Database Users

Add Cities to Weather-Tab?

Hi, Weather Database Editor doesnt work with my Girlfriends Touch 3G (german).
Is there any Solution to manually add Cities?
Thanks. =)

Same problem here

Try this one..
http://forum.xda-developers.com/showpost.php?p=2488224&postcount=73

Thanks but it does no show any cities...

yepp, seems that the database has another filename...
i try investigating this...

Ok, found the Database. =)
Its HH_0407_WeatherCities.xml (for German Users i think).
Bad news:
Its hidden/system/in rom
Any ideas how to rename it?
I copied it to the PC and edited the Cities in but i cant copy it back to the phone...

You can easily overwrite the file with resco explorer after disabling touchflo from the today screen but I have yet to find a way to copy the file to the pc. Could you share your xml please?

Ok I am getting nearer.
Disable touchflo
Copy HH_0407_WeatherCities.xml from the /windows folder to your pc.
Edit the xml to include your new city.
Copy it back to the phone into somewhere like "My Documents" then use resco explorer to move it to /windows and overwrite the original file.
Copy manil2d.exe from windows to your pc,
download XVI32 from http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm
download sign code from N2A's site http://weather.not2advanced.com/files/SignCode.zip
Open manila2d.exe in XVI32 and do a search for "weather.manila1.htc.com" ( make sure Unicode check box is checked )
You will see the update URL in unicode , which means that if you want to replace it , there has to be a hex 00 between every letter !
It needs to be changed to something like weather.not2advanced.com/htcweather/forecastdata.php?locCode=%s%s%s
save manila2d.exe and sign it using N2A's batch file
Copy it back to the phone into somewhere like "My Documents" then use resco explorer to move it to /windows and overwrite the original file.
Now I have the new city listed but when I update, all the temperatures = 0
I'm not sure what I have done wrong but I think the URL is wrong.
Any ideas?

Ok, the URL was different for me.
Done that but without the %s%s%s.
Still not working.
I can select the cities but i cant see them in the tab.
Update says that it cannot get updates for the selected city.

Hi Vibez
I reply here instead of the PM , so the others can read it aswell
I don't have a touch 3G so I cannot experiment for you , but 1 thing is sure ,
people had the same issue on the Diamond ( cities not updating after hex-edit ) when the hex-edit was not done 100% correctly ...
So 2 questions :
1) Did any of you try the reigistry hack from the diamond ?
In stock ROM, the URL used to update the weather is a specific Accuweather URL. WDE change it to point to N2A'website ( http://weather.not2advanced.com/ ).
Registry key=HKEY_CURRENT_USER\Software\HTC\Manila
String value Name=Weather.ServerURLOverride
Click to expand...
Click to collapse
2) when u tried patching , did the replacement weather string have EXACTLY the same length as the original ? On the diamond , it was an absolute no-go when the length was different
Open manila exe in XVI32 and do a search for "weather.manila1.htc.com" ( make sure Unicode check box is checked )
You will see the update URL in unicode , which means that if you want to replace it , there has to be a hex 00 between every letter !
I then replaced : http://weather.manila1.htc.com/widget/htc/forecast-data_v3.asp?locCode=%1s&?ac=TR2cra9U
with : http://weather.not2advanced.com/htcweather/forecastdata.php?locCode=%1s&ac=XDADevs1234
Those two lines have exactely the same length upto there ( That's why i added 1234 to the XDAdevs , thankfully that's ok with N2A's site ) so the rest of the URL ( &device=innovation etc.. ) can remain unchanged !
Click to expand...
Click to collapse
If that fails to work , send me a copy of the manila app ( modded and original maybe so I can see what u did ) , I'll look at it , patch it & send it back for you to try ...
I can't promise anything of course , but I'm on holidays this week , so I've got a little time to spare ;-)
cheers,
Claude

Thanks for the info!
Unicode-Strings should be NULL-terminated to, so all i've done was to zero out the remaining chars.
I give it a try and answer here asap.
//edit:
Ok, works but Temps are at 0°C.
Seems that the XML-Format has been changed.
BTW: String used for Patching Mainila2D.exe was:
000D8858 68 00 74 00 74 00 70 00 3A 00 2F 00 2F 00 77 00 65 00 61 00 74 00 68 00 h.t.t.p.:././.w.e.a.t.h.
000D8870 65 00 72 00 2E 00 6E 00 6F 00 74 00 32 00 61 00 64 00 76 00 61 00 6E 00 e.r...n.o.t.2.a.d.v.a.n.
000D8888 63 00 65 00 64 00 2E 00 63 00 6F 00 6D 00 2F 00 68 00 74 00 63 00 77 00 c.e.d...c.o.m./.h.t.c.w.
000D88A0 65 00 61 00 74 00 68 00 65 00 72 00 2F 00 66 00 6F 00 72 00 65 00 63 00 e.a.t.h.e.r./.f.o.r.e.c.
000D88B8 61 00 73 00 74 00 64 00 61 00 74 00 61 00 2E 00 70 00 68 00 70 00 3F 00 a.s.t.d.a.t.a...p.h.p.?.
000D88D0 6C 00 6F 00 63 00 43 00 6F 00 64 00 65 00 3D 00 25 00 31 00 73 00 00 00 l.o.c.C.o.d.e.=.%.1.s...

Ahw F...!
Tested the original URL:
first, city in original database:
http://htc.accuweather.com/widget/htc/forecast-data.asp?ac=TR2cra9U&locCode=EUR|DE|GM011|AACHEN
second, city manually added:
http://htc.accuweather.com/widget/h...ac=TR2cra9U&locCode=EUR|DE|GM017|SCHMALKALDEN
second URL does NOT give any information back in the XML...
Seems that the database is also online and it trys to find the city there...
OK, tried the not2advanced URL, XML Format has changed heavily...
*sniff*

Garfield1970,
Thanks for helping out.
The registry trick did not work.
I did find a patched version of manila2d.exe from another rom that works perfect on our phone, but ideally I would like to see how to patch the original version that our phone ships with. The hex surrounding the URL string in our manilla2d.exe looks a little different. I'm not 100% there is enough room to fit the full N2A url in!
I will post all 3 versions later for you to play with.

Weltherrscher said:
Ahw F...!
Tested the original URL:
first, city in original database:
http://htc.accuweather.com/widget/htc/forecast-data.asp?ac=TR2cra9U&locCode=EUR|DE|GM011|AACHEN
Click to expand...
Click to collapse
Ok
second, city manually added:
http://htc.accuweather.com/widget/h...ac=TR2cra9U&locCode=EUR|DE|GM017|SCHMALKALDEN
second URL does NOT give any information back in the XML...
Seems that the database is also online and it trys to find the city there...
Click to expand...
Click to collapse
That's normal as that city is unknown to the HTC Server
OK, tried the not2advanced URL, XML Format has changed heavily...
*sniff*
Click to expand...
Click to collapse
Indeed , I just compared the XML Outputs for Aachen from HTC & N2A , they changed the format .... But if you ask N2A very very nicely and if he has some time to spare , he might eventually adapt a version of his script to reflect the other XML format
You can clearly see the differences between the following two outputs :
http://weather.not2advanced.com/htc...hp?locCode=EUR|DE|GM011|AACHEN&ac=XDADevs1234
is the Diamond compatible format
http://htc.accuweather.com/widget/htc/forecast-data.asp?ac=TR2cra9U&locCode=EUR|DE|GM011|AACHEN
is the format the touch 3g seems to need ....
I'll crosspost the URL's to N2A's main thread so he can maybe have a look
Claude

Just for info the XML format that ships with our ROM works fine with N2A.
To me it seems N2A provides extra elements which I assume is for compatibility with HTC home.
So no need as far as I can tell to ask him to change anything.
Unless i'm getting confused in what you are saying?

vibez said:
Just for info the XML format that ships with our ROM works fine with N2A.
To me it seems N2A provides extra elements which I assume is for compatibility with HTC home.
So no need as far as I can tell to ask him to change anything.
Unless i'm getting confused in what you are saying?
Click to expand...
Click to collapse
Are you sure that the N2A output works for you ?
Because if you look at the XML's , what your device expects is to see includes blocks titled :
Today
Tonight
Tomorrow
and then the following weekdays
whereas on my Diamond it's just current and the different Weekdays being reported
Claude

I'm 100% sure it works with this version of manila2d.exe that i'm using. Now it may be that this version I have uses the old format.
We don't have
Today
Tonight
Tomorrow
we just have current temp, and hi, lo for each day

You mean using the patched manila from the other rom that you mentionned earlier ?
Might be that the format switch has happened between differen Rom versions ?
Claude

Garfield1970 said:
You mean using the patched manila from the other rom that you mentionned earlier ?
Might be that the format switch has happened between differen Rom versions ?
Claude
Click to expand...
Click to collapse
Yes it could be that. Although the end result is the same. The original version only showed Current and hi/lo temps

Ok i've attached the files
Manila2D_original.exe
This is the original unpatched file
Manila2D_original_patched_not_working.exe
This the original file I tried to patch without success
Manila2D_patched_ok.exe
This is the patched file from another rom that works ok.

[NEED HELP!!!]Debranding method by replacing two files is no longer working for x10

SEUS has just updated their program so instead of seeing a long file like this "FILE_277344675_1271909822000_1271909822000_277398125_114906833_INFILE_LONGTERM" , instead of that, it is shortened like this "FILE_277398125".
After overwriting the two files according to the tutorial, the SEUS keeps downloading the firmware files over the ones which have been overwritten.
I thought the SEUS is OK last weekend, but now, they changed their program. Anyone tried and find a solution for this issue?

Man im stuck with the same problem...someone pls help !!

Use Omnius instead? Quick and easy to use.
Download
Set up account online
Enter account details in Omnius
Then follow instructions below on how to flash
http://forum.xda-developers.com/showpost.php?p=6789689&postcount=324
Hope this helps.

wingz85 said:
Use Omnius instead? Quick and easy to use.
Download
Set up account online
Enter account details in Omnius
Then follow instructions below on how to flash
http://forum.xda-developers.com/showpost.php?p=6789689&postcount=324
Hope this helps.
Click to expand...
Click to collapse
yea ur intrustions are for the the SIn reconstructions, what if i want to reinstal using my bak ups from the seus dump (blog.fs) before i debranded??

exekias said:
yea ur intrustions are for the the SIn reconstructions, what if i want to reinstal using my bak ups from the seus dump (blog.fs) before i debranded??
Click to expand...
Click to collapse
i have the same problem . i want brand to my original A1(Austria) branded files.
now i have R2BA023 root + market fix.
and i have the 2 original A1 files ( File_ xxxxxxxxxxxxxxx_infile_longterm).
but how does omnius work with those files?
what is the application file and what the customize file?
kind regards DauL

can someone help me`` how to flash rooted phone back to A1 ( Austria) branded witfh omnius ? i have the two original files, but i dont know which file i should take for the application and the customize file
kind regards

wingz85 said:
Use Omnius instead? Quick and easy to use.
Download
Set up account online
Enter account details in Omnius
Then follow instructions below on how to flash
http://forum.xda-developers.com/showpost.php?p=6789689&postcount=324
Hope this helps.
Click to expand...
Click to collapse
Hi，Thank you for your sugestion. However, I am still failed to flash by Omnius.
Finally got error and Yellow exclamation mark on my phone after reboot it.
Here is the result after I flash the x10 with Omnious.
Code:
Action journal
22:29:08 Flash
22:29:08 Allows to change languages supported by the phone and upgrade its firmware.
22:29:08 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
22:29:08 Application version: 0.07.2279 (beta)
22:29:08 . The action name is 'Flash'
22:29:08 Selected phone type: Xperia™ X10
22:29:08 i Instructions
22:29:08 i 1. Make sure the phone battery is charged to at least 50%.
22:29:08 i 2. Switch off the phone!
22:29:08 i 3. Remove the phone battery and wait at least 5 seconds before reinserting it!
22:29:08 i 4. Press and hold the return back button, then connect the cable to the phone!
22:29:08 . The action started waiting for the user
22:29:25 . The action finished waiting for the user
22:29:25 Connecting via SEMC USB Flash Device (USB3)...
22:29:25 Device driver version: 2.2.0.5
22:29:25 Detected chipset: QSD8250
22:29:25 Boot mode: EROM
22:29:25 IMEI: [email protected]@@
22:29:25 Sending loader...
22:29:26 Establishing connection to the server...
22:29:29 Receiving news...
22:29:34 i No news
22:29:34 Actual credit: 0.00
22:29:40 Writing file phone.zip...
22:30:18 Writing file X10i_GENERIC_1234_8465R8A_R1FB001.zip...
22:33:38 e Failed!
22:33:38 . The action entered shutdown phase
22:33:38 . The action reported failure
Error code
# E39CDD9F86C3082E
Error details
---
61 C6 C0 A4 65 CB CD 00 FF 08 E1 72 F3 9F B5 AE
13 9B E7 8D E5 86 63 FA 78 BD E4 7E ED 5F 85 68
09 52 D0 4B 3E 18 6D E0 61 94 3A D6 3F 7D 06 ED
11 DB BB C5 11 03 FE 12 A2 17 E5 DB 4F B0 1E 0D
C5 5C E6 DF 47 8B A0 93 02 E4 6C 19 80 4D 59 91
46 C1 3B 15 F6 69 01 6B CA 64 A3 13 2E 26 7A 7C
7E AD 9A 9E 1D EB 00 E8 80 F0 7A 96 0F 25 D0 BA
D5 FD 93 6D 4B 5B 30 D9 6C D7 4D 92 B4 C0 04 64
F7 56 66 50 2A AA 3B E5 F3 13 07 8D EE A3 41 61
48 50 E9 72 04 6F 71 F5 55 D4 0A 0C 6D 2F 05 E8
77 58 E8 34 2A 17 BD A1 E1 9A FF 0A ED 48 D5 09
C7 38 25 15 95 C7 43 B0 6F 20 0C E7 BD 5C 0B 29
17 8E 39 EE F3 F9 7F 69 EF 5B A1 DC B3 74 21 FF
19 DE A7 ED 25 46 5D DE 0F B6 8F 34 FD F2 BB 58
E7 3F D9 C4 D5 24 2D E1 A1 DA BF 44 5B 79 BB 34
F9 22 57 42 85 66 03 14 99 C1 7C 7F
---

It still works via SEUS but some steps have changed due to the new SESU release.
Follow THIS revised tutorial and all will work again.
I know it works as I have been doing it and even used this yesterday.

Candy[MAN] said:
It still works via SEUS but some steps have changed due to the new SESU release.
Follow THIS revised tutorial and all will work again.
I know it works as I have been doing it and even used this yesterday.
Click to expand...
Click to collapse
Yes, I know the new method. however, I have already bricked my x10 and now it show me a Yellow exclamation mark after rebooting.
I have tried the new method, it did not work for my case.

[Q] compressed XPRS image and WinCE 6.0 in qemu/emulator ?

Hi,
from the firmware upgrade of an ARM9 Windows Embedded CE 6.0 Device, I was able to extract a number of files, including the kernel image (NK.BIN.COMP).
However, with tools such as osnbtool, ImgfsToDump or ImgFsTools I was unable to decompress the image.
The image starts with:
Code:
00000000 58 50 52 53 e7 8b 26 01 16 89 00 00 05 00 01 00 |XPRS..&.........|
00000010 42 30 30 30 46 46 0a 00 10 36 80 50 10 2b 01 39 |B000FF...6.P.+.9|
00000020 00 04 00 00 00 eb 01 00 00 fe 03 00 ea 40 78 00 |[email protected]|
00000030 08 78 00 00 00 05 00 63 03 00 00 45 43 45 43 7c |.x.....c...ECEC||
00000040 f6 60 81 48 1c 01 8d 18 01 7c e6 2a 01 00 20 36 |.`.H.....|.*.. 6|
00000050 80 64 de 00 00 11 c5 47 00 02 04 00 00 d3 00 a0 |.d.....G........|
00000060 e3 00 f0 21 e1 0c 00 9f e5 10 0f 01 ee 87 15 00 |...!............|
00000070 eb 83 18 00 f8 37 00 ea 78 10 00 c0 b0 01 00 10 |.....7..x.......|
00000080 80 97 0a 7c 75 97 4e 39 00 02 18 00 20 18 00 08 |...|u.N9.... ...|
00000090 66 18 00 5a b8 00 d8 02 b9 00 07 00 0f 0f 6b 65 |f..Z..........ke|
000000a0 72 6e 65 6c 2e 64 6c 6c 7b 00 33 40 00 00 c4 04 |rnel.dll{[email protected]|
000000b0 4b 00 01 41 44 00 50 10 40 09 05 59 00 4c 53 5a |[email protected]|
000000c0 00 78 20 03 59 00 ec 10 29 80 f0 08 04 01 4b 5a |.x .Y...).....KZ|
000000d0 00 5a 03 04 52 54 58 00 39 81 00 00 81 24 0b 90 |.Z..RTX.9....$..|
000000e0 5f 00 c9 d0 5f 00 30 4c e0 5b 00 86 11 00 13 ba |_..._.0L.[......|
000000f0 50 58 00 44 4c 00 0b 10 20 00 cc a0 00 00 05 4e |PX.DL... ......N|
I suppose this is the Xpress compression format that is used in Win CE 6.0 ?
Are there any tools available that can decompress this image ?
Also, I would like to know which emulators you use to test out Win CE images.
I tried qemu-system-arm with the ARM926EJ-S core emulation, but it didn't work so far.
Ultimately, I would like to be able to boot into the image I extracted from the firmware upgrade and start a remote debugger inside the image, so that I can step through the code.
cheers,
knossos2

Hi,
as I already knew that the image was a Windows Embedded CE 6.0 image, I installed Platform Builder and other required development components.
My plan was to find out how the NK.BIN.COMP image is decompressed by the WinCE 6.0 loader.
It turned out, that the file had just been compressed with the WinCE 6.0 bincompress.exe tool (PUBLIC/COMMON/OAK/BIN/I386/bincompress.exe).
Although at least some of the tools I tried previously had compression support by using the WinCE libraries, it didn't work.
My best guess is that the libraries were for older versions of WinCE and thus it didn't work.
So, if you ever see "XPRS" at the start of a WinCE file, it has been compressed with bincompress.exe
I'm now trying to run the decompressed image either in qemu or in the MS Device Emulator.
I guess the Device Emulator will be the easier way.
Cheers,
knossos2

hboot wifi mac patcher

Hi, I created simple tool that will be used for permanently wifi mac changes. Before you use this tool you must to understand that I will not be responsible for any damage you done by using this tool !!! You must agre that you using this tool on your own risk!
How to use this tool:
- you must be s-off and you need to have installed revolutionary hboot! If you do not have installed revolutionary, skip this tool!!!
- open command prompt and type hboot_mac ... you will get instructions!
- when you sucesfully generate patched hboot, reboot phone to fastboot mode
fastboot commands:
- fastboot oem eraseWifiFlash
- fastboot flash hboot hboot_mac_patched.img
- fastboot reboot-bootloader
verify if mac is changed:
- fastboot oem emapiWlanMac
Warning! This patched hboot have disabled hboot overwriting security so you need after next reboot to install hboot from attachment!!!
- fastboot flash hboot revolutionary_hboot.bin
- fastboot reboot
Done! Enjoy!
EDIT:
And do not install hboot 1.03.0000, its locked bull**** and you will not be able to back to hboot 1.02.0000 or any other!!!

Good contrib, however i have got htcdev.com hboot 1.03. Is possible come back to hboot 1.02?
Thanks

Hi, please give me hboot 1.03, I will test it and will report here!

hboot zip file contains nb0, not img file.
munjeni said:
Hi, please give me hboot 1.03, I will test it and will report here!
Click to expand...
Click to collapse

Is this htcdev.com hboot 1.03 ? My device is locked now with this hboot!

Yes, it is the hdev hboot !
munjeni said:
Is this htcdev.com hboot 1.03 ? My device is locked now with this hboot!
Click to expand...
Click to collapse

Ok but this is b.s. from htcdev... its say unlocked but its still locked and s-on... no way s-off

Is possible downgrade to hboot 1.02?

No way for now .

munjeni said:
Ok but this is b.s. from htcdev... its say unlocked but its still locked and s-on... no way s-off
Click to expand...
Click to collapse
It's not S-OFF, but it does allow you to flash custom recovery, install ROMs, and write to system partition while booted. Most people won't have any issues with it.
I think there is a way to downgrade from 1.03 to 1.02, but it's not for the faint of heart. Ask in #liberatedAria on Freenode.

drumist said:
Ask in #liberatedAria on Freenode.
Click to expand...
Click to collapse
Yes, I joined irc and when I said "hallo" Anthony1s gave me BAN , so why?

Try this
http://forum.xda-developers.com/showpost.php?p=21746420&postcount=14
It worked for me!
Anthony1s seems a little touchy, I asked for help and I was banned too.
munjeni said:
Yes, I joined irc and when I said "hallo" Anthony1s gave me BAN , so why?
Click to expand...
Click to collapse
---------- Post added at 07:55 PM ---------- Previous post was at 07:54 PM ----------
With revolutionary hboot fastboot oem emapiWlanMac 00 01 02 03 04 05 works fine, although thanks anyway

zeubea said:
Try this
http://forum.xda-developers.com/showpost.php?p=21746420&postcount=14
It worked for me!
Click to expand...
Click to collapse
Thanks, do you installed hboot 1.02 ower htcdev hboot 1.03 using this??

Indeed I installed 1.0.0 hboot RUU and then upgrading to 1.02, then revo for S-off , then unrevocked for cwm,.and finally restore. Crazy, but it worked for me.
munjeni said:
Thanks, do you installed hboot 1.02 ower htcdev hboot 1.03 using this??
Click to expand...
Click to collapse

Ok, but I think its not possible if have hboot 1.03... allready tried with gold card without luck

You must to patch misc partition as previous step. I modified a tool for it. I detail this step at http://forum.xda-developers.com/showpost.php?p=23381950&postcount=21

zeubea said:
for downgrade 1.03 to 1.02 and worked for me.
Click to expand...
Click to collapse
you had hboot 1.03 from htcdev -> http://htcdev.com/bootloader/ ? Are you sure?
EDIT:
I can confirm it not working while have hboot 1.03, tried now!
This is misc partition that is modified, and gold card is 100% gold card that I used before
Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 31 31 31 31 31 31 31 31 00 00 00 00 00 00 00 00 11111111........
00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000020 44 65 76 69 63 65 57 61 72 6D 42 6F 6F 74 00 00 DeviceWarmBoot..
00000030 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00000040 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙
00000050 43 45 20 53 65 72 69 61 6C 20 49 6E 55 73 65 00 CE Serial InUse.
00000060 44 65 62 75 67 20 43 61 62 6C 65 20 45 6E 61 00 Debug Cable Ena.
00000070 43 45 20 20 20 55 53 42 20 20 49 6E 55 73 65 00 CE USB InUse.
00000080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000090 43 6C 65 61 72 41 75 74 6F 49 6D 61 67 65 00 00 ClearAutoImage..
000000A0 31 2E 31 31 2E 31 31 31 2E 31 00 00 00 00 00 00 1.11.111.1......
Indeed I installed 1.0.0 hboot RUU and then upgrading to 1.02, then revo for S-off , then unrevocked for cwm,.and finally restore. Crazy, but it worked for me
Click to expand...
Click to collapse
from this mesage I did not see that you had hboot 1.03, do you want to confirm?

YES I had hboot 1.03 from htdev.
Did you do relock? fastboot oem lock

Yes, its working after relocking... thanks dude!

Ok, I gave the hboot 1.03, so problem solved

(WIP) ZTE Blade X Max Z983 R&D Root Research

Well like the rest of you I want to unlock and root this device.
I'm sure this is going to be a long road for all of us but I really like this device so personally I will do what i can to help figure out how to unlock and root this thing.
As a single soul this could take months or even a year but with combined efforts of this community I think we can pull it off. We all have our strengths and if we combine them with your help and the help of others it might turn out to be quite easy.
Don't be fooled and believe that fastboot is removed from the bootloader. It is there im sure we just need to figure out how to access it.
On a good note I already have a method to overcome update.zip signing that I developed for the alcatel one touch fierce 2. When using the recovery to flash the phone things actually become simpler. I would expect though that the recovery image is signed as well meaning we dont simply have the ability to flash the recovery. Unless we can unlock the boot loader first.
In reality to do any of this we are going to need temp root. At this time i have no idea how were going to get that but if you can get temp root even just enough to pull a backup from the device that will be a huge step forward.
To do anything useful we need a device backup. Or a update.zip.
If you can find a way to copy the update from this device before it is installed that would be wonderful.
My device already updated so if you have a brand new device that is not updated let us know so we can get our hands on the update.
In the meantime ( Until we get some firmware to reverse engineer ) I will document all the data I can get and how to get it.
The very first thing we need is to know all of the partitions on the device. If I can get the full GPT Partition Table that would be best.
So without further adieu I will start this journey.
Some of my post will be fairly basic to some and very complex to others.
I'm going to start by seeing what all boot modes i can get into.
Then see what I can get with ADB without root permissions.
Map out the partition scheme, and see how much of the security scheme I can determine is in place. All the fun stuff like what files are signed, how the boot chain is verified. I have seen it before where overcoming the initial security mechanism opens up a whole world of possibilities.
Programmers get lazy and to save money if they think your blocked out of a vulnerable area period they may lax on harder to bypass security.

Ok after a day of research and some gleaning of info from my blade x max I have a direction to move in anyway.
The closest device and one of the only devices zte allowed unlocked is the ZTE axom7.
We can study the Axom7 and get some Ideas on what will work on the BladeXMax.
First fastboot is crippled initially.
But this is easily overcome by swapping a few bytes on the right partition.
Thats my theory anyway. I'm in the process of proving it.
After Fastboot receives its prosthetic Limb oem unlock is as simple as 1 command.
Once the bootloader is unlocked the device will allow for a unsigned TWRP to run.
Now of course we need to compile our own TWRP. And then we can root.
Obviously we need the ability to write to this fastboot partition.
And we need to be able to flash TWRP.
Without Root how???
Just like the axon 7. EDL mode.
ZTE seems EDL Mode Friendly.
And the flash programmer (Firehose) is not signed.
Miflash can write partitions on the zte devices.
The only issue right now is we need the files of of the Blade x max.
And the GPT partition table.
Seeing that axom7tool can backup partitions from the axon7 in edl mode.......
Knowing that miflash works.
One of us that knows the protocol of miflash ( saraha ??? )
Can write a tool for linux that uses the same protocol.
Once this tool exists we can backup all the partitions and the GPT without root.
Once i have the files from the blade it should be possible to edit the fastboot partition and un-cripple the Fastboot.
So if any of you know the guys that wrote the axon 7 tool he can help us with a tool.
Other than that were stuck writing the tool ourself.
On a good not the sahara protocol and other edl protocols are very well documented.
If you seriously want in this Blade this is the way to go.

Well my theory about fastboot is correct.
I guess its obvious that versions of the axon 7 fastboot would be different.
The unlocked and the locked fastboot.
I'm going to hexdump and diff all the fastboot images i can find but so far it looks like this.
It seems that ZTE has used the same fastboot partition for a while.
If you boot into recovery on the blade x max and view the recovery log. Last log
You will find a list of all the parttion names on our device.
system
cache
persist
data
sdcard
boot
recovery
misc
aboot
apdp
bluetooth
carrier
cdt
cmnlib
cmnlib64
cryptkey
DDR
devcfg
devcfgbak
devinfo
dip
dpo
dsp
echarge
fastboot
fbop
fingerid
fsc
fsg
hyp
keymaster
keystore
lksecapp
mdtp
modem
msadp
persistent
pmic
reserve
rpm
sbl1
sec
splash
ssd
sti
tz
xbl
xblbak
ztecfg
tmp
Yep you can see we have the fastboot partition.
But the fbop partition is an important important one.
If we look at the updater scripts of the firmware upgrade packages we see.
FROM Partition.xml
<data><program SECTOR_SIZE_IN_BYTES="4096" file_sector_offset="0" filename="fastboot.img" label="fbop" num_partition_sectors="32" partofsingleimage="false" physical_partition_number="0" readbackverify="false" size_in_KB="128.0" sparse="false" start_byte_hex="0x321a8000" start_sector="205224"/></data>
FROM Update Zip
getprop("ro.product.device") == "ailsa_ii" || abort("E3004: This package is for "ailsa_ii" devices; this is a "" + getprop("ro.product.device") + "".");
assert(getprop("ro.product.name") == "P996A01_N");
ui_print("Target: ZTE/P996A01_N/ailsa_ii:7.1.1/NMF26F/20170301.161705:user/release-keys");
show_progress(0.650000, 0);
ui_print("Patching system image unconditionally...");
block_image_update("/dev/block/bootdevice/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat") ||
abort("E1001: Failed to update system image.");
show_progress(0.050000, 5);
package_extract_file("boot.img", "/dev/block/bootdevice/by-name/boot");
package_extract_file("ddr.img", "/dev/block/bootdevice/by-name/ddr");
package_extract_file("keymaster.mbn", "/dev/block/bootdevice/by-name/xblbak");
package_extract_file("lksecapp.mbn", "/dev/block/bootdevice/by-name/lksecapp");
package_extract_file("rpm.mbn", "/dev/block/bootdevice/by-name/rpm");
package_extract_file("tz.mbn", "/dev/block/bootdevice/by-name/tz");
package_extract_file("echarge.img", "/dev/block/bootdevice/by-name/echarge");
package_extract_file("mdtp.img", "/dev/block/bootdevice/by-name/mdtp");
package_extract_file("xbl.elf", "/dev/block/bootdevice/by-name/xbl");
package_extract_file("cmnlib64.mbn", "/dev/block/bootdevice/by-name/cmnlib64");
package_extract_file("adspso.bin", "/dev/block/bootdevice/by-name/dsp");
package_extract_file("recovery.img", "/dev/block/bootdevice/by-name/recovery");
package_extract_file("sec.dat", "/dev/block/bootdevice/by-name/sec");
package_extract_file("NON-HLOS.bin", "/dev/block/bootdevice/by-name/modem");
package_extract_file("pmic.elf", "/dev/block/bootdevice/by-name/pmic");
package_extract_file("devcfg.mbn", "/dev/block/bootdevice/by-name/devcfg");
package_extract_file("emmc_appsboot.mbn", "/dev/block/bootdevice/by-name/aboot");
package_extract_file("fastboot.img", "/dev/block/bootdevice/by-name/fbop");
package_extract_file("splash.img", "/dev/block/bootdevice/by-name/splash");
package_extract_file("hyp.mbn", "/dev/block/bootdevice/by-name/hyp");
package_extract_file("BTFM.bin", "/dev/block/bootdevice/by-name/bluetooth");
package_extract_file("cmnlib.mbn", "/dev/block/bootdevice/by-name/cmnlib");
show_progress(0.200000, 10);
show_progress(0.100000, 10);
format("ext4", "EMMC", "/dev/block/bootdevice/by-name/userdata", "0", "/data");
set_progress(1.000000);
Here we can conclude that the fastboot.img is flashed to the fob partition which is where the flags to enable the full fastboot commands. It's basically a security partition.
Is the Whole Partition different??
Is it just a few bytes difference??
Its actually not much and seeing that this identical partition has been used for several years
We can hope our fastboot image is the same or very similar. But remember it is the fob partition.
Here is the difference.
[email protected]:~$ hexdump -C -v /home/bigcountry907/Desktop/ZTE/FB-UL-EDL/A2017U_FASTBOOT_UNLOCK_EDL/fastboot.img > /home/bigcountry907/Desktop/ZTE/FB-UL-EDL/fbunlck.txt
[email protected]:~$ diff home/bigcountry907/Desktop/ZTE/FB-UL-EDL/fbunlck.txt /home/bigcountry907/Desktop/ZTE/stock/fbstock.txt
diff: home/bigcountry907/Desktop/ZTE/FB-UL-EDL/fbunlck.txt: No such file or directory
[email protected]:~$ hexdump -C -v /home/bigcountry907/Desktop/ZTE/FB-UL-EDL/A2017U_FASTBOOT_UNLOCK_EDL/fastboot.img > /home/bigcountry907/Desktop/ZTE/FB-UL-EDL/fbunlck.txt
[email protected]:~$ diff /home/bigcountry907/Desktop/ZTE/FB-UL-EDL/fbunlck.txt /home/bigcountry907/Desktop/ZTE/stock/fbstock.txt
257c257
< 00001000 01 00 00 00 78 56 34 12 00 00 00 00 01 00 00 00 |....xV4.........|
---
> 00001000 00 00 00 00 78 56 34 12 00 00 00 00 00 00 00 00 |....xV4.........|
579,595c579,595
< 00002420 62 6f 6f 74 02 02 20 00 04 82 01 00 04 e0 4f a3 |boot.. .......O.|
< 00002430 b8 c0 79 df 98 9a ce 8b 47 ed f6 23 61 e8 3e 4d |..y.....G..#a.>M|
< 00002440 7a 43 fc 4b d4 39 60 c5 5a a6 96 ea c0 4d e2 52 |zC.K.9`.Z....M.R|
< 00002450 27 3e b6 d0 21 72 72 c8 59 03 44 90 ff 4a 86 3b |'>..!rr.Y.D..J.;|
< 00002460 29 2c 16 7a 04 2b 36 07 6f 8f 04 8e 35 7c f2 9f |),.z.+6.o...5|..|
< 00002470 cc 29 e5 0b 74 30 e9 0c ec cd 23 4b 19 84 c7 d1 |.)..t0....#K....|
< 00002480 f7 46 9b 7d dc 8b 6b bb 01 d3 f0 0a ab 96 ca 7e |.F.}..k........~|
< 00002490 a2 6e 91 6b d9 38 d6 d6 2e 4f 50 3e 2d 17 55 e3 |.n.k.8...OP>-.U.|
< 000024a0 e5 50 e4 1f dc 03 26 9e e9 22 19 dc 60 e1 0b a0 |.P....&.."..`...|
< 000024b0 b5 06 25 bd e4 08 24 4f 7b dd 42 29 82 55 06 84 |..%...$O{.B).U..|
< 000024c0 a1 5f d7 c1 99 3f 83 30 5d 10 59 5e 9d 2a 31 3f |._...?.0].Y^.*1?|
< 000024d0 f9 87 54 55 1e 82 40 68 5b c8 e4 18 98 80 d1 ec |[email protected][.......|
< 000024e0 df d7 01 d1 ec a5 a2 e4 c1 86 76 63 e0 82 13 35 |..........vc...5|
< 000024f0 61 30 63 d7 cd e8 21 33 73 e9 c4 93 ad 65 68 77 |a0c...!3s....ehw|
< 00002500 3e eb 3e 90 8a bb 8b 07 1b 26 ff d5 0d 37 a4 6c |>.>......&...7.l|
< 00002510 ec c6 69 30 dd 22 1b 9f 69 79 47 69 22 ba 9e c8 |..i0."..iyGi"...|
< 00002520 0c 23 96 f8 cf 66 74 74 11 98 d6 e4 |.#...ftt....|
---
> 00002420 62 6f 6f 74 02 02 20 00 04 82 01 00 a8 e0 dd 69 |boot.. ........i|
> 00002430 5b b2 47 12 bf 74 41 7a 00 37 a0 b8 10 15 d4 4e |[.G..tAz.7.....N|
> 00002440 a6 59 74 9b 7d a4 df 95 eb 3f 1a 29 1c 60 23 7c |.Yt.}....?.).`#||
> 00002450 91 37 2a 07 d3 e9 45 17 ac ac ab a9 ba b4 42 70 |.7*...E.......Bp|
> 00002460 46 5f 67 22 f7 37 1f de 46 f9 67 44 74 d7 26 42 |F_g".7..F.gDt.&B|
> 00002470 49 9c e8 ee 98 78 89 2b b2 1e c3 58 a8 d2 3a 7f |I....x.+...X..:.|
> 00002480 39 7d 22 09 c6 01 c5 0f 95 65 57 1e af 79 d9 d6 |9}"......eW..y..|
> 00002490 8d 99 84 4f 24 ff 55 b2 b0 20 07 00 39 e6 9a 27 |...O$.U.. ..9..'|
> 000024a0 a0 bc 97 dd 27 7d f2 a2 88 b6 b5 53 4a ba 7a 8e |....'}.....SJ.z.|
> 000024b0 65 98 f6 ef 4d 7e 2e 91 01 66 35 9e e1 da 15 c4 |e...M~...f5.....|
> 000024c0 fe a4 d2 26 a1 99 88 a3 55 2f ac 65 71 f8 5f 86 |...&....U/.eq._.|
> 000024d0 a7 79 f8 b5 61 b5 da 2c 7b 89 39 3b ff 45 a3 7f |.y..a..,{.9;.E..|
> 000024e0 dc 92 d5 4e 8b df 68 c0 e9 43 18 7b 60 5a 03 60 |...N..h..C.{`Z.`|
> 000024f0 18 da 96 84 e7 97 a7 09 a9 1a 2d b6 5b d3 d2 f6 |..........-.[...|
> 00002500 c8 33 a2 8f ef 32 5e 6a 45 39 66 b5 a6 a4 35 0f |.3...2^jE9f...5.|
> 00002510 03 0c 9d 57 79 28 43 09 9a 3e 7b 01 8c 6e 66 b2 |...Wy(C..>{..nf.|
> 00002520 1a f3 3d 92 d1 66 91 04 4a 3e 79 69 |..=..f..J>yi|
[email protected]:~$ hexdump -C -v /home/bigcountry907/Desktop/ZTE/Fastboot-UL/fastboot.img > /home/bigcountry907/Desktop/ZTE/Fastboot-UL/fbul2.txt
[email protected]:~$ diff /home/bigcountry907/Desktop/ZTE/FB-UL-EDL/fbunlck.txt /home/bigcountry907/Desktop/ZTE/Fastboot-UL/fbul2.txt
[email protected]:~$
There's definitely more to come but this is enough to think about for now.
Here are all the partition block sizes and labels for the blade x max
30535680 mmcblk0 EMMC CHIP
4096 mmcblk0p1
4096 mmcblk0p2
4096 mmcblk0p3
4096 mmcblk0p4
4096 mmcblk0p5
4096 mmcblk0p6
4096 mmcblk0p7
16384 mmcblk0p8
16384 mmcblk0p9
16384 mmcblk0p10
4096 mmcblk0p11
4096 mmcblk0p12
4096 mmcblk0p13
4096 mmcblk0p14
4096 mmcblk0p15
4096 mmcblk0p16
4096 mmcblk0p17
4096 mmcblk0p18
32768 mmcblk0p19
4096 mmcblk0p20
94208 mmcblk0p21
65536 mmcblk0p22
65536 mmcblk0p23
4096 mmcblk0p24
4096 mmcblk0p25
4096 mmcblk0p26
4096 mmcblk0p27
4096 mmcblk0p28
4096 mmcblk0p29
4096 mmcblk0p30
4096 mmcblk0p31
4096 mmcblk0p32
4096 mmcblk0p33
32768 mmcblk0p34
4096 mmcblk0p35
4096 mmcblk0p36
4096 mmcblk0p37
4096 mmcblk0p38
65536 mmcblk0p39
4096 mmcblk0p40
4096 mmcblk0p41
4096 mmcblk0p42
4096 mmcblk0p43
65536 mmcblk0p44
1048576 mmcblk0p45 cache
5242880 mmcblk0p46 system
23629807 mmcblk0p47 data
4096 mmcblk0rpmb
31166976 mmcblk1 SD CARD
31165935 mmcblk1p1 SD CARD Storage

Old codehead (emphasis on the "old"), and I have this device... unfortunately, it's been updated, so there's not a whole lot I could offer...
With an at least rudimentary how-to provided, though... as long as I can get the device back to square-one, if things go tits-up and it's necessary... bitter experience... not a few Cricket LG G Stylo paperweights at hand... I'l like to offer myself as an alpha-tester for whatever you find out...
Just bought this lovely new home in Albuquerque, and, until a few things settle down, don't have a lot of cash... but I'll offer mine as a test-bed of sorts...
I'm fascinated with the work you are doing, and I really dig this phone for pretty much every reason except Cricket's bullheadedness, and am looking forward to watching you work...
I'm also kinda horrified that, seeing your log dumps upthread, I could actually understand it... can take the boy out of the tech, but some things seem to be stuck in the little grey cells forever.... *chuckle*
My tech chops tended more towards xBASE and Delphi, and still do... was what I learned, along with COBOL and RPig...
Have been trying, over the past few years, to get some C++ and Java under my belt, but it's more important to me to finish my BA in the up coming spring semester, and do UNM School of Law... Renaissance man wanna-be here... *grin*

Just wondering, good madam or sir, what progress you've been able to do... I don't mean to push, as we all have lives away from this forum (at least I do hope so.. *smile*), but, as I love to learn, and now in my 60's, found my Java, C and C++ texts, have downloaded and installed all my preferred tools, and would just really dig seeing some journaling of your progress on this rather fascinating device... more internal RAM than I would have ever expected on a smart phone, and, as such, space is not at such a premium that I'm required to use Apps2SD Pro (although I paid for it), Titanium (although I paid for it), but just damn...
I'm disgusted that Cricket would be so paranoid against their paying customers that they insist on absolute control... just damn...
Sorry... woolgathering on a Friday afternoon, while installing other dev tools... <smile>

Firmware update downloaded
My phone has the firmware downloaded please let me know if there is a way to pull it for R&D
---------- Post added at 03:31 AM ---------- Previous post was at 02:55 AM ----------
This phone just force installed nevermind

Update not installed
I have the update downloaded but not installed. The phone is trying to force update but it can't because my battery is too low, I'll try and leave it that way. Do we have a way to find and extract the update?

Scratch that. Force install starts at 20% battery or so. Accidently over charged haha.

We need to post the way to pull the update
We need to post a way to extract the update so that the next person who has it but it is not installed can pull it for us any help from more experienced individuals would be greatly appreciated

Update ready to dl
Any ideas how to pull it from the phone

If you have an update.zip signing bypass, I could leverage that to get a dump of the partition table.

Z983 Root Method Development
Hello world of XDA,
We want to root this device. Yes? Well, as of right now, 01-27-2018, there is no working method available on the internet. We have to do this ourselves. Ive rooted literally hundereds of phones, but this one, Crickets down played version of the Blade Zmax, re-dubbed Blade XMax Z983..
First, we need the boot loader. I am willing to team up with some people, to make this happen. Any takers?

Has anyone been able to get the last update files, about a week ago i think, off the phone before applying the update. If anyone has those we may be in business, at least further along than we were. That last update was a decent size update, and if it had anything to do with the spectre/meldown patch, that update would have had the partition layout, how the bootloader has been hidden and so on and so fourth. So if anyone was able to grab the update please post here, as the thread creator and a few others seem to know what to do from there.

Can I start by modifying tye system UI apk?

Hey so I've got this device and it's FRP locked. If anybody is willing to work on this still these days (for root, frp, various unlocks, etc) then let's make it happen. Can't say for sure if I'll have the device for very long, but I'm definitely down to try while I have it. Lmk if there's anything I can do to help the progress.

dammi.forza0910 said:
Hello world of XDA,
We want to root this device. Yes? Well, as of right now, 01-27-2018, there is no working method available on the internet. We have to do this ourselves. Ive rooted literally hundereds of phones, but this one, Crickets down played version of the Blade Zmax, re-dubbed Blade XMax Z983..
First, we need the boot loader. I am willing to team up with some people, to make this happen. Any takers?
Click to expand...
Click to collapse
You know how bad I wish I could take you up on this? I just don't have the experience or the knowledge. I'd love to learn but I don't even know where to start.

Okay, so I have successfully copied the boot animation.zip and have attatched it as proof. I believe, i can actuall copy the firmware because I found the file locatiom after an exhausting amount of trial and error with different approaches. Usong Debian (wheezy) ,and a combination of file explores, and modifying apk's through luck patcher, I was able to view the device tree and so on. Anybody willing to guide me to the next step?

Z983 Firmware .img files found and uploaded
Okay, I found the firmware files and when I moved them to my external SD card, they combined automatically and was labled update.zip. This is it guys, help me!

Device Tree
Can anyone let me know if this is helping, or if everyone gave up....?

dammi.forza0910 said:
Okay, I found the firmware files and when I moved them to my external SD card, they combined automatically and was labled update.zip. This is it guys, help me!
Click to expand...
Click to collapse
Downloading the files when I get off work and will look at them as best I can, maybe we can get the bootloader to show up in the recovery, Cricket did something to the flags that bypasses the bootloader, maybe we can reflag and get it to show up again. Good work, hopefully some progress can be made now.