on G3 phones only, regardless of ROM version, but i see little point in going through all these steps when for 90% of you, lokiwiz should work fine. So i suggest you only use this guide if you are having trouble with lokiwiz, and/or you a 2.21+ SPL G3 Wizard.
**EDIT**Guide back up and updated
Looks good Craptree,
Unfortunately I don't own a G4 device to try it on.
Would love to hear some feedback from users that have a G4 CID Locked Wizard and used this how-to to succesfully CID unlock their G4 Wizard.
Regards,
Molski
Thankyou
keep up the good work Molski
Firstly good work, that was some reading and collating you did , I ive worked my way through but when i come to write the unlocked.nb file back using " pdocwrite -n 1 unlocked.nb" i get this error
CopyFileToTFFS(unlocked.nb:0, 0, 00010000)
ERROR: ITWriteDisk - A device attached to the system is not functioning.
can you shed some light.
Ok ive done some snooping around should the last command be something like
pdocwrite -n 1 0 0x10000 unlocked.nb ??
I have tried this method. And got cid.bin file from the device. How can I convert the cid.bin to cid.nf file? Will this command "perl typhooncidedit.pl cid.bin" will generate the cid.nf file? I don't get it. Please help me. Thanks!
Hi im by no means anywahere near an expert (as you can see from my posting above) but from my limited experience i can say no, perl typhooncidedit.pl cid.bin will read the current file , though note you need to reboot after installing Active Perl and there seems to be a spelling mistake in the commands in the howto its typhooncidedit_pl note the underscore not a full stop.
Its the command "perl typhooncidedit_pl cid.bin -c 11111111 -w unlocked.bin" that creates the file to be written back to the phone. However this is where it ends for me as i cant get the next stage to work just yet and am a little weary of playing around without mor einformed guidence in case i brick the device.
problem with soulcage
when I try to download the package with the crypt-des i got this message:
soulcage.net
This domain name expired on 10/09/2006 and is pending renewal or deletion.
is there any other place to get this package?!?
weird i did it last night and it worked, i even just reopened activeperl and it rececked with no errors, you are downloading the package through activeperl arent you ?
I'm also getting the ITWriteDisk errror and the problem with the Crypt-DES repository. Found Crypt-DES at http://theory.uwinnipeg.ca/ppms/ in the end.
wblqx - oops, looks like i got muddled up with my file name extensions. it doesnt matter if the files a .nb or .bin, theyre both identical. just reference the file you have. so if you have a cid.bin, the command would be
perl typhooncidedit.pl cid.bin -c 11111111 -w unlocked.nb
flipside101 - hmmm im not quiet sure why it wont let you write the file back...all i can sugest is to make sure that cert_spcs.cab and enablerapi.cab have been loaded onto your phone. have you tried copying the files onto your phone and running them manualy?
PS - ive chaged the orignal guides to avoid this confusion in the future wblqx
Ok, I got the crypt-des from here: http://theoryx5.uwinnipeg.ca/ppms/package.xml
and it's version 2.05 from Dave Parishere and this is what I have here:
I got the cid.bin file and this is what I read "inside" it:
D:\qtek\cid>perl typhooncidedit.pl cid.bin
0x0000 - version : 00000001
0xfff8 - checksum: keyix=48: f75b0704 - f2c82199ed8f7449
0x01a0 - keyindex: 000000e600000000 -> 230
0x1930 - cid key : 'MODULESN'
0x0160 - cid : 0008:'WIZQTK01' 0e0f101112131415161718191a1b1c1d1e1f20212223
0x1c80 - lockflag: 0000000000000000
0x0140 - imei : 3563840009225810
0x1d00 - lock 0 : 7bea42ec25ae4b6eac30b47d9691fdac
0x1d10 - lock 1 : 4a02f79b693fe782ad1cf1a9133fc981
0x1d20 - lock 2 : 5afd85493fd413c46b2a28d3ead12c0e
0x1d30 - lock 3 : c82b3203be8574b85f141684499d1d85
0x1d40 - lock 4 : ea60e2bc84f2f60fc730cea22b3147ab
0x4000 - mncmcc : f5a235190000000000000000875f796f5cd3ce3ed6b1a16fc7cef324eed501e8
(the locks codes appears to be crypted, is that correct?)
then I did the perl typhooncidedit.pl cid.bin -c 11111111 -w unlocked.nb and got it:
D:\qtek\cid>perl typhooncidedit.pl cid.bin -c 11111111 -w unlocked.nb
0x0000 - version : 00000001
0xfff8 - checksum: keyix=48: f75b0704 - f2c82199ed8f7449
0x01a0 - keyindex: 000000e600000000 -> 230
0x1930 - cid key : 'MODULESN'
0x0160 - cid : 0008:'WIZQTK01' 0e0f101112131415161718191a1b1c1d1e1f20212223
0x1c80 - lockflag: 0000000000000000
0x0140 - imei : 3563840009225810
0x1d00 - lock 0 : 7bea42ec25ae4b6eac30b47d9691fdac
0x1d10 - lock 1 : 4a02f79b693fe782ad1cf1a9133fc981
0x1d20 - lock 2 : 5afd85493fd413c46b2a28d3ead12c0e
0x1d30 - lock 3 : c82b3203be8574b85f141684499d1d85
0x1d40 - lock 4 : ea60e2bc84f2f60fc730cea22b3147ab
0x4000 - mncmcc : f5a235190000000000000000875f796f5cd3ce3ed6b1a16fc7cef324eed501e8
olddata: 6d18c04e8ed463a6460f100469464259621e8365aeb43277cf2858b925828379
newdata: 95ea23df0bf16432cf7be60912a5cbdedee342037c9d3bd3dee342037c9d3bd3
newsum=3c8b458b encsum=4e3630065084dd42
and at least the: pdocwrite -n 1 unlocked.nb gave me this:
D:\qtek\cid>pdocwrite -n 1 unlocked.nb
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 96 10 01 04 13 1d 11 2c 15 03 06 c5
CopyFileToTFFS(unlocked.nb:0, 0, 00010000)
ERROR: ITWriteDisk - An internal error occurred.
captree, do you have any clue about what is wrong?
here is the unlocked.nb:
D:\qtek\cid>perl typhooncidedit.pl unlocked.nb
0x0000 - version : 00000001
0xfff8 - checksum: keyix=48: 3c8b458b - 4e3630065084dd42
0x01a0 - keyindex: 000000e600000000 -> 230
0x1930 - cid key : 'MODULESN'
0x0160 - cid : 0008:'11111111' 00000000000000000000000000000000000000000000
0x1c80 - lockflag: 0000000000000000
0x0140 - imei : 3563840009225810
0x1d00 - lock 0 : 7bea42ec25ae4b6eac30b47d9691fdac
0x1d10 - lock 1 : 4a02f79b693fe782ad1cf1a9133fc981
0x1d20 - lock 2 : 5afd85493fd413c46b2a28d3ead12c0e
0x1d30 - lock 3 : c82b3203be8574b85f141684499d1d85
0x1d40 - lock 4 : ea60e2bc84f2f60fc730cea22b3147ab
0x4000 - mncmcc : f5a235190000000000000000875f796f5cd3ce3ed6b1a16fc7cef324eed501e8
Hi Craptree, no i tried the manual running of rapi but i still get the same error
D:\XDA\CID>pdocwrite -n 1 unlocked.bin
CopyFileToTFFS(unlocked.bin:0, 0, 00010000)
ERROR: ITWriteDisk - A device attached to the system is not functioning.
In case its any help heres some info on the locked and unlocked files
LOCKED
D:\XDA\CID>perl typhooncidedit_pl cid.bin
0x0000 - version : 00000001
0xfff8 - checksum: keyix=55: 431ca7b6 - fa9d45e5b52e53c3
0x01a0 - keyindex: 0000004a00000000 -> 74
0x1450 - cid key : 32421a0edf4fa9d6
0x0160 - cid : 0008:'WIZO2B01' 0e0f101112131415161718191a1b1c1d1e1f20212223
0x1c80 - lockflag: 0000000000000000
0x0140 - imei : 3563830004598750
0x1d00 - lock 0 : a2a9faccbbfbc0d94497e96264896558
0x1d10 - lock 1 : 58ff98fb2af1350f7fca4f890f358808
0x1d20 - lock 2 : 7b53c3aa8c9d522e46e73b558d75f287
0x1d30 - lock 3 : 0e92d1ddbc64b8e5f8c9950a0bf33284
0x1d40 - lock 4 : 92895c989f8ac37c77b97eadef53e5dc
0x4000 - mncmcc : 095ce2420000000000000000c7c8aba45e2c4b0f8d5e300ab86152430094117c
UNLOCKED
D:\XDA\CID>perl typhooncidedit_pl unlocked.bin
0x0000 - version : 00000001
0xfff8 - checksum: keyix=55: 7d3a21f5 - fdee2cb45bfc5c18
0x01a0 - keyindex: 0000004a00000000 -> 74
0x1450 - cid key : 32421a0edf4fa9d6
0x0160 - cid : 0008:'11111111' 00000000000000000000000000000000000000000000
0x1c80 - lockflag: 0000000000000000
0x0140 - imei : 3563830004598750
0x1d00 - lock 0 : a2a9faccbbfbc0d94497e96264896558
0x1d10 - lock 1 : 58ff98fb2af1350f7fca4f890f358808
0x1d20 - lock 2 : 7b53c3aa8c9d522e46e73b558d75f287
0x1d30 - lock 3 : 0e92d1ddbc64b8e5f8c9950a0bf33284
0x1d40 - lock 4 : 92895c989f8ac37c77b97eadef53e5dc
0x4000 - mncmcc : 095ce2420000000000000000c7c8aba45e2c4b0f8d5e300ab86152430094117c
Hello,
First I have to say this initiative for a CID unlock guide is GREAT !
Unfortunately, I went to the same process and also got write error in the end.
Here's for me :
- Had to use Crypt-DES from http://theoryx5.uwinnipeg.ca/ppms/package.xml while Soulcage.net access is off (or so it seems)
- Installed Cert_SPCS.cab and EnableRapi.cab both using .bat and manual installation
- Was able to get the CID.bin & modify without problem
- Last operation results in following error:
"3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 3a 20 01 02 23 2a 12 8d 01 09 05 40
CopyFileToTFFS(cid_unlocked.nb:0, 0, 00010000)
ERROR: ITWriteDisk - Internal error" (translated from French).
My CID binaries :
## perl typhooncidedit.pl cid_original.bin
0x0000 - version : 00000001
0xfff8 - checksum: keyix=40: 1cab1674 - 37f31b4a27fe4616
0x01a0 - keyindex: 000000d900000000 -> 217
0x18c8 - cid key : 'MODULESN'
0x0160 - cid : 0008:'WIZQTK24' 0e0f101112131415161718191a1b1c1d1e1f20212223
0x1c80 - lockflag: 0000000000000000
0x0140 - imei : 3563840001521300
0x1d00 - lock 0 : 76a905824418f065eefd32cbfb611d28
0x1d10 - lock 1 : 91450180424a15f000bdd1851e5fbb51
0x1d20 - lock 2 : c14cc13d337415f59b71512adfb0319d
0x1d30 - lock 3 : 8b62365380a7f3436e43a4299ce97c0d
0x1d40 - lock 4 : 867bbb89c9d3593a72621810278c89db
0x4000 - mncmcc : 762173b9000000000000000091bcf2bbcf1921a206e6fd057e61d6c08f467a95
## perl typhooncidedit.pl cid_unlocked.nb
0x0000 - version : 00000001
0xfff8 - checksum: keyix=40: 500ec10b - c44c8893515dcabf
0x01a0 - keyindex: 000000d900000000 -> 217
0x18c8 - cid key : 'MODULESN'
0x0160 - cid : 0008:'11111111' 00000000000000000000000000000000000000000000
0x1c80 - lockflag: 0000000000000000
0x0140 - imei : 3563840001521300
0x1d00 - lock 0 : 76a905824418f065eefd32cbfb611d28
0x1d10 - lock 1 : 91450180424a15f000bdd1851e5fbb51
0x1d20 - lock 2 : c14cc13d337415f59b71512adfb0319d
0x1d30 - lock 3 : 8b62365380a7f3436e43a4299ce97c0d
0x1d40 - lock 4 : 867bbb89c9d3593a72621810278c89db
0x4000 - mncmcc : 762173b9000000000000000091bcf2bbcf1921a206e6fd057e61d6c08f467a95
Could this be because we had to use a different Crypt-DES package ? Or shall we look some other reason ?
Thanks and good luck
Sylvain
This is weird, it looks like its worked no one except me
sorry...
my wizard was a G3, but it was locked into 2.26 spl, and refused to be
unlocked with lokiwiz (as G3's with 2.21+ roms seem to have the same problem with cid unlocking that G4's do), or any thing else, and this manual way was the
only thing that did the job for me...
I have two reasons, and i fear its the first one...
1)G3 2.21+ CID locked phones don't have the same problem with CID unlocking that G4's do. So this solution may only work on G3 2.21+ phones
2)I semi downgraded the phone with ftp://xda:[email protected]__RUU_Wizard_1050412_WWE_101_11210_WWE.exe first (it downgraded everything except the spl), then did all the steps layed out in the guide.
riz
jubanet - yea, it appears the lock code is encrypted. if someone with the crypted lock code cid.bin files could send me one, i can see if it appears unencrypted on my version of crypt-des
craptree said:
jubanet - yea, it appears the lock code is encrypted. if someone with the crypted lock code cid.bin files could send me one, i can see if it appears unencrypted on my version of crypt-des
Click to expand...
Click to collapse
here it is!
craptree said:
This is weird, it looks like its worked no one except me
sorry...
my wizard was a G3, but it was locked into 2.26 spl, and refused to be
unlocked with lokiwiz (as G3's with 2.21+ roms seem to have the same problem with cid unlocking that G4's do), or any thing else, and this manual way was the
only thing that did the job for me...
I have two reasons, and i fear its the first one...
1)G3 2.21+ CID locked phones don't have the same problem with CID unlocking that G4's do. So this solution may only work on G3 2.21+ phones
2)I semi downgraded the phone with ftp://xda:[email protected]__RUU_Wizard_1050412_WWE_101_11210_WWE.exe first (it downgraded everything except the spl), then did all the steps layed out in the guide.
riz
Click to expand...
Click to collapse
hummm...
everyboody says that's impossible to CID unlock the G4...
I'll try downgrading to that rom (without touching the ipl/spl)
@ craptree
Im on a g3 2.21.4.1 o2 wizard, so similar to yours, ill try the partial downgrade
Might be a stupid question but the subject says that it's a CID and SIM unlock. The doc only meantions SIM unlock.
LordPhong said:
Might be a stupid question but the subject says that it's a CID and SIM unlock. The doc only meantions SIM unlock.
Click to expand...
Click to collapse
The only bit in the doc thats about SIM unlocking is
"**The number at 0x1d00 is your sim unlock code. Write it down somewhere and use it to sim unlock your phone (i.e. when you insert a different providers sim card, it will ask you for a code)"
The rest is purely about the cid
Hi all,
On a Nook Simple Touch (E-ink reader), there is a service I am unable to locate and delete.
The details:
Code:
Label: Android System
Name: system
Flags: PERSISTENT, SYSTEM
Clients: I
Package: android
Pack. label: Wallpaper
Pack. details: android/com.android.internal.service.wallpaper.ImageWallpaper
While I accept that the system requires resources, this service degrades the performance of the e-reader every now and then to irritatingly slow levels. When it is persistently using CPU time, the screen is very noticeably unresponsive, perhaps once a day or so.
grep reports that this service is a "Default built-in wallpaper that simply shows a static image. "
Added to the rather odd fact that I do not recall having a wallpaper beyond a sheet of white, which I would gladly sacrifice in return for a reliably responsive system.
I additionally don't know how a wallpaper service takes almost more memory than my web browser.
I have been unable to locate documentation on this service, what it does, where it resides and how to disable it.
If anyone could provide any insight on this service, it would be greatly appreciated.
Thanks
(tl;dr: Android's imagewallpaper service uses more RAM/CPU than a web browser, and I would like to kill it or understand why)
The service you mention is the default and very simple implementation of a WallpaperService.
Basically, it gets an intent to use a drawable as a background and draws it when needed.
It really should not be using any CPU or memory.
But it is, and using 10-20% of CPU and about a quarter of my RAM.
How would one go about diagnosing the root cause, and subsequently disabling it?
I tried 'pm disable servicename' but it only shifted the exact same CPU and RAM usage to the Google checkin service, and after I disabled that, to the Android system itself.
What might be causing this?
Where are you getting these statistics from?
Are you getting these statistics over ADB without an app running?
What are you using for a launcher?
Do you have any widgets on the desktop?
What does logcat say?
What does ps say?
Renate NST said:
Where are you getting these statistics from?
Click to expand...
Click to collapse
From the task manager built into Relaunch (nookdevs . com/ReLaunch), a barebones file manager/launcher without animations nor wallpaper.
Renate NST said:
Are you getting these statistics over ADB without an app running?
Click to expand...
Click to collapse
This is persistent over a week-long period of regular usage, as in, the resource consumption is constant regardless of what I am doing with the device (ie. fresh boot, web browser, reading).
I am unaware of the command to pull these statistics over ADB, though I suspect they will be similar.
Renate NST said:
What are you using for a launcher?
Click to expand...
Click to collapse
Relaunch (nookdevs . com/ReLaunch)
Written for the Nook, spartan feature set includes only file manager, basic app selection, wifi and battery information.
UI is simplistic, about what you'd expect from a file manager.
No animations.
Renate NST said:
Do you have any widgets on the desktop?
Click to expand...
Click to collapse
I have a listing of files in the current directory, beyond that nothing.
Renate NST said:
What does logcat say?
Click to expand...
Click to collapse
pastebin . com/j4EWAH0R
(Does not seem to have anything relevant, but the lagging problems only manifest themselves once a day or so.)
Renate NST said:
What does ps say?
Click to expand...
Click to collapse
Code:
USER PID PPID VSIZE RSS WCHAN PC NAME
root 1 0 552 248 c00d4988 0000d6cc S /init
root 2 0 0 0 c0078ee4 00000000 S kthreadd
root 3 2 0 0 c006925c 00000000 S ksoftirqd/0
root 4 2 0 0 c0090d48 00000000 S watchdog/0
root 5 2 0 0 c0075624 00000000 S events/0
root 6 2 0 0 c0075624 00000000 S khelper
root 12 2 0 0 c0075624 00000000 S suspend
root 127 2 0 0 c0075624 00000000 S kblockd/0
root 133 2 0 0 c0075624 00000000 S cqueue
root 143 2 0 0 c0075624 00000000 S twl4030-irqchip
root 144 2 0 0 c01a4b54 00000000 S twl4030-irq
root 170 2 0 0 c0075624 00000000 S omap2_mcspi
root 177 2 0 0 c0075624 00000000 S ksuspend_usbd
root 182 2 0 0 c01df4e4 00000000 S khubd
root 187 2 0 0 c0075624 00000000 S kmmcd
root 218 2 0 0 c00a573c 00000000 S pdflush
root 219 2 0 0 c00a573c 00000000 S pdflush
root 220 2 0 0 c00aa36c 00000000 S kswapd0
root 222 2 0 0 c0075624 00000000 S aio/0
root 230 2 0 0 c0075624 00000000 S epd-su/0
root 231 2 0 0 c0075624 00000000 S epd-dspck/0
root 371 2 0 0 c01f7818 00000000 S usb_mass_storag
root 385 2 0 0 c0075624 00000000 S zforce_wq
root 404 2 0 0 c0075624 00000000 S kondemand/0
root 416 2 0 0 c0075624 00000000 S hid_compat
root 485 2 0 0 c0215cb8 00000000 S mmcqd
root 716 2 0 0 c0215cb8 00000000 S mmcqd
root 720 2 0 0 c012dcdc 00000000 S kjournald
root 724 2 0 0 c012dcdc 00000000 S kjournald
root 725 1 700 276 c017e784 afe0c74c S /system/bin/sh
root 728 1 836 360 c00d4988 afe0cb14 S /system/bin/OMXPolicyManager
root 729 1 1900 360 ffffffff afe0c7ec S /system/bin/OMXResourceManager
root 734 1 216 64 c007dd0c 0001413c S /system/bin/bridged
system 735 1 764 264 c022646c afe0c9ec S /system/bin/servicemanager
root 737 1 816 400 c00d4988 afe0cb14 S /system/bin/vold
root 738 1 628 244 c0248ce4 afe0d37c S /system/bin/debuggerd
root 740 1 171004 8552 c00d4988 afe0cb14 S zygote
media 741 1 28516 1820 ffffffff afe0c9ec S /system/bin/mediaserver
bluetooth 742 1 1068 348 c00d4988 bef345b4 S /system/bin/dbusdaemon
root 743 1 756 328 c02ab6e8 afe0c74c S /system/bin/installd
keystore 746 1 1600 272 c0248ce4 afe0d37c S /system/bin/keystore
root 754 2 0 0 c0075624 00000000 S pvr_timer/0
root 782 2 0 0 c0075624 00000000 S pvr_workqueue
root 790 1 16832 12172 c016e7e8 afe0c74c S /system/bin/omap-edpd.elf
system 810 740 353844 54808 ffffffff afe0c9ec S system_server
root 820 2 0 0 c0075624 00000000 S pvr_display_syn
system 1003 740 258112 16916 ffffffff afe0d974 S com.android.settings
root 1008 2 0 0 c0075624 00000000 S sdio_wq
root 1015 2 0 0 c0075624 00000000 S tiwlan_wq
wifi 1032 1 1988 668 c00d4988 afe0cb14 S /system/bin/wpa_supplicant
app_2 1043 740 245724 12396 ffffffff afe0d974 S com.android.inputmethod.latin
app_3 1108 740 249840 11984 ffffffff afe0d974 S com.bn.cloud.svc:svc
system 1134 740 252272 18352 ffffffff afe0d974 S com.bn.devicemanager
system 1181 740 261060 10192 ffffffff afe0d974 S com.bn.waveformdownloader.svc
app_22 1201 740 249236 11240 ffffffff afe0d974 S com.android.vending
app_23 1558 740 308052 62676 ffffffff afe0d974 S com.UCMobile
app_29 1742 740 253832 15392 ffffffff afe0d974 S com.eink.norefresh
app_29 1756 1742 636 344 c0227544 afe0c74c S /system/bin/logcat
app_34 3105 740 259656 21560 ffffffff afe0d974 S com.harasoft.relaunch
dhcp 3173 1 304 164 c00d4988 0000ee6c S /system/bin/dhcpcd
app_30 3247 740 250176 15752 ffffffff afe0d974 S siir.es.adbWireless
root 3289 1 3372 184 ffffffff 0000f444 S /sbin/adbd
root 3369 3289 700 328 c017e784 afe0c74c S /system/bin/sh
root 3370 3289 636 344 c0227544 afe0c74c S logcat
app_17 3395 740 251488 11776 ffffffff afe0d974 S com.google.process.gapps
app_20 3413 740 244860 10292 ffffffff afe0d974 S com.android.setupwizard
root 3442 3289 700 328 c0066b58 afe0d61c S /system/bin/sh
root 3446 3442 844 340 00000000 afe0c74c R ps
Thanks
Edit: The PID/UID of the problematic process is 810/1000, which corresponds to "system 810 740 353844 54808 ffffffff afe0c9ec S system_server" from the ps result. I'm searching for insight on system_server.
Thanks, oops, sorry. I meant to say "top".
If you are running something that displays stats constantly it could be causing the wallpaper to constantly redraw.
Try a top from ADB, I'm sure that it will show zero usage.
You do have some wackiness going on in your logcat.
The UMSServer is going crazy. Is there a problem with your SD card?
Cross-referencing the PID with the processes reported in the task manager appears to point the issue at "system_server"
I'm not sure of the relevance of this, but it appears other Android devices have encountered issues with this particular process, with symptoms similar to mine.
However, their solutions (disabling GPS, replacing 'system_server' with its 2.3/4.0 counterpart) do not seem to apply, or cause more issues in this case.
The UMS messages only show up during physical USB connection, not during logcat when there is only a wireless connection, so it should be unrelated.
Could you clarify 'top'?
Your explanation makes sense, but it doesn't fully explain why the system slows to a crawl for about ten to twenty minutes out of the blue every now and then, seemingly caused by this process.
However, this may just be an unrelated factor.
I have, in my search for what 'system_server' does, discovered what happens if you replace said file with its 2.3/4.0 counterpart, should anyone wish to know.
Regular functions are unaffected, resource usage by the process is slightly diminished, however the tablet is unable to wake from sleep.
Additionally, removing most of the Google and B&N system services has somewhat circumvented the issue.
Thanks for your help, by the way, wouldn't have gotten past the whole figuring out what ImageWallpaper was without it.
I looked at the code for UMSServerActivity quickly and jumped to the conclusion that it was for mounting of the SD card.
It's actually the USB Mass Storage mounter.
I looked at logcat with a USB drive plugged in and I don't get any of those messages that you have.
From a shell in ADB:
Code:
# top
User 0%, System 0%, IOW 0%, IRQ 0%
User 3 + Nice 0 + Sys 1 + Idle 300 + IOW 0 + IRQ 0 + SIRQ 0 = 304
PID CPU% S #THR VSS RSS PCY UID Name
24453 0% R 1 876K 388K fg root top
2 0% S 1 0K 0K fg root kthreadd
3 0% S 1 0K 0K fg root ksoftirqd/0
4 0% S 1 0K 0K unk root watchdog/0
and so on for another 50 lines...
There is a somewhat more pressing issue, is there a way to have Android save logcat data automatically regardless of system state and ADB connection?
Right now it only has ADB over wifi, which is terminated soon after the device sleeps.
The reason I ask is that right now if I leave it for too long it refuses to wake up, I assumed this was an issue with the replacement of "system_server" in "/system/bin/", as the reverting those changes initially did away with the problem, but it just manifested itself twice over the span of five minutes and I'd like to track
down the source.
Thanks
aliastral said:
I assumed this was an issue with the replacement of "system_server" in "/system/bin/"
Click to expand...
Click to collapse
Um, if you start indiscriminately swapping out system parts you are bound to cause wackiness.
For example: I've been having problems with "mediaserver".
It crashes all the time, but what is in /system/bin/mediaserver is just a stub that gets a bunch of processes running.
I wouldn't think of trying to swap out /system/bin/mediaserver.
The problem probably lies in a bug in one of the audio libraries in /system/lib