I ran the latest version 0.36 on my Mio8390 which is using a PXA262 processor
running smartphone 2003.
When I started haret I've got an error message :
EXCEPTION reading coprocessor 15 register 0
twice.
And the detected cpu type is unknown
Anyway i could start the application and open a tcp port
Here is the result of dump cp(0) :
c00: ffffffd2 | c08: ffffffd2
c01: ffffffd2 | c09: ffffffd2
c02: ffffffd2 | c10: ffffffd2
c03: ffffffd2 | c11: ffffffd2
c04: ffffffd2 | c12: ffffffd2
c05: ffffffd2 | c13: ffffffd2
c06: ffffffd2 | c14: ffffffd2
c07: ffffffd2 | c15: ffffffd2
And here is the result of dump mmu:
----- Virtual address map -----
Descriptor flags legend:
C: Cacheable
B: Bufferable
0..3: Access Permissions (for up to 4 slices):
0: Supervisor mode Read
1: Supervisor mode Read/Write
2: User mode Read
3: User mode Read/Write
Error: EXCEPTION reading coprocessor 15 register 2
MMU 1st level descriptor table is at FFFFC000
Virtual | Physical | Descr | Description
address | address | flags |
----------+----------+---------+-----------------------------
Error: EXCEPTION CAUGHT AT MEGABYTE 0!
ffffffff | | | End of virtual address space
It seems that haret is having problem trying to read the CPU registeries,
what could be the problem?
So it means that I have to patch the source of haret before I can use it on a smartphone?
Or is it because of smartphone security policies? something about user-mode, kernel-mode in
wince?
I'm quite a nub but I think I have to know what to read first before I start reading books. Any info or help is appreciated.
aybabtu said:
I ran the latest version 0.36 on my Mio8390 which is using a PXA262 processor
running smartphone 2003.
When I started haret I've got an error message :
EXCEPTION reading coprocessor 15 register 0
...
Any info or help is appreciated.
Click to expand...
Click to collapse
You can try to add this code the the assembler file
and call the functions directly. Worked for
me with wince2.11, where i also had problems:
export |cp15_0|
|cp15_0| proc
mrc p15, 0, r0, c0, c0, 0
mov pc, lr
endp
export |cp15_2|
|cp15_2| proc
mrc p15, 0, r0, c2, c0, 0
mov pc, lr
endp
export |cp15_13|
|cp15_13| proc
mrc p15, 0, r0, c13, c0, 0
mov pc, lr
endp
aybabtu said:
I ran the latest version 0.36 on my Mio8390 which is using a PXA262 processor
running smartphone 2003.
Click to expand...
Click to collapse
Don't forget to post at least the 'dump gpio', FB address,
'dump mmu' and 'pd 0x41300004 4' here when
haret works
cr2 said:
... 'dump gpio', FB address,
'dump mmu' and 'pd 0x41300004 4'
Click to expand...
Click to collapse
Thank you for your help.
I signed the code with a privileged certification, then dump gpio and
physical address worked.
Code:
#dump gpio :
GPIO# D S A INTER | GPIO# D S A INTER | GPIO# D S A INTER | GPIO# D S A INTER
------------------+-------------------+-------------------+------------------
0 I 0 0 FE | 21 I 0 0 | 42 I 1 1 | 63 I 1 0 FE
1 I 0 0 RE FE | 22 O 1 0 | 43 O 1 2 | 64 O 1 0
2 I 0 0 RE | 23 O 0 0 | 44 I 1 1 | 65 O 1 0
3 I 0 0 RE FE | 24 O 0 0 | 45 O 1 2 | 66 O 1 0
4 I 0 0 RE | 25 O 0 0 | 46 I 1 2 | 67 I 1 0 FE
5 I 1 0 FE | 26 I 1 0 | 47 O 1 1 | 68 I 1 0
6 O 0 1 | 27 I 1 0 | 48 I 1 0 | 69 I 0 0
7 I 1 0 | 28 I 1 1 | 49 O 1 2 | 70 I 1 0
8 O 1 1 | 29 I 0 1 | 50 O 1 0 | 71 I 1 0
9 I 1 0 | 30 O 0 2 | 51 O 0 0 | 72 I 1 0 FE
10 I 1 0 FE | 31 O 0 2 | 52 I 1 0 | 73 O 1 0
11 I 1 0 | 32 I 1 0 | 53 I 1 0 | 74 O 0 0
12 I 1 0 RE FE | 33 O 1 2 | 54 O 0 0 | 75 O 1 0
13 I 0 0 RE FE | 34 I 1 1 | 55 O 1 0 | 76 O 0 0
14 I 0 0 RE FE | 35 I 0 1 | 56 O 0 0 | 77 O 0 0
15 O 1 2 | 36 I 0 0 | 57 I 1 0 | 78 O 1 2
16 I 1 0 | 37 I 0 1 | 58 O 0 0 | 79 I 1 2
17 O 1 2 | 38 I 0 0 | 59 O 0 0 | 80 O 1 2
18 I 1 1 | 39 O 1 2 | 60 O 1 0 | 81 I 1 1
19 O 1 0 | 40 O 0 0 | 61 O 1 0 | 82 O 1 1
20 O 1 0 | 41 O 0 0 | 62 O 1 0 | 83 I 1 2
#pd 0x41300004 4 :
41300004 | 00017bef | .{..
(What is so special about these four bytes?)
Then I tried to apply your code, but i don't know where should I call those fumctions, I tried calling them right before cpuDetect() or put it inside cpu-pxa.cpp and call them before cpuGetCP(), same effect.
The error message box doesn't show up but there is no message in the wince side console (detected cpu type),
then the same exception show up when I telnet it and when I dump any cp other then cp0.
phrack #63 - Hacking Windows CE said:
...
; SetProcessorMode.s
AREA |.text|, CODE, ARM
EXPORT |SetProcessorMode|
|SetProcessorMode| PROC
mov r1, lr ; different modes use different lr - save it
msr cpsr_c, r0 ; assign control bits of CPSR
mov pc, r1 ; return
END
...
Most of Pocket PC ROMs were builded with Enable Full Kernel Mode option, so all applications appear to run in kernel mode. The first 5 bits of the Psr register is 0x1F when debugging, that means the ARM processor runs in system mode. This value defined in nkarm.h:
// ARM processor modes
#define USER_MODE 0x10 // 0b10000
#define FIQ_MODE 0x11 // 0b10001
#define IRQ_MODE 0x12 // 0b10010
#define SVC_MODE 0x13 // 0b10011
#define ABORT_MODE 0x17 // 0b10111
#define UNDEF_MODE 0x1b // 0b11011
#define SYSTEM_MODE 0x1f // 0b11111
...
Click to expand...
Click to collapse
I guess smartphone is a little bit different from pocketpc?
Oh, btw I have to specify the address 0x81a00000 when I dumped the
rom using itsme's pmemdump, so it means that 0x81a00000 is mapped to 0x0?
I'd better start reading the ARM reference manual.
aybabtu said:
(What is so special about these four bytes?)
Click to expand...
Click to collapse
This is a ClocKENable (CKEN) register, so you have:
LCD,I2C,ICP,MMC,USB,NSSP,I2S,BTUART,FFUART,STUART,
SSP,AC97,PWM1,PWM0
enabled.
Then I tried to apply your code, but i don't know where should I call those fumctions
Click to expand...
Click to collapse
Add them to the wince/asmstuff.asm file,
and modify the cpuGetCP function in
wince/s-cpu.cpp to
Code:
uint32 cpuGetCP (uint cp, uint regno)
{
uint32 result=0xffffffff;
int ok=0;
if (cp > 15)
return 0xffffffff;
if (cp==15)
{
ok=1;
SetKMode (TRUE);
cli ();
switch (regno)
{
case 0:
result=cp15_0();
break;
case 2:
result=cp15_2();
break;
case 13:
result=cp15_13();
break;
default:
ok=0;
break;
}
sti ();
SetKMode (FALSE);
}
if (!ok) Output (L"Invalid register read cp=%d regno=%d\n",cp,regno);
return result;
uint32 value;
selfmod [0] = 0xee100010 | (cp << 8) | (regno << 16);
if (!FlushSelfMod ("read"))
return 0xffffffff;
__try
{
value = ((uint32 (*) ())&selfmod) ();
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
Complain (C_ERROR ("EXCEPTION reading coprocessor %d register %d"), cp, regno);
value = 0xffffffff;
}
return value;
Oh, btw I have to specify the address 0x81a00000 when I dumped the
rom using itsme's pmemdump, so it means that 0x81a00000 is mapped to 0x0?
Click to expand...
Click to collapse
Maybe, but how did you come to using this address ?
The 'dump gpio' shows that the phone is not using the
builtin LCD pins. Then there must be a
video chipset in the phone. Interesting,
because even HTC is saving money on that.
I tried adding SetKMode to the original function, it worked without
calling your functions.
would there be any possible problem?
Maybe, but how did you come to using this address ?
Click to expand...
Click to collapse
Well I got a leaked dump out rom and tried to extract it with itsme's tool.
and i got something similar to these:
Code:
img 00000000 : hdr=81d5352c base=81a00000 commandlineoffset=81a00000
img 00640000 : hdr=82c40878 base=81a00000 commandlineoffset=81a00000
img 01300000 : hdr=82d02dd8 base=81a00000 commandlineoffset=81a00000
img 01380000 : hdr=8356d204 base=81a00000 commandlineoffset=81a00000
there must be a video chipset in the phone
Click to expand...
Click to collapse
There is a MediaQ MQ2100-JBE chipset inside, i'll look for info for this chipset later. And yes this phone is interesting, low price for it's high specification compared to other same generation phones but crappy customer service .
I'll post the result of dump mmu to the point it crash a little bit later.
aybabtu said:
I tried adding SetKMode to the original function, it worked without
calling your functions.
would there be any possible problem?
Click to expand...
Click to collapse
Unlikely.
Well I got a leaked dump
Click to expand...
Click to collapse
Then you can just lookup the static remapping
table.
There is a MediaQ MQ2100-JBE chipset inside, i'll look for info for this chipset later.
Click to expand...
Click to collapse
The datasheet is available here
www.handhelds.org/platforms/hp/ipaq-h22xx/mq-lcd-interface-appnote.pdf
And the mapping table dumped out using itsme's pmemmap:
Code:
v81a00000-83a00000 -> p00000000-02000000
v86000000-86100000 -> pe0000000-e0100000
v86100000-86200000 -> p48000000-48100000
v86200000-88200000 -> p40000000-42000000
v8c000000-8e000000 -> pa0000000-a2000000
v9a300000-9a400000 -> p04000000-04100000
v9c300000-9c400000 -> p08000000-08100000
v9f600000-9f700000 -> p0c000000-0c100000
v9f800000-9f900000 -> p14000000-14100000
Dumped it out and i can only tell that the first 32MB is my rom data.
And many info you gave me which I don't fully understand, guess I have to
read much more before I can thtink about running linux on this phone,
at least I know what to read now.
On a side note, it jumps to 1000h at the beginning of the rom likes the others
wince devices, but starting from 1000h, the content matches the dumped out
NK.exe kernel without the PE header(?).
Wasn't there supposed to be a 256K bootloader?
And at the end of the rom, there are 2 copies of 256K code, in which I found
strings of the bootloader in it, and the second copy is 1 byte different from
the first one, 1:0x00 2:0x01, in the middle of the code.
I'm not sure these are Mitac only layout, just put it here in case anyone
knows.
Oh and there is a Atmel MEGA16L-8MI Microcontroller inside,
don't know what it exactly does but I found strings related to this
in the 'bootloader portion'.
aybabtu said:
And the mapping table dumped out using itsme's pmemmap:
Click to expand...
Click to collapse
v81a00000-83a00000 -> p00000000-02000000
32MB ROM
v86000000-86100000 -> pe0000000-e0100000
Weird.
v86100000-86200000 -> p48000000-48100000
PXA26x Memory Controller
v86200000-88200000 -> p40000000-42000000
PXA26x Peripherals
v8c000000-8e000000 -> pa0000000-a2000000
32MB SDRAM
v9a300000-9a400000 -> p04000000-04100000
v9c300000-9c400000 -> p08000000-08100000
v9f600000-9f700000 -> p0c000000-0c100000
v9f800000-9f900000 -> p14000000-14100000
mmaped devices.
And many info you gave me which I don't fully understand, guess I have to
read much more before I can thtink about running linux on this phone
Click to expand...
Click to collapse
You can also dump/decode the registry and identify the
use of the serial ports.
Your GPIO table suggests that the PXA MMC
controller is used.
Looks good
aybabtu said:
Oh and there is a Atmel MEGA16L-8MI Microcontroller inside,
don't know what it exactly does but I found strings related to this
in the 'bootloader portion'.
Click to expand...
Click to collapse
Battery monitoring or something like that,
maybe keyboard controller.
aybabtu said:
On a side note, it jumps to 1000h at the beginning of the rom likes the others
wince devices, but starting from 1000h, the content matches the dumped out
NK.exe kernel without the PE header(?).
Wasn't there supposed to be a 256K bootloader?
Click to expand...
Click to collapse
Not all wince devices have a bootloader,
wince2.11 and wince2005 un universal for example.
You can also look with 'strings -el' for
other useful strings.
v86000000-86100000 -> pe0000000-e0100000
Weird.
Click to expand...
Click to collapse
Seems to be that 16MB PXA26X NAND Flash ROM
aybabtu said:
v86000000-86100000 -> pe0000000-e0100000
Weird.
Click to expand...
Click to collapse
Seems to be that 16MB PXA26X NAND Flash ROM
Click to expand...
Click to collapse
Built-in ? BTW, does this device support SD cards or only MMC ?
Built-in ? BTW, does this device support SD cards or only MMC ?
Click to expand...
Click to collapse
Built-in, It should be the M-System DiskOnChip MD3831-D16-V3Q18-T inside.
Support both.
And this phone does not support bluetooth, but the clock to BTUART is
enabled :?:
aybabtu said:
And this phone does not support bluetooth, but the clock to BTUART is
enabled :?:
Click to expand...
Click to collapse
It is a normal UART, not blue at all , Himalaya
uses it for the serial cable.
That's not exactly the datasheet of
mq2100...
archive.org show that this was available
for downloads.. oh well
Put the list of all components and the known
information to wiki. That can help other people.
Hi there,
I am trying to get Linux running on a handheld which uses the HTC bootloader and it would be great if one of the gurus here could give me some hints about using IDA on the bootloader (to find out how buttons and USB are controlled).
The handheld is Dell Axim X50 (PXA270, big ASIC,some CPLD, beside that pretty standard)-for more hardware details take a look at: http://handhelds.org/moin/moin.cgi/DellAximX50
I already identified where the bootloader loads itself into RAM and configures and enables the MMU, I modified the available .idc script (for PXA2xx-regs) to show me nice synonymes instead of the raw register addresses. I traced a little bit through the code - but only seeing lots of operations on RAM addresses and very few (far too few IMO) and very general operations on processor registers doesn't help much. I expect that the register addresses are partly loaded from RAM instead of beeing hard coded.
So now to my question: is there a way to "copy" the into RAM loaded ROM parts in IDA? I mean so that IDA can actually find the data which is supposed to be in RAM right before MMU is enabled and that I can see references to the GPIO/ASIC/CPLD addresses and to the string data (which would greatly help in identifying the useful functions).
Thanks for any hints or advices!
pphoenixx said:
The handheld is Dell Axim X50 (PXA270, big ASIC,some CPLD, beside that pretty standard)-for more hardware details take a look at: http://handhelds.org/moin/moin.cgi/DellAximX50
Click to expand...
Click to collapse
Hi,
a lot of information can be obtained without any disassembling.
I'm curious, if have the "dump gpio" haret output somewhere ?
here you go:
http://www.bfamily.us/~richard/tmp/arm/gpio_map.xml
Code:
GPIO# D S A INTER | GPIO# D S A INTER | GPIO# D S A INTER | GPIO# D S A INTER
------------------+-------------------+-------------------+------------------
0 I 0 0 RE FE | 21 O 1 1 | 42 O 0 0 | 63 O 0 0
1 I 1 0 | 22 O 0 0 | 43 O 0 0 | 64 O 0 0
2 O 1 0 | 23 O 0 2 | 44 O 0 0 | 65 O 0 0
3 O 1 0 | 24 O 1 2 | 45 O 0 0 | 66 O 0 0
4 O 1 0 | 25 O 0 2 | 46 I 1 2 | 67 O 0 0
5 I 1 0 | 26 I 1 1 | 47 O 0 1 | 68 O 0 0
6 I 1 0 | 27 I 0 0 | 48 O 1 2 | 69 O 0 0
7 I 1 0 | 28 O 0 0 | 49 O 1 2 | 70 O 0 0
8 I 1 0 | 29 O 0 0 | 50 O 1 2 | 71 O 0 0
9 O 1 1 | 30 O 0 0 | 51 O 1 2 | 72 O 0 0
10 O 0 1 | 31 O 0 0 | 52 I 1 0 | 73 O 0 0
11 I 0 0 RE FE | 32 O 0 0 | 53 O 1 0 | 74 O 0 0
12 I 1 0 RE FE | 33 O 1 2 | 54 O 1 2 | 75 O 0 0
13 I 0 0 RE | 34 O 0 0 | 55 O 1 2 | 76 O 0 0
14 I 1 0 RE FE | 35 O 0 0 | 56 I 1 1 | 77 O 0 0
15 O 1 2 | 36 O 1 0 | 57 I 1 1 | 78 O 1 2
16 O 0 0 | 37 O 0 0 | 58 O 0 0 | 79 O 1 2
17 O 1 2 | 38 I 0 0 | 59 O 0 0 | 80 O 1 2
18 I 1 1 | 39 O 0 0 | 60 O 0 0 | 81 O 0 0
19 O 1 0 | 40 O 0 0 | 61 O 0 0 | 82 O 0 0
20 O 1 1 | 41 O 0 0 | 62 O 0 0 | 83 I 0 0 RE FE
There is already much accomplished - A 2.6.15-rc7 kernel boots without problem, working framebuffer and I can activate IRDA and use it for console.. everything directly connected to the PXA is no issue; the ASIC and CPLDs are my major problem right now - that's why I throw myself into disassembling.
pphoenixx said:
There is already much accomplished - A 2.6.15-rc7 kernel boots without problem, working framebuffer and I can activate IRDA and use it for console.. everything directly connected to the PXA is no issue; the ASIC and CPLDs are my major problem right now - that's why I throw myself into disassembling.
Click to expand...
Click to collapse
Ok. You are using PXA270 SDIO.
We are also moving forward, but have some problems with the framebuffer.
http://wiki.xda-developers.com/index.php?pagename=UniversalResearch
http://wiki.xda-developers.com/index.php?pagename=UniversalProgress
Do you know how the wifi chip is connected ? Is it on pcmcia ?
FYI, we have a weird CPLD too.
cr2 said:
Do you know how the wifi chip is connected ? Is it on pcmcia ?
FYI, we have a weird CPLD too.
Click to expand...
Click to collapse
well, looking at
Code:
HaRET(29)# pd 0x48000014 1
48000014 | 00000003 | ....
PC Card Is Present
This bit must be written by software when either PC Card is inserted into a
socket.
0 = No PC Card inserted
1 = PC Card inserted
0 R/W NOS
PC Card Interface Number of Sockets
0 = 1 socket
1 = 2 sockets
Click to expand...
Click to collapse
one could assume that at least something is sitting on pcmcia. and if I write a 0x0 in there - WIFI is suddenly gone while the device remains responsive (= hasn't crashed). So at least on the axim, I suppose it's on pcmcia.
pphoenixx said:
Code:
HaRET(29)# pd 0x48000014 1
48000014 | 00000003 | ....
Click to expand...
Click to collapse
The same here. But i can zero it while running over wlan.
Maybe you disabled something else and WIFI is connected via USB1.1 (try to disable USB)? or your WIFI chip is connected via socket 1 (which can't be disabled) - I tried to write a 0x1 in there (no PC CARD) and WIFI remained operational, it's only gone when I completly disabled socket2 (0x0).
It's pcmcia for sure on axim.
If you have the same driver, tiacxwln.dll Version: 2.0.53(NDIS)
Create an empty file: tiacxwln_testmode.txt and put it in your WINDOWS directory and soft-reboot -- on Axim, the driver looks for that file and if it exists the wifi hardware isn't claimed anymore (propably to easly test other drivers or launch special testmode drivers..). WinCE kicks in and recognizes an unknown networking device connected to PCMCIA socket 2.
pphoenixx said:
Create an empty file: tiacxwln_testmode.txt and put it in your WINDOWS directory and soft-reboot -- on Axim, the driver looks for that file and if it exists the wifi hardware isn't claimed anymore (propably to easly test other drivers or launch special testmode drivers..). WinCE kicks in and recognizes an unknown networking device connected to PCMCIA socket 2.
Click to expand...
Click to collapse
ACX100 is used by most PDAs through the PCMCIA (or SDIO) interface.
Unfortunately, the acx100.sf.net driver supports only pci and usb...
ACX100 could be partially initialized on HTC Blueangel, but it is not working yet.
-----
\Storage Card\tiacxwln_testmode.txt
\SD Card\tiacxwln_testmode.txt
\windows\tiacxwln_testmode.txt
Well I was trying to port slimben for my acer a500 and the build goes well until the last few steps when trying to make a zip file. Can you guys help me take a look thank you!
Code:
Made boot image: out/target/product/a500/boot.img
----- Making recovery image ------
out/host/linux-x86/bin/mkbootimg --kernel out/target/product/a500/kernel --ramdisk out/target/product/a500/ramdisk-recovery.img --base 0x10000000 --output out/target/product/a500/recovery.img
Made recovery image: out/target/product/a500/recovery.img
out/target/product/a500/recovery.img maxsize=5136384 blocksize=135168 total=4249600 reserve=270336
Construct recovery from boot
mkdir -p out/target/product/a500/obj/PACKAGING/recovery_patch_intermediates/
PATH=out/host/linux-x86/bin:$PATH out/host/linux-x86/bin/imgdiff out/target/product/a500/boot.img out/target/product/a500/recovery.img out/target/product/a500/obj/PACKAGING/recovery_patch_intermediates/recovery_from_boot.p
Construct patches for 3 chunks...
patch 0 is 205 bytes (of 2838538)
patch 1 is 1242964 bytes (of 170881)
patch 2 is 153 bytes (of 1141)
chunk 0: normal ( 0, 2838538) 205
chunk 1: deflate ( 2838538, 1410471) 1242964 (null)
chunk 2: normal ( 4249009, 591) 153
Install system fs image: out/target/product/a500/system.img
out/target/product/a500/system.img+out/target/product/a500/obj/PACKAGING/recovery_patch_intermediates/recovery_from_boot.p maxsize=1310318592 blocksize=135168 total=195068238 reserve=13246464
Package target files: out/target/product/a500/obj/PACKAGING/target_files_intermediates/slim_a500-target_files-eng.user.zip
Package OTA: out/target/product/a500/slim_a500-ota-eng.user.zip
./build/tools/releasetools/ota_from_target_files -v \
-p out/host/linux-x86 \
-k build/target/product/security/testkey \
--backup=true \
--override_device=picasso,a500 \
out/target/product/a500/obj/PACKAGING/target_files_intermediates/slim_a500-target_files-eng.user.zip out/target/product/a500/slim_a500-ota-eng.user.zip
unzipping target target-files...
running: unzip -o -q out/target/product/a500/obj/PACKAGING/target_files_intermediates/slim_a500-target_files-eng.user.zip -d /tmp/targetfiles-91NFVw
--- target info ---
blocksize = (int) 131072
boot_size = (int) 8388608
default_system_dev_certificate = (str) build/target/product/security/testkey
extfs_sparse_flag = (str) -s
fs_type = (str) ext4
fstab = (dict) {'/flexrom': <common.Partition object at 0x1e48150>, '/cache': <common.Partition object at 0x1e480d0>, '/boot': <common.Partition object at 0x1e44ed0>, '/system': <common.Partition object at 0x1e48050>, '/mnt/sdcard': <common.Partition object at 0x1e48250>, '/recovery': <common.Partition object at 0x1e44e50>, '/data': <common.Partition object at 0x1e481d0>}
recovery_api_version = (int) 2
recovery_size = (int) 5242880
system_size = (int) 1283457024
tool_extensions = (str) device/acer/a500/../common
userdata_size = (int) 13950255104
using device-specific extensions in device/acer/common
unable to load device-specific module; assuming none
Traceback (most recent call last):
File "./build/tools/releasetools/ota_from_target_files", line 901, in <module>
main(sys.argv[1:])
File "./build/tools/releasetools/ota_from_target_files", line 869, in main
WriteFullOTAPackage(input_zip, output_zip)
File "./build/tools/releasetools/ota_from_target_files", line 448, in WriteFullOTAPackage
script.Mount("/data")
File "/home/user/slim4.1/build/tools/releasetools/edify_generator.py", line 157, in Mount
(p.fs_type, common.PARTITION_TYPES[p.fs_type],
KeyError: 'auto'
make: *** [out/target/product/a500/slim_a500-ota-eng.user.zip] Error 1
Wanted to return to settings manufactures and as I thought I had deleted the update program, I decided to reinstall the room. I ended up doing no such thing and only getting worse ..
With the terminal emulator I did the following:
TWRP INSTALL: ** dd if = / storage / external_sd / recovery.img of = / dev / block / mmcblk0p17 bs = 2048 ** // (believe is the TWRP)
with backup:
** Dd if = / dev / block / mmcblk0p6 of = / storage / external_sd / abootstock.bin **
and a aboot.bin (* available on xda ([HowTo] Root, TWRP, patched aboot LG L-FINE Dual [D295tested] *)
** Dd if = / storage / external_sd / aboot.bin of = / dev / block / mmcblk0p6 **
But now only opens TWRP, self contained than I do, I open download mode, system, recovery, always in the TWRP (08/02/50)
Perhaps the ADB Sideload the TWRP function to work. with the command (** dd if = / storage / external_sd / abootstock.bin of = / dev / block / mmcblk0p6 **) can return to an old one. But when I click "Swipe to Start Sideload" is only with the screen
* "Updating partition details ...
... Done
Full SELinux support is present.
.
MTP Enable
Starting ADB sideload feature. "*
Recalling that only found the room in this mobile KBZ format, the LG Flash Tools, which does not recognize the device it seems.
Its someone help me?
Help me, I'm still paying this phone.
Google Translate some things, sorry