Related
I Am Not Responsible For Breaking Your Device, Take Your Own Risks ^__^
Click to expand...
Click to collapse
Hi Folks
Please Follow Below;
To Set SuperCID Or Change Any CID For That Fact;
1. Check you are S-OFF; Follow Moonshine OR Revolutionaries Guide.
2. Reboot Into Bootloader & Check You Are Fastboot USB
3. Type As Below
Code:
fastboot oem writecid 11111111
(Or whatever CID you want to have from the list in the second post)
4. Reboot Into Bootloader Again & Check You Are Fastboot USB
5. Check You Have Your Chosen CID;
Code:
fastboot getvar cid
(This Should Confirm The CID you chose from the list in the second post)
6. Reboot Back To Android By Typing
Code:
fastboot reboot
Files attached in post should anyone be a bit lost
CID List
Description CID
ALL 11111111
BM BM___001
Bouygues-Telecom BOUYG201
Brightstar-SPA BSTAR301
Entel BSTAR306
Tigo BSTAR307
Movistar BSTAR308
Brightstar-PTB BSTAR502
Chunghwa-Taiwan CHT__601
ATT CWS__001
CA_Dave DAVE_001
DCM DOCOM801
DOPOD DOPOD701
Fastweb-IT FASTW401
GOOGLE GOOGL001
H3G-UK H3G__001
H3G-ROI H3G__003
H3G-AT H3G__106
H3G-Italy H3G__402
H3G-DAN H3G__F05
H3G-SWE H3G__G04
HTC-WWE HTC__001
VODA-Africa-South HTC__016
HTC-Australia HTC__023
HTC-EastEurope HTC__032
HTC-Asia-SEA HTC__037
AirTel-India HTC__038
HTC-India HTC__038
HTC-Asia-SEA-WWE HTC__044
HTC-Tesco HTC__052
HTC Israel HTC__K18
HTC-GER HTC__102
HTC-FRA HTC__203
HTC-FRA-Bouygues HTC__247
HTC-FRA-NRJ HTC__249
HTC-SPA HTC__304
HTC-ITA HTC__405
HTC-PTG HTC__506
TWM-TW HTC__621
Asia-HK-CHT HTC__622
HTC-Russia HTC__A07
HTC-Poland HTC__B25
HTC-Czech HTC__C24
HTC-Dutch HTC__E11
HTC-BE HTC__E41
HTC-Denmark HTC__F08
HTC-Sweden HTC__G09
HTC-Norway HTC__H10
HTC-GCC (Gulf Cooperation) HTC__J15
HTC-Turkey HTC__M27
HTC-ELL HTC__N34
HTC-Nor HTC__Y13
Open-Channel HTCCN701
CT HTCCN702
CU HTCCN703
Hutch-Australia HUTCH001
O2-UK O2___001
O2-DE O2___102
Optus-Australia OPTUS001
ORANGE-UK ORANG001
ORANGE-SK ORANG006
ORANGE-PO ORANG008
ORANGE-BE ORANG012
ORANGE-CH-GER ORANG104
ORANGE-AT ORANG113
ORANGE-French ORANG202
ORANGE-CH-FRA ORANG203
ORANGE-ES ORANG309
ORANGE-PL ORANGB10
Rogers ROGER001
SKT_KR SKT__901
SMC-Voda-HK SMCVD001
HTC-Singapore HTC__044
TELEF-Spain TELEF301
Telstra TELST001
TELUS TELUS001
TIM-Italy TIM__401
TMNL T-MOB003
TMCZ T-MOB004
TMUK T-MOB005
TMHR T-MOB006
TMH T-MOB007
TMSK T-MOB008
Era T-MOB009
TMUS T-MOB010
TMD T-MOB101
TMA T-MOB102
TMMK T-MOBL11
CA_Videotron VIDEO001
VIRGIN-UK VIRGI001
VODA-UK VODAP001
VODA-Greece VODAP006
VODA-Swisscom-WWE VODAP015
VODA-Ireland VODAP019
VODA-Australia VODAP021
VODA-New-Zealand VODAP022
VODA-Proximus VODAP024
VODA-SA VODAP026
VODA-Germany VODAP102
VODA-Swisscom-DE VODAP110
VODA-Mobilkom VODAP120
VODA-DE VODAP129
VODA-SFR VODAP203
VODA-Swisscom-FR VODAP212
VODA-Spain VODAP304
VODA-Italy VODAP405
VODA-Swisscom-IT VODAP416
VODA-MTS-RUS VODAPA30
VODA-Portugal VODAPD18
VODA-Netherland VODAPE17
VODA-TR VODAPM27
HTC Australia HTC__039
What CID would HTC_Y13 be?
Theshawty said:
What CID would HTC_Y13 be?
Click to expand...
Click to collapse
HTC__Y13 - Norway I believe / Nordic
Has anyone got dialer issues with super CID enabled?
gianton said:
Has anyone got dialer issues with super CID enabled?
Click to expand...
Click to collapse
Nope , not here,
Enlighten me what seems to be the issue?
Mine is CID-HTC_044
It's for HTC-Asia-SEA-WWE HTC__044 or HTC-Singapore HTC__044 ?
My RUU before using HTC-Asia-SEA-WWE ! !?
Good Guide, I have a question though, now we have s-off and supercid, can we put any cid on our phone for eg my phone came with H3G__001, can I put command for changing it to HTC__001
dryspuri said:
Good Guide, I have a question though, now we have s-off and supercid, can we put any cid on our phone for eg my phone came with H3G__001, can I put command for changing it to HTC__001
Click to expand...
Click to collapse
Yep thats what SuperCID is for it gives you the opportunity to amend you "Region Code" if you want to call it that
wzu7 said:
Mine is CID-HTC_044
It's for HTC-Asia-SEA-WWE HTC__044 or HTC-Singapore HTC__044 ?
My RUU before using HTC-Asia-SEA-WWE ! !?
Click to expand...
Click to collapse
It can mean both have a look at 038 - India
it has the same for 2 x carriers and WWE edition
fkofilee said:
Nope , not here,
Enlighten me what seems to be the issue?
Click to expand...
Click to collapse
Some users with the Dev edition reported after changing to super CID that about an hour later got their dialer disabled and a message of formatting data partition. Reverting to their old CID fixed that.
gianton said:
Some users with the Dev edition reported after changing to super CID that about an hour later got their dialer disabled and a message of formatting data partition. Reverting to their old CID fixed that.
Click to expand...
Click to collapse
Nope nothing on that here... 4.1.2 bug possibly? Or 4.2.2?
fkofilee said:
Nope nothing on that here... 4.1.2 bug possibly? Or 4.2.2?
Click to expand...
Click to collapse
OK great, I think it's device edition related as none other users reported that. Going to revert my CID too. :good:
Don`t want to ruin the Super CID party, but whether we have trie Super CID or not, remains to be seen. It`s true, that both by hex editing the partition or fastboot command now we get Super CID in fastboot, but what is interesting, that when double checking via adb in live system with adb shell getprop "ro.cid", you will still get your original CID. So it seems CID is stored in 2 different locations now and that fastboot forcing the new CID does not fully finish the task.
Try yourself in adb with:
adb shell getprop "ro.cid"
So old CID still hides in one of these...
PHP:
179 0 30535680 mmcblk0
179 1 128 mmcblk0p1
179 2 256 mmcblk0p2
179 3 130671 mmcblk0p3
179 4 1 mmcblk0p4
179 5 16 mmcblk0p5
179 6 256 mmcblk0p6
179 7 15577 mmcblk0p7
179 8 256 mmcblk0p8
179 9 1024 mmcblk0p9
179 10 256 mmcblk0p10
179 11 2048 mmcblk0p11
179 12 2080 mmcblk0p12
179 13 5120 mmcblk0p13
179 14 1024 mmcblk0p14
179 15 1024 mmcblk0p15
179 16 61441 mmcblk0p16
179 17 8190 mmcblk0p17
179 18 32768 mmcblk0p18
179 19 1022 mmcblk0p19
179 20 4096 mmcblk0p20
179 21 4096 mmcblk0p21
179 22 20480 mmcblk0p22
179 23 4 mmcblk0p23
179 24 256 mmcblk0p24
179 25 16 mmcblk0p25
179 26 1280 mmcblk0p26
179 27 64 mmcblk0p27
179 28 1024 mmcblk0p28
179 29 98727 mmcblk0p29
179 30 54270 mmcblk0p30
179 31 76800 mmcblk0p31
179 32 98303 mmcblk0p32
179 33 16384 mmcblk0p33
179 34 16383 mmcblk0p34
179 35 1900543 mmcblk0p35
179 36 655359 mmcblk0p36
179 37 27262976 mmcblk0p37
he_stheone64 said:
Don`t want to ruin the Super CID party, but whether we have trie Super CID or not, remains to be seen. It`s true, that both by hex editing the partition or fastboot command now we get Super CID in fastboot, but what is interesting, that when double checking via adb in live system with adb shell getprop "ro.cid", you will still get your original CID. So it seems CID is stored in 2 different locations now and that fastboot forcing the new CID does not fully finish the task.
Try yourself in adb with:
adb shell getprop "ro.cid"
So old CID still hides in one of these...
PHP:
179 0 30535680 mmcblk0
179 1 128 mmcblk0p1
179 2 256 mmcblk0p2
179 3 130671 mmcblk0p3
179 4 1 mmcblk0p4
179 5 16 mmcblk0p5
179 6 256 mmcblk0p6
179 7 15577 mmcblk0p7
179 8 256 mmcblk0p8
179 9 1024 mmcblk0p9
179 10 256 mmcblk0p10
179 11 2048 mmcblk0p11
179 12 2080 mmcblk0p12
179 13 5120 mmcblk0p13
179 14 1024 mmcblk0p14
179 15 1024 mmcblk0p15
179 16 61441 mmcblk0p16
179 17 8190 mmcblk0p17
179 18 32768 mmcblk0p18
179 19 1022 mmcblk0p19
179 20 4096 mmcblk0p20
179 21 4096 mmcblk0p21
179 22 20480 mmcblk0p22
179 23 4 mmcblk0p23
179 24 256 mmcblk0p24
179 25 16 mmcblk0p25
179 26 1280 mmcblk0p26
179 27 64 mmcblk0p27
179 28 1024 mmcblk0p28
179 29 98727 mmcblk0p29
179 30 54270 mmcblk0p30
179 31 76800 mmcblk0p31
179 32 98303 mmcblk0p32
179 33 16384 mmcblk0p33
179 34 16383 mmcblk0p34
179 35 1900543 mmcblk0p35
179 36 655359 mmcblk0p36
179 37 27262976 mmcblk0p37
Click to expand...
Click to collapse
Well fella you're wrong on that one ^__^
Just done it and it came back "11111111"
However you are right and it has been an issue before :/
Done!
he_stheone64 said:
Don`t want to ruin the Super CID party, but whether we have trie Super CID or not, remains to be seen. It`s true, that both by hex editing the partition or fastboot command now we get Super CID in fastboot, but what is interesting, that when double checking via adb in live system with adb shell getprop "ro.cid", you will still get your original CID. So it seems CID is stored in 2 different locations now and that fastboot forcing the new CID does not fully finish the task.
Try yourself in adb with:
adb shell getprop "ro.cid"
So old CID still hides in one of these...
PHP:
179 0 30535680 mmcblk0
179 1 128 mmcblk0p1
179 2 256 mmcblk0p2
179 3 130671 mmcblk0p3
179 4 1 mmcblk0p4
179 5 16 mmcblk0p5
179 6 256 mmcblk0p6
179 7 15577 mmcblk0p7
179 8 256 mmcblk0p8
179 9 1024 mmcblk0p9
179 10 256 mmcblk0p10
179 11 2048 mmcblk0p11
179 12 2080 mmcblk0p12
179 13 5120 mmcblk0p13
179 14 1024 mmcblk0p14
179 15 1024 mmcblk0p15
179 16 61441 mmcblk0p16
179 17 8190 mmcblk0p17
179 18 32768 mmcblk0p18
179 19 1022 mmcblk0p19
179 20 4096 mmcblk0p20
179 21 4096 mmcblk0p21
179 22 20480 mmcblk0p22
179 23 4 mmcblk0p23
179 24 256 mmcblk0p24
179 25 16 mmcblk0p25
179 26 1280 mmcblk0p26
179 27 64 mmcblk0p27
179 28 1024 mmcblk0p28
179 29 98727 mmcblk0p29
179 30 54270 mmcblk0p30
179 31 76800 mmcblk0p31
179 32 98303 mmcblk0p32
179 33 16384 mmcblk0p33
179 34 16383 mmcblk0p34
179 35 1900543 mmcblk0p35
179 36 655359 mmcblk0p36
179 37 27262976 mmcblk0p37
Click to expand...
Click to collapse
Yes I did what you said and it shows my old CID. Maybe this file stayed there and after a ROM update will go away.
he_stheone64 said:
Don`t want to ruin the Super CID party, but whether we have trie Super CID or not, remains to be seen. It`s true, that both by hex editing the partition or fastboot command now we get Super CID in fastboot, but what is interesting, that when double checking via adb in live system with adb shell getprop "ro.cid", you will still get your original CID. So it seems CID is stored in 2 different locations now and that fastboot forcing the new CID does not fully finish the task.
Try yourself in adb with:
adb shell getprop "ro.cid"
So old CID still hides in one of these...
PHP:
179 0 30535680 mmcblk0
179 1 128 mmcblk0p1
179 2 256 mmcblk0p2
179 3 130671 mmcblk0p3
179 4 1 mmcblk0p4
179 5 16 mmcblk0p5
179 6 256 mmcblk0p6
179 7 15577 mmcblk0p7
179 8 256 mmcblk0p8
179 9 1024 mmcblk0p9
179 10 256 mmcblk0p10
179 11 2048 mmcblk0p11
179 12 2080 mmcblk0p12
179 13 5120 mmcblk0p13
179 14 1024 mmcblk0p14
179 15 1024 mmcblk0p15
179 16 61441 mmcblk0p16
179 17 8190 mmcblk0p17
179 18 32768 mmcblk0p18
179 19 1022 mmcblk0p19
179 20 4096 mmcblk0p20
179 21 4096 mmcblk0p21
179 22 20480 mmcblk0p22
179 23 4 mmcblk0p23
179 24 256 mmcblk0p24
179 25 16 mmcblk0p25
179 26 1280 mmcblk0p26
179 27 64 mmcblk0p27
179 28 1024 mmcblk0p28
179 29 98727 mmcblk0p29
179 30 54270 mmcblk0p30
179 31 76800 mmcblk0p31
179 32 98303 mmcblk0p32
179 33 16384 mmcblk0p33
179 34 16383 mmcblk0p34
179 35 1900543 mmcblk0p35
179 36 655359 mmcblk0p36
179 37 27262976 mmcblk0p37
Click to expand...
Click to collapse
I did what you say, but before being S-OFF and super-cid-ed, i was with HTC__203 CID.
Now verified in fastboot and with your method, both are giving me the same result CID 11111111.
I've to say that i'm on ARHD10.1. Does it affect the manner to obtain the SUPER-CID?...Really don't know.
he_stheone64 said:
Don`t want to ruin the Super CID party, but whether we have trie Super CID or not, remains to be seen. It`s true, that both by hex editing the partition or fastboot command now we get Super CID in fastboot, but what is interesting, that when double checking via adb in live system with adb shell getprop "ro.cid", you will still get your original CID. So it seems CID is stored in 2 different locations now and that fastboot forcing the new CID does not fully finish the task.
Try yourself in adb with:
adb shell getprop "ro.cid"
So old CID still hides in one of these...
PHP:
179 0 30535680 mmcblk0
179 1 128 mmcblk0p1
179 2 256 mmcblk0p2
179 3 130671 mmcblk0p3
179 4 1 mmcblk0p4
179 5 16 mmcblk0p5
179 6 256 mmcblk0p6
179 7 15577 mmcblk0p7
179 8 256 mmcblk0p8
179 9 1024 mmcblk0p9
179 10 256 mmcblk0p10
179 11 2048 mmcblk0p11
179 12 2080 mmcblk0p12
179 13 5120 mmcblk0p13
179 14 1024 mmcblk0p14
179 15 1024 mmcblk0p15
179 16 61441 mmcblk0p16
179 17 8190 mmcblk0p17
179 18 32768 mmcblk0p18
179 19 1022 mmcblk0p19
179 20 4096 mmcblk0p20
179 21 4096 mmcblk0p21
179 22 20480 mmcblk0p22
179 23 4 mmcblk0p23
179 24 256 mmcblk0p24
179 25 16 mmcblk0p25
179 26 1280 mmcblk0p26
179 27 64 mmcblk0p27
179 28 1024 mmcblk0p28
179 29 98727 mmcblk0p29
179 30 54270 mmcblk0p30
179 31 76800 mmcblk0p31
179 32 98303 mmcblk0p32
179 33 16384 mmcblk0p33
179 34 16383 mmcblk0p34
179 35 1900543 mmcblk0p35
179 36 655359 mmcblk0p36
179 37 27262976 mmcblk0p37
Click to expand...
Click to collapse
Mine is saying original CID too, O2___001
Isn't Australia HTC__039?
Sent from my HTC One using Tapatalk 4 Beta
I managed to get the system folder. Via http://forum.xda-developers.com/showthread.php?t=1578099
CWM
Instructions and discussion available here
Click to expand...
Click to collapse
CWM Flashable Recovery
Both have been tested by me
Stock Recovery
CWM 6.0.3.6 by Unjustified Dev
Click to expand...
Click to collapse
DOWNLOAD:
System.img (/dev/block/mmcblk0p22)
Boot.img (/dev/block/mmcblk0p20)
Recovery.img (/dev/block/mmcblk0p21)
Modem.img - T599UVAMB5 (/dev/block/mmcblk0p12)
modem.bin (/dev/block/mmcblk0p16)
param.lfs (/dev/block/mmcblk0p19)
Preload.img (/dev/block/mmcblk0p24)
efs.img (/dev/block/mmcblk0p11)
Click to expand...
Click to collapse
Hmmm... can you explain me what is that? Thx
Feyerabend said:
Hmmm... can you explain me what is that? Thx
Click to expand...
Click to collapse
It is for development purposes. It is basically the stock firmware minus the kernel and recovery.
goldfingerfif said:
I uploaded the system tar its almost 1GB I cannot pull the Kernel though.
I managed to get the system folder. Via http://forum.xda-developers.com/showthread.php?t=1578099
If someone can assist with getting the kernel without root I would be forever grateful. If it is unpossible then please let me know as well as I cannot find a root method that works.
Click to expand...
Click to collapse
So, what you basicly need is someone with linux who can make a system.img from this, and add supersu and su binary?
And then someone who makes a factoryreset and flash it in odin I guess..
That person might then be able to extract recovery.img and boot.img. Am I right?
tys0n said:
So, what you basicly need is someone with linux who can make a system.img from this, and add supersu and su binary?
And then someone who makes a factoryreset and flash it in odin I guess..
That person might then be able to extract recovery.img and boot.img. Am I right?
Click to expand...
Click to collapse
You don’t NEED linux, you can use Cygwin with windows, but yes someone can then make system.img or system.tar.md5 with supersu and su.
From there if a root shell is obtained recovery and boot partitions should be able to be extracted from the phone.
Then insecure kernel and custom recovery can be installed.
I’ve done something like this with the T989 but this phone is for someone at my work and so bricking is an issue unlike if it was a personal phone as well there is less motivation to do it if it isn’t mine.
goldfingerfif said:
You don’t NEED linux, you can use Cygwin with windows, but yes someone can then make system.img or system.tar.md5 with supersu and su.
From there if a root shell is obtained recovery and boot partitions should be able to be extracted from the phone.
Then insecure kernel and custom recovery can be installed.
I’ve done something like this with the T989 but this phone is for someone at my work and so bricking is an issue unlike if it was a personal phone as well there is less motivation to do it if it isn’t mine.
Click to expand...
Click to collapse
Somethimg like this I guess? http://forum.xda-developers.com/showthread.php?t=1081239&highlight=odin
tys0n said:
Somethimg like this I guess? http://forum.xda-developers.com/showthread.php?t=1081239&highlight=odin
Click to expand...
Click to collapse
Yes just like that minus the need to unpack it because it is just a tarball so 7zip or whatever should open it fine. I am at work but I believe my home computer has either a linux vm installed or Cygwin with dsixda’s kitchen.
I should be able to manually or through dsixda’s kitchen add supersu and su convert to a odin img and flash.
If it successfully roots so I can at least get a rooted shell so I can dd if=/dev/block/….. of=/sdcard/…img to get a recovery.img and boot.img then carefully cook up a TWRP or CWM recovery to flash then make a “custom” or modified stock rom to flash with insecured kernel.
Anything new on how this is going?
thecasual01 said:
Anything new on how this is going?
Click to expand...
Click to collapse
I added SuperSU.apk and su binary.
Scared to flash it without a known good working factory image. Need to read up on a couple things a little more like triple check I can flash just the system partition without boot, etc.
goldfingerfif said:
I added SuperSU.apk and su binary.
Scared to flash it without a known good working factory image. Need to read up on a couple things a little more like triple check I can flash just the system partition without boot, etc.
Click to expand...
Click to collapse
Excuse me if this may come across as stupid or ignorant, but to my understanding the SGH-T599 seems to be an alternative version of the S3 Mini , I think the main difference is the screen size? That being said, can you not use the current existing kernel, boot.img of the S3 mini? I'm basing this off the fact that I had soft-bricked my phone by attempting to flash CWM Recovery but it didn't work, and I couldn't get myself the stock recovery.img file so in an attempt to revive my phone, I substituted that with the S3 mini's and it worked. Although at first every time i turned on and off the phone it displayed noise (TV Static) but it no longer does so.
I would offer being a test monkey, but this is my only phone and I do not have any other phones that I could use in the scenario it does get bricked.
goldfingerfif said:
I added SuperSU.apk and su binary.
Scared to flash it without a known good working factory image. Need to read up on a couple things a little more like triple check I can flash just the system partition without boot, etc.
Click to expand...
Click to collapse
I think it will be fine to flash system.img only as long as you don't use any pit and repartition. Factory reset first to prevent bootloops.
tamil.soljahz said:
Excuse me if this may come across as stupid or ignorant, but to my understanding the SGH-T599 seems to be an alternative version of the S3 Mini , I think the main difference is the screen size? That being said, can you not use the current existing kernel, boot.img of the S3 mini? I'm basing this off the fact that I had soft-bricked my phone by attempting to flash CWM Recovery but it didn't work, and I couldn't get myself the stock recovery.img file so in an attempt to revive my phone, I substituted that with the S3 mini's and it worked. Although at first every time i turned on and off the phone it displayed noise (TV Static) but it no longer does so.
I would offer being a test monkey, but this is my only phone and I do not have any other phones that I could use in the scenario it does get bricked.
Click to expand...
Click to collapse
Are you saying you used a boot.img from s3 mini?
tamil.soljahz said:
Excuse me if this may come across as stupid or ignorant, but to my understanding the SGH-T599 seems to be an alternative version of the S3 Mini , I think the main difference is the screen size? That being said, can you not use the current existing kernel, boot.img of the S3 mini? I'm basing this off the fact that I had soft-bricked my phone by attempting to flash CWM Recovery but it didn't work, and I couldn't get myself the stock recovery.img file so in an attempt to revive my phone, I substituted that with the S3 mini's and it worked. Although at first every time i turned on and off the phone it displayed noise (TV Static) but it no longer does so.
I would offer being a test monkey, but this is my only phone and I do not have any other phones that I could use in the scenario it does get bricked.
Click to expand...
Click to collapse
What exactly did you use to get it up and running, just the recovery.img, system.img, or boot.img (kernel) you flashed or some combo?
Looks like processor, screen and possibly bluetooth are different
T-599 vs i8190
goldfingerfif said:
What exactly did you use to get it up and running, just the recovery.img, system.img, or boot.img (kernel) you flashed or some combo?
Looks like processor, screen and possibly bluetooth are different
T-599 vs i8190
Click to expand...
Click to collapse
I just flashed the recovery.img, and (incorrectly) came to the assumption that the boot.img and system.img would work on the phone as well. In fact, I realize I can't access recovery. I was asking whether that the S3 mini's boot.img would work on the T599V as well.
Also, according to this link: http://www.sammobile.com/2012/11/24/review-samsung-galaxy-s-iii-mini-gt-i8190-2/
it says the S3 mini uses the U8420 chipset as well, which is why I thought the phones were similar.
tamil.soljahz said:
I just flashed the recovery.img, and (incorrectly) came to the assumption that the boot.img and system.img would work on the phone as well. In fact, I realize I can't access recovery. I was asking whether that the S3 mini's boot.img would work on the T599V as well.
Also, according to this link: http://www.sammobile.com/2012/11/24/review-samsung-galaxy-s-iii-mini-gt-i8190-2/
it says the S3 mini uses the U8420 chipset as well, which is why I thought the phones were similar.
Click to expand...
Click to collapse
The site you linked doesn't mention the SGH-T599 just the GT-8190 and the GT-i9300, did you send the right link?
According to http://www.gsmchoice.com/en/catalogue/samsung/galaxyexhibit/ it's built on same board. ST-Ericsson U8420.
It' same for i8190, some sites say U8500 others say U8420.
The Cydia Impactor root method works on the T599, I just did it to mine. Stays rooted on reboot.
marksalot said:
The Cydia Impactor root method works on the T599, I just did it to mine. Stays rooted on reboot.
Click to expand...
Click to collapse
Cool
So, first guy who "dd" will be hero of the day
If partition layout is the same as i8190 it should look like this.
Code:
GT-I8190 PARTITION LAYOUT
Official Name * Fs * Mount point * Known as * Contents
/efs * ext4 * /dev/block/mmcblk0p11 * Efs folder *Device IMEI,mac address etc
/modemfs * ext4 * /dev/block/mmcblk0p12 * Radio *
/SdCcard * vfat * /dev/block/mmcblk1 /dev/block/mmcblk1p1 * Internal sd * Your stuff
/boot * emmc * /dev/block/mmcblk0p20 * kernel/zimage * Drivers etc
/recovery * emmc * /dev/block/mmcblk0p21 * Recovery partion * ??????
/system * ext4 * /dev/block/mmcblk0p22 * System folder * The operation system
/cache * ext4 * /dev/block/mmcblk0p23 * Cache partition * Update.zips csc,samsung and carriers customizations
/preload * ext4 * /dev/block/mmcblk0p24 * Hidden partition * Media files,apks etc from Samsung/carriers
/.lfs * j4fs * /dev/block/mmcblk0p19 * param.lfs ## * splash screen,charging animation download mode pngs, etc
/data * ext4 * /dev/block/mmcblk0p25 length=-16384 * data folder * Your download apps, current device and use, settings
/temp * ? * /dev/block/mmcblk0p5 * nedded to load *
* * * psccd and CSPSA *
* * * when reset is *
* * * triggered *
* * * *
* * * *
* *
* * * *
I guess boot, recovery, and param is most wanted
Here is the content of /proc/partitions
Code:
major minor #blocks name
7 0 5229 loop0
179 0 3866624 mmcblk0
179 1 128 mmcblk0p1
179 2 384 mmcblk0p2
179 3 1024 mmcblk0p3
179 4 1024 mmcblk0p4
179 5 512 mmcblk0p5
179 6 512 mmcblk0p6
179 7 512 mmcblk0p7
179 8 512 mmcblk0p8
179 9 1024 mmcblk0p9
179 10 1024 mmcblk0p10
179 11 16384 mmcblk0p11
179 12 16384 mmcblk0p12
179 13 16384 mmcblk0p13
179 14 51200 mmcblk0p14
179 15 64 mmcblk0p15
179 16 14336 mmcblk0p16
179 17 2048 mmcblk0p17
179 18 2048 mmcblk0p18
179 19 16384 mmcblk0p19
179 20 16384 mmcblk0p20
179 21 16384 mmcblk0p21
179 22 1228800 mmcblk0p22
179 23 737280 mmcblk0p23
179 24 102400 mmcblk0p24
179 25 1535983 mmcblk0p25
179 64 2048 mmcblk0boot1
179 32 2048 mmcblk0boot0
179 96 15637504 mmcblk1
179 97 15633408 mmcblk1p1
254 0 5229 dm-0
Here is the output of busybox df -h
I have a 16GB SD Card, apparently Maverick (GPS map app I installed) creates it's own partition.
Code:
busybox df -h
Filesystem Size Used Available Use% Mounted on
tmpfs 402.1M 112.0K 401.9M 0% /dev
tmpfs 402.1M 0 402.1M 0% /mnt/asec
tmpfs 402.1M 0 402.1M 0% /mnt/obb
tmpfs 402.1M 0 402.1M 0% /dev/shm
/dev/block/mmcblk0p22
1.2G 965.4M 215.7M 82% /system
/dev/block/mmcblk0p12
15.7M 4.3M 11.4M 28% /modemfs
/dev/block/mmcblk0p23
708.7M 12.0M 696.7M 2% /cache
/dev/block/mmcblk0p11
15.7M 4.5M 11.2M 29% /efs
/dev/block/mmcblk0p24
98.4M 11.6M 86.8M 12% /preload
/dev/block/mmcblk0p25
1.4G 1.3G 173.7M 88% /data
df: /mnt/.lfs: Function not implemented
/dev/fuse 1.3G 1.3G 73.7M 95% /storage/sdcard0
/dev/block/dm-0 5.0M 2.9M 2.1M 57% /mnt/asec/com.codesector.maverick.full-1
/dev/block/vold/179:97
14.9G 10.1G 4.8G 68% /storage/extSdCard
cat /proc/partitions gives me in I8190.
Code:
major minor #blocks name
7 0 16664 loop0
7 1 2111 loop1
7 2 5229 loop2
7 3 2111 loop3
7 4 2111 loop4
7 5 2111 loop5
7 6 2111 loop6
7 7 17703 loop7
179 0 7634944 mmcblk0
179 1 128 mmcblk0p1
179 2 384 mmcblk0p2
179 3 1024 mmcblk0p3
179 4 1024 mmcblk0p4
179 5 512 mmcblk0p5
179 6 512 mmcblk0p6
179 7 512 mmcblk0p7
179 8 512 mmcblk0p8
179 9 1024 mmcblk0p9
179 10 1024 mmcblk0p10
179 11 16384 mmcblk0p11
179 12 16384 mmcblk0p12
179 13 16384 mmcblk0p13
179 14 51200 mmcblk0p14
179 15 64 mmcblk0p15
179 16 14336 mmcblk0p16
179 17 2048 mmcblk0p17
179 18 2048 mmcblk0p18
179 19 16384 mmcblk0p19
179 20 16384 mmcblk0p20
179 21 16384 mmcblk0p21
179 22 1228800 mmcblk0p22
179 23 860160 mmcblk0p23
179 24 327680 mmcblk0p24
179 25 4945920 mmcblk0p25
179 64 2048 mmcblk0boot1
179 32 2048 mmcblk0boot0
179 96 15558144 mmcblk1
179 97 13473792 mmcblk1p1
179 98 2075648 mmcblk1p2
254 0 16663 dm-0
254 1 2110 dm-1
254 2 5229 dm-2
254 3 2110 dm-3
254 4 2110 dm-4
254 5 2110 dm-5
254 6 2110 dm-6
254 7 17703 dm-7
7 8 2111 loop8
254 8 2110 dm-8
7 9 26019 loop9
254 9 26019 dm-9
Looks like it matches pretty well
So, I used the Online Nandroid app, it detects the T599 as "codinatmo" and doesn't have a patch available.
Manually chose the "Samsung Galaxy S III mini GT-l8190" patch and installed.
Was able to back up boot.img and recovery.img, both 16MB.
Hi guys,
I am in desperate need of a raw img of mmcblk0. All I need one of you to do is get an adb shell or in terminal emulator with root type:
dd if=/dev/block/mmcblk0 of=/sdcard/unbrick.img count=524288
This creates a raw image dump I can use to help unbrick my device. It does NOT contain any sensitive data like IMEI or ESN, etc... I need MJE on Verizon Note 3 specifically. Thank you very much in advanced!
EDIT: 2/14 11:15am CST I am still in need of MJE N900V image. Surely would appreciate anyone with the time.
ryanbg said:
Hi guys,
I am in desperate need of a raw img of mmcblk0. All I need one of you to do is get an adb shell or in terminal emulator with root type:
dd if=/dev/block/mmcblk0 of=/sdcard/unbrick.img
This creates a raw image dump I can use to help unbrick my device. It does NOT contain any sensitive data like IMEI or ESN, etc... I need MJE on Verizon Note 3 specifically. Thank you very much in advanced!
Click to expand...
Click to collapse
Dev Edition matter? I can offer one up if that is acceptable
TechSavvy2 said:
Dev Edition matter? I can offer one up if that is acceptable
Click to expand...
Click to collapse
It's worth a shot, I sure would appreciate it.
/dev/mmcblk0 is the entire device - 32 GB
Is that really what you mean?
ryanbg said:
It's worth a shot, I sure would appreciate it.
Click to expand...
Click to collapse
aight, give me a minute
Edit: Sorry give me another minute, had to re-root really quick
Edit: PS, any other dd's you want me to run for you while I'm at it?
---------- Post added 14th February 2014 at 12:12 AM ---------- Previous post was 13th February 2014 at 11:58 PM ----------
bftb0 said:
/dev/mmcblk0 is the entire device - 32 GB
Is that really what you mean?
Click to expand...
Click to collapse
This.
TechSavvy2 said:
aight, give me a minute
Edit: Sorry give me another minute, had to re-root really quick
Edit: PS, any other dd's you want me to run for you while I'm at it?
---------- Post added 14th February 2014 at 12:12 AM ---------- Previous post was 13th February 2014 at 11:58 PM ----------
This.
Click to expand...
Click to collapse
Cancel that!!! I gave you a bad command. Just delete unbrick.img
ryanbg said:
Cancel that!!! I gave you a bad command. Just delete unbrick.img
Click to expand...
Click to collapse
Already cancelled it out when I realized the size and time it was gonna take. Another memory block you need perhaps?
Code:
major minor #blocks name Label
7 0 21861 loop0
7 1 3150 loop1
7 2 26019 loop2
7 3 9387 loop3
7 4 2111 loop4
7 5 4190 loop5
7 6 26019 loop6
179 0 30535680 mmcblk0
179 1 15360 mmcblk0p1 apnhlos
179 2 58816 mmcblk0p2 modem
179 3 512 mmcblk0p3 sbl1
179 4 32 mmcblk0p4 dbi
179 5 32 mmcblk0p5 ddr
179 6 2048 mmcblk0p6 aboot
179 7 512 mmcblk0p7 rpm
179 8 512 mmcblk0p8 tz
179 9 10240 mmcblk0p9 pad
179 10 10240 mmcblk0p10 param
179 11 14336 mmcblk0p11 efs
179 12 3072 mmcblk0p12 modemst1
179 13 3072 mmcblk0p13 modemst2
179 14 11264 mmcblk0p14 boot
179 15 13312 mmcblk0p15 recovery
179 16 13312 mmcblk0p16 fota
179 17 7159 mmcblk0p17 backup
179 18 3072 mmcblk0p18 fsg
179 19 1 mmcblk0p19 fsc
179 20 8 mmcblk0p20 ssd
179 21 8192 mmcblk0p21 persist
179 22 9216 mmcblk0p22 persdata
179 23 2777088 mmcblk0p23 system
179 24 1048576 mmcblk0p24 cache
179 25 26521583 mmcblk0p25 userdata
179 32 512 mmcblk0rpmb
179 64 30702592 mmcblk1
179 65 30701568 mmcblk1p1
254 0 21861 dm-0
254 1 3150 dm-1
254 2 26019 dm-2
254 3 9387 dm-3
254 4 2110 dm-4
254 5 4189 dm-5
254 6 26019 dm-6
TechSavvy2 said:
Already cancelled it out when I realized the size and time it was gonna take. Another memory block you need perhaps?
Code:
major minor #blocks name Label
7 0 21861 loop0
7 1 3150 loop1
7 2 26019 loop2
7 3 9387 loop3
7 4 2111 loop4
7 5 4190 loop5
7 6 26019 loop6
179 0 30535680 mmcblk0
179 1 15360 mmcblk0p1 apnhlos
179 2 58816 mmcblk0p2 modem
179 3 512 mmcblk0p3 sbl1
179 4 32 mmcblk0p4 dbi
179 5 32 mmcblk0p5 ddr
179 6 2048 mmcblk0p6 aboot
179 7 512 mmcblk0p7 rpm
179 8 512 mmcblk0p8 tz
179 9 10240 mmcblk0p9 pad
179 10 10240 mmcblk0p10 param
179 11 14336 mmcblk0p11 efs
179 12 3072 mmcblk0p12 modemst1
179 13 3072 mmcblk0p13 modemst2
179 14 11264 mmcblk0p14 boot
179 15 13312 mmcblk0p15 recovery
179 16 13312 mmcblk0p16 fota
179 17 7159 mmcblk0p17 backup
179 18 3072 mmcblk0p18 fsg
179 19 1 mmcblk0p19 fsc
179 20 8 mmcblk0p20 ssd
179 21 8192 mmcblk0p21 persist
179 22 9216 mmcblk0p22 persdata
179 23 2777088 mmcblk0p23 system
179 24 1048576 mmcblk0p24 cache
179 25 26521583 mmcblk0p25 userdata
179 32 512 mmcblk0rpmb
179 64 30702592 mmcblk1
179 65 30701568 mmcblk1p1
254 0 21861 dm-0
254 1 3150 dm-1
254 2 26019 dm-2
254 3 9387 dm-3
254 4 2110 dm-4
254 5 4189 dm-5
254 6 26019 dm-6
Click to expand...
Click to collapse
Sorry I'm in a bit of a panic. Trying to remember how to piece together a debrick image. Appreciate your patience again.
EDIT: Here we go Link
ryanbg said:
Hi guys,
I am in desperate need of a raw img of mmcblk0. All I need one of you to do is get an adb shell or in terminal emulator with root type:
dd if=/dev/block/mmcblk0 of=/sdcard/unbrick.img
This creates a raw image dump I can use to help unbrick my device. It does NOT contain any sensitive data like IMEI or ESN, etc... I need MJE on Verizon Note 3 specifically. Thank you very much in advanced!
Click to expand...
Click to collapse
Actually it DOES contain sensitive data since it contains ALL 32GB of the internal flash
You need to be rooted and with a decent busybox and do more like:
dd if=/dev/block/mmcblk0 of=/sdcard/unbrick.img count=524288
(this will create a 256MB image).
IMHO you also need to create the debrick image on the same family product - it would be VERY interesting if that would work from a verizon developer edition model (and I would really want to see that tested) but I have some doubts. I would also be interested if any other debrick image would work - I assume you have N900V but IMHO it would be again VERY interesting to try with a N900W8 debrick image (but be very, very careful when you later write stuff with the modem-related stuff, which is very different in N900W8 and you really want to keep your N900V modem and stuff ).
xclub_101 said:
... it would be VERY interesting if that would work from a verizon developer edition model (and I would really want to see that tested) but I have some doubts. I would also be interested if any other debrick image would work ...
Click to expand...
Click to collapse
I guess I need to go looking for the right threads, but is it correct to say that the SDcard unbrick method (Qualcomm phone versions) only provides a kind of volatile boot scaffolding so that the device owner can enter Odin/download mode... and that no flashing of the device occurs until the owner actually performs the subsequent flash operation using Odin? (That is, none of the content of the unbrick image is ever written to the device being rescued?)
A second question is whether version locking occurs - I thought I saw someone claiming that a prior release unbrick image, even if taken from the same device (e.g. MI9 or MJ7 prior to a MJE upgrade) will not launch into download mode - is that right?
bftb0 said:
I guess I need to go looking for the right threads, but is it correct to say that the SDcard unbrick method (Qualcomm phone versions) only provides a kind of volatile boot scaffolding so that the device owner can enter Odin/download mode... and that no flashing of the device occurs until the owner actually performs the subsequent flash operation using Odin? (That is, none of the content of the unbrick image is ever written to the device being rescued?)
A second question is whether version locking occurs - I thought I saw someone claiming that a prior release unbrick image, even if taken from the same device (e.g. MI9 or MJ7 prior to a MJE upgrade) will not launch into download mode - is that right?
Click to expand...
Click to collapse
That is somehow true, but IMHO if all relevant partitions are wiped on the internal flash (from SBL1 to ABOOT) then all those will be read from microSD and have the code and signatures from there, and the "Odin mode" itself will be the version from microSD.
And here we have a number of interesting paths:
- the signature/hash on SBL1 itself is similar among Note 3 versions - that would result on all steps up to and including ABOOT being valid, so the "special Odin mode" will be entered; if the signature/hash on SBL1 is NOT similar between Note 3 families (or even before and after a major bootloader version) not even the "special Odin mode" will be started;
- if "special Odin mode" is started we can see another fork - if the "downgrade limitations" are part of the microSD code itself then you will be able to write any single firmware you were able to write when the internal SBL1/ABOOT was at the same version as the microSD SBL1/ABOOT - in other words you will be able to downgrade as far back as the microSD SBL1/ABOOT will let you!
- however there are some reports that the "downgrade restrictions" are actually stored in the internal flash in the "invisible/protected" regions there - and can be reset with special JTAG-like hardware:
http://forum.gsmhosting.com/vbb/f672/regarding-knox-s4-1775213/
Even in that last case there would still be a small chance that the "downgrade restrictions" might be skipped when booting from microSD since the internal flash could be considered at that point "less reliable" (or hopefully somebody at Samsung forgot to read that extra info on this special path - we can all hope )
So yes, I have also seen some people claiming stuff but I would still like to see more detailed tests on it with detailed reports on what is failing at what point! And especially on the microSD with the N900W8 "happy bootloader" or even with some much earlier "early development bootloader" (I have seen something like that mentioned somewhere)!
bftb0 said:
I guess I need to go looking for the right threads, but is it correct to say that the SDcard unbrick method (Qualcomm phone versions) only provides a kind of volatile boot scaffolding so that the device owner can enter Odin/download mode... and that no flashing of the device occurs until the owner actually performs the subsequent flash operation using Odin? (That is, none of the content of the unbrick image is ever written to the device being rescued?)
A second question is whether version locking occurs - I thought I saw someone claiming that a prior release unbrick image, even if taken from the same device (e.g. MI9 or MJ7 prior to a MJE upgrade) will not launch into download mode - is that right?
Click to expand...
Click to collapse
My theory on this (for public, bftb0 already knows) is you can boot anything that isn't fused to a lower binary counter, and since these values are inconsistent with firmware updates, it gives you a little wiggle room. AKA if A flag in ODIN is A2, you can not use an A1 aboot (MI9), but I (think) could use MJ7 since it's counter value is 2, same as MJE. These values are stored in AP RAW ANTI ROLLBACK in QFPROM. It is my belief that these values are also accessed from the shadow register as opposed to being read every time, since I was able to downgrade and replicate. I'm almost positive it's pulling these flags from RPMB. I'm extremely curious what P is since I may have full control. P1 changed to P0 when I downgraded my SBL1, TZ, and RPM to the testbit bootloader leaked by designgears, which doesn't make much since I believe all three of those have their own counters.
well ryanbg can summarize when he gets some free time (and I think that there are further experiments in the queue) but an initial attempt at performing a rescue of his bricked retail SM-900V phone (which was on MJE prior to hard bricking by a TZ partition mod) using a 200 MiB dump of mmcblk0 from a MJ7 device resulted in .... nothing.
I haven't seen anything in any of the posts so far about folks talking extra precautions involving repair of the secondary GPT (after doing a raw dump of the unbrick.img to their SDcard media), so I suppose that means that the SDCard unbrick method is - when it works - supposed to be insensitive to the fact that the unbrick SD Card does not have a complete UEFI set of primary & secondary GPTs - and might even have garbage sitting at the secondary GPT offsets.
For the MJ7 trial, we used dd if=/dev/block/mmcblk0 bs=4096 count=50000 (200 MiB) which is sufficiently large to capture everything including some amount of slop at the beginning of /system (p23). I thought I saw a post where someone was using 300 MB unbrick images, making the claim that smaller sizes didn't seem to work. Doesn't make much sense though, as only about ~ 180 MB are needed for everything up to and including p22. (p1 - p22 are ordered contiguously in LBA address space on the SM-900V, and p23 is 2.7GB, so clearly an intact copy of /system can't be needed).
any ideas welcome
sorry to resurrect this thread, but I can't seem to find a sm-n900v debrick/unbrick img anywhere. i've found the 900T, 900A, 9005 images, but nothing for 900v.
my retail edition n900v is definitely hard bricked and I could use some assistance.
Does any one have a note 3 verizon mj7 debrick/unbrick.img
THREAD IS NOW AT ->
http://forum.xda-developers.com/nexus-6/general/fix-fix-qhusbbulk-cm12-t3059518
I will help out. I have been reading all the threads about bricking. I have a working phone running skop and elemental. My computer is a little netbook running windows 7 32. I wont have access to it till later though.
Sent from my Nexus 6
Casper34 said:
I will help out. I have been reading all the threads about bricking. I have a working phone running skop and elemental. My computer is a little netbook running windows 7 32. I wont have access to it till later though.
Sent from my Nexus 6
Click to expand...
Click to collapse
sure no problems, i will need some comands to be run, not flashing or anything.
and thanks
opssemnik said:
sure no problems, i will need some comands to be run, not flashing or anything.
and thanks
Click to expand...
Click to collapse
I will PM you when I get near my computer, or can I run them in terminal emulator?
Sent from my Nexus 6
Casper34 said:
I will PM you when I get near my computer, or can I run them in terminal emulator?
Sent from my Nexus 6
Click to expand...
Click to collapse
which you prefer, tho the output will be a bit big
opssemnik said:
which you prefer, tho the output will be a bit big
Click to expand...
Click to collapse
Check PMs
Sent from my Nexus 6
Casper34 said:
Check PMs
Sent from my Nexus 6
Click to expand...
Click to collapse
can you show me the output of:
ls /dev/block
cat /proc/partitions
ls /dev/block/platform
So we just need to flash 5.0 bootloader before we flash cm Roms? can we still flash asop 5.0?
Sent from my Nexus 6 using Tapatalk
kenbrownstone said:
So we just need to flash 5.0 bootloader before we flash cm Roms? can we still flash asop 5.0?
Sent from my Nexus 6 using Tapatalk
Click to expand...
Click to collapse
once you flash the 5.1 bootloader you can not go back to 5.0.x bootloader. i tried and got a motorola error saying mismatch. so if you flash the 5.1 bootloader that's what you're stuck on. what i want to know is, can you still flash a 5.0.x system/boot image even though you're on 5.1 bootloader?
I flashed back to stock other day after running it ..Should that have been affected
Sent from my Nexus 6 using Tapatalk
looking foward to unbricking it. Thanks a lot
opssemnik said:
can you show me the output of:
ls /dev/block
cat /proc/partitions
ls /dev/block/platform
Click to expand...
Click to collapse
Here you go...... this from 5.0.1
Spoiler
[email protected]:/ $ su
[email protected]:/ # ls /dev/block
bootdevice
dm-0
loop0
loop1
loop2
loop3
loop4
loop5
loop6
loop7
mmcblk0
mmcblk0p1
mmcblk0p10
mmcblk0p11
mmcblk0p12
mmcblk0p13
mmcblk0p14
mmcblk0p15
mmcblk0p16
mmcblk0p17
mmcblk0p18
mmcblk0p19
[email protected]:/ # cat /proc/partitions
major minor #blocks name
179 0 30535680 mmcblk0
179 1 114688 mmcblk0p1
179 2 16384 mmcblk0p2
179 3 384 mmcblk0p3
179 4 56 mmcblk0p4
179 5 16 mmcblk0p5
179 6 32 mmcblk0p6
179 7 1024 mmcblk0p7
179 8 256 mmcblk0p8
179 9 512 mmcblk0p9
179 10 500 mmcblk0p10
179 11 4156 mmcblk0p11
179 12 384 mmcblk0p12
179 13 1024 mmcblk0p13
179 14 256 mmcblk0p14
179 15 512 mmcblk0p15
179 16 500 mmcblk0p16
179 17 4 mmcblk0p17
179 18 512 mmcblk0p18
179 19 1024 mmcblk0p19
179 20 1024 mmcblk0p20
179 21 1024 mmcblk0p21
179 22 1024 mmcblk0p22
179 23 16384 mmcblk0p23
179 24 16384 mmcblk0p24
179 25 2048 mmcblk0p25
179 26 32768 mmcblk0p26
179 27 256 mmcblk0p27
179 28 32 mmcblk0p28
179 29 128 mmcblk0p29
179 30 8192 mmcblk0p30
179 31 1024 mmcblk0p31
259 0 2528 mmcblk0p32
259 1 1 mmcblk0p33
259 2 8 mmcblk0p34
259 3 16400 mmcblk0p35
259 4 9088 mmcblk0p36
259 5 16384 mmcblk0p37
259 6 262144 mmcblk0p38
259 7 65536 mmcblk0p39
259 8 1024 mmcblk0p40
259 9 2097152 mmcblk0p41
259 10 27807616 mmcblk0p42
179 32 4096 mmcblk0rpmb
254 0 27807616 dm-0
[email protected]:/ # ls /dev/block/platform
msm_sdcc.1
[email protected]:/ #
Sent from my Nexus 6
My nexus is also bricked after flash cm12 on top of the 5.2 bootloader. I hit reboot in TWRP and the phone shut down and hasn't done anything since. I cannot get anything to show on the screen and my computer is not recognizing it through fastboot or adb commands. I am running Ubuntu if that helps but again, I cannot see the device connected at all. I am starting to think I need to send this in for RMA
Any help is appreciated.
EDIT: When I run "lsusb" command, I get the following line when my phone is plugged in-
Bus 002 Device 006: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)
Casper34 said:
Here you go...... this from 5.0.1
Spoiler
[email protected]:/ $ su
[email protected]:/ # ls /dev/block
bootdevice
dm-0
loop0
loop1
loop2
loop3
loop4
loop5
loop6
loop7
mmcblk0
mmcblk0p1
mmcblk0p10
mmcblk0p11
mmcblk0p12
mmcblk0p13
mmcblk0p14
mmcblk0p15
mmcblk0p16
mmcblk0p17
mmcblk0p18
mmcblk0p19
[email protected]:/ # cat /proc/partitions
major minor #blocks name
179 0 30535680 mmcblk0
179 1 114688 mmcblk0p1
179 2 16384 mmcblk0p2
179 3 384 mmcblk0p3
179 4 56 mmcblk0p4
179 5 16 mmcblk0p5
179 6 32 mmcblk0p6
179 7 1024 mmcblk0p7
179 8 256 mmcblk0p8
179 9 512 mmcblk0p9
179 10 500 mmcblk0p10
179 11 4156 mmcblk0p11
179 12 384 mmcblk0p12
179 13 1024 mmcblk0p13
179 14 256 mmcblk0p14
179 15 512 mmcblk0p15
179 16 500 mmcblk0p16
179 17 4 mmcblk0p17
179 18 512 mmcblk0p18
179 19 1024 mmcblk0p19
179 20 1024 mmcblk0p20
179 21 1024 mmcblk0p21
179 22 1024 mmcblk0p22
179 23 16384 mmcblk0p23
179 24 16384 mmcblk0p24
179 25 2048 mmcblk0p25
179 26 32768 mmcblk0p26
179 27 256 mmcblk0p27
179 28 32 mmcblk0p28
179 29 128 mmcblk0p29
179 30 8192 mmcblk0p30
179 31 1024 mmcblk0p31
259 0 2528 mmcblk0p32
259 1 1 mmcblk0p33
259 2 8 mmcblk0p34
259 3 16400 mmcblk0p35
259 4 9088 mmcblk0p36
259 5 16384 mmcblk0p37
259 6 262144 mmcblk0p38
259 7 65536 mmcblk0p39
259 8 1024 mmcblk0p40
259 9 2097152 mmcblk0p41
259 10 27807616 mmcblk0p42
179 32 4096 mmcblk0rpmb
254 0 27807616 dm-0
[email protected]:/ # ls /dev/block/platform
msm_sdcc.1
[email protected]:/ #
Sent from my Nexus 6
Click to expand...
Click to collapse
Thanks, im preparing the QPST / Drivers zip, im also looking into the factory images
ccb1208 said:
My nexus is also bricked after flash cm12 on top of the 5.2 bootloader. I hit reboot in TWRP and the phone shut down and hasn't done anything since. I cannot get anything to show on the screen and my computer is not recognizing it through fastboot or adb commands. I am running Ubuntu if that helps but again, I cannot see the device connected at all. I am starting to think I need to send this in for RMA
Any help is appreciated.
EDIT: When I run "lsusb" command, I get the following line when my phone is plugged in-
Bus 002 Device 006: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)
Click to expand...
Click to collapse
yep, in that mode we need a program that acts as QPST (or QPST itself) a 2nd_loader.hex (new bootloader) and a APQ8974_image hex that matches ours nexus 6, once there we can send the basic stuff and get rsd mode / fastboot to work, then we just flash factory images
Your best bet would be to try the Moto X/G blankflash program. It uses an executable called qboot which is a USB loader. It may be possible to use the 8226 programmer to flash the bootloader image back to the device from bulk mode. I'd doubt it'd work, but worth checking out.
freebee269 said:
once you flash the 5.1 bootloader you can not go back to 5.0.x bootloader. i tried and got a motorola error saying mismatch. so if you flash the 5.1 bootloader that's what you're stuck on. what i want to know is, can you still flash a 5.0.x system/boot image even though you're on 5.1 bootloader?
Click to expand...
Click to collapse
Yes, you can go back to the 5.0.x system after updating to 5.1
I just flashed the ENTIRE 5.0.1 factory image, minus the bootloader.
You must obviously already be bootloader unlocked to do so.
No ill-effects whatsoever.
If you do go back to 5.0.x, make sure you flash the radio for it as well. There's a chance you'll not be able to receive calls if on LTE with 5.1's radio, as was the case for me. Only on 3g/4g did calls go through (I'm on TMO, btw)
I had the same calls issue on T-Mobile, I was on a 5.0.2 ROM and had flashed the 5.1 bootloader and radio and a friend said she called me but I didn't get a call. When she came over I had her call me again but got nothing, I could call her though. I booted to a 5.1 rom and had her call me and my phone rang.
Hey I have a fully working N6 running stock 5.1, what can I do to help?
opssemnik said:
can you show me the output of:
ls /dev/block
cat /proc/partitions
ls /dev/block/platform
Click to expand...
Click to collapse
swimdude1120 said:
Hey I have a fully working N6 running stock 5.1, what can I do to help?
Click to expand...
Click to collapse
Run those commands if you are rooted and quote opssemnik, the one with the commands, so he can see them.
If you do, put the word SPOILER in brackets [] and then the output, the /SPOILER in the brackets []
Sent from my Nexus 6
I have looked at and tried every manual or how to I could find all over the web. Nothing seems to be working. Even if I run a getprop sys.usb.config it shows that the phone is in Diag,adb. However, I am not getting a comport showing up in Windows device manager. Does ASUS disable this process?
Have you enabled developer options in settings and selected "USB debugging" ?
If so, sounds like it might be a Windows driver issue. Grab the latest ones off the ASUS website and post back.
wang1chung said:
Have you enabled developer options in settings and selected "USB debugging" ?
If so, sounds like it might be a Windows driver issue. Grab the latest ones off the ASUS website and post back.
Click to expand...
Click to collapse
Yes, yes, and yes. Have done all that. Once in Diag mode it is suppose to show up as a Qualcomm comport device. Didn't doesn't even show up for me to install drivers.
when you plug your phone in, do you see "usb debugging" in the pull down menu?
Maybe another member can help with the Windows issue as I don't use that OS.
What are you trying to do?
wang1chung said:
when you plug your phone in, do you see "usb debugging" in the pull down menu?
Maybe another member can help with the Windows issue as I don't use that OS.
What are you trying to do?
Click to expand...
Click to collapse
Yes, USB debugging is activated, and I can ADB just fine. What I am trying to do is put the phone in USB Diagnostic(Diag) Mode, not USB debugging. When in USB Diag Mode the phone will communicate to the PC as a serial comport. This will allow me to use the Qualcomm Utilities to possibly edit and unlock LTE bands on it.
Ah, my apologies, I thought you meant debugging mode.
Maybe someone else can chime in to assist.
Have you tried a different computer? Post a link to the software, I'll try it on my Linux box. I could really use this software on the ZenFone Ultra if it works.
wang1chung said:
Ah, my apologies, I thought you meant debugging mode.
Maybe someone else can chime in to assist.
Have you tried a different computer? Post a link to the software, I'll try it on my Linux box. I could really use this software on the ZenFone Ultra if it works.
Click to expand...
Click to collapse
Yes it is the Ultra that I am trying to use it for. Posted here because there is more traffic, and thought maybe the devices are close enough that if someone figured it out on the Zenfone, that it could translate to the Ultra as well. There are multiple guides on XDA, but this is the main one I was trying to follow:
https://forum.xda-developers.com/galaxy-s5/general/how-to-add-rf-lte-frequency-bands-to-t2886059
Although I do admit I have been bouncing around from guide to guide, basically everything that Google search could uncover.
You'll be my wife's hero if you can get this done. Post back how it goes.
Edit: I see the ZenFone 3 ultra zu680kl on willmyphonework.net shows different 4g bands than the phones for sale on gearbest. Which bands did you need and do you have any idea why they're different? I was looking at the global version not the China one.
wang1chung said:
You'll be my wife's hero if you can get this done. Post back how it goes.
Edit: I see the ZenFone 3 ultra zu680kl on willmyphonework.net shows different 4g bands than the phones for sale on gearbest. Which bands did you need and do you have any idea why they're different? I was looking at the global version not the China one.
Click to expand...
Click to collapse
I need 2, 4, and 17
I need the same, lol
In my researching, there was one guy that said he got it to work with an asus rom with an app called "ASUS log tool e". I downloaded that firmware, extracted the app and tried to install. It didn't work, said the app already existed. Maybe there's a hidden one already on our phones?
I also tried win7 32bit and linux, can't detect my phone either.
On updating to nougat, I have lost root explorer (latest version from the play store doesn't work). I'll keep messing with it.
You find anything?
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
doctahjeph said:
..... There are multiple guides on XDA, but this is the main one I was trying to follow:
https://forum.xda-developers.com/galaxy-s5/general/how-to-add-rf-lte-frequency-bands-to-t2886059
Click to expand...
Click to collapse
so, I think I got it to work. Using your guide you referenced, I can browse the nv files with qpst and read the data from ID 01877 in qxdm. I stopped there because all my LTE bands work and I didn't want to mess anything up, lol.
I forced windows to install "Qualcomm hs-usb qdloader 9008" drivers after I executed a script I found that enables (I think) diag mode.
Can you take a look with your zu680kl ?
I used the script from doroid.org/2017/01/24/zenfone-3-ze520kl-rooted-diag-mode/
wang1chung said:
so, I think I got it to work. Using your guide you referenced, I can browse the nv files with qpst and read the data from ID 01877 in qxdm. I stopped there because all my LTE bands work and I didn't want to mess anything up, lol.
I forced windows to install "Qualcomm hs-usb qdloader 9008" drivers after I executed a script I found that enables (I think) diag mode.
Can you take a look with your zu680kl ?
I used the script from doroid.org/2017/01/24/zenfone-3-ze520kl-rooted-diag-mode/
Click to expand...
Click to collapse
Awesome!! I will definitely take a look at this today. Thanks!
wang1chung said:
so, I think I got it to work. Using your guide you referenced, I can browse the nv files with qpst and read the data from ID 01877 in qxdm. I stopped there because all my LTE bands work and I didn't want to mess anything up, lol.
I forced windows to install "Qualcomm hs-usb qdloader 9008" drivers after I executed a script I found that enables (I think) diag mode.
Can you take a look with your zu680kl ?
I used the script from doroid.org/2017/01/24/zenfone-3-ze520kl-rooted-diag-mode/
Click to expand...
Click to collapse
yes yes yes!!! finally!! you are the man!! I freaking love you dude!!
No way, it works? So you have successfully enabled those LTE bands? Omg, I'm buying that phone now!
wang1chung said:
No way, it works? So you have successfully enabled those LTE bands? Omg, I'm buying that phone now!
Click to expand...
Click to collapse
wait, lol. sorry the computer seeing the phones an a comport part works. I am in the process now of trying to edit the bands. I will report back soon, hopefully with good news.
Lol
Ok, well to test that you have successfully enabled them, the app "network signal guru" is the only one I've found that displays the correct in use LTE band.
Good luck!
wang1chung said:
Lol
Ok, well to test that you have successfully enabled them, the app "network signal guru" is the only one I've found that displays the correct in use LTE band.
Good luck!
Click to expand...
Click to collapse
Not looking good so far. I get right up to rewriting the NV values, but Everytime I reboot to set the new values they always resort back to the original values. From what I have read this maybe a fail safe setup in the kernel by ASUS. In which case I can get around it with a stock custom kernel. Non of those lying around. I have no clue how to even compile one myself. So more research I must do.
doctahjeph said:
Not looking good so far. I get right up to rewriting the NV values, but Everytime I reboot to set the new values they always resort back to the original values. From what I have read this maybe a fail safe setup in the kernel by ASUS. In which case I can get around it with a stock custom kernel. Non of those lying around. I have no clue how to even compile one myself. So more research I must do.
Click to expand...
Click to collapse
Did you happen to get the correct SPC code for QPST? I have read there are issues writing the NV values without the correct SPC code, how did you get it? I tried reading 00085 (sec_code) and get a "no diag response". Edit: I updated qxdm and confirmed it is 000000.
I am trying to do a full NV backup through the "software download" part of QPST and it doesn't complete. Have you been able to? I'd feel more comfortable if I had a full and proper QCN backup before I started messing with it.
Are we assuming Asus injected the anti-tamper code into the stock kernel only? So compiling the stock kernel with unmolested source code should be all we need?
---------- Post added at 04:00 AM ---------- Previous post was at 03:43 AM ----------
forgot to add some partition info I got when I was bored. I made some dd backups of all the partitions too, just missing the QCN backup file.
EDIT: From what I've read, the IMEI info is stored in the modemst1, modemst2, and fsg partitions (mmcblk0p24, mmcblk0p26 and mmcblk0p27). If a QCN backup is not possible, I would definitely advise backing up these.
Code:
ASUS_Z012D:/ # cat /proc/partitions
major minor #blocks name
7 0 98304 loop0
254 0 786432 zram0
179 0 61071360 mmcblk0
179 1 1280 mmcblk0p1
179 2 1280 mmcblk0p2
179 3 512 mmcblk0p3
179 4 512 mmcblk0p4
179 5 2048 mmcblk0p5
179 6 2048 mmcblk0p6
179 7 256 mmcblk0p7
179 8 256 mmcblk0p8
179 9 256 mmcblk0p9
179 10 256 mmcblk0p10
179 11 256 mmcblk0p11
179 12 256 mmcblk0p12
179 13 256 mmcblk0p13
179 14 256 mmcblk0p14
179 15 128 mmcblk0p15
179 16 128 mmcblk0p16
179 17 32 mmcblk0p17
179 18 8 mmcblk0p18
179 19 5120 mmcblk0p19
179 20 5120 mmcblk0p20
179 21 16 mmcblk0p21
179 22 1024 mmcblk0p22
179 23 1024 mmcblk0p23
179 24 1536 mmcblk0p24
179 25 1 mmcblk0p25
179 26 1536 mmcblk0p26
179 27 1536 mmcblk0p27
179 28 20480 mmcblk0p28
179 29 1024 mmcblk0p29
179 30 1024 mmcblk0p30
179 31 1024 mmcblk0p31
259 0 1024 mmcblk0p32
259 1 1024 mmcblk0p33
259 2 1024 mmcblk0p34
259 3 1024 mmcblk0p35
259 4 1024 mmcblk0p36
259 5 1024 mmcblk0p37
259 6 512 mmcblk0p38
259 7 512 mmcblk0p39
259 8 32 mmcblk0p40
259 9 512 mmcblk0p41
259 10 1024 mmcblk0p42
259 11 512 mmcblk0p43
259 12 4096 mmcblk0p44
259 13 256 mmcblk0p45
259 14 256 mmcblk0p46
259 15 8 mmcblk0p47
259 16 11264 mmcblk0p48
259 17 2048 mmcblk0p49
259 18 1536 mmcblk0p50
259 19 2048 mmcblk0p51
259 20 16384 mmcblk0p52
259 21 65536 mmcblk0p53
259 22 16384 mmcblk0p54
259 23 32768 mmcblk0p55
259 24 32768 mmcblk0p56
259 25 32768 mmcblk0p57
259 26 32768 mmcblk0p58
259 27 32768 mmcblk0p59
259 28 49152 mmcblk0p60
259 29 16384 mmcblk0p61
259 30 86016 mmcblk0p62
259 31 32768 mmcblk0p63
259 32 212992 mmcblk0p64
259 33 131072 mmcblk0p65
259 34 3932160 mmcblk0p66
259 35 56233967 mmcblk0p67
179 32 4096 mmcblk0rpmb
179 64 62521344 mmcblk1
179 65 62520320 mmcblk1p1
253 0 56233951 dm-0
ASUS_Z012D:/ # df
Filesystem 1K-blocks Used Available Use% Mounted on
rootfs 1716480 5876 1710604 1% /
tmpfs 1826588 644 1825944 1% /dev
tmpfs 1826588 0 1826588 0% /mnt
/dev/fuse 55220256 26700280 28519976 49% /mnt/runtime/default/emulated
/dev/fuse 55220256 26700280 28519976 49% /mnt/runtime/read/emulated
/dev/fuse 55220256 26700280 28519976 49% /mnt/runtime/write/emulated
/dev/block/vold/public:179,65 62505024 56435648 6069376 91% /mnt/media_rw/ADCA-0A16
/dev/fuse 62505024 56435648 6069376 91% /mnt/runtime/default/ADCA-0A16
/dev/fuse 62505024 56435648 6069376 91% /mnt/runtime/read/ADCA-0A16
/dev/fuse 62505024 56435648 6069376 91% /mnt/runtime/write/ADCA-0A16
/dev/block/mmcblk0p66 3749404 3443272 306132 92% /system
/dev/block/loop0 92656 2392 90264 3% /system/bin/su
/dev/block/mmcblk0p65 124912 408 124504 1% /cache
/dev/block/mmcblk0p56 28144 340 27804 2% /persist
/dev/block/mmcblk0p54 12016 5052 6964 43% /dsp
/dev/block/mmcblk0p62 85968 75008 10960 88% /firmware
/dev/block/mmcblk0p61 12016 40 11976 1% /persdata/absolute
/dev/block/mmcblk0p53 60400 4020 56380 7% /asdf
/dev/block/mmcblk0p28 16048 5328 10720 34% /factory
/dev/block/mmcblk0p60 12016 8344 3672 70% /asusfw
/dev/block/mmcblk0p63 27632 44 27588 1% /ADF
/dev/block/mmcblk0p64 199648 163352 36296 82% /APD
/dev/block/dm-0 55220256 26700280 28519976 49% /data
ASUS_Z012D:/ #
ASUS_Z012D:/data # parted /dev/block/mmcblk0
GNU Parted 1.8.8.1.179-aef3
Using /dev/block/mmcblk0
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) p
Model: MMC HCG8a4 (sd/mmc)
Disk /dev/block/mmcblk0: 62.5GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Number Start End Size File system Name Flags
1 17.4kB 1328kB 1311kB sbl1
2 1328kB 2639kB 1311kB sbl1bak
3 2639kB 3163kB 524kB rpm
4 3163kB 3687kB 524kB rpmbak
5 3687kB 5785kB 2097kB tz
6 5785kB 7882kB 2097kB tzbak
7 7882kB 8144kB 262kB devcfg
8 8144kB 8406kB 262kB devcfgbak
9 8406kB 8668kB 262kB keymaster
10 8668kB 8930kB 262kB keymasterbak
11 8930kB 9192kB 262kB cmnlib
12 9192kB 9455kB 262kB cmnlibbak
13 9455kB 9717kB 262kB cmnlib64
14 9717kB 9979kB 262kB cmnlib64bak
15 9979kB 10.1MB 131kB lksecapp
16 10.1MB 10.2MB 131kB lksecappbak
17 10.2MB 10.3MB 32.8kB DDR
18 10.3MB 10.3MB 8192B ssd
19 10.3MB 15.5MB 5243kB aboot
20 15.5MB 20.8MB 5243kB abootbak
21 20.8MB 20.8MB 16.4kB sec
22 33.6MB 34.6MB 1049kB devinfo
23 50.3MB 51.4MB 1049kB sysinfo
24 51.4MB 53.0MB 1573kB fsg
25 53.0MB 53.0MB 1024B fsc
26 53.0MB 54.5MB 1573kB modemst1
27 54.5MB 56.1MB 1573kB modemst2
28 56.1MB 77.1MB 21.0MB ext4 factory
29 77.1MB 78.1MB 1049kB asuskey
30 78.1MB 79.2MB 1049kB asuskey2
31 79.2MB 80.2MB 1049kB asuskey3
32 80.2MB 81.3MB 1049kB asuskey4
33 81.3MB 82.3MB 1049kB asuskey5
34 82.3MB 83.4MB 1049kB asuskey6
35 83.4MB 84.4MB 1049kB persistent
36 84.4MB 85.5MB 1049kB asusgpt
37 85.5MB 86.5MB 1049kB misc
38 86.5MB 87.0MB 524kB keystore
39 87.0MB 87.6MB 524kB config
40 87.6MB 87.6MB 32.8kB limits
41 87.6MB 88.1MB 524kB mota
42 88.1MB 89.2MB 1049kB dip
43 89.2MB 89.7MB 524kB syscfg
44 89.7MB 93.9MB 4194kB mcfg
45 93.9MB 94.1MB 262kB apdp
46 94.1MB 94.4MB 262kB msadp
47 94.4MB 94.4MB 8192B dpo
48 94.4MB 106MB 11.5MB splash
49 106MB 108MB 2097kB abootdebug
50 108MB 110MB 1573kB fsgCA
51 110MB 112MB 2097kB abootlog
52 117MB 134MB 16.8MB oem
53 134MB 201MB 67.1MB ext4 asdf
54 201MB 218MB 16.8MB ext4 dsp
55 218MB 252MB 33.6MB mdtp
56 252MB 285MB 33.6MB ext4 persist
57 285MB 319MB 33.6MB ftm
58 319MB 352MB 33.6MB boot
59 352MB 386MB 33.6MB recovery
60 386MB 436MB 50.3MB ext4 asusfw
61 436MB 453MB 16.8MB ext4 persdata
62 453MB 541MB 88.1MB fat16 modem
63 541MB 575MB 33.6MB ext4 ADF
64 575MB 793MB 218MB ext4 APD
65 793MB 927MB 134MB ext4 cache
66 927MB 4953MB 4027MB ext4 system
67 4953MB 62.5GB 57.6GB userdata
doctahjeph, have you made any progress? Did you write "0" value to 6828/6829 before writing 134283487 value? Have you tried the new Lineage OS rom (https://forum.xda-developers.com/zenfone-3/development/unofficial-lineageos-14-1-ze520kl-t3587178), maybe it'll allow you to write if you just flash the kernel from this rom? It'll definitely FC like a mofo but might be enough to write the NV values.
I tried this on my wife's phone, the Le Max x900, got into diag mode, re-wrote the nv values , even got the new LTE bands to show up in network signal guru but it won't switch to them (I deselected band 7 and it wouldn't switch to 2/4/17 like my zf3 does). I'm not sure this works for all the phones, unless you've found some other info out? I'm wondering about NV 1878 which I've read needs to be changed, but if there is no version of the phone that comes with those bands enabled, there's no way to know what the value should be. I tried flashing a modem from a similar phone with those bands enabled and soft-bricked it, lol.
anyways, if you need any values from zf3, let me know.
Any luck with this. I am donating 500 bucks to anyone who solves this. Enabling all Lte bands to work