Hello, does anyone know why this is happening to me?
I am using LGNPST v2.2.3 ACG and this error occurs every time with multiple factory image .bins when Masterbin D/L reaches 85%.
I am using the LG Optimus LGNPST .dll which I heard should work fine for the Nexus 4. Can anyone help me get around this error?
Here is the picture of the error and LGNPST:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Here is the XDA thread containing the .tot and .bin files I am trying to restore to via LGNPST:
http://forum.xda-developers.com/showthread.php?t=1976057&highlight=dll
I have the Generic Models and Components (v5) both properly installed so it is not that problem.
Please someone lend me some assistance!
*Disclaimer: I am using LGNPST because my Nexus 4 is in a bricked state and I must revive it through LGNPST..
Does anyone know what this problem is or how to fix it? :crying:
fakudolan said:
Does anyone know what this problem is or how to fix it? :crying:
Click to expand...
Click to collapse
According to users with the Optimus G, they have that same issue and it is resolved by way of the info at this link:
http://newphablet.org/howto/optimus-g-root-unlock-boot-loader-up-to-room-experience-using/
"1. When the Optimus G restarts successfully, the Setup screen appears, LGNPST continues to run normally, and the device will be reboot 1-2 times. You just still wait for the Finish tool is ok.
2. The Optimus G does not boot up, hangs on LG logo with bright spots. LGNPST runs to 85% and error. Now you leave the usb cable, click “OK” in the error message, press keeping the power button for about 10 seconds waiting for a red light on charging. Quickly remove the power button, keeping down two keys to increase or decrease the volume in order to get back to download mode. Usually make this tool will run, but if the error after about 1 minute. You click OK, press and hold the power key to turn off the power phone, then press 1 to turn on the machine. The tool will run.
3. After the tool has finished running 100%. Your chance will be suspended logo. In that situation, you shutdown Optimus G completely and hold VOL Down and Power at the same time to Factor Reset Default."
Report back after checking it out, please.
VicFreeze said:
According to users with the Optimus G, they have that same issue and it is resolved by way of the info at this link:
http://newphablet.org/howto/optimus-g-root-unlock-boot-loader-up-to-room-experience-using/
"1. When the Optimus G restarts successfully, the Setup screen appears, LGNPST continues to run normally, and the device will be reboot 1-2 times. You just still wait for the Finish tool is ok.
2. The Optimus G does not boot up, hangs on LG logo with bright spots. LGNPST runs to 85% and error. Now you leave the usb cable, click “OK” in the error message, press keeping the power button for about 10 seconds waiting for a red light on charging. Quickly remove the power button, keeping down two keys to increase or decrease the volume in order to get back to download mode. Usually make this tool will run, but if the error after about 1 minute. You click OK, press and hold the power key to turn off the power phone, then press 1 to turn on the machine. The tool will run.
3. After the tool has finished running 100%. Your chance will be suspended logo. In that situation, you shutdown Optimus G completely and hold VOL Down and Power at the same time to Factor Reset Default."
Report back after checking it out, please.
Click to expand...
Click to collapse
The problem with that is that my Nexus 4 doesn't even show any sign of life, no reboots or anything, nothing happens to it while/after the error happens..
fakudolan said:
The problem with that is that my Nexus 4 doesn't even show any sign of life, no reboots or anything, nothing happens to it while/after the error happens..
Click to expand...
Click to collapse
Does this process write enough to get the bootloader written back to the device so that you can boot back into Fastboot though? After powering down and initiating a Fastboot hardware button boot sequence, of course.
VicFreeze said:
Does this process write enough to get the bootloader written back to the device so that you can boot back into Fastboot though? After powering down and initiating a Fastboot hardware button boot sequence, of course.
Click to expand...
Click to collapse
Nope, the process does not progress enough to write the bootloader back into the device. I have tried different factory images but to no avail, the same error occurs at the same 85%.
Here is the log file that occurs from the Masterbin error in LGNPST, if it helps.
Port Open 41
Port Open
StartFactory Download#### [EXTENDED SUPER BOOST] ####
*****************************************************************************
*- PartitionTable Info -*
*- Software Version :
*- 601358336 Bytes
*****************************************************************************
Index| Part Name | Logical Start | Logical Size ( KB) | Start Sector | No Of Sectors ( KB)
0 | PrimaryGPT | 0x 0 | 0x 80000 ( 512KB) | 0x 0 | 0x 400 ( 512KB)
1 | modem | 0x 80000 | 0x 3580000 ( 54784KB) | 0x 400 | 0x 20000 ( 65536KB)
2 | sbl1 | 0x 3600000 | 0x 80000 ( 512KB) | 0x 20400 | 0x 400 ( 512KB)
3 | sbl2 | 0x 3680000 | 0x 80000 ( 512KB) | 0x 20800 | 0x 400 ( 512KB)
4 | sbl3 | 0x 3700000 | 0x 180000 ( 1536KB) | 0x 20C00 | 0x 1000 ( 2048KB)
5 | tz | 0x 3880000 | 0x 80000 ( 512KB) | 0x 21C00 | 0x 400 ( 512KB)
6 | boot | 0x 3900000 | 0x 1200000 ( 18432KB) | 0x 22000 | 0x B000 ( 22528KB)
7 | recovery | 0x 4B00000 | 0x 700000 ( 7168KB) | 0x 2D000 | 0x C400 ( 25088KB)
8 | rpm | 0x 5200000 | 0x 80000 ( 512KB) | 0x 39400 | 0x 400 ( 512KB)
9 | aboot | 0x 5280000 | 0x 80000 ( 512KB) | 0x 39800 | 0x 400 ( 512KB)
10 | sbl2b | 0x 5300000 | 0x 80000 ( 512KB) | 0x 39C00 | 0x 400 ( 512KB)
11 | sbl3b | 0x 5380000 | 0x 180000 ( 1536KB) | 0x 3A000 | 0x 1000 ( 2048KB)
12 | abootb | 0x 5500000 | 0x 80000 ( 512KB) | 0x 3B000 | 0x 400 ( 512KB)
13 | rpmb | 0x 5580000 | 0x 80000 ( 512KB) | 0x 3B400 | 0x 400 ( 512KB)
14 | tzb | 0x 5600000 | 0x 80000 ( 512KB) | 0x 3B800 | 0x 800 ( 1024KB)
15 | misc | 0x 5680000 | 0x 800000 ( 8192KB) | 0x 3C000 | 0x 8000 ( 16384KB)
16 | persist | 0x 5E80000 | 0x 480000 ( 4608KB) | 0x 44000 | 0x 8000 ( 16384KB)
17 | system | 0x 6300000 | 0x 8000000 ( 131072KB) | 0x 4C000 | 0x 40000 ( 131072KB)
18 | system | 0x E300000 | 0x 80000 ( 512KB) | 0x 8C000 | 0x 10D8 ( 2156KB)
19 | system | 0x E380000 | 0x 7E00000 ( 129024KB) | 0x 8D0D8 | 0x 3FE38 ( 130844KB)
20 | system | 0x16180000 | 0x 7E80000 ( 129536KB) | 0x CCF10 | 0x 401C8 ( 131300KB)
21 | system | 0x1E000000 | 0x 4E80000 ( 80384KB) | 0x 10D0D8 | 0x 3EF28 ( 128916KB)
22 | system | 0x22E80000 | 0x 80000 ( 512KB) | 0x 14C000 | 0x 40000 ( 131072KB)
23 | system | 0x22F00000 | 0x 80000 ( 512KB) | 0x 18C000 | 0x 40000 ( 131072KB)
24 | system | 0x22F80000 | 0x 80000 ( 512KB) | 0x 1CC000 | 0x 24000 ( 73728KB)
25 | cache | 0x23000000 | 0x B00000 ( 11264KB) | 0x 1F0000 | 0x 40000 ( 131072KB)
26 | cache | 0x23B00000 | 0x 80000 ( 512KB) | 0x 230000 | 0x 40000 ( 131072KB)
27 | cache | 0x23B80000 | 0x 80000 ( 512KB) | 0x 270000 | 0x 40000 ( 131072KB)
28 | cache | 0x23C00000 | 0x 80000 ( 512KB) | 0x 2B0000 | 0x 40000 ( 131072KB)
29 | cache | 0x23C80000 | 0x 80000 ( 512KB) | 0x 2F0000 | 0x B9FC00 ( 6094336KB)
30 | BackupGPT | 0x23D00000 | 0x 80000 ( 512KB) | 0x E8FC00 | 0x 400 ( 512KB)
Dload Nop [20:31:48.707][T000004] 06 4E 95 7E .N..
[ERROR] RX Timeout : 90.0 seconds
We can't communicate with PhoneDload Nop [20:33:18.710][T000004] 06 4E 95 7E .N..
[ERROR] RX Timeout : 90.0 seconds
We can't communicate with Phone [20:34:48.711][T000004] 3A A1 6E 7E :.n.
[ERROR] RX Timeout : 90.0 seconds
We can't communicate with PhonePort is already Opened
[20:36:38.713][T000008] FA 19 00 07 00 B3 6B 7E ......k.
[20:36:38.713][R000005] 03 00 06 9E 4C ....L
[LGFTM_FAIL] FTM CMD 250-25-7 FAIL!
Battery Level is enough
Feature Query [20:36:38.714][T000015] 2F 00 00 00 00 00 00 00 00 00 00 00 1A C3 7E /..............
[ERROR] RX Timeout : 90.0 seconds
We can't communicate with PhoneFeature Query [20:38:08.716][T000015] 2F 00 00 00 00 00 00 00 00 00 00 00 1A C3 7E /..............
[20:38:08.717][R000005] 03 00 06 9E 4C ....L
This firmware does not support LG Download. [ response cmd code : 3 ]Port Close
Click to expand...
Click to collapse
There are 3 different minute and a half gaps where the phone is undetected...As per the previous link, you should try to disconnect the phone then put it back in download mode so that it can try to continue writing the image. At 85% sometime you should be able to hear your computer telling you that a device is "unplugged". Try to force download mode again during that time.
Sent from my GT-N5100 using Tapatalk 4 Beta
VicFreeze said:
There are 3 different minute and a half gaps where the phone is undetected...As per the previous link, you should try to disconnect the phone then put it back in download mode so that it can try to continue writing the image. At 85% sometime you should be able to hear your computer telling you that a device is "unplugged". Try to force download mode again during that time.
Sent from my GT-N5100 using Tapatalk 4 Beta
Click to expand...
Click to collapse
I can't get the phone into Download mode, my Nexus 4 is unable to get into recovery, fastboot, bootloader, or download mode.
fakudolan said:
I can't get the phone into Download mode, my Nexus 4 is unable to get into recovery, fastboot, bootloader, or download mode.
Click to expand...
Click to collapse
So, how are you even properly attempting to do this procedure? The only way this should be working is with the phone in download mode (from off, hold Vol Up + Vol Down and plug in the USB cable). Are you saying that the phone just shows as a black screen? Does your phone properly charge while off (show the battery graphics while charging)?
VicFreeze said:
So, how are you even properly attempting to do this procedure? The only way this should be working is with the phone in download mode (from off, hold Vol Up + Vol Down and plug in the USB cable). Are you saying that the phone just shows as a black screen? Does your phone properly charge while off (show the battery graphics while charging)?
Click to expand...
Click to collapse
LGNPST detects the COM port from my phone, but that is about it. And yes, the phone just shows as a black screen, and there is no battery graphic visual while charging.
It's dead. Sorry. The only hope for you is JTAG and there is no guarantees.
Sent from my Nexus 4 using Tapatalk 4 Beta
Related
I ran the latest version 0.36 on my Mio8390 which is using a PXA262 processor
running smartphone 2003.
When I started haret I've got an error message :
EXCEPTION reading coprocessor 15 register 0
twice.
And the detected cpu type is unknown
Anyway i could start the application and open a tcp port
Here is the result of dump cp(0) :
c00: ffffffd2 | c08: ffffffd2
c01: ffffffd2 | c09: ffffffd2
c02: ffffffd2 | c10: ffffffd2
c03: ffffffd2 | c11: ffffffd2
c04: ffffffd2 | c12: ffffffd2
c05: ffffffd2 | c13: ffffffd2
c06: ffffffd2 | c14: ffffffd2
c07: ffffffd2 | c15: ffffffd2
And here is the result of dump mmu:
----- Virtual address map -----
Descriptor flags legend:
C: Cacheable
B: Bufferable
0..3: Access Permissions (for up to 4 slices):
0: Supervisor mode Read
1: Supervisor mode Read/Write
2: User mode Read
3: User mode Read/Write
Error: EXCEPTION reading coprocessor 15 register 2
MMU 1st level descriptor table is at FFFFC000
Virtual | Physical | Descr | Description
address | address | flags |
----------+----------+---------+-----------------------------
Error: EXCEPTION CAUGHT AT MEGABYTE 0!
ffffffff | | | End of virtual address space
It seems that haret is having problem trying to read the CPU registeries,
what could be the problem?
So it means that I have to patch the source of haret before I can use it on a smartphone?
Or is it because of smartphone security policies? something about user-mode, kernel-mode in
wince?
I'm quite a nub but I think I have to know what to read first before I start reading books. Any info or help is appreciated.
aybabtu said:
I ran the latest version 0.36 on my Mio8390 which is using a PXA262 processor
running smartphone 2003.
When I started haret I've got an error message :
EXCEPTION reading coprocessor 15 register 0
...
Any info or help is appreciated.
Click to expand...
Click to collapse
You can try to add this code the the assembler file
and call the functions directly. Worked for
me with wince2.11, where i also had problems:
export |cp15_0|
|cp15_0| proc
mrc p15, 0, r0, c0, c0, 0
mov pc, lr
endp
export |cp15_2|
|cp15_2| proc
mrc p15, 0, r0, c2, c0, 0
mov pc, lr
endp
export |cp15_13|
|cp15_13| proc
mrc p15, 0, r0, c13, c0, 0
mov pc, lr
endp
aybabtu said:
I ran the latest version 0.36 on my Mio8390 which is using a PXA262 processor
running smartphone 2003.
Click to expand...
Click to collapse
Don't forget to post at least the 'dump gpio', FB address,
'dump mmu' and 'pd 0x41300004 4' here when
haret works
cr2 said:
... 'dump gpio', FB address,
'dump mmu' and 'pd 0x41300004 4'
Click to expand...
Click to collapse
Thank you for your help.
I signed the code with a privileged certification, then dump gpio and
physical address worked.
Code:
#dump gpio :
GPIO# D S A INTER | GPIO# D S A INTER | GPIO# D S A INTER | GPIO# D S A INTER
------------------+-------------------+-------------------+------------------
0 I 0 0 FE | 21 I 0 0 | 42 I 1 1 | 63 I 1 0 FE
1 I 0 0 RE FE | 22 O 1 0 | 43 O 1 2 | 64 O 1 0
2 I 0 0 RE | 23 O 0 0 | 44 I 1 1 | 65 O 1 0
3 I 0 0 RE FE | 24 O 0 0 | 45 O 1 2 | 66 O 1 0
4 I 0 0 RE | 25 O 0 0 | 46 I 1 2 | 67 I 1 0 FE
5 I 1 0 FE | 26 I 1 0 | 47 O 1 1 | 68 I 1 0
6 O 0 1 | 27 I 1 0 | 48 I 1 0 | 69 I 0 0
7 I 1 0 | 28 I 1 1 | 49 O 1 2 | 70 I 1 0
8 O 1 1 | 29 I 0 1 | 50 O 1 0 | 71 I 1 0
9 I 1 0 | 30 O 0 2 | 51 O 0 0 | 72 I 1 0 FE
10 I 1 0 FE | 31 O 0 2 | 52 I 1 0 | 73 O 1 0
11 I 1 0 | 32 I 1 0 | 53 I 1 0 | 74 O 0 0
12 I 1 0 RE FE | 33 O 1 2 | 54 O 0 0 | 75 O 1 0
13 I 0 0 RE FE | 34 I 1 1 | 55 O 1 0 | 76 O 0 0
14 I 0 0 RE FE | 35 I 0 1 | 56 O 0 0 | 77 O 0 0
15 O 1 2 | 36 I 0 0 | 57 I 1 0 | 78 O 1 2
16 I 1 0 | 37 I 0 1 | 58 O 0 0 | 79 I 1 2
17 O 1 2 | 38 I 0 0 | 59 O 0 0 | 80 O 1 2
18 I 1 1 | 39 O 1 2 | 60 O 1 0 | 81 I 1 1
19 O 1 0 | 40 O 0 0 | 61 O 1 0 | 82 O 1 1
20 O 1 0 | 41 O 0 0 | 62 O 1 0 | 83 I 1 2
#pd 0x41300004 4 :
41300004 | 00017bef | .{..
(What is so special about these four bytes?)
Then I tried to apply your code, but i don't know where should I call those fumctions, I tried calling them right before cpuDetect() or put it inside cpu-pxa.cpp and call them before cpuGetCP(), same effect.
The error message box doesn't show up but there is no message in the wince side console (detected cpu type),
then the same exception show up when I telnet it and when I dump any cp other then cp0.
phrack #63 - Hacking Windows CE said:
...
; SetProcessorMode.s
AREA |.text|, CODE, ARM
EXPORT |SetProcessorMode|
|SetProcessorMode| PROC
mov r1, lr ; different modes use different lr - save it
msr cpsr_c, r0 ; assign control bits of CPSR
mov pc, r1 ; return
END
...
Most of Pocket PC ROMs were builded with Enable Full Kernel Mode option, so all applications appear to run in kernel mode. The first 5 bits of the Psr register is 0x1F when debugging, that means the ARM processor runs in system mode. This value defined in nkarm.h:
// ARM processor modes
#define USER_MODE 0x10 // 0b10000
#define FIQ_MODE 0x11 // 0b10001
#define IRQ_MODE 0x12 // 0b10010
#define SVC_MODE 0x13 // 0b10011
#define ABORT_MODE 0x17 // 0b10111
#define UNDEF_MODE 0x1b // 0b11011
#define SYSTEM_MODE 0x1f // 0b11111
...
Click to expand...
Click to collapse
I guess smartphone is a little bit different from pocketpc?
Oh, btw I have to specify the address 0x81a00000 when I dumped the
rom using itsme's pmemdump, so it means that 0x81a00000 is mapped to 0x0?
I'd better start reading the ARM reference manual.
aybabtu said:
(What is so special about these four bytes?)
Click to expand...
Click to collapse
This is a ClocKENable (CKEN) register, so you have:
LCD,I2C,ICP,MMC,USB,NSSP,I2S,BTUART,FFUART,STUART,
SSP,AC97,PWM1,PWM0
enabled.
Then I tried to apply your code, but i don't know where should I call those fumctions
Click to expand...
Click to collapse
Add them to the wince/asmstuff.asm file,
and modify the cpuGetCP function in
wince/s-cpu.cpp to
Code:
uint32 cpuGetCP (uint cp, uint regno)
{
uint32 result=0xffffffff;
int ok=0;
if (cp > 15)
return 0xffffffff;
if (cp==15)
{
ok=1;
SetKMode (TRUE);
cli ();
switch (regno)
{
case 0:
result=cp15_0();
break;
case 2:
result=cp15_2();
break;
case 13:
result=cp15_13();
break;
default:
ok=0;
break;
}
sti ();
SetKMode (FALSE);
}
if (!ok) Output (L"Invalid register read cp=%d regno=%d\n",cp,regno);
return result;
uint32 value;
selfmod [0] = 0xee100010 | (cp << 8) | (regno << 16);
if (!FlushSelfMod ("read"))
return 0xffffffff;
__try
{
value = ((uint32 (*) ())&selfmod) ();
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
Complain (C_ERROR ("EXCEPTION reading coprocessor %d register %d"), cp, regno);
value = 0xffffffff;
}
return value;
Oh, btw I have to specify the address 0x81a00000 when I dumped the
rom using itsme's pmemdump, so it means that 0x81a00000 is mapped to 0x0?
Click to expand...
Click to collapse
Maybe, but how did you come to using this address ?
The 'dump gpio' shows that the phone is not using the
builtin LCD pins. Then there must be a
video chipset in the phone. Interesting,
because even HTC is saving money on that.
I tried adding SetKMode to the original function, it worked without
calling your functions.
would there be any possible problem?
Maybe, but how did you come to using this address ?
Click to expand...
Click to collapse
Well I got a leaked dump out rom and tried to extract it with itsme's tool.
and i got something similar to these:
Code:
img 00000000 : hdr=81d5352c base=81a00000 commandlineoffset=81a00000
img 00640000 : hdr=82c40878 base=81a00000 commandlineoffset=81a00000
img 01300000 : hdr=82d02dd8 base=81a00000 commandlineoffset=81a00000
img 01380000 : hdr=8356d204 base=81a00000 commandlineoffset=81a00000
there must be a video chipset in the phone
Click to expand...
Click to collapse
There is a MediaQ MQ2100-JBE chipset inside, i'll look for info for this chipset later. And yes this phone is interesting, low price for it's high specification compared to other same generation phones but crappy customer service .
I'll post the result of dump mmu to the point it crash a little bit later.
aybabtu said:
I tried adding SetKMode to the original function, it worked without
calling your functions.
would there be any possible problem?
Click to expand...
Click to collapse
Unlikely.
Well I got a leaked dump
Click to expand...
Click to collapse
Then you can just lookup the static remapping
table.
There is a MediaQ MQ2100-JBE chipset inside, i'll look for info for this chipset later.
Click to expand...
Click to collapse
The datasheet is available here
www.handhelds.org/platforms/hp/ipaq-h22xx/mq-lcd-interface-appnote.pdf
And the mapping table dumped out using itsme's pmemmap:
Code:
v81a00000-83a00000 -> p00000000-02000000
v86000000-86100000 -> pe0000000-e0100000
v86100000-86200000 -> p48000000-48100000
v86200000-88200000 -> p40000000-42000000
v8c000000-8e000000 -> pa0000000-a2000000
v9a300000-9a400000 -> p04000000-04100000
v9c300000-9c400000 -> p08000000-08100000
v9f600000-9f700000 -> p0c000000-0c100000
v9f800000-9f900000 -> p14000000-14100000
Dumped it out and i can only tell that the first 32MB is my rom data.
And many info you gave me which I don't fully understand, guess I have to
read much more before I can thtink about running linux on this phone,
at least I know what to read now.
On a side note, it jumps to 1000h at the beginning of the rom likes the others
wince devices, but starting from 1000h, the content matches the dumped out
NK.exe kernel without the PE header(?).
Wasn't there supposed to be a 256K bootloader?
And at the end of the rom, there are 2 copies of 256K code, in which I found
strings of the bootloader in it, and the second copy is 1 byte different from
the first one, 1:0x00 2:0x01, in the middle of the code.
I'm not sure these are Mitac only layout, just put it here in case anyone
knows.
Oh and there is a Atmel MEGA16L-8MI Microcontroller inside,
don't know what it exactly does but I found strings related to this
in the 'bootloader portion'.
aybabtu said:
And the mapping table dumped out using itsme's pmemmap:
Click to expand...
Click to collapse
v81a00000-83a00000 -> p00000000-02000000
32MB ROM
v86000000-86100000 -> pe0000000-e0100000
Weird.
v86100000-86200000 -> p48000000-48100000
PXA26x Memory Controller
v86200000-88200000 -> p40000000-42000000
PXA26x Peripherals
v8c000000-8e000000 -> pa0000000-a2000000
32MB SDRAM
v9a300000-9a400000 -> p04000000-04100000
v9c300000-9c400000 -> p08000000-08100000
v9f600000-9f700000 -> p0c000000-0c100000
v9f800000-9f900000 -> p14000000-14100000
mmaped devices.
And many info you gave me which I don't fully understand, guess I have to
read much more before I can thtink about running linux on this phone
Click to expand...
Click to collapse
You can also dump/decode the registry and identify the
use of the serial ports.
Your GPIO table suggests that the PXA MMC
controller is used.
Looks good
aybabtu said:
Oh and there is a Atmel MEGA16L-8MI Microcontroller inside,
don't know what it exactly does but I found strings related to this
in the 'bootloader portion'.
Click to expand...
Click to collapse
Battery monitoring or something like that,
maybe keyboard controller.
aybabtu said:
On a side note, it jumps to 1000h at the beginning of the rom likes the others
wince devices, but starting from 1000h, the content matches the dumped out
NK.exe kernel without the PE header(?).
Wasn't there supposed to be a 256K bootloader?
Click to expand...
Click to collapse
Not all wince devices have a bootloader,
wince2.11 and wince2005 un universal for example.
You can also look with 'strings -el' for
other useful strings.
v86000000-86100000 -> pe0000000-e0100000
Weird.
Click to expand...
Click to collapse
Seems to be that 16MB PXA26X NAND Flash ROM
aybabtu said:
v86000000-86100000 -> pe0000000-e0100000
Weird.
Click to expand...
Click to collapse
Seems to be that 16MB PXA26X NAND Flash ROM
Click to expand...
Click to collapse
Built-in ? BTW, does this device support SD cards or only MMC ?
Built-in ? BTW, does this device support SD cards or only MMC ?
Click to expand...
Click to collapse
Built-in, It should be the M-System DiskOnChip MD3831-D16-V3Q18-T inside.
Support both.
And this phone does not support bluetooth, but the clock to BTUART is
enabled :?:
aybabtu said:
And this phone does not support bluetooth, but the clock to BTUART is
enabled :?:
Click to expand...
Click to collapse
It is a normal UART, not blue at all , Himalaya
uses it for the serial cable.
That's not exactly the datasheet of
mq2100...
archive.org show that this was available
for downloads.. oh well
Put the list of all components and the known
information to wiki. That can help other people.
Hi.
Has anyone tried to make linux/familiar boot on the Wizard yet?
Any luck?
mind said:
Hi.
Has anyone tried to make linux/familiar boot on the Wizard yet?
Any luck?
Click to expand...
Click to collapse
Oh this looks interesting. What could you do with a linux boot?
mind said:
Has anyone tried to make linux/familiar boot on the Wizard yet?
Click to expand...
Click to collapse
Have you tried to run haret ?
If it works, can you post the
framebuffer address and 'dump mmu' here ?
It might take a bit longer for anything like this to appear, but it would be interesting when it does.
I haven't tried it. The reason for my question was that I'm going to do some development work for Opie (opie.handhelds.org), and need a machine that boots and runs familiar to test stuff. And I would like to get me a wizard
Familiar has a list of machines tested on familiar ( booting or not ). But only Wallaby (XDA), Himalaya (XDA II), Blueangel (XDA III) and Universal (MDA Pro) are listed.
So if anyone in this forum wich has a wizard and would like to try out linux/opie on it; please let me know if it boots!!!
There are a lot of advantages having linux on you're XDA instead of windows mobile. The most obvious being that if you're stuck in some corner ( lets say mp3 audio over bt isn't working ), you could always do some work on the ( BlueZ ) code you're self to try to fix the problem. Also there's alot of cool software available that you don't have on WM.
And oh, you're free
Best regards,
mind said:
Familiar has a list of machines tested on familiar ( booting or not ). But only Wallaby (XDA), Himalaya (XDA II), Blueangel (XDA III) and Universal (MDA Pro) are listed.
Click to expand...
Click to collapse
The only machine where Linux WORKS right now
is Blueangel (with GPE, never seen reports about opie). Himalaya, Universal and Magician need some work. Alpine should work with some
effort too.
Wallaby is not really working (no SD) because
nobody is interested in writing this driver.
Power management (i.e. suspend) is missing now.
So if anyone in this forum wich has a wizard and would like to try out linux/opie on it; please let me know if it boots!!!
Click to expand...
Click to collapse
To run opie, you need a running kernel, which does not exist. To write the kernel it is necessary to run 'haret'. So, the first step
is to try 'haret' !
To run opie, you need a running kernel, which does not exist. To write the kernel it is necessary to run 'haret'. So, the first step
is to try 'haret' !
Click to expand...
Click to collapse
Just tried it. Haret starts, but prints out the message "Exception reading coprocessor 15 register .." I can connect to Haret on port 9999 and can issue some commands like "dump mmu" but there's not much info there...:
Code:
descriptor flags legend:
C: Cacheable
B: Bufferable
0..3: Access Permissions (for up to 4 slices):
0: Supervisor mode Read
1: Supervisor mode Read/Write
2: User mode Read
3: User mode Read/Write
Error: EXCEPTION reading coprocessor 15 register 2
MMU 1st level descriptor table is at FFFFC000
Virtual | Physical | Descr | Description
address | address | flags |
----------+----------+---------+-----------------------------
00000000 | | | UNMAPPED
ffffffff | | | End of virtual address sp
richardt007 said:
Haret starts, but prints out the message "Exception reading coprocessor 15 register .." I can connect to Haret on port 9999 and can issue some commands like "dump mmu" but there's not much info there...:
Click to expand...
Click to collapse
Then you need to sign haret with the "priviledged certificate". Read more here:
http://forum.xda-developers.com/viewtopic.php?t=30399&start=0
Can you tell me how to do that in a little more detail than what's described in the thread? I managed to compile the latest haret.exe using wine and the msvc package. Do I need to alter the asm-files (and which one?) with the code-snippet in that thread or is it a little more complicated than that? Would like to contribute though...
richardt007 said:
Can you tell me how to do that in a little more detail than what's described in the thread?
Click to expand...
Click to collapse
No, it seems that you don't need to change anything, only to sign the executable.
Don't ask me how, i don't know exactly
I've tried makecert.exe with wine-0.9.1 and
it works. You should look into the archives
on this site or read the microsoft documentation.
cr2 said:
Don't ask me how, i don't know exactly
Click to expand...
Click to collapse
There is an explanation now at the end of this
thread.
I managed to get some output from haret, although don't know the validity of the output.
1. I had to modify the asmstuff.asm to include the cp_0, cp_2 and cp_13 calls in order to get rid of the exception ( GetLastError returned 120=ERROR_CALL_NOT_IMPLEMENTED)
2. Called the cp_2 from _cpu_get_cp.
3. Signed the executable using signcode.exe from the Smartphone 2003 SDK (have no clue if this was needed at all)
Here is some output from the output, can somebody help out to interpret it?
Code:
HaRET(3)# dump gpio
GPIO# D S A INTER | GPIO# D S A INTER | GPIO# D S A INTER | GPIO# D S A INTER
------------------+-------------------+-------------------+------------------
0 O 1 0 | 21 I 0 0 | 42 O 0 0 | 63 O 0 2
1 O 0 0 | 22 I 0 0 | 43 I 0 0 | 64 I 0 0
2 I 1 0 | 23 I 0 0 | 44 I 0 0 | 65 I 0 2 FE
3 I 0 0 | 24 I 0 0 | 45 I 0 0 | 66 I 0 3
4 I 0 0 | 25 I 0 0 | 46 I 0 0 | 67 I 0 3
5 I 0 0 | 26 I 0 0 | 47 O 0 0 | 68 I 0 3
6 I 0 0 | 27 I 0 0 | 48 I 0 0 | 69 I 0 1
7 I 0 0 | 28 I 0 0 | 49 I 0 2 | 70 I 0 0
8 I 0 0 | 29 I 0 0 | 50 I 0 3 | 71 I 0 2
9 I 0 0 | 30 I 0 0 | 51 O 0 3 | 72 I 0 0
10 I 0 0 | 31 I 0 0 | 52 O 0 3 | 73 I 0 2
11 I 0 0 | 32 I 0 0 FE | 53 O 0 1 | 74 I 0 3
12 I 0 0 | 33 I 1 0 | 54 O 0 0 | 75 I 0 3
13 I 0 0 | 34 I 0 0 FE | 55 O 0 2 | 76 I 0 3
14 I 0 0 | 35 O 0 0 | 56 O 0 0 | 77 I 0 1
15 I 0 0 | 36 O 0 0 | 57 O 0 2 | 78 I 0 0
16 I 0 3 | 37 O 0 0 | 58 O 0 3 | 79 I 0 2
17 I 0 3 | 38 O 0 0 | 59 I 0 3 | 80 I 0 0
18 I 0 3 | 39 O 0 0 | 60 I 0 3 | 81 I 0 2
19 I 0 1 | 40 O 0 0 | 61 I 0 1 | 82 I 0 3
20 I 0 0 | 41 O 0 0 | 62 I 0 0 | 83 I 0 3
Code:
HaRET(2)# print "%x" VRAM
20001020
Dump mmu gives a lot of lines, have no idea what the most relevant part of it is, so here a snippet:
Code:
HaRET(7)# dump mmu
----- Virtual address map -----
Descriptor flags legend:
C: Cacheable
B: Bufferable
0..3: Access Permissions (for up to 4 slices):
0: Supervisor mode Read
1: Supervisor mode Read/Write
2: User mode Read
3: User mode Read/Write
MMU 1st level descriptor table is at 10360000
Virtual | Physical | Descr | Description
address | address | flags |
----------+----------+---------+-----------------------------
00000000 | | | UNMAPPED
02000000 | | | UNMAPPED
02101000 | 10463000 | CB0000 | Small page (4K)
...
...
29fff000 | 12b4b000 | CB3 | Small page (4K)
2a000000 | | | UNMAPPED
Then it stops, with the progress bar somewhere at 40%. had to give it a soft reset. So what's the next step...?
richardt007 said:
I managed to get some output from haret, although don't know the validity of the output.
Here is some output from the output, can somebody help out to interpret it?
Click to expand...
Click to collapse
I have looked in the docs, wizard has TI OMAP processor, and haret 'gpio' knows only about
PXA. So , this table is probably useless.
Code:
HaRET(2)# print "%x" VRAM
20001020
From omap730.h:
#define OMAP730_SRAM_START 0x20000000
So your VRAM is in the OMAP built-in SRAM.
Code:
HaRET(7)# dump mmu
MMU 1st level descriptor table is at 10360000
Your RAM starts at 0x10000000.
At least 4MB for the kernel & stuff.
Code:
Virtual | Physical | Descr | Description
address | address | flags |
----------+----------+---------+-----------------------------
02101000 | 10463000 | CB0000 | Small page (4K)
The page in RAM mapped for some system purposes.
Then it stops, with the progress bar somewhere at 40%. had to give it a soft reset.
Click to expand...
Click to collapse
It's normal, "dump mmu" in haret is buggy
So what's the next step...?
Click to expand...
Click to collapse
It is interesting to find out where is your ROM mapped.
You can also sign the itsutils and try to dump the memory with these tools.
Read the linux-omap documentation and code
and dump the OMAP registers. You can also
try to find out from the wince dlls what other
chips are used in this phone.
You can also sign the itsutils and try to dump the memory with these tools.
Click to expand...
Click to collapse
Signing itsutils was not enough unfortunately, as I had to change the security policy (policy ID=4097) from 1 to 2 to allow RAPI calls.
(see http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnppcgen/html/wmdeploy.asp)
After that, itsutils ran like a charm:
Code:
c:\src\itsutils\build>pmemmap
v82000000-83000000 -> p00000000-01000000
v8a000000-8a400000 -> p13c00000-14000000
v8c000000-8fc00000 -> p10000000-13c00000
v90000000-90100000 -> p20000000-20100000
v98000000-98100000 -> pfff00000-00000000 (huh?)
v98100000-98200000 -> p04000000-04100000
v98400000-98500000 -> p06000000-06100000
v98500000-98600000 -> p40000000-40100000
A simple process list, 'pps -t' showed _alot_ of .dll's being used (mainly by device.exe, naturally)
Code:
c:\src\itsutils\build>pps
handle n base kern user heap exe
0ddf5fba 5 20000000 0.0 8.2 0 rapiclnt -drndis_peer
0dfb5706 2 0e000000 0.0 0.0 0 elatepushservice.exe
0dfdf8ce 11 1a000000 0.0 0.5 0 repllog.exe /sched /remote /h
0e0f03ba 2 10000000 0.0 0.0 0 sddaemon.exe
0fbb4002 2 c2000000 0.0 0.0 0 NK.EXE
2e0a2402 8 14000000 0.0 0.0 0 srvtrust.exe 80
4de65d06 10 18000000 0.0 0.0 0 cprog.exe -n
4e3767c2 10 08000000 0.0 2.1 0 shell32.exe 50
6fba4bfa 12 04000000 0.0 37.8 0 filesys.exe
8dfb56e2 2 1c000000 0.0 0.0 0 PowerTray.exe
8e91ce1a 107 06000000 0.0 1.8 0 device.exe 20
adf78e9e 1 1e000000 0.0 0.0 0 WiFiTray.exe
ae0b6dc2 11 12000000 0.0 0.0 0 connmgr.exe 70
ae54049a 15 0a000000 0.0 0.0 0 gwes.exe 30
ce376c4a 20 0c000000 0.0 0.0 0 services.exe 60
edc4dd32 9 22000000 0.0 0.0 0 tmail.exe -RunInBKG
ee040e02 1 16000000 0.0 0.0 0 poutlook.exe
0 ........ 0.0 50.4 0 total
The list of partitions is completely unclear to me:
Code:
c:\src\itsutils\build>pdocread -l
57.00M TrueFFS
| 3.06M Part00
| 2.88M Part01
| 51.06M Part02
48.23M TrueFFS
| 3.06M Part00
| 2.88M Part01
| 51.06M Part02
10.00M TRUEFFS
| 3.06M Part00
| 2.88M Part01
| 51.06M Part02
483.88M DSK1:
| 483.70M Part00
STRG handles: afb7d5fe
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
(483.70M) ce9ec2da
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 10.00M) 0eae8ede
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 48.23M) 0fb2bf42
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 fe 04 01 02 1c 32 08 ee 0d 07 05 4d
( 51.06M) efb2bd82
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 fe 04 01 02 1c 32 08 ee 0d 07 05 4d
( 2.88M) cfb2bd5e
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 fe 04 01 02 1c 32 08 ee 0d 07 05 4d
( 3.06M)
This machine has 128Mb of ROM, is there anyway I can read this using itsutils? pmemdump can successfully read only after 0x82000000 and prints out "Attempt to access invalid address"...
I dumped the first 16Megs after 0x82000000 and there's all kind of garbage, same like on the maui device. (marxx printed the first 8192 bytes in the above thread). Unfortunately, arm-wince-pe-objdump says "File format not recognized" on both dumps... What am I missing here?
richardt007 said:
arm-wince-pe-objdump says "File format not recognized" on both dumps... What am I missing here?
Click to expand...
Click to collapse
arm-wince-pe-objdump expects a PE binary, so
it is necessary to tell it that we have a raw binary dump.
arm-wince-pe-objdump -D -b binary -m arm dump.file
I have found this information about Linux
on HTC Typhoon:
http://vivien.chappelier.free.fr/typhoon/index.html
I was going to recomend a kernel built with omap 730 support, since the 850 seems to just be a 730 with edge. TI's site isn't to informational about the other circuits built into the omap850, or 730.
I have not been able to get the bootloader thing to do a single useful thing. I only get the tricolored screen. When pluged into the usb I get it saying usb in the corner. I set my mini sd up for the omap 730 image off the above site, but no dice.
My phone is the wiza 100 I beleive (cingular 8125).
YAY! PROGRESS! i will join you guys, when i find out more about how memory is organised. TI supports linux on the omap, maybe if we asked... :/
I never have any luck with the installing the damn toolchains, they never come with any instructions, or limited instructions. But I think I may have it. I nticed a lot of you are better coders and embedded developers than I I hope to learn a lot from you. Also, if there are any tutorials you can provide links to to help me learn, that would be perfect.
Hi there,
I am trying to get Linux running on a handheld which uses the HTC bootloader and it would be great if one of the gurus here could give me some hints about using IDA on the bootloader (to find out how buttons and USB are controlled).
The handheld is Dell Axim X50 (PXA270, big ASIC,some CPLD, beside that pretty standard)-for more hardware details take a look at: http://handhelds.org/moin/moin.cgi/DellAximX50
I already identified where the bootloader loads itself into RAM and configures and enables the MMU, I modified the available .idc script (for PXA2xx-regs) to show me nice synonymes instead of the raw register addresses. I traced a little bit through the code - but only seeing lots of operations on RAM addresses and very few (far too few IMO) and very general operations on processor registers doesn't help much. I expect that the register addresses are partly loaded from RAM instead of beeing hard coded.
So now to my question: is there a way to "copy" the into RAM loaded ROM parts in IDA? I mean so that IDA can actually find the data which is supposed to be in RAM right before MMU is enabled and that I can see references to the GPIO/ASIC/CPLD addresses and to the string data (which would greatly help in identifying the useful functions).
Thanks for any hints or advices!
pphoenixx said:
The handheld is Dell Axim X50 (PXA270, big ASIC,some CPLD, beside that pretty standard)-for more hardware details take a look at: http://handhelds.org/moin/moin.cgi/DellAximX50
Click to expand...
Click to collapse
Hi,
a lot of information can be obtained without any disassembling.
I'm curious, if have the "dump gpio" haret output somewhere ?
here you go:
http://www.bfamily.us/~richard/tmp/arm/gpio_map.xml
Code:
GPIO# D S A INTER | GPIO# D S A INTER | GPIO# D S A INTER | GPIO# D S A INTER
------------------+-------------------+-------------------+------------------
0 I 0 0 RE FE | 21 O 1 1 | 42 O 0 0 | 63 O 0 0
1 I 1 0 | 22 O 0 0 | 43 O 0 0 | 64 O 0 0
2 O 1 0 | 23 O 0 2 | 44 O 0 0 | 65 O 0 0
3 O 1 0 | 24 O 1 2 | 45 O 0 0 | 66 O 0 0
4 O 1 0 | 25 O 0 2 | 46 I 1 2 | 67 O 0 0
5 I 1 0 | 26 I 1 1 | 47 O 0 1 | 68 O 0 0
6 I 1 0 | 27 I 0 0 | 48 O 1 2 | 69 O 0 0
7 I 1 0 | 28 O 0 0 | 49 O 1 2 | 70 O 0 0
8 I 1 0 | 29 O 0 0 | 50 O 1 2 | 71 O 0 0
9 O 1 1 | 30 O 0 0 | 51 O 1 2 | 72 O 0 0
10 O 0 1 | 31 O 0 0 | 52 I 1 0 | 73 O 0 0
11 I 0 0 RE FE | 32 O 0 0 | 53 O 1 0 | 74 O 0 0
12 I 1 0 RE FE | 33 O 1 2 | 54 O 1 2 | 75 O 0 0
13 I 0 0 RE | 34 O 0 0 | 55 O 1 2 | 76 O 0 0
14 I 1 0 RE FE | 35 O 0 0 | 56 I 1 1 | 77 O 0 0
15 O 1 2 | 36 O 1 0 | 57 I 1 1 | 78 O 1 2
16 O 0 0 | 37 O 0 0 | 58 O 0 0 | 79 O 1 2
17 O 1 2 | 38 I 0 0 | 59 O 0 0 | 80 O 1 2
18 I 1 1 | 39 O 0 0 | 60 O 0 0 | 81 O 0 0
19 O 1 0 | 40 O 0 0 | 61 O 0 0 | 82 O 0 0
20 O 1 1 | 41 O 0 0 | 62 O 0 0 | 83 I 0 0 RE FE
There is already much accomplished - A 2.6.15-rc7 kernel boots without problem, working framebuffer and I can activate IRDA and use it for console.. everything directly connected to the PXA is no issue; the ASIC and CPLDs are my major problem right now - that's why I throw myself into disassembling.
pphoenixx said:
There is already much accomplished - A 2.6.15-rc7 kernel boots without problem, working framebuffer and I can activate IRDA and use it for console.. everything directly connected to the PXA is no issue; the ASIC and CPLDs are my major problem right now - that's why I throw myself into disassembling.
Click to expand...
Click to collapse
Ok. You are using PXA270 SDIO.
We are also moving forward, but have some problems with the framebuffer.
http://wiki.xda-developers.com/index.php?pagename=UniversalResearch
http://wiki.xda-developers.com/index.php?pagename=UniversalProgress
Do you know how the wifi chip is connected ? Is it on pcmcia ?
FYI, we have a weird CPLD too.
cr2 said:
Do you know how the wifi chip is connected ? Is it on pcmcia ?
FYI, we have a weird CPLD too.
Click to expand...
Click to collapse
well, looking at
Code:
HaRET(29)# pd 0x48000014 1
48000014 | 00000003 | ....
PC Card Is Present
This bit must be written by software when either PC Card is inserted into a
socket.
0 = No PC Card inserted
1 = PC Card inserted
0 R/W NOS
PC Card Interface Number of Sockets
0 = 1 socket
1 = 2 sockets
Click to expand...
Click to collapse
one could assume that at least something is sitting on pcmcia. and if I write a 0x0 in there - WIFI is suddenly gone while the device remains responsive (= hasn't crashed). So at least on the axim, I suppose it's on pcmcia.
pphoenixx said:
Code:
HaRET(29)# pd 0x48000014 1
48000014 | 00000003 | ....
Click to expand...
Click to collapse
The same here. But i can zero it while running over wlan.
Maybe you disabled something else and WIFI is connected via USB1.1 (try to disable USB)? or your WIFI chip is connected via socket 1 (which can't be disabled) - I tried to write a 0x1 in there (no PC CARD) and WIFI remained operational, it's only gone when I completly disabled socket2 (0x0).
It's pcmcia for sure on axim.
If you have the same driver, tiacxwln.dll Version: 2.0.53(NDIS)
Create an empty file: tiacxwln_testmode.txt and put it in your WINDOWS directory and soft-reboot -- on Axim, the driver looks for that file and if it exists the wifi hardware isn't claimed anymore (propably to easly test other drivers or launch special testmode drivers..). WinCE kicks in and recognizes an unknown networking device connected to PCMCIA socket 2.
pphoenixx said:
Create an empty file: tiacxwln_testmode.txt and put it in your WINDOWS directory and soft-reboot -- on Axim, the driver looks for that file and if it exists the wifi hardware isn't claimed anymore (propably to easly test other drivers or launch special testmode drivers..). WinCE kicks in and recognizes an unknown networking device connected to PCMCIA socket 2.
Click to expand...
Click to collapse
ACX100 is used by most PDAs through the PCMCIA (or SDIO) interface.
Unfortunately, the acx100.sf.net driver supports only pci and usb...
ACX100 could be partially initialized on HTC Blueangel, but it is not working yet.
-----
\Storage Card\tiacxwln_testmode.txt
\SD Card\tiacxwln_testmode.txt
\windows\tiacxwln_testmode.txt
Greetings everyone. I have been stuck in download mode for the past week or so and have been contemplating having my phone replaced. Since I need it for work.
I have tried flashing a ZV8 tot file via Flash Tools 1.8 but seem to be getting an error message
Download FAIL!! (15 sec)
[21:46:25] ## [ERROR] : Partition Change userdata Partition[21:46:25] ERROR: userdata Partition was Changed.
21:46:25] GPT Partition information.
[21:46:25] Idx | Part Name |
[21:46:25] 0 | modem | 32768 | - | 163839
[21:46:25] 1 | sbl1 | 163840 | - | 165887
[21:46:25] 2 | dbi | 165888 | - | 166911
[21:46:25] 3 | DDR | 196608 | - | 197631
[21:46:25] 4 | aboot | 229376 | - | 231423
[21:46:25] 5 | rpm | 231424 | - | 233471
[21:46:25] 6 | boot | 262144 | - | 294911
[21:46:25] 7 | tz | 294912 | - | 296959
[21:46:25] 8 | pad | 296960 | - | 296961
[21:46:25] 9 | modemst1 | 327680 | - | 333823
[21:46:25] 10 | modemst2 | 333824 | - | 339967
[21:46:25] 11 | pad1 | 339968 | - | 339969
[21:46:25] 12 | misc | 360448 | - | 393215 Skip
[21:46:25] 13 | persist | 393216 | - | 458751
[21:46:25] 14 | recovery | 458752 | - | 491519
[21:46:25] 15 | fsg | 491520 | - | 497663
[21:46:25] 16 | fsc | 524288 | - | 525311
[21:46:25] 17 | ssd | 525312 | - | 526335
[21:46:25] 18 | pad2 | 526336 | - | 526337
[21:46:25] 19 | encrypt | 526338 | - | 527361
[21:46:25] 20 | drm | 557056 | - | 573439
[21:46:25] 21 | sns | 573440 | - | 589823
[21:46:25] 22 | ve | 589824 | - | 622591
[21:46:25] 23 | laf | 622592 | - | 688127
[21:46:25] 24 | fota | 688128 | - | 753663
[21:46:25] 25 | mpt | 753664 | - | 819199 Erase
[21:46:25] 26 | carrier | 819200 | - | 884735 Erase
[21:46:25] 27 | eri | 884736 | - | 901119
[21:46:25] 28 | blus | 901120 | - | 905215
[21:46:25] 29 | dbibak | 905216 | - | 906239
[21:46:25] 30 | rpmbak | 906240 | - | 908287
[21:46:25] 31 | tzbak | 908288 | - | 910335
[21:46:25] 32 | rct | 910336 | - | 910351 Erase
[21:46:25] 33 | system | 917504 | - | 7733247
[21:46:25] 34 | cache | 7733248 | - | 9371647
[21:46:25] 35 | tombstones | 9371648 | - | 9535487
[21:46:25] 36 | spare | 9535488 | - | 9568255
[21:46:25] 37 | userdata | 9568256 | - | 61046783 Change
[21:46:25] LAF retrieveGPT() failed.
I'm unable to load any custom or stock recovery so adb commands are out so is fastboot. Also unable to restore to factory.
Though I'm able to use dd commands in ubuntu but my knowledge is very limited.
If anyone can point me in the right direction it would be greatly appreciated.
Been driving myself nuts..
Same Boat
Exact same story virtually, bricked black screen after a failed flash, msm bulk device or w/e. Flashed the correct partition in ubuntu, got device into fastboot loop. Pushed recovery ect to device via fastboot, download loop.
Recovery mode just goes to download mode also.
When device is plugged into computer cdc serial (androidnet modem) failed install.
Lg Flash tool gets to 16% and fails. LafPartitionChanged
Exactly the same issue
Greetings -- I have exactly the same problem on my D803 Puerto Rico (Claro) phone purchased on Amazon.com in the US.
The bug seems related to how the phone identifies as D801, but is in fact a D803.
Can't restore, can't flash, can't install firmware... Softbricked but dead G2.
I've started writing a letter to LG's support (PM me for link b/c I can't post URLs yet). Let me know if you're having similar issues (or if I missed any vital solution).
ZDuncanZ said:
Exact same story virtually, bricked black screen after a failed flash, msm bulk device or w/e. Flashed the correct partition in ubuntu, got device into fastboot loop. Pushed recovery ect to device via fastboot, download loop.
Recovery mode just goes to download mode also.
When device is plugged into computer cdc serial (androidnet modem) failed install.
Lg Flash tool gets to 16% and fails. LafPartitionChanged
Click to expand...
Click to collapse
How'd you solve it?
Hi guys,
I bricked my LG G2 D802 a while ago. I got continious bootloops when I turned the phone on and when i tried to get my phone in download mode it went in fastboot mode. So i found this ( uncle-yakuza.jouwweb.nl/lg-g2-fast-boot-menu-fix ) guide and downloaded the files and flashed the .laf and recovery.img and all went well. I got my phone in download mode. But when i tried to flash the stock rom, it could not finish and gave me an error.
I found out that the .laf and recovery.img I downloaded on that website were for a 32GB version of the D802 and mine is a 16GB.
I tried flashing the 32GB rom and the 16GB rom, both ways the tot way and the kdz way, but it ends up in an error.
I searched google but I couldn't find a sollution.
If i could only get in fastboot mode and flash the correct files.....
Can somebody please help me.
Use lg flashtool: http://forum.xda-developers.com/showthread.php?t=2797190
Sent from my LG-D802 using XDA Free mobile app
abbek1008 said:
Use lg flashtool: http://forum.xda-developers.com/showthread.php?t=2797190
Sent from my LG-D802 using XDA Free mobile app
Click to expand...
Click to collapse
Thnx, but i already tried that, both methods: the kdz method and the tot method.
I posted the log file of the tot method below:
[ 2:59: 8] ¡Ú Tool : 1, 5, 10, 1120 : C:\LG\LGFLASHTOOL\LGFLASHTOOL.EXE
[ 2:59: 8] ¡Ú DLL : 1.0.0.3 : C:\Users\H4K1M\Desktop\BIN files LG G2\LGD802_20130912_LGFLASHv160.dll
[ 2:59: 8] Process :
[ 2:59: 8] BIN : C:\Users\H4K1M\Desktop\BIN files LG G2\BIN_LGD802AT-00-V10a-425-02-SEP-05-2013-16G+0\BIN_LGD802AT-00-V10a-425-02-SEP-05-2013-16G+0.tot
[ 2:59: 8] SCR :
[ 2:59: 8] PRL : ;;;;;;;;;;
[ 2:59: 8] ERI :
[ 2:59: 8] + 1. Web Download Mode = -1
[ 2:59: 8] + 4. Web param-Bin Version =
[ 2:59: 8] Frmae Type : LGFlashTool
[ 2:59: 8] Load : 29 Total : 4094756KB Avail : 2873220KB
[ 2:59: 8] AvailPage : 3540452KB AvailVirtual : 1888004KB
[ 2:59: 8] Total/Free of C:\ : 429600 MB / 366508 MB
[ 2:59: 8]
¡Ú¡Ú¡Ú Factory Information ¡Ú¡Ú¡Ú
[ 2:59: 8] 1. Model Name : LG-D802
[ 2:59: 8] 2. SWV : LGD800AT-01-V10q-310-410-JAN-23-2014+0
[ 2:59: 8] 3. SWOV : LGD800AT-00-V10q-ATT-US-JAN-23-2014+0
[ 2:59: 8] 4. PID : BS10S130902000056
[ 2:59: 8] 5. IMEI : ***
[ 2:59: 8]
[ 2:59: 9] CBasicComControl::IsConnected, the port(COM41) connection is not detected
[ 2:59: 9] CBasicComControl:pen, the port(COM 41) is constructed successfully => HANDLE : 0x47c
[ 2:59: 9] CPort:penPort() Success. Port number is 41
[ 2:59: 9] ---------------------------------------------------------------------------------
[ 2:59: 9] SubProcess Name : NoOperationCmd
[ 2:59: 9] [T000004] 06 4E 95 7E .N..
[ 2:59:10] [R000004] 02 6A D3 7E .j..
[ 2:59:10] Current Process : PROCESS_FAC_UPGRADE
[ 2:59:10] Binary Path : C:\Users\H4K1M\Desktop\BIN files LG G2\BIN_LGD802AT-00-V10a-425-02-SEP-05-2013-16G+0\BIN_LGD802AT-00-V10a-425-02-SEP-05-2013-16G+0.tot
[ 2:59:10] Try opening C:\Users\H4K1M\Desktop\BIN files LG G2\BIN_LGD802AT-00-V10a-425-02-SEP-05-2013-16G+0\BIN_LGD802AT-00-V10a-425-02-SEP-05-2013-16G+0.tot file
[ 2:59:10] Crc32OfTot : 0x832D52B3
[ 2:59:10] Tot File length verify : PASS 2779250688 / 2779250688
[ 2:59:10] #### [EXTENDED SUPER BOOST] ####
[ 2:59:10] *****************************************************************************
[ 2:59:10] *- LG-D802 PartitionTable Info -*
[ 2:59:10] *- SW Version : D80210a
[ 2:59:10] *- SWFV : D802-APf81ffda9.1378380281-CP29b8647a.1378383744
[ 2:59:10] *- Build Type : user
[ 2:59:10] *- Binary Size: 2779250688 Bytes
[ 2:59:10] *****************************************************************************
[ 2:59:10] Index | Part Name | Start Sector | FileSize | No Of Sectors
[ 2:59:10] 0/ 0 | PrimaryGPT | 0x00000000 | 0x0000000000080000 | 0x00008000
[ 2:59:10] 0/ 1 | modem | 0x00008000 | 0x0000000003480000 | 0x00020000
[ 2:59:10] 0/ 2 | sbl1 | 0x00028000 | 0x0000000000080000 | 0x00000800
[ 2:59:10] 0/ 3 | dbi | 0x00028800 | 0x0000000000080000 | 0x0000F800
[ 2:59:10] 0/ 4 | aboot | 0x00038000 | 0x0000000000100000 | 0x00000800
[ 2:59:10] 0/ 5 | rpm | 0x00038800 | 0x0000000000080000 | 0x00007800
[ 2:59:10] 0/ 6 | boot | 0x00040000 | 0x0000000000A80000 | 0x00008000
[ 2:59:10] 0/ 7 | tz | 0x00048000 | 0x0000000000080000 | 0x00010000
[ 2:59:10] 0/ 8 | misc | 0x00058000 | 0x0000000000800000 | 0x00008000
[ 2:59:10] 0/ 9 | persist | 0x00060000 | 0x0000000000500000 | 0x00010000
[ 2:59:10] 0/ 10 | recovery | 0x00070000 | 0x0000000000C00000 | 0x00020000
[ 2:59:10] 0/ 11 | laf | 0x00090000 | 0x0000000000F80000 | 0x00038000
[ 2:59:10] 0/ 12 | system | 0x000C8000 | 0x0000000008000000 | 0x00040000
[ 2:59:10] 0/ 13 | system | 0x00108000 | 0x0000000000080000 | 0x00000588
[ 2:59:10] 0/ 14 | system | 0x00108588 | 0x0000000000080000 | 0x00000FD0
[ 2:59:10] 0/ 15 | system | 0x00109558 | 0x0000000007D80000 | 0x0003FA78
[ 2:59:10] 0/ 16 | system | 0x00148FD0 | 0x0000000007E80000 | 0x0003F5B8
[ 2:59:10] 0/ 17 | system | 0x00188588 | 0x0000000000080000 | 0x00000FD0
[ 2:59:10] 0/ 18 | system | 0x00189558 | 0x0000000007D80000 | 0x0003FA78
[ 2:59:10] 0/ 19 | system | 0x001C8FD0 | 0x0000000007E80000 | 0x0003F5B8
[ 2:59:10] 0/ 20 | system | 0x00208588 | 0x0000000000080000 | 0x00000FD0
[ 2:59:10] 0/ 21 | system | 0x00209558 | 0x0000000007D80000 | 0x0003FA78
[ 2:59:10] 0/ 22 | system | 0x00248FD0 | 0x0000000007E80000 | 0x0003F5B8
[ 2:59:10] 0/ 23 | system | 0x00288588 | 0x0000000000080000 | 0x00000FD0
[ 2:59:10] 0/ 24 | system | 0x00289558 | 0x0000000007D80000 | 0x0003FA78
[ 2:59:10] 0/ 25 | system | 0x002C8FD0 | 0x0000000007E80000 | 0x0003F5B8
[ 2:59:10] 0/ 26 | system | 0x00308588 | 0x0000000000080000 | 0x00000FD0
[ 2:59:10] 0/ 27 | system | 0x00309558 | 0x0000000007D80000 | 0x0003FA78
[ 2:59:10] 0/ 28 | system | 0x00348FD0 | 0x0000000007E80000 | 0x00040000
[ 2:59:10] 0/ 29 | system | 0x00388FD0 | 0x0000000007E80000 | 0x00040000
[ 2:59:10] 0/ 30 | system | 0x003C8FD0 | 0x0000000007E80000 | 0x00040000
[ 2:59:10] 0/ 31 | system | 0x00408FD0 | 0x0000000007E80000 | 0x00040000
[ 2:59:10] 0/ 32 | system | 0x00448FD0 | 0x0000000007E80000 | 0x00040000
[ 2:59:10] 0/ 33 | system | 0x00488FD0 | 0x0000000007E80000 | 0x00040000
[ 2:59:10] 0/ 34 | system | 0x004C8FD0 | 0x0000000007E80000 | 0x00040000
[ 2:59:10] 0/ 35 | system | 0x00508FD0 | 0x0000000007E80000 | 0x00040000
[ 2:59:10] 0/ 36 | system | 0x00548FD0 | 0x0000000007E80000 | 0x00040000
[ 2:59:10] 0/ 37 | system | 0x00588FD0 | 0x0000000004D00000 | 0x0003F030
[ 2:59:10] 0/ 38 | system | 0x005C8000 | 0x0000000000080000 | 0x00040000
[ 2:59:10] 0/ 39 | system | 0x00608000 | 0x0000000000080000 | 0x00028000
[ 2:59:10] 0/ 40 | cache | 0x00630000 | 0x0000000000C00000 | 0x00040000
[ 2:59:10] 0/ 41 | cache | 0x00670000 | 0x0000000000080000 | 0x00040000
[ 2:59:10] 0/ 42 | cache | 0x006B0000 | 0x0000000000080000 | 0x00040000
[ 2:59:10] 0/ 43 | cache | 0x006F0000 | 0x0000000000080000 | 0x00040000
[ 2:59:10] 0/ 44 | cache | 0x00730000 | 0x0000000000080000 | 0x00060000
[ 2:59:10] 0/ 45 | cust | 0x00790000 | 0x0000000002F00000 | 0x015C9C00
[ 2:59:10] 0/ 46 | BackupGPT | 0x01D59C00 | 0x0000000000080000 | 0x00000400
[ 2:59:10] InitDiag is success.
[ 2:59:10] InitializeProcess() is success.
[ 2:59:10] CComPort::ClosePort, Closed Port Successfully for COM 41
[ 2:59:10] CBasicComControl::Close, the port(COM41) is closed successfully
[ 2:59:11] Start Download
[ 2:59:11] Port is already closed
[ 2:59:11] Port Open 41
[ 2:59:11] [T000032] 48 45 4C 4F 01 00 00 01 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 4C 3F 00 00 B7 BA B3 B0 HELO....................L?......
[ 2:59:11] [R000032] 48 45 4C 4F 01 00 00 01 01 00 00 10 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 B7 BA B3 B0 HELO............................
[ 2:59:11] [T000032] 4F 50 45 4E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8E 36 00 00 B0 AF BA B1 OPEN.....................6......
[ 2:59:11] Queue is empty Waiting for Events
[ 2:59:11] [R000032] 4F 50 45 4E 0E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B0 AF BA B1 OPEN............................
[ 2:59:11] [T002856] 49 4E 46 4F 47 50 52 4F 00 00 00 00 00 00 00 00 00 00 00 00 08 0B 00 00 3D BC 00 00 B6 B1 B9 B0 INFOGPRO................=.......
[ 2:59:11] [R002856] 49 4E 46 4F 47 50 52 4F 00 00 00 00 00 00 00 00 00 00 00 00 08 0B 00 00 00 00 00 00 B6 B1 B9 B0 INFOGPRO........................
[ 2:59:11] prog size = 2824, receive size = 2824
[ 2:59:11] == PROPERTY INFO
[ 2:59:11] 1. download cable = USER
[ 2:59:11] 2. battery level = 14
[ 2:59:11] 3. download type =
[ 2:59:11] 4. download speed = 0
[ 2:59:11] 5. usb version = UHS
[ 2:59:11] 6. hardware revision = rev_10
[ 2:59:11] 7. download sw version =
[ 2:59:11] 8. device sw version = D80210b
[ 2:59:11] 9. secure device = S
[ 2:59:11] 10. laf sw version = 1.0
[ 2:59:11] 11. device factory version = LGD800AT-01-V10q-310-410-JAN-23-2014+0
[ 2:59:11] 12. device factory out version = LGD800AT-00-V10q-ATT-US-JAN-23-2014+0
[ 2:59:11] 13. pid = BS10S130902000056
[ 2:59:11] 14. imei = ***
[ 2:59:11] 15. model name = LG-D802
[ 2:59:11] 16. device build type = U
[ 2:59:11] 17. chipset platform = msm8974
[ 2:59:11] 18. target_operator = OPEN
[ 2:59:11] 19. target_country = COM
[ 2:59:11] 20. ap_factory_reset_status = 3
[ 2:59:11] 21. cp_factory_reset_status = 1
[ 2:59:11] 22. isDownloadNotFinish = 0
[ 2:59:11] 23. qem = 0
[ 2:59:11] 24. cupss swfv =
[ 2:59:11] 25. is one binary dual plan = 1
[ 2:59:11] 26. memroy size = 61071360
[ 2:59:11] 27. memory_id = 032G96
[ 2:59:11] LAF : Bin_User_Mode
[ 2:59:11] LAF : Bin_User_Mode
[ 2:59:11] CBasicFlash::isValidateSecureImage Device is a qfused.
[ 2:59:11] found sbl1 Partition for secure image check
[ 2:59:11] Secure Image
[ 2:59:11] found aboot Partition for secure image check
[ 2:59:11] Secure Image
[ 2:59:11] found rpm Partition for secure image check
[ 2:59:11] Secure Image
[ 2:59:11] found tz Partition for secure image check
[ 2:59:11] Secure Image
[ 2:59:11] QFUSE Status Check OK.
[ 2:59:11] Laf memory size: 32G!
[ 2:59:11] Memory size is not matched!
[ 2:59:11] Memory size: 32G, File name: BIN_LGD802AT-00-V10A-425-02-SEP-05-2013-16G+0.TOT
[ 2:59:11] [T000032] 43 4C 53 45 0E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 75 00 00 BC B3 AC BA CLSE....................xu......
[ 2:59:11] [R000032] 43 4C 53 45 0E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BC B3 AC BA CLSE............................
[ 2:59:11] *********************************************************************************************
[ 2:59:11] *********************************************************************************************
[ 2:59:11] Port Close
[ 2:59:12] Port Open 41
[ 2:59:12] Retry download 1 time(s)
[ 2:59:12] [T000032] 48 45 4C 4F 01 00 00 01 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 4C 3F 00 00 B7 BA B3 B0 HELO....................L?......
[ 2:59:13] [R000032] 48 45 4C 4F 01 00 00 01 01 00 00 10 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 B7 BA B3 B0 HELO............................
[ 2:59:13] [T000032] 4F 50 45 4E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8E 36 00 00 B0 AF BA B1 OPEN.....................6......
[ 2:59:13] Queue is empty Waiting for Events
[ 2:59:13] [R000032] 4F 50 45 4E 0E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B0 AF BA B1 OPEN............................
[ 2:59:13] [T002856] 49 4E 46 4F 47 50 52 4F 00 00 00 00 00 00 00 00 00 00 00 00 08 0B 00 00 12 86 00 00 B6 B1 B9 B0 INFOGPRO........................
[ 2:59:13] [R002856] 49 4E 46 4F 47 50 52 4F 00 00 00 00 00 00 00 00 00 00 00 00 08 0B 00 00 00 00 00 00 B6 B1 B9 B0 INFOGPRO........................
[ 2:59:13] prog size = 2824, receive size = 2824
[ 2:59:13] == PROPERTY INFO
[ 2:59:13] 1. download cable = USER
[ 2:59:13] 2. battery level = 14
[ 2:59:13] 3. download type =
[ 2:59:13] 4. download speed = 0
[ 2:59:13] 5. usb version = UHS
[ 2:59:13] 6. hardware revision = rev_10
[ 2:59:13] 7. download sw version =
[ 2:59:13] 8. device sw version = D80210b
[ 2:59:13] 9. secure device = S
[ 2:59:13] 10. laf sw version = 1.0
[ 2:59:13] 11. device factory version = LGD800AT-01-V10q-310-410-JAN-23-2014+0
[ 2:59:13] 12. device factory out version = LGD800AT-00-V10q-ATT-US-JAN-23-2014+0
[ 2:59:13] 13. pid = BS10S130902000056
[ 2:59:13] 14. imei = ***
[ 2:59:13] 15. model name = LG-D802
[ 2:59:13] 16. device build type = U
[ 2:59:13] 17. chipset platform = msm8974
[ 2:59:13] 18. target_operator = OPEN
[ 2:59:13] 19. target_country = COM
[ 2:59:13] 20. ap_factory_reset_status = 3
[ 2:59:13] 21. cp_factory_reset_status = 1
[ 2:59:13] 22. isDownloadNotFinish = 0
[ 2:59:13] 23. qem = 0
[ 2:59:13] 24. cupss swfv =
[ 2:59:13] 25. is one binary dual plan = 1
[ 2:59:13] 26. memroy size = 61071360
[ 2:59:13] 27. memory_id = 032G96
[ 2:59:13] LAF : Bin_User_Mode
[ 2:59:13] LAF : Bin_User_Mode
[ 2:59:13] CBasicFlash::isValidateSecureImage Device is a qfused.
[ 2:59:13] found sbl1 Partition for secure image check
[ 2:59:13] Secure Image
[ 2:59:13] found aboot Partition for secure image check
[ 2:59:13] Secure Image
[ 2:59:13] found rpm Partition for secure image check
[ 2:59:13] Secure Image
[ 2:59:13] found tz Partition for secure image check
[ 2:59:13] Secure Image
[ 2:59:13] QFUSE Status Check OK.
[ 2:59:13] Laf memory size: 32G!
[ 2:59:13] Memory size is not matched!
[ 2:59:13] Memory size: 32G, File name: BIN_LGD802AT-00-V10A-425-02-SEP-05-2013-16G+0.TOT
[ 2:59:13] [T000032] 43 4C 53 45 0E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 75 00 00 BC B3 AC BA CLSE....................xu......
[ 2:59:13] [R000032] 43 4C 53 45 0E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BC B3 AC BA CLSE............................
[ 2:59:13] *********************************************************************************************
[ 2:59:13] *********************************************************************************************
[ 2:59:13] Port Close
[ 2:59:14] Port Open 41
[ 2:59:14] Retry download 2 time(s)
[ 2:59:14] [T000032] 48 45 4C 4F 01 00 00 01 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 4C 3F 00 00 B7 BA B3 B0 HELO....................L?......
[ 2:59:14] [R000032] 48 45 4C 4F 01 00 00 01 01 00 00 10 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 B7 BA B3 B0 HELO............................
[ 2:59:14] [T000032] 4F 50 45 4E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8E 36 00 00 B0 AF BA B1 OPEN.....................6......
[ 2:59:14] Queue is empty Waiting for Events
[ 2:59:14] [R000032] 4F 50 45 4E 0E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B0 AF BA B1 OPEN............................
[ 2:59:14] [T002856] 49 4E 46 4F 47 50 52 4F 00 00 00 00 00 00 00 00 00 00 00 00 08 0B 00 00 13 47 00 00 B6 B1 B9 B0 INFOGPRO.................G......
[ 2:59:14] [R002856] 49 4E 46 4F 47 50 52 4F 00 00 00 00 00 00 00 00 00 00 00 00 08 0B 00 00 00 00 00 00 B6 B1 B9 B0 INFOGPRO........................
[ 2:59:14] prog size = 2824, receive size = 2824
[ 2:59:14] == PROPERTY INFO
[ 2:59:14] 1. download cable = USER
[ 2:59:14] 2. battery level = 14
[ 2:59:14] 3. download type =
[ 2:59:14] 4. download speed = 0
[ 2:59:14] 5. usb version = UHS
[ 2:59:14] 6. hardware revision = rev_10
[ 2:59:14] 7. download sw version =
[ 2:59:14] 8. device sw version = D80210b
[ 2:59:14] 9. secure device = S
[ 2:59:14] 10. laf sw version = 1.0
[ 2:59:14] 11. device factory version = LGD800AT-01-V10q-310-410-JAN-23-2014+0
[ 2:59:14] 12. device factory out version = LGD800AT-00-V10q-ATT-US-JAN-23-2014+0
[ 2:59:14] 13. pid = BS10S130902000056
[ 2:59:14] 14. imei = ***
[ 2:59:14] 15. model name = LG-D802
[ 2:59:14] 16. device build type = U
[ 2:59:14] 17. chipset platform = msm8974
[ 2:59:14] 18. target_operator = OPEN
[ 2:59:14] 19. target_country = COM
[ 2:59:14] 20. ap_factory_reset_status = 3
[ 2:59:14] 21. cp_factory_reset_status = 1
[ 2:59:14] 22. isDownloadNotFinish = 0
[ 2:59:14] 23. qem = 0
[ 2:59:14] 24. cupss swfv =
[ 2:59:14] 25. is one binary dual plan = 1
[ 2:59:14] 26. memroy size = 61071360
[ 2:59:14] 27. memory_id = 032G96
[ 2:59:14] LAF : Bin_User_Mode
[ 2:59:14] LAF : Bin_User_Mode
[ 2:59:14] CBasicFlash::isValidateSecureImage Device is a qfused.
[ 2:59:14] found sbl1 Partition for secure image check
[ 2:59:14] Secure Image
[ 2:59:14] found aboot Partition for secure image check
[ 2:59:14] Secure Image
[ 2:59:14] found rpm Partition for secure image check
[ 2:59:14] Secure Image
[ 2:59:14] found tz Partition for secure image check
[ 2:59:14] Secure Image
[ 2:59:14] QFUSE Status Check OK.
[ 2:59:14] Laf memory size: 32G!
[ 2:59:14] Memory size is not matched!
[ 2:59:14] Memory size: 32G, File name: BIN_LGD802AT-00-V10A-425-02-SEP-05-2013-16G+0.TOT
[ 2:59:14] [T000032] 43 4C 53 45 0E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 75 00 00 BC B3 AC BA CLSE....................xu......
[ 2:59:14] [R000032] 43 4C 53 45 0E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BC B3 AC BA CLSE............................
[ 2:59:14] *********************************************************************************************
[ 2:59:14] *********************************************************************************************
[ 2:59:19] [T000038] 45 58 45 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 F0 35 00 00 BA A7 BA BC EXEC.....................5......
64 6D 65 73 67 00 dmesg.
[ 2:59:19] [R000032] 45 58 45 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BA A7 BA BC EXEC............................
[ 2:59:19] Port Close
[ 2:59:20] RefurbishProcess() Error.
[ 2:59:20] ¡Ú¡Ú ERROR REASON : LAF_ERROR_INVALID_LAF_PROTOCOL
[ 2:59:20] CBasicComControl::IsConnected, the port(COM41) connection is not detected
[ 2:59:20] RunProcess() is fail.
[ 2:59:20] CBasicComControl::IsConnected, the port(COM41) connection is not detected
[ 2:59:20] [ 2:59:14] Memory size: 32G, File name: BIN_LGD802AT-00-V10A-425-02-SEP-05-2013-16G+0.TOT
[ 2:59:20] DoDownload() Exception
Flash the correct images in fastboot.
_____________________________________Read more write less and be smart
siggey said:
Flash the correct images in fastboot.
_____________________________________Read more write less and be smart
Click to expand...
Click to collapse
Hi siggey,
I can't get in to fastboot. The phone goes in download mode only.
If somebody knows a way how to get in to fasrboot, please let me know. So i can flash the right images.