Hi
Yesterday with SEUS my X10 is bicked, today i try all this ways and all the same result BRICKED.
1º Several times with SEUS, 2 pcs, and not installed.
2º pccompanion connect to X10 but not identifie.
3º flashupdate with step 1 of root way, several times, KO
Code:
INFO: <<<ERR_SEVERITY="MAJOR";ERR_CLASS="PROTOCOL_CLASS";ERR_STATIC="UNVALID_COMMAND";ERR_DYNAMIC="";
30-jun-2010 12:11:52 X10flash writeCmd
INFO: write(cmd=10) (finish)
30-jun-2010 12:11:52 X10flash readReply
INFO: <<< cmd=10,flags=0,length=0
30-jun-2010 12:11:52 X10flash writeCmd
INFO: write(cmd=4) (finish)
30-jun-2010 12:11:52 X10flash readReply
INFO: <<< cmd=4,flags=1,length=0
30-jun-2010 12:11:52 X10flash run
INFO: ###test end.
4º With special pack unbrick XIOFUB, the same result, KO
hotfile.com/dl/44983907/9d54b5e/XIOFUB.rar.html
5º With Omnius, the same result, KO
Code:
13:11:49 Flash
13:11:49 Allows to change languages supported by the phone and upgrade its firmware.
13:11:49 Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
13:11:49 Application version: 0.04.2151 (beta)
13:11:49 . The action name is 'Flash'
13:11:49 Selected phone type: Xperia™ X10
13:11:49 i Instructions
13:11:49 i 1. Make sure the phone battery is charged to at least 50%.
13:11:49 i 2. Switch off the phone!
13:11:49 i 3. Remove the phone battery and wait at least 5 seconds before reinserting it!
13:11:49 i 4. Press and hold the return back button, then connect the cable to the phone!
13:11:49 . The action started waiting for the user
13:12:31 . The action finished waiting for the user
13:12:31 Conectado por medio de Dispositivo Flash USB SEMC (USB1)...
13:12:31 Version del controlador: 2.2.0.5
13:12:31 Cip detectado: QSD8250
13:12:31 Modo de Arranque: EROM
13:12:31 IMEI:
13:12:31 Enviando Cargador...
13:12:33 Establishing connection to the server...
13:12:38 Receiving news...
13:12:39 i No news
13:12:40 Actual credit: 0.00
13:12:46 Writing file R1FA016_APP_SW_RACHAEL_GENERIC_1227_4612_S1_SW_LIVE_AC12_0001_S1_PARTITION.zip...
13:13:16 e ¡Fallo!
13:13:16 . The action entered shutdown phase
13:13:16 . The action reported failure
Error code
# C882780696072EA7
Detalles del error
---
11 2C C9 F3 6E FE 3A DF 5C 3D FE F8 38 EA 82 99
EE D9 94 3C B0 8F 36 FB 3D B5 B1 B8 86 08 EE A7
44 5B AA 5E 60 2C A6 D1 86 58 4C 8A E8 79 A2 23
11 08 38 33 3E 30 EA 6F D4 29 2A D4 0A 7E 9C 18
DC B5 8A 47 D4 C6 F8 BF B2 4C C2 35 08 29 3E C9
14 65 FA E3 70 CF A4 62 F4 3D CE 0B 18 76 AE 99
04 EB 62 74 CE B3 9A 01 04 1D A2 D5 D8 C3 D6 3C
61 E8
---
6º With Davinci, the same result, KO
Code:
Getting Software List From Server For: X10 / 0001 / Red...
SELECTED: Flash / Debrand / Re-Brand [SonyEricsson] X10 / 0001 / Red / R2BA020 / O2 DE/LUSTER WHITE (1233-2794/R14A | GENERIC)
Script Execution Started...
Checking Files...
Downloading 85Kb...OK! (1 sec)
Downloading 16268Kb...OK! (47 sec)
Downloading 131984Kb...OK! (413 sec)
Starting up...
Script initialization. Please wait...
Loading S1 Loader... OK
20091222 15:39:00 S1_LOADER R4A024 1226-2250
Memory Stick: 8GB
Opening TA...OK
Reading TA Please Wait...OK
Closing TA...OK
Opening MiscTA...OK
Reading TA Please Wait...OK
Requesting Account Status...OK
User: 49574 / Credits: 0 / Counters: 10
Writing TA Data...OK
Writing APP-SW/amss_fs.sin...OK
Writing APP-SW/apps_log.sin...OK
Writing APP-SW/amss.sin...OK
Writing APP-SW/fota0.sin...OK
Writing APP-SW/fota1.sin...OK
Writing APP-SW/recovery.sin...
Error! SIN Body Block Not Accepted! Done 0x575000 of 0x575880
Writing APP-SW/dsp1.sin...
Error! APP-SW/dsp1.sin Header Is Not Accepted!
Writing APP-SW/boot.sin...
Error! APP-SW/boot.sin Header Is Not Accepted!
Writing APP-SW/cache.sin...
Error! FSP/cache.sin Header Is Not Accepted!
Writing APP-SW/preset.ta...FAILED
Error! SIN Body Block Not Accepted! Done 0x575000 of 0x575880
Writing APP-SW/dsp1.sin...
Error! APP-SW/dsp1.sin Header Is Not Accepted!
Writing APP-SW/boot.sin...
Error! APP-SW/boot.sin Header Is Not Accepted!
Writing APP-SW/cache.sin...
Error! FSP/cache.sin Header Is Not Accepted!
Writing APP-SW/preset.ta...FAILED
Failed To Write: 0x08FD Size 0x0010
Writing FSP/system_S1-SW-LIVE-AC12-0001-S1-PARTITION-WITH-SPARE.sin...
Error! FSP/system_S1-SW-LIVE-AC12-0001-S1-PARTITION-WITH-SPARE.sin Header Is Not Accepted!
Writing FSP/userdata_S1-SW-LIVE-AC12-0001-S1-PARTITION-WITH-SPARE.sin...
Error! FSP/userdata_S1-SW-LIVE-AC12-0001-S1-PARTITION-WITH-SPARE.sin Header Is Not Accepted!
Writing TA Data...FAILED
Starting Advanced Section...
Closing TA...FAILED
Shutting Down...OK
Your X10 Has Been Successfully Updated!
Execution Time - 00:10:07
Done!
Loading User Info...
User: / Credits: 0 / Counters: 10
You are, of course putting the device into flash mode each try right?
what do you mean by bricked? bricked usually means unable to do anything including flash roms....
x edude03, of course always put return key and x10 is in flash mode.
x dan-htc-touch, bricked is like you say, power on my x10 and in 30/40 seconds one phone with warning appear in the screen.
May be this problems is by status battery < than 50% ?
thanks a lot
alucine
alucine said:
x edude03, of course always put return key and x10 is in flash mode.
x dan-htc-touch, bricked is like you say, power on my x10 and in 30/40 seconds one phone with warning appear in the screen.
May be this problems is by status battery < than 50% ?
thanks a lot
alucine
Click to expand...
Click to collapse
I have a feeling that is has to do with an incompatible baseband (amss) currently on your phone, and the OS image...
the easy way: why don't you try the root method again?
rodrigofd said:
the easy way: why don't you try the root method again?
Click to expand...
Click to collapse
rodrigofd, if you look first post "way 3" is with root method of this forum, "way 4" is unbrick method of this forum, "way 5" is with Omnius server, and "way 6" is with Davinci server.
I think that is impossible, that 4 differents methods fail.
My last theory is battery status, it is possible to update firm with less than 50% battery ?
May be my X10 brick has less than 50% battery and ALL method fail buy this...
Anybody can updated x10 with less than 50% battery ?
Thanks agains.
alucine
P.D: Gracias amigo, desde Madrid
I updated yesterday, using Omnius, with 38% battery. Then I rooted it. No problems here.
when you tried with omnious , did you try to flash with software that was for your version of the x10, ie, did you use x10a software with an x10a or x10a software on a x10i?
my bricked phone came back to life only after flashing with the correct version of the software
instigator008 , sure that with 38% battery ? you are the first my friend
hondaguy, i sure that firmware is for X10i
by bricked you mean that you have a phone with a triangle on screen?
If so, I had the same problem.
what I did was to flash the latest firmware R2. This booted the phone for me.
Grab the flash tool, and download the Telenor R2 version from here
forum.xda-developers.com/showthread.php?t=683793
backup system.sin and userdata.sin from the flash folder, and rename the files that you got in the R2 rar to system.sin and userdata.sin (userdata.sin should be the file that is 5kb)
and then flashed it, this fixed the issue
stop what you are doing and start with the BASICS.
first of all if your phone goes to yellow triangle then it is not bricked so stop worrying
secondly re download an omnius firmware of your choice ( i suggest UK generic r1b0016 as it will prepare you for root )
i tell you to re-download because your old download may be corrupt
extract the file you downloaded so you get the 2 .zip files
try omnius again. large zip in top , small zip in bottom
if that fails then try from different a computer.
What version of Omnius are you using and where did you get the firmware that you are trying to flash through it from?
Also can you add how you "stuffed" it exactly.
Global Generic R1FA016 for Omnius:
http://www.2shared.com/file/rWZ3YeGm/X10i_GLOBAL_GGL_GENERIC_1232_9.html
http://www.megaupload.com/?d=0JMUI3I5
R1FA016_APP_SW_RACHAEL_GENERIC_1227_4612_S1_SW_LIVE_AC12_0001_S1_PARTITION in as the application file and
R7A_R1FA016_FSP_X10i_GENERICGLOBAL_GGL_GENERIC_1232_9897_S1_SW_LIVE_AC12_0001_S1_PARTITION_WITH_SPARE as the customised file.
and also have you tried emptying your blob_fs folder and getting SEUS to do a repair with its own files ? rather than with the 2 files you put in
andy8271 said:
and also have you tried emptying your blob_fs folder and getting SEUS to do a repair with its own files ? rather than with the 2 files you put in
Click to expand...
Click to collapse
Ok, bad thing what you have there. Seems like part of the erase/write procedure for the recovery image has crashed. What might mean you have a hardware problem (and seus crashed because of that) or some essential area has got corrupt.
First pick omnius and try to backup the Trim Area (TA). Just in case you might need it, and to check it still exists.
Pick Any of the rooting packages, and from step1 move all SIN files EXCEPT loader.sin to another folder.
Then, one by one, go flashing those files, in no particular order, but one by one:
amss first
dsp second
amss_fs
apps_log
boot
fota0
fota1
system
userdata
recovery
If any of them give any kind of error, the rest won't flash. If it always get stucked on recovery, you probably have a bad block on the flash chip, and you should go to a service center, tell them you were updating with SEUS and it crashed. See if you can get a swap.
alucine said:
My last theory is battery status, it is possible to update firm with less than 50% battery ?
May be my X10 brick has less than 50% battery and ALL method fail buy this...
Click to expand...
Click to collapse
Yes it might completely fail with less than 50% battery, I myself had one rooting routine where my battery dropped from 60% to less than 10% in a full ROM flashing. So the guy who did it with only 38% just had a lucky run period.
I can't remember where it was posted but I did see a post from somebody who failed flashing with 48% of battery power.
So before starting any recovery attemp I'd suggest you let your X10 load up to a full 100% (when the led turns off) before trying anything else. I also noticed that when loading the battery directly from a power outlet it loads faster than from powering from USB.
alucine said:
instigator008 , sure that with 38% battery ? you are the first my friend
hondaguy, i sure that firmware is for X10i
Click to expand...
Click to collapse
My impression is the 50% battery is a recommendation for safety, not a must have to proceed.
Hi guys, this morning my battery in another X10 say 30% left only...
My X10 with the battery of a friend, not work update firmware, pccompanion, SEUS and flashtool.
This afternoon i will go to oficial SE support of my city, i hope that will be revive
while rooting yesterday, i left my phone in flash mode for around 20 mins
and from 80% battery it dropped to 10%
if you try rooting or restoring firmware with only 30% battery you are asking for trouble!
I guess I was lucky then lol.. had around 35-40%
Sent from my X10i using XDA App
alucine said:
Hi
Yesterday with SEUS my X10 is bicked, today i try all this ways and all the same result BRICKED.
[/CODE]
Click to expand...
Click to collapse
You mean that its bricked while you used SEUS update?
If this is true and you cannot run X10flash or others again you have a nand failure (hw related).
Then please connect SE and let it fixed by them. I know exactly one person with the same problem, they replaced his device directly .
Regards
Bin4ry
Related
I have been playing around in the kitchen the past days and managed to cook several 'version' of ROMs. Each always produced the same error message, as below:
echo Warning: OS type not detected, you may need to set tounicode variable manuallywrite xip block starting at 81740000, with 7 fileswrite xip block starting at 81b00000, with 122 files!!! your rom is not known to me: md5: 1cd007bbffa268b12b7968cabb7cc75fthis bootloader seems to be V5.22 2003-05-15 17:46:55no operator rom found80000000 - 80040000 -- bootloader 0 files 1 modules80040000 - 8015d5cc 9 XIPKERNEL 5 files 5 modules80180000 - 80375bdc 8 KERNEL 10 files 14 modules80380000 - 8064306c 7 OS 20 files 36 modules80670000 - 80be66a8 6 SHELL 107 files 88 modules80c00000 - 8102ce98 5 BROWSING 11 files 36 modules81050000 - 813ef114 4 COREAPPS 95 files 44 modules81400000 - 815d2238 3 EXAPPS 34 files 7 modules815f0000 - 8171bc7c 2 PHONE 56 files 19 modules81740000 - 8177ffec 10 XDA_DEVELOPERS1 7 files 0 modules81780000 - 81781c34 -- xip chain 11 xip entries817c0000 - 81ae4338 1 MISC 109 files 42 modules81b00000 - 81e1904c 11 XDA_DEVELOPERS2 122 files 0 modules81ec0000 - 81ee5800 -- bitmap : ffffffff .. ffffffff../rom.exe: found a preamble of 31232 bytes adding: English/NK.nbf (deflated 47%)
-------------------------------------------
Does it mean anything? Is this normal?
I have used one of the newly created ROM and installed it in my XDA. The installation went smooth. But now after 12 hours usage my XDA run unusually sluggish...i.e. when I tapped a menu, the response took a good 3 secs or even much longer on some menus...
I just did a hard reset and everything seemed to be fine (for now), but now I am concerned if this thing will happen again.
Has anyone experienced this before? Could any one please be so kind as to give me a short explantion?
BTW, this website is the coolest thing I have ever experienced in my 17 years of internet browsing. Simply the best!!
I have experienced similar warning msgs on the logs. I think they are pretty normal, but the ROMs work fine.
Abt the slow response - I had similar problems with my device initially. After lots of research, I found that the problem was the stk.lnk file in the startup folder. Once I removed this, all was fine.
The ROM kitchen does this for you now.
Also select "fix multiple reset bug .. " as well.
hope this helps
Ignore this warning. It just means the 4.x ROMs aren't in the database of known ROMs yet. Lazyness on our part...
sps: appreciate your kind reply and advises. Did all that ...actually ..
another small problem I just found when i turned on the unit, the xda started a soft reset automatically (i.e. i did not press the soft reset button at all). On another occasion, the unit went off as soon as the back light went off. (my battery was fully charged).
sorry if i asked too many small questions like this, but i wanted to know if anyone else experienced these and that if it is some bugs from WM2003 or something else. I don't mind with all these teething problems, as i always like to try new things. But I need some advises/ comments.
xda-developers : thank you for your prompt n effective explanation..
cheers..
Hi all,
Like many of us, I managed to kill a digitizer on my HTC Aria. Replaced the blasted thing, and now I find my proximity sensor is really sensitive. It's locked in proximity mode (Z-devicetest shows distance 0) in normal conditions.
If I pull off the digitizer, so the prox sensor has a clear path in front of it, it goes out of proximity state and Z-devicetest shows the distance as 1 (and the display works properly during calls, speakerphone works, etc) ...
If I slowly move the tip of my finger towards the prox. sensor, digitizer still removed, Z-devicetest shows it flip from 1 to 0 (out of prox to in prox) as my finger gets within ~2 inches.
So it seems the prox. sensor is working but is too sensitive.
Is this the normal failure mode of a CM3602 prox sensor (read: i dropped it, and not only broke the digizer, but took out the prox sensor too!) .. or, is there some sort of calibration i need to do?
Anyone have a USA source of the CM3602? My usual suppliers digikey and mouser don't carry this component..
*curses self* shoulda listened to my friend who warned me this phone is real easy to bust
There is a guy in the accessories board that is selling parts of his aria. I'd link ya but I don't know how from this app.
Sent from my Liberty using XDA App
Right on.
I didn't want to butcher this poor little POS more so I figured out how to turn the bloody sensor off in software.
append
gsm.proximity.enable=false
to /system/build.prop
or just uncomment the line if you have an editor.. but you can just cat >> build.prop in the shell and type in the line. No editor needed.
Must do this via adb shell with phone in clockwork, otherwise nand is lokt. boo. dev eng hardware doesn't have that problem... stupid consumer devices!
So do you just start Android sdk and then type the following.
append (enter)
gsm.proximity.enable=false (enter)
or is there more to it. I really need to get this disabled.
I tried to do it with ASTRO but it doesnt save my changes.
/system/build.prop is a standard text file.
Remember that stuff in /system is protected, I find the best way to deal with the /system partition is through clockworkmod recovery.
a. Disconnect USB, reboot into clockworkmod recovery
b. Mount the /system partition from the partitions menu
c. Connect USB to a system with adb
d. adb pull /system/build.prop
e. Edit file with your favorite text editor to append gsm.proximity.enable=false
f. adb push build.prop /system/build.prop
g. unmount /system from clockworkmod recovery partition menu
h. reboot phone, receive bacon
If you don't have clockworkmod recovery, just use unrevoked to install it
Oh, i should also say CM6 (and maybe all of Froyo images?) do not honor this setting.
Thank you I will try this when I get home..
I may have an issue because if I open build.prop with root explorer it says...
# try to disable proximity sensor in call by default
# gsm.proximity.enable=false
This is located almost at the bottom of the page does this mean I am sol. It is the liberated Rom and I haven't done anything to it.
Sent from my HTC Liberty using XDA App
Just remove the # ...
# gsm.proximity.enable=false
..to
gsm.proximity.enable=false
thank you so much..... you may be oh wait you are the FN man.
ok so if froyo images dont honor this does that mean when we get froyo I shouldn't upgrade.
anyway thank you so much now I can use my phone again, I didn't realize how much my Pure was dated till I had to use it for a few days.
Glad that helped
I didn't find a property in Froyo that disabled the proximity sensor. Maybe there is one, maybe there is not. I went another method..
Code:
# hexdump -C /system/lib/hw/sensors.liberty.so | grep -C3 dev/cm
00001b10 54 5f 54 46 4c 41 47 20 65 72 72 6f 72 20 28 25 |T_TFLAG error (%|
00001b20 73 29 00 45 43 53 5f 49 4f 43 54 4c 5f 41 50 50 |s).ECS_IOCTL_APP|
00001b30 5f 53 45 54 5f 4d 56 46 4c 41 47 20 65 72 72 6f |_SET_MVFLAG erro|
00001b40 72 20 28 25 73 29 00 2f 64 65 76 2f 63 6d 66 75 |r (%s)./dev/cmfu|
00001b50 6b 74 00 43 41 50 45 4c 4c 41 5f 43 4d 33 36 30 |kt.CAPELLA_CM360|
00001b60 32 5f 49 4f 43 54 4c 5f 45 4e 41 42 4c 45 20 65 |2_IOCTL_ENABLE e|
00001b70 72 72 6f 72 20 28 25 73 29 00 2f 64 65 76 2f 6c |rror (%s)./dev/l|
Offset 1b48 in /system/lib/hw/sensors.liberty.so defines the device name of the proximity sensor, normally /dev/cm3602.
Hexedit the file to change the name of the device to something that doesn't exist, and you will no longer use the proximity sensor.
Nasty and totally the wrong way to do this, but it worked for me. I suppose I could have dug through source code to check for a flag to disable the sensor, but that takes more time and is far less hacking fun than hex editing a system library If I didn't want to live dangerously I'd stick with the stock ROM lol.
Thanks again I will check back when group comes out if I can't figure it out. I am going to stick with the liberated Rom till we get the official Rom and it gets liberated.
Sent from my HTC Liberty using XDA App
Not a bad idea if you're happy with 2.1 and Sense
Yeah I really like the sense UI so I will stay with 2.1 until a 2.2 with sense is available.
Sent from my HTC Liberty using XDA App
Thanks for this info. Just changed CM3602 to XM3602 and it stopped.
I just upgraded to the new attn1 2.2 Rom with sense and I used the same fix you gave me for the 2.1 Rom and it worked so I guess that fix will work on all sence roms.
Sent from my HTC Liberty using XDA App
I just used hexeditor on my phone ( fr 2.2) and went to the location you noted 00001b48 but nothing there. I went on looking and found it on a few lines starting at 00002090. but which value do I change to get it to disable. If you could look at this for me it would help alot.
nrvate said:
/system/build.prop is a standard text file.
Remember that stuff in /system is protected, I find the best way to deal with the /system partition is through clockworkmod recovery.
a. Disconnect USB, reboot into clockworkmod recovery
b. Mount the /system partition from the partitions menu
c. Connect USB to a system with adb
d. adb pull /system/build.prop
e. Edit file with your favorite text editor to append gsm.proximity.enable=false
f. adb push build.prop /system/build.prop
g. unmount /system from clockworkmod recovery partition menu
h. reboot phone, receive bacon
If you don't have clockworkmod recovery, just use unrevoked to install it
Click to expand...
Click to collapse
I am trying to use these steps to disable the sensor, but I am having issues pulling build.prop.
In the command prompt, I enter in:
adb pull /system/build.prop c:\
And receive:
264 Kb/s (4695 bytes in .012s)
The issue I am having is that I cannot find where adb stores the file on my computer. It's not in the c:\ directory. It's not in platform-tools folder. I did a search, and nothing came up
Any suggests would be really appreciated.
Thanks!
I'm confused - why are you guys disabling the proximity sensor???
Is it because you improperly installed a new screen?
Might as well use duct tape to hold the new screen on and then JB Weld the back case. Seriously guys, do things right and take the screen back off and install it the right way.
kaschenberg,
I dropped my phone, shattering the screen; resulting in a lot of fractures in the glass where the sensor is located. The phone and screen works when I add pressure to the upper right corner, leaving me to believe the sensor is being interrupted by the fractures. I am hopeful, as a temporary fix, that if I can disable the sensor, the phone will work more optimally until I replace the screen.
- Thoughts?
I accidentally restored TWRP backup of another Zuk Z2 phone on my new pgone and in this process over-wrote the EFS partition. This left me with a phone having no IMEI, no mac for Wifi and Bluetooth. Effectively No Network on phone.
Worried, I searched across internet to find out ways to restore IMEIs and get my phone working again. The way out was to restore xqcn file and use it to get back IMEIs, mac address etc. But there were various posts and mixed feedbacks. Even when I restored modified xqcn and got IMEIs back, it had only one sim actually working and other had no signal.
I spent many hours searching for finding right steps. It was a long tiring process wherein close to 2 days were gone trying multiple methods, flashing QPST roms around 10 times to observe network in Stock ROM , in Custom ROMs and after reflashing etc etc etc . Shouts go out to Akrapovic & Nordicus for their detailed posts which helped me in understanding lot many things and also finalizing key steps to restore IMEIs, MAC etc and getting phone working
Pre-requisites:
1) QPST installed on PC; Download v 2.7.453 from here or elsewhere if you know of
2) ADB / Fastboot installed
3) Drivers Installed for Zuk Z2
4) Hex Editor to edit xcqn file
5) WriteDualIMEI_W_G_eMMC - to write IMEIs once xqcn has been restored
6) Zuk Z2 rooted with ADB enabled through developer options and connected to computer
For points 2 and 5, pls refer here to download the files and tools.
So the solution which worked for me, and one which has been tried and tested is following:
1) First check the IMEIs dialing *#06#.
If you see IMEI and matching with that on your box, there is no issue and you should stop.
If you see blank / error, process further
2) The EFS is corrupt and hence we don't see IMEIs. Follow this paget and get the EFS partition wiped out to properly prepare EFS for restore of xqcn in next steps.
I had restored xqcn file without wiping EFS partition and later on had issues. But all these issues were gone when first wiped EFS and then restored xqcn. So will suggest doing same.
3) Get the xqcn for our phone Zuk Z2 from here original credits to 唐大土土 and Nordicus who shared it here
Use HexEditor to search below default values and replace them with your devices value. IMEIs / MEID is available on box. MAC can be assumed suitably
MEID: 22 22 22 22 22 22 22
IMEI1: 33 33 33 33 33 33 33 33
IMEI2: 44 44 44 44 44 44 44 44
WIFIMAC: 55 55 55 55 55 55
BTMAC: 66 66 66 66 66 66
4) To be on safer side and avoid other variabilities, it is suggested to first flash QPST rom to ensure that apart from EFS all other partitions are fine. This is optional.
5) Now with rooted phone connected to PC, open command prompt on PC and go to adb folder. From there type these commands
Code:
adb shell
su (looking at the phone screen, as during this second command you need to grant root rights)
setprop sys.usb.config diag
Once done you will see in device manager 3 new com ports are open. If some errors or no success in getting com ports opened you can try following too
Code:
adb shell
su (looking at the phone screen, as during this second command you need to grant root rights)
setprop sys.usb.config diag,rmnet,adb
setprop sys.usb.config diag,acm_smd,acm_tty,rmnet_bam,mass_storage,adb
6) In Device Manager, you will see a com port title Qualcomm Android Diagnosis etc, note the com no.
7) Open QPST, click "Add new port" and enter the port in both places (Port and Port Label), which is written in the device manager.
Next Click Start Client -> Software download. Go to Restore tab, and use the modified xqcn file which you saved in step 2 and press Start.
If any error, tick the check box "Allow phone/file ESN mismatch" and press Start
8) Once restore is 100% done, close the QPST and open the WriteDualIMEI_W_G_eMMC, and put in the IMEIs and flash. You should see Green Pass.
9) Reboot phone and dial *#06# - the IMEIs should be seen. Bingo, job done... give me thanks. Just put in SIM and network should be back.
For Step 7, if more details required, pls refer this post with step by step details
Hope this helps !! I will be extremely happy if this guide helps you in restoring IMEIs, repairing lost network and radio issues.
Reserved
Reserved for FAQs and other experiences.
If i keep a backup of efs patition using twrp..will i be safe in case the partition is corrupt or unreadable?
Bidyadhar said:
If i keep a backup of efs patition using twrp..will i be safe in case the partition is corrupt or unreadable?
Click to expand...
Click to collapse
Yes, that will help in future. Also should take backup of xqcn file using QPST.
I had the lost IMEI problem before, but I did not need rooted phone to solve it. Just turn off the phone, then press Volume (-), and finally connect at the same time the usb cable (make sure drivers were installed before!). You will see 3 new devices, the important is the diagnostics one. Take note of the COM port, and you can use QFIL to backup/flash the qcn. All without root
rainbyte said:
I had the lost IMEI problem before, but I did not need rooted phone to solve it. Just turn off the phone, then press Volume (-), and finally connect at the same time the usb cable (make sure drivers were installed before!). You will see 3 new devices, the important is the diagnostics one. Take note of the COM port, and you can use QFIL to backup/flash the qcn. All without root
Click to expand...
Click to collapse
Interesting, was not aware of this. Is this EDL mode?
mGforCe said:
Yes, that will help in future. Also should take backup of xqcn file using QPST.
Click to expand...
Click to collapse
Sir, can you please tell me how to backup xqcn?
Sent from my Z2 Plus using Tapatalk
Bidyadhar said:
Sir, can you please tell me how to backup xqcn?
Sent from my Z2 Plus using Tapatalk
Click to expand...
Click to collapse
Go till Step 7 as per first post and therein choose backup in place of restore. That's it !
mGforCe said:
Interesting, was not aware of this. Is this EDL mode?
Click to expand...
Click to collapse
I think is not EDL mode, because usb vendor and product ids are different. When I had the IMEI problem, I tried to restore qcn from EDL mode to no avail. After that, I found the suggestion of using Vol(-) and it worked, but it is a diffrent mode, because screen is not black in this one, it shows some options instead (sdcard flash, qcn restore, etc).
mGforCe said:
Use HexEditor to search below default values and replace them with your devices value
Click to expand...
Click to collapse
Please, write here a guide how to edit this values in HEX-editor.
Thanks in advance!
sergsinger said:
Please, write here a guide how to edit this values in HEX-editor.
Thanks in advance!
Click to expand...
Click to collapse
Pls refer below quoted text from OP
Use HexEditor to search below default values and replace them with your devices value. IMEIs / MEID is available on box. MAC can be assumed suitably
MEID: 22 22 22 22 22 22 22
IMEI1: 33 33 33 33 33 33 33 33
IMEI2: 44 44 44 44 44 44 44 44
WIFIMAC: 55 55 55 55 55 55
BTMAC: 66 66 66 66 66 66
Click to expand...
Click to collapse
Use Search and replace feature of Hex Editor to replace above value with your device values
mGforCe said:
Pls refer below quoted text
Click to expand...
Click to collapse
Man, I've tried to do it with two different editors with no luck, because I'm not so close to operate with it. So I ask you to write guide.
Regards.
Problem solved, done by myself.
sergsinger said:
[Man, I've tried to do it with two different editors with no luck, because I'm not so close to operate with it. So I ask you to write guide.
Regards.
Problem solved, done by myself.
Click to expand...
Click to collapse
Good, why don't you share small guide on same for other users now.
mGforCe said:
why don't you share small guide on same for other users now
Click to expand...
Click to collapse
It looks strange. I've asked you to do this, but now you ask me to write a small guide...
I've used Hex Workshop (it's not an advertisement, because I've tried to edit QCN-file with few different editors and they wasn't so friendly to use).
1) Open editor, choose QCN.
Press "Search" and put in data of MEID, Wi-Fi and Bluetooth MACs:
MEID: 22 22 22 22 22 22 22
WIFIMAC: 55 55 55 55 55 55
BTMAC: 66 66 66 66 66 66
!!! Please, notice, that Wi-Fi MAC, that you can see in menu of phone is shown as "54 55 55 55 55 55", but in editor it will be found as "55 55 55 55 55 55" and even in three places. I've changed in all three, because edition of one only doesn't change MAC after reboot.
3) Check after reboot:
- Wi-Fi and Bluetooth MACs are native
- MEID has changed, but it become upside down by group consist of 2 digits (first two digits are now in the end and so on). Problem was solved by "MEID/ESN Tool".
Press "Volume -" and "Power On/Off" (release Power after vibration) until you see "Menu from 0 to 5" (SD update...GetInfo). Connect phone to PC. Launch "MEID/ESN Tool", press "Initialize" (COM-port will be shown), then press button "MEID" and set checkbox "do MEID", enter native MEID (it is like IMEI w/o last digit; it is shown on the box and on the film from the back of the phone), press "Write".
!!! I've tried to change MEID in "MEID/ESN Tool" before QCN was edited, but this was unsuccessful, MEID didn't changed. MEID become native after I've edited QCN in hex-editor and then used "MEID/ESN Tool" as mentioned above.
4) The last one - recover native IMEIs. IMEIs were changed via programm "WriteDualIMEI(W+G_eMMC)". Press "Volume -" and "Power On/Off" (release Power after vibration) until you see "Menu from 0 to 5" (SD update...GetInfo). Connect phone to PC. Launch "WriteDualIMEI(W+G_eMMC)" and enter native IMEIs, press "Start". After reboot you will get native IMEIs.
!!! I've tried to edit IMEIs in hex-editor. But QCN include IMEIs consist of 16 digits, but regular IMEI consist of 15. I've replaced last (useless) number by pressing "space" on keyboard and after reboot there wasn't network. I've supposed that I need to put not a "space", but something like "leave an empty cell" in hex-editor. I haven't tried to do this because I have "WriteDualIMEI(W+G_eMMC)".
@sergsinger don't know why it's strange.. we can give back to xda community only by sharing our knowledge!
Since you had learnt and done it yourself, why not to share the same.
rainbyte said:
I had the lost IMEI problem before, but I did not need rooted phone to solve it. Just turn off the phone, then press Volume (-), and finally connect at the same time the usb cable (make sure drivers were installed before!). You will see 3 new devices, the important is the diagnostics one. Take note of the COM port, and you can use QFIL to backup/flash the qcn. All without root
Click to expand...
Click to collapse
i try your method without rooting, but it didn't work, can you send me qcn file to edit for z2132, also to edit with hex editor is find and replace imei 3333...33 with our imei number is ok or there is other method, also where to look for meid.
sunnythehoney said:
i try your method without rooting, but it didn't work, can you send me qcn file to edit for z2132, also to edit with hex editor is find and replace imei 3333...33 with our imei number is ok or there is other method, also where to look for meid.
Click to expand...
Click to collapse
Pls read OP in detail...the xqcn file is shared there...also to write IMEI you will need tool WriteDualIMEI_W_G_eMMC
Again pls read and download all tools as mentioned in OP as pre-requisite
mGforCe said:
Pls read OP in detail...the xqcn file is shared there...also to write IMEI you will need tool WriteDualIMEI_W_G_eMMC
Again pls read and download all tools as mentioned in OP as pre-requisite
Click to expand...
Click to collapse
i download above 66...6.xqcn file posted above and edit with hexeditor by replacing meid:22.....22 by imei translator hex number. same for imei numbers and restore through qpst config. and then use writedualimei_w_g_emmc all operations shows no error completed successfully but after reboot when dial *#06# shows null meid or imei. now i am going to try by inverting meid no by inverting regular meid no. and imei in inverting pair and make first 8 as 8A. see what happen
sunnythehoney said:
i download above 66...6.xqcn file posted above and edit with hexeditor by replacing meid:22.....22 by imei translator hex number. same for imei numbers and restore through qpst config. and then use writedualimei_w_g_emmc all operations shows no error completed successfully but after reboot when dial *#06# shows null meid or imei. now i am going to try by inverting meid no by inverting regular meid no. and imei in inverting pair and make first 8 as 8A. see what happen
Click to expand...
Click to collapse
where did you find your mied no i am having the same problem
badri21 said:
where did you find your mied
Click to expand...
Click to collapse
It is shown on the box & film from the back of the phone. Usually it is like first IMEI w/o last digit.
In hex-editor MEID which comes with QCN will be simply found by typing "22 22 22 22 22 22 22" in search bar.
If someone interested, just try this small tool:
Run from cmdline (according to sample image), connect device in flash mode, and wait a bit.
*binary* comes from device directly, *config* is in infile format if you want to know what is inside.
No virus / other foreign legionary inside :
https://www.virustotal.com/#/file/8...f13e2099bc9b5a1ddb487ad41cb3948144d/detection
Works on G814x, may work on other devices, but not before (and including) Z5 Premium.
How to fix DRM on XZP:
Step one: Collect Underpants.
Step two: Backup TA.
Step three: Profit.
But seriously, good luck to all testing this. Please report back!
No matter how unstable or chancy this may be (haven't tested, don't wanna risk it haha) it''s progress in this right direction and to the idiots that gave up in the bounty thread, having patience can pay off
Its working. If you don't want to try, don't do that. This is not violence, this only an option To make a drm fix, this could be a step forward.
It's NOT write anything to the device, so safe to try. I have only one G8142, tested, read working fine. On weekend, I'll work on full/partial restore.
Anyway, its not for personal profit, I just want to speed up a complete lossless root solution
Just tested, files have been created, and phone is working without any problem.
Hope someone could get DRM fix soon or at least a point to start with this tool.
Thanks a lot for the effort
Mine just hangs on Checking S1 devices
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Edit: Sorry Didn't read the part that need to connect FLASH MODE It backed up stuff.
does it work with sony xz1 or should wait for next update
karrouma said:
does it work with sony xz1 or should wait for next update
Click to expand...
Click to collapse
You can test is. It cannot write anything, at most cannot read anything.
BTW, this is NOT A RAW TA BACKUP, it backup what the phone give us. But I hope it contains any DRM related stuff
I hope someone will try it out who can understand what it read out, and can give us some feedback.
Anyway, unlocked my one, I love new green shots, but now I can attack from another way too. Looks like dd raw backup
a bit bigger, even its not fully filled
Very good work. It's because people like you that things get done.
HELLO !!! @Macs1209 PERFECT WORK BRO !!!
MY PHONE IS G8141 with windows 7 x64
E:\SONY\XPERIA XZ PREMIUM>dmsSonyTABackup.exe
Checking S1 devices
S1 interface found: \\?\USB#VID_0FCE&PID_B00B#5&1dd2df13&0&2#{a5dcbf10-6530-11d2
-901f-00c04fb951ed}
TA1 binary read ok, size: 139096, saved to E:\SONY\XPERIA XZ PREMIUM\MY IMEI_TA_1.binary.tab
- TA binary parsed, saved to E:\SONY\XPERIA XZ PREMIUM\MY IMEI_TA_1.confi
g.tab
TA2 binary read ok, size: 179230, saved to E:\SONY\XPERIA XZ PREMIUM\MY IMEI_TA_2.binary.tab
- TA binary parsed, saved to E:\SONY\XPERIA XZ PREMIUM\MY IMEI_TA_2.confi
g.tab
THANK YOU VERY VERY SO MUCH GOOD WORK
ps it 's possible change in TA.img or add restore ?
please help bro @munjeni
LukeyWolf said:
No matter how unstable or chancy this may be (haven't tested, don't wanna risk it haha) it''s progress in this right direction and to the idiots that gave up in the bounty thread, having patience can pay off
Click to expand...
Click to collapse
There's a quote in Urdu "sabar ka phal meetha hota he" means that the fruit of patience is always sweet.
kudos to this guy. since S8 Snapdragon 835 version is now rooted. i hope we can get Root and Drm keys together sooner on our XZP
Saadkhalid786 said:
There's a quote in Urdu "sabar ka phal meetha hota he" means that the fruit of patience is always sweet.
kudos to this guy. since S8 Snapdragon 835 version is now rooted. i hope we can get Root and Drm keys together sooner on our XZP
Click to expand...
Click to collapse
Yep, a grest step in the correct direction, also I have to wait anyway haha as I only got my XZP 1 month ago with EE locked haha
I can help reconstruct real TA.img!
Edit:
This tool doesn't backup drm key, I didn't see unit 66667. Without shake authentification I'm believing you can't backup secured units including that drm key unit. I'm still believing that drm key or unlock key is outside trim area, I even didn't see unit 0x8b2 from unlocked device trim area. https://github.com/munjeni/newflasher , can you show your's?
@the_laser , how that is possible that his tool reads some units like:
Code:
[67320]
size=2
data=9A 02
text=
[67321]
size=2
data=FA 01
text=
[67322]
size=2
data=3A 01
text=:
[67323]
size=2
data=1A 01
text=
This works on XZ1 Compact.
It produced 4 files:
[IMEI]_TA_1.binary.tab (146036 bytes)
[IMEI]_TA_1.config.tab (Text display of above)
[IMEI]_TA_2.binary.tab (183728 bytes)
[IMEI]_TA_2.config.tab (Text display of above)
EDIT: For reference, the XZ1c's TA partition is 2MB, so this tool is pulling < 1/4th of that partition.
I don't see 66667 or 8B2 either.
Thanks for responses. So now I need to focus on 66667 abnd 0x8B2.
BTW, "text=" lines for info only, to see is there any text inside, like imei, any sw part version, or log data.
Another question: is there any way to create a modem interface for this device? In the modem firmware part, there's
lot of AT commands, but without interface, I can't communicate with the baseband. On Samsung qualcomm devices,
I could reach lot of things via modem, same logs what are in the partial TA backup binaries. (also I killed one exynos
g925f by wrote something wrong to RF calibration.... )
pbarrette said:
This works on XZ1 Compact.
It produced 4 files:
[IMEI]_TA_1.binary.tab (146036 bytes)
[IMEI]_TA_1.config.tab (Text display of above)
[IMEI]_TA_2.binary.tab (183728 bytes)
[IMEI]_TA_2.config.tab (Text display of above)
EDIT: For reference, the XZ1c's TA partition is 2MB, so this tool is pulling < 1/4th of that partition.
I don't see 66667 or 8B2 either.
Click to expand...
Click to collapse
The tool didn't find my XZ1c, tough I probably need some special drivers that I missed.
Those files are s1 dump for Sony repair services
That provide device info, last Boot logs, installed firmware versions, baseband info, etc
Small parts of TA nothing important
pbarrette said:
This works on XZ1 Compact.
It produced 4 files:
[IMEI]_TA_1.binary.tab (146036 bytes)
[IMEI]_TA_1.config.tab (Text display of above)
[IMEI]_TA_2.binary.tab (183728 bytes)
[IMEI]_TA_2.config.tab (Text display of above)
EDIT: For reference, the XZ1c's TA partition is 2MB, so this tool is pulling < 1/4th of that partition.
I don't see 66667 or 8B2 either.
Click to expand...
Click to collapse
@Macs1209
it is wirking in xz1 also
i got same 4 files
xzp xzc xz1 same drm and same oreo firmware family like xz and xzs
pbarrette said:
EDIT: For reference, the XZ1c's TA partition is 2MB, so this tool is pulling < 1/4th of that partition.
Click to expand...
Click to collapse
Yes partition is 2mb but that not mean that it have 2mb of the data inside! So thats expected.
---------- Post added at 09:39 AM ---------- Previous post was at 09:38 AM ----------
munjeni said:
https://github.com/munjeni/newflasher , can you show your's?
Click to expand...
Click to collapse
Macs1209 said:
Another question: is there any way to create a modem interface for this device?
Click to expand...
Click to collapse
Yes, but waiting your reaply to my question first.
munjeni said:
Yes partition is 2mb but that not mean that it have 2mb of the data inside! So thats expected.
---------- Post added at 09:39 AM ---------- Previous post was at 09:38 AM ----------
Yes, but waiting your reaply to my question first.
Click to expand...
Click to collapse
Code:
Checking S1 devices
S1 interface found: \\?\USB#VID_0FCE&PID_B00B#6&f44bfc6&0&4#{a5dcbf10-6530-11d2-901f-00c04fb951ed}
Response(BIN): SUCCESS: 104857600
Response(HEX): SUCCESS: 31 30 34 38 35 37 36 30 30
Reading TA 1 / 2226
Response(BIN): FAILED: Unable to read TA unit 2226, error=-22
Response(HEX): FAILED: 55 6E 61 62 6C 65 20 74 6F 20 72 65 61 64 20 54 41 20 75 6E 69 74 20 32 32 32 36 2C 20 65 72 72 6F 72 3D 2D 32 32
Reading TA 2 / 2226
Response(BIN): FAILED: Unable to read TA unit 2226, error=-22
Response(HEX): FAILED: 55 6E 61 62 6C 65 20 74 6F 20 72 65 61 64 20 54 41 20 75 6E 69 74 20 32 32 32 36 2C 20 65 72 72 6F 72 3D 2D 32 32
Reading TA 1 / 66667
Response(BIN): FAILED: Unable to read TA unit 66667, error=-22
Response(HEX): FAILED: 55 6E 61 62 6C 65 20 74 6F 20 72 65 61 64 20 54 41 20 75 6E 69 74 20 36 36 36 36 37 2C 20 65 72 72 6F 72 3D 2D 32 32
Reading TA 2 / 66667
Response(BIN): FAILED: Command not authenticated
Response(HEX): FAILED: 43 6F 6D 6D 61 6E 64 20 6E 6F 74 20 61 75 74 68 65 6E 74 69 63 61 74 65 64
Done
Sadly not. 2/66667 looks like needs some authentication, but after it possible to read
(I already unlocked this device, so error-22 can mean TA ID not exists (anymore) too)
I am having Huawei Honor 3C H30-U10, It was running fine but some days back when I plugged in charger it restarted and hung up on welcome screen (no animated logo). Seems like I need to install Stock Rom to it.
Phone Details:
Huawei Honor 3C H30-U10
Build Number: H30-U10 V100R001C900B108
International Variant
I download Stock ROM for it with version B108 but it was in SP Flash Tool format. My phone isn't recognised by my laptop even though I have VCOM drivers installed.
This force me to think I need to download Stock ROM but which is in dload and UPDATE.APP form. It was hard for me to get any ROM H30-U10 V100R001C900B108 in UPDATE.APP form. Fortunately I got one from
forum.lowyat . net/topic/3237141/+1260
(Please look at: 7. V100R001C900B108 ROM (update.app))
Upon pressing Volume UP+Power Key It successfully went to updating from SD Card but I am receiving this error log on screen:
Code:
md5_verify success
dloading module CURVER.....
main version string=H30-U10 V100R001C900B108
dloading module VERLIST.....
Main version from property is H30-U10 V100R001C900B108
main version check: the market is same. go to continue..
current version in VERLIST, allow to update.
dloading module MBR.....
dload:update partition MBR failed
Update /sdcard/dload/update.app failed
=============================
@@@@@ @ @@@ @
@ @ @ @ @
@@@ @ @ @ @
@ @@@@@ @ @
@ @ @ @@@ @@@@@
=============================
My question is
Why I am getting this error?
What are the other possibilities that I can do to bring back this phone to life?
PS:
Pointing to this dload:update partition MBR failed Shopkeeper (Mobile technician) told me your phone internal memory is full or corrupted. You can't get it right until you change the hardware part associated with memory. Is he right?
Guys, I tried hard to search this question on internet and I didn't find anything. Please provide rich information so that other community use it for reference.