[APOLLO]Direct eMMC access - Kindle Fire HDX 7" & 8.9" General

Hi. I finished the study of direct eMMC flash access on 8.9" 3rd gen tablet. This is particularly necessary in the case when the tablet is bricked.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
This instruction requires precise and accurate execution including soldering small SMD components. Many difficult operation for the average user.
The method is similar to shown in this topic http://forum.xda-developers.com/fire-tv/general/hardware-root-via-emmc-chip-t2885344.
I have found the necessary pads for soldering wires from the adapter.
I use only DAT0,CMD, CLK and GND wires.
Attention: You need special mmc adapter which use 1.8v SDIO
Also I found how to block CPU from running to take proper access to CLK line, simply remove the voltage from the crystal oscillator.
Now I have full access to onboard eMMC and see all partitions.
parted /dev/sde
GNU Parted 3.1
Using /dev/sde
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) print free
Model: Generic- SD/MMC (scsi)
Disk /dev/sde: 31.9GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags:
Number Start End Size File system Name Flags
4096B 67.1MB 67.1MB Free Space
1 67.1MB 134MB 67.1MB fat16 modem
2 134MB 135MB 524kB sbl1
3 135MB 135MB 32.8kB dbi
135MB 201MB 66.6MB Free Space
4 201MB 201MB 32.8kB DDR
201MB 268MB 67.1MB Free Space
5 268MB 268MB 2048B misc
6 268MB 271MB 2097kB aboot
7 271MB 271MB 512kB rpm
271MB 336MB 64.5MB Free Space
8 336MB 346MB 10.5MB boot
346MB 403MB 56.6MB Free Space
9 403MB 403MB 512kB tz
10 403MB 404MB 1049kB pad
11 404MB 406MB 1573kB modemst1
12 406MB 407MB 1573kB modemst2
407MB 470MB 62.4MB Free Space
13 470MB 471MB 1573kB fsg
471MB 537MB 65.5MB Free Space
14 537MB 537MB 1024B fsc
15 537MB 537MB 8192B ssd
537MB 604MB 67.1MB Free Space
16 604MB 614MB 10.5MB dkernel
17 614MB 749MB 134MB ext4 dfs
18 749MB 759MB 10.5MB recovery
19 759MB 793MB 33.6MB ext4 persist
20 793MB 826MB 33.6MB ext4 persistbackup
21 826MB 1900MB 1074MB ext4 cache
22 1900MB 3209MB 1309MB ext4 system
23 3209MB 31.9GB 28.7GB ext4 userdata
31.9GB 31.9GB 13.3kB Free Space
Now I searching way how to unbrick my tablet

finally someone found how to direct emmc access from pcb
need more detail, and how to solder xtal to resistor ??

MaximilianOzora said:
finally someone found how to direct emmc access from pcb
need more detail, and how to solder xtal to resistor ??
Click to expand...
Click to collapse
Original step-by-step instruction here: 4pda.ru/forum/index.php?showtopic=509786&st=780#entry44555049
Translate it to read.

Any progress on this, mine is a paper weight...lol
Sent from my SM-N920T using Tapatalk

It‘s very grade. I think if you can flash the data ,like the system data, YOU can solve all the soft brike.
I is any guy can find some way to flash the data?

bournezhang said:
It‘s very grade. I think if you can flash the data ,like the system data, YOU can solve all the soft brike.
I is any guy can find some way to flash the data?
Click to expand...
Click to collapse
I do it already.
Finally I use 6 lines to connect to mother board: DAT0, CMD,CLK, +3.3v, +1.8v, GND.
I read and write eMMC via custom MMC adapter with voltage level shifter.
But my apollo work only 30 minutes and go to reboot.
You can translate and read my original post: http://4pda.ru/forum/index.php?showtopic=509786&st=800#entry45388337
I think that power controller damaged and replaced by previuos customer.
And some words about soft brick: if you have bricked tablet recovery is possible if you didn't lost some partitions e.g. persist, persistbackup, because these partitions have encrypted info about HW components.
Now I need for new mother board, may be anyone have it from bricked or craked apollo?

I hope anyone can provide detail steps about how to flash the img
thank you very much for helping so many guys like me whose kindle fire become a brick

bournezhang said:
I hope anyone can provide detail steps about how to flash the img
thank you very much for helping so many guys like me whose kindle fire become a brick
Click to expand...
Click to collapse
Read #1 post about used hardware and pcb connections.
I use linux live cd and dd command:
to read from MMC use "dd if=/dev/your_drive of=/path_to_save/dd_copy_full.img"
to write to MMC use "dd if=/path_to_save/dd_copy_full.img of=/dev/your_drive bs=1M"

Off topic a little but my Apollo is bricked from doing a factory reset in safestrap.
If I were to replace the motherboard would that work to fix it?
Thanks
Sent from my SM-N920T using Tapatalk

donharden2002 said:
Off topic a little but my Apollo is bricked from doing a factory reset in safestrap.
If I were to replace the motherboard would that work to fix it?
Thanks
Sent from my SM-N920T using Tapatalk
Click to expand...
Click to collapse
Yes, if you replace to new board (which not bricked) your kindle would work. I test this: put my working board to backcase and screen from bricked apollo and it work.
If you interesting you can use my instruction to read mmc content and you can check partitons and read full image or files from chip. But if you bricked to QHSUSB_BULK 9008 you need generate proper files to wrire. Sorry I can't help with it because my bricked board now damaged.

ivan_nik said:
Yes, if you replace to new board (which not bricked) your kindle would work. I test this: put my working board to backcase and screen from bricked apollo and it work.
If you interesting you can use my instruction to read mmc content and you can check partitons and read full image or files from chip. But if you bricked to QHSUSB_BULK 9008 you need generate proper files to wrire. Sorry I can't help with it because my bricked board now damaged.
Click to expand...
Click to collapse
Thank you for your reply. Just ordered one from ifixit.
Sent from my SM-N920T using Tapatalk

ivan_nik said:
Yes, if you replace to new board (which not bricked) your kindle would work. I test this: put my working board to backcase and screen from bricked apollo and it work.
If you interesting you can use my instruction to read mmc content and you can check partitons and read full image or files from chip. But if you bricked to QHSUSB_BULK 9008 you need generate proper files to wrire. Sorry I can't help with it because my bricked board now damaged.
Click to expand...
Click to collapse
it seems has a little risk if follow this step.
I still want to wait any guy can find a better way that don't have to disassemble it

Anyone please can share with use the file that we can flash on the EMMC? I just want to know if I can flash all the partition or some of them via this method so the tablet work again, I've been waiting for this for so long (more than a year now... I've found previously a thread here where some did flash some of the boot files but no one answered how they did it or at least uploaded the files that allow us to do the same (I don't have access to another tablet), I am offering a brand new cover to the one who put enough details to revive this tablet.

neoroid said:
Anyone please can share with use the file that we can flash on the EMMC? I just want to know if I can flash all the partition or some of them via this method so the tablet work again, I've been waiting for this for so long (more than a year now... I've found previously a thread here where some did flash some of the boot files but no one answered how they did it or at least uploaded the files that allow us to do the same (I don't have access to another tablet), I am offering a brand new cover to the one who put enough details to revive this tablet.
Click to expand...
Click to collapse
Related conversation here (posts 47-50).

ivan_nik said:
Hi. I finished the study of direct eMMC flash access on 8.9" 3rd gen tablet. This is particularly necessary in the case when the tablet is bricked.
This instruction requires precise and accurate execution including soldering small SMD components. Many difficult operation for the average user.
The method is similar to shown in this topic http://forum.xda-developers.com/fire-tv/general/hardware-root-via-emmc-chip-t2885344.
I have found the necessary pads for soldering wires from the adapter.
I use only DAT0,CMD, CLK and GND wires.
Attention: You need special mmc adapter which use 1.8v SDIO
Also I found how to block CPU from running to take proper access to CLK line, simply remove the voltage from the crystal oscillator.
Now I have full access to onboard eMMC and see all partitions.
parted /dev/sde
GNU Parted 3.1
Using /dev/sde
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) print free
Model: Generic- SD/MMC (scsi)
Disk /dev/sde: 31.9GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags:
Number Start End Size File system Name Flags
4096B 67.1MB 67.1MB Free Space
1 67.1MB 134MB 67.1MB fat16 modem
2 134MB 135MB 524kB sbl1
3 135MB 135MB 32.8kB dbi
135MB 201MB 66.6MB Free Space
4 201MB 201MB 32.8kB DDR
201MB 268MB 67.1MB Free Space
5 268MB 268MB 2048B misc
6 268MB 271MB 2097kB aboot
7 271MB 271MB 512kB rpm
271MB 336MB 64.5MB Free Space
8 336MB 346MB 10.5MB boot
346MB 403MB 56.6MB Free Space
9 403MB 403MB 512kB tz
10 403MB 404MB 1049kB pad
11 404MB 406MB 1573kB modemst1
12 406MB 407MB 1573kB modemst2
407MB 470MB 62.4MB Free Space
13 470MB 471MB 1573kB fsg
471MB 537MB 65.5MB Free Space
14 537MB 537MB 1024B fsc
15 537MB 537MB 8192B ssd
537MB 604MB 67.1MB Free Space
16 604MB 614MB 10.5MB dkernel
17 614MB 749MB 134MB ext4 dfs
18 749MB 759MB 10.5MB recovery
19 759MB 793MB 33.6MB ext4 persist
20 793MB 826MB 33.6MB ext4 persistbackup
21 826MB 1900MB 1074MB ext4 cache
22 1900MB 3209MB 1309MB ext4 system
23 3209MB 31.9GB 28.7GB ext4 userdata
31.9GB 31.9GB 13.3kB Free Space
Now I searching way how to unbrick my tablet
Click to expand...
Click to collapse
I've read about this before, but that was before I managed to brick
one of my test devices. Now, all of a sudden this became even more
interesting, but it also seems unnecessarily complicated.
Given that an HDX with a broken bootloader(aboot) will enter
'Emergency Download Mode' and expose all of its partitions
as USB Storage, doing all the work to read/write using an
external device feels like overkill.
All I need is to glitch a bit (any 1 bit) during the time the CPU
tries load 'aboot' during the boot process. BUT, timing needs
to be [approximately] right: the earlier stages (including sbl1)
do have to load correctly...
Can anyone comment on the simplest setup to achieve just
that (no less, no more ). If I have to, I will look more into
the protocol and try to borrow an oscilloscope to figure
this out myself, but if someone already has this hooked up
and is able to identify the necessary timing, getting a bit
(or bits) to flip at the right time could be achieved with
a lot less effort... (Or, so I hope...)
Any input on this would be very much appreciated!

Not 100% related but might help you. There where a couple of methods for unbricking the HDX with QDLoader 9008 detected after bricking.
https://forum.xda-developers.com/ki...-to-unbrick-kindle-fire-hdx-firmware-t3277197
https://forum.xda-developers.com/showthread.php?t=2795602
They where for older firmware <=1314.3.2.6 that used a leaked "emmcbld.mbn" file.
I've a bricked HDX 7 motherboard from December that shows as an unknown device when connected to the battery, however when battery unplugged it shows as connects as a HS-USB Qdloader 9008 and I can connect to it on com port 3 using MiFlash. But because the only emmcbld.mbn we have which i assume has partition info is outdated it's not possible to flash a recovery.
I also have completely bricked HDX 8.9 Appollo, I bought it bricked ( for 20 euro ) and don't know how it got bricked. It is not detected when connected using a normal usb, however using a fastboot cable with battery unplugged it is also detected as HS-USB Qdloader 9008 and can be connected using Miflash but again not flashed to because of the emmcbld.mbn
Qdloader 9008 on other devices are recoverable and the are recoverable on the HDX with older firmware but we need a emmcbld.mbn related to a modern firmware preferably 4.5.5.2 or another way to write from Miflash

Thanks anyway!
Mr McBoatface said:
Not 100% related but might help you. There where a couple of methods for unbricking the HDX with QDLoader 9008 detected after bricking.
https://forum.xda-developers.com/ki...-to-unbrick-kindle-fire-hdx-firmware-t3277197
https://forum.xda-developers.com/showthread.php?t=2795602
They where for older firmware <=1314.3.2.6 that used a leaked "emmcbld.mbn" file.
I've a bricked HDX 7 motherboard from December that shows as an unknown device when connected to the battery, however when battery unplugged it shows as connects as a HS-USB Qdloader 9008 and I can connect to it on com port 3 using MiFlash. But because the only emmcbld.mbn we have which i assume has partition info is outdated it's not possible to flash a recovery.
I also have completely bricked HDX 8.9 Appollo, I bought it bricked ( for 20 euro ) and don't know how it got bricked. It is not detected when connected using a normal usb, however using a fastboot cable with battery unplugged it is also detected as HS-USB Qdloader 9008 and can be connected using Miflash but again not flashed to because of the emmcbld.mbn
Qdloader 9008 on other devices are recoverable and the are recoverable on the HDX with older firmware but we need a emmcbld.mbn related to a modern firmware preferably 4.5.5.2 or another way to write from Miflash
Click to expand...
Click to collapse
Well... I'd say the above is 100% unrelated
(and, for me, completely useless) info,
but I still thank you for the effort! (-;
Unfortunately, this device shows zero
activity on USB, which is part of the reason
why I need a simpler variant of this HW hack.
I know exactly how I bricked this HDX,
why it doesn't work, and -as outline above-
I have a reasonably clear idea about how
I might be able to revive it.
Of course, I do understand that the number of
people out there who have attempted this
*and* among those brave souls the ones that
still have a device hooked up and can provide
the desired timing measurements with little
hassle is severely limited... but, I don't have
anything to lose by asking (except for the time
it takes to write these messages), I thought I'd
give it a chance anyways...
If I have to do all that work, it'll take quite a while... (-;

No problem
Like I said my HDX 8.9 shows nothing when connected via a standard usb but with a fastboot cable it loads as a HS-USB Qdloader 9008 device. Might be something you could check if you have one available. It might open an easier avenue to attempt to glitch a bit assuming you could write to the Qdloader 9008.

Mr McBoatface said:
No problem
Like I said my HDX 8.9 shows nothing when connected via a standard usb but with a fastboot cable it loads as a HS-USB Qdloader 9008 device. Might be something you could check if you have one available. It might open an easier avenue to attempt to glitch a bit assuming you could write to the Qdloader 9008.
Click to expand...
Click to collapse
Well... I don't have a specific fastboot cable; so, that's beyond my reach right now,
but I might try with the standard cable and battery unplugged to see if that makes
a difference. I need to open that HDX anyways...

Well I hope you manage to find a solution to your brick. I've not had much luck myself, I had read that AFtool 4.8.0 had the ability to format and upgrade any Qdloader 9008 but couldn't find much information on it.

Related

Corrupt partition table or fried emmc?

Hi Guys,
I've been researching about this topic now for quite a while, but i am still not certain, whether if the eMMC of my DZ is fried..
Story is as follows:
Just rooted my newly bought DZ (lost my old one )using downgrade, then gfree, everything went fine so far.
After that i went to recovery, flashed virtuous affinity and rebooted. I gave it time to boot, but it got stuck on the "loading initial setup" screen (waited patiently about 20 mins or so). I thought it would be no big deal to pull the battery and let it boot again (Did this with my previous DZ numerous times and all was fine)
On second boot nothing happened, so i checked recovery and saw that the /data and /cache were obviously corrupt. Formatting was not possible by any means, neither by the tools in recovery, nor through flashing superwipe.
I can confirm that my eMMC is one of those possible faulty M4G2DE, see: http://forum.xda-developers.com/showthread.php?t=1039504&highlight=can+t+format&page=3
But it is mentioned in the thread, that it could be either a faulty chip or a defective partition table, which should be possible to rebuild either with a RUU or by adb shell:
Code:
mke2fs -t -ext3 /dev/block/mmcblk0p27
It was also mentioned to check whether
Code:
cat /proc/kmsg | grep mmc0
would say anything about an initialization error, which is not the case for me:
Code:
cat /proc/kmsg | grep mmc0
<3>[ 7.565124] mmc0: No card detect facilities available
<6>[ 7.565765] mmc0: Qualcomm MSM SDCC at 0x00000000a0500000 irq 98,0 dma 7
<6>[ 7.565917] mmc0: Platform slot type: MMC
<6>[ 7.566162] mmc0: 4 bit data mode disabled
<6>[ 7.566284] mmc0: 8 bit data mode enabled
<6>[ 7.566528] mmc0: MMC clock 144000 -> 50000000 Hz, PCLK 96000000 Hz
<6>[ 7.566680] mmc0: Slot eject status = 0
<6>[ 7.566802] mmc0: Power save feature enable = 1
<6>[ 7.567077] mmc0: DM non-cached buffer at ffa0c000, dma_addr 0x2a924000
<6>[ 7.567199] mmc0: DM cmd busaddr 0x2a924000, cmdptr busaddr 0x2a924300
<6>[ 7.723022] mmc0: new high speed MMC card at address 0001
<6>[ 7.724884] mmcblk0: mmc0:0001 M4G2DE 2.10 GiB
I know, from this point, being unable to do a RUU, nor flash a PC10IMG.zio via fastboot, nor recreate partitions in any other way, would suggest that the eMMC is fried and i should see that i send it in for repair.
BUT
I came across this:
http://tjworld.net/wiki/Android/HTC/Vision/EmmcPartitioning
Basically he is saying, that the hboot is trying to create an extended partition on the end of the blocks, if unallocated blocks are still available this should do no harm. But if the disk is fully partitioned, it simply overflows and creates the partittion at the beginning of the disk. According to that, this causes the usual tools to be unable to reformat the disk, because they get stuck in the same overflow.
He mentions a way to fix this, by unallocating the last partition, but i am not sure how this could be done.
Can the hboot be the problem? The new DZ runs eng hboot 84.2000, on my old one i used to have the normal pvt ship (see sig)
Maybe some of you would like to help me think
And maybe we can find a solution for some of the fried eMMC's
Hi Xadro
unfortunatly i have currently exactly the same problem. I can't manage to format the system partition (mmcblk0p25) and the cache partition (mmcblk0p27).
Do got any solution for it?
Thx in advance
Chris
Small update:
I managed to format each in 4EXT with tools formating to use ext3. Now my info is showing me the attatched screeni. Before that he crashed everytime when I opend that view and system and cache was ext4 but also without size values.
Kind of an awkward way of thinking, but... I see that you have a 32GB Sd Card.
Could that have any link to your problem?
Mhh dont know. Shouldn't as i never had problems before.
My target was to use Android Revolution HD 7.0.2 and I may should add the whole story in short form:
followed http://forum.xda-developers.com/showthread.php?t=1178912 to do a downgrade -> worked perfectly
followed the rest of http://forum.xda-developers.com/wiki/HTC_Vision#Rooting_the_Vision_.28G2.2FDZ.29_and_DHD to gain perm root until step 7. -> worked perfectly
used http://forum.xda-developers.com/showthread.php?t=1493404 to gain a new rom
it was written to use 4EXT -> so installed what worked and also the info was displaying the correct sizes
applied ZIP and restarted -> waited 30min but only boot animation was displayed and after some time it restarted -> boot loop
applied the ZIP again -> same result
found in http://forum.xda-developers.com/showthread.php?t=840040 to load SuperWipe...what i did and it reformated worked with out error
applied ZIP again
didn't started anymore -> stucked there
During all the restartings it can be that i may interrupt some important "reallocating" of partitions...but not sure.
But I can try replace the SD with the original one. But not thinking that it is a problem, cause it is normal accessable :/
Any way big thanks for trying to help me!
try a fastboot wipe, cleaner than even your best superwipe - then when you pick a rom to flash pick an old tried and true like the stable cm7 or miui.us
Hi,
unfortunatly that didn't worked
if I start "fastboot erase system -w" (i think you ment that) he just writing "erasing 'system'..." and just stops there. my phone is displaying the whole time the fastboot white screen, but i can't do anything there anymore (vol up/down...). I waitet 2h...only could remove battery
I realy appresiate any other recommendation :/
Update:
Also this hangs:
Code:
./fastboot -w
erasing 'userdata'...
ERROR: usb_read failed with status e00002ed
FAILED (status read failed (No such file or directory))
finished. total time: 3627.265s
Phone needs to be in flashboot usb, and when you open cmd on your comp you need to open it to where you have fastboot stored or change directories to it. Or you can add it to your variables and open it anywhere.
Sent from my HTC Desire Z using xda premium
Sorry for answering a bit late, but was in weekend holidays
Of course i did it in the fastboot folder and my phone was in fastboot usb (red blinking on phone screen). Otherwise i would get "<waiting for device>". Just got that error message posted above. Any ideas left? Otherwise it seams to be a broken eMMC
So when conected phone displayedfastboot usb in red? If so when you typed fastboot devices did it display one?
Sent from my T-Mobile G2 using xda premium
Yepp, it does show serial and "recovery".
And if you try to flash the hboot/spl now what happens?
Sent from my T-Mobile G2 using xda premium
Hi again,
I tried to flash the hboot while in fastboot with following message:
Code:
C:\android-sdk-windows\platform-tools\rom_26>fastboot flash hboot hboot_7230_Vision_HEP_0.85.0005_101011.nb0
sending 'hboot' (1024 KB)...
OKAY [ 0.183s]
writing 'hboot'...
FAILED (remote: image update error)
finished. total time: 2.904s
Also tried to do it with "dd" what seem to work but as soon as i restart the phone it still says it is in an "VISION PVT ENG S-OFF" while i was flashing a non-ENG hboot...and the version also not matching "HBOOT-0.84.2000" while flashing 0.85.0005
I also tried to put a newer (2.42.405.2) PC10IMG.zip from RUU on SD Card but it fails with message "BOOTLOADER - Fail-PU" and "Partition update fail! Update Fail!"
I realy think the eMMC got bricked...If you do not have any advices anymore i will look for a replacement from somewhere.
I still searched around and found that post: http://forum.xda-developers.com/showthread.php?t=1039504&page=6#post14645519
Its exactly my situation with same outputs and also the "bad" eMMC. I will try to send it in. Reading all that i have to admit that i already had before trying rooting it, i couldn't do a normal restart (just had a black screen after splash screen). It must have been connected to USB to be able to do a restart. So I think i didn't done anything wrong...just have a hardware issue
Sorry for not answering you chrisdeath, was busy with other stuff lately, so i hadn't had the time to stop by here. Have you been sending in your phone already? Telling from the stuff you wrote earlier, it is very likely a fried emmc. There is a way to confirm this, using two shells. With one shell, you need to display the log using
Cat /proc/kmsg ¦ grep emmc0
With the other shell, try to do any kind of write access (e.g. format partition or dd anywhere)
If there are any errors in the log referring to the write fail, your chip is bricked.
It will probably get fixed free of charge, even if the phone is rooted, others have told me that they got it new without payment. If your new one has the same chip, you should if by any means possible, never pull the battery during operation, as this seems to be the main cause for bricking the chip.
Sent from my HTC Vision using XDA

[HOW TO] Unbrick Kindle Fire HDX (QHUSB_BULK) with firmware <=1314.3.2.6

First of all - this is works only if you bricked on firmware <=1314.3.2.6.
So it don't works for "rollbacked 3.2.8(7)" bricks(
Sorry but need leak of newest version of flash programmer for higher sw.
I understand that there is not many people with this type of bricks but it is better that nothing=)
Of course you can try - you can not do worse=) I test this method on 13.3.2.3 and 13.3.2.4.
Apollo users should read post to the end before doing anything!
Manual in progress. Additions and comments are appreciated.
Logs of flasher to examine errors locates at C:\Program Files(X86)\Xiaomi\MiPhone\
My English isn't perfect) - PM me with OP corrections.
​
1. Download archive - https://drive.google.com/file/d/0B2twXJIOgv-UR0dZTVJUeFFsVU0/view?usp=sharing and unpack it. Two folders inside - fw and tools.
2. Install ./tools/MiPhone2015731.exe
2a. For x64 system you need disable drivers signature verification before installing. Google it.
3. Start and setup Miflash:
3a. Press 'Browse' and select folder "fw" from archive. Press OK.
3b. Press down arrow on this button, Press "Advanced" and fill fields with files in folder 'fw' by "Browse" :
- flashprogrammer - .\fw\prog_emmc_firehose_8974.mbn
- raw xml file - .\fw\rawprogram0.xml
- patch xml file - .\fw\patch0.xml
- other fields no need to touch
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
4. Ok. Now you need put your device in QHSUSB Bulk - mode and install Drivers.
4a. Your device can be in this state already. Just connect it to PC.
4b. If you have working adb (who knows) - type "adb reboot oem-2" or "adb reboot emergency" in cmd (i suppose you know that is adb drivers and adb). This is reboot kindle into emergency mode Qdloader 9008.
4c. Your device is stucked at greylogo or bootlooping without adb access. You need fastboot cable. Reboot device with plugged fastboot-cable.
5. Navigate to device manager and check for new device named QHSUSB_BULK . Drivers will install automatically or you need install it manually from .\tools\QualcommDrv.
In device manager at COM-Ports section you must obtain HS-USB Qdloader 9008 (COMx) without exclamation!
6. Go to Miflash , press Refresh, you should see your com port and empty bar under "progress" section.
7. Press "Flash". You should see messages like "WriteFile position 0x00000000840000, size 131072"
8. If all gone successfully disconnect kindle from PC and reboot it by holding power+vol up.
8a. If unsuccessful - reboot device and start over. In this mode for reboot sometimes needs above 5 min holding of power button.
If you get "Opening port" after some loading - you probably have > 1314.3.2.6 fw version.
9. Grats. You are in TWRP. You could flash stock 1314.3.2.3 firmware renaming bin to zip. Do not forget to block OTA immediately!
10. BTW you aboot partition is 13.3.2.3 version so you can do procedure of unlock without downgrading to 13.3.2.3 - http://forum.xda-developers.com/kindle-fire-hdx/general/multi-platform-1-click-bootloader-t3241014
Apollo users !!! - you need to replace recovery.img and emmc_appsboot.mbn with these (rename twrp and aboot_vuln).
CREdits:
bournezhang - for leaked programmer.
FSmp - for testing at 13.3.2.4
For advanced users - this works with any unlocked devices too (aboot<= 13.2.3.2).
By filling "filename" at rawprogram0.xml you can flash any partition to your device. Big partition like system.img must be sparsed I assume and rawprogram0 need to correct.
Of course all of it could be done with dd or maybe with fastboot. But just FYI.
ps. Anyone who knows something about newest version of emmcbld.mbn or lab126 insiders =) feel free to send anonymous e-mail to 2457678atgmaildotcom. Thank you.
Reserved
sorry,I don't have the newest version.
i think we can only get it from lab126 or amazon.
by the way, in factory ,they have to flash the device to a special mode, and then reflash all the system images.
ONYXis said:
Reserved
Click to expand...
Click to collapse
Hope these files can help you. they are old version
bournezhang said:
Hope these files can help you. they are old version
Click to expand...
Click to collapse
Thank you. I already have it. Nothing interesting.
bournezhang said:
by the way, in factory ,they have to flash the device to a special mode, and then reflash all the system images.
Click to expand...
Click to collapse
there is no any difference, i use same protocol as Amazon. i can make fullflash instructions with system, cache, userdata, but I see no sense of this. just bigger download size - approx 2.5 GB.
With twrp you can flash what you want by yourself.
But most user's version is 4.5.2 or higher now .
Look forward this issue be solved.
really nice job
@FotixChiang , thanks. btw maybe "our friend" with that dev 4.1.1 firmare has this file for 4.x ?
I just followed your steps, but when I flashed the program failed. I then reset my device, but it no longer recognizes it as QHUSB BULK. All it says is "Unknown USB Device (Descriptor Request Failed)". Any ideas on how to get it back into QDLoader mode for another shot at flashing?
Hold power button long. Above 5 min sometimes. It always works.
ONYXis said:
First of all - this is works only if you bricked on firmware <=1314.3.2.6.
So it don't works for "rolbacked 3.2.8(7)" bricks(
Sorry but need leak of newest version of flash programmer for higher sw.
I understand that there is not many people with this type of bricks but it is better that nothing=)
Of course you can try - you can not do worse=) I test this method on 13.3.2.3 and 13.3.2.4.
Apollo users should read post to the end before doing anything!
Manual in progress. Additions and comments are appreciated.
Logs of flasher to examine errors locates at C:\Program Files(X86)\Xiaomi\MiPhone\
My English isn't perfect) - PM me with OP corrections.
​
1. Download archive - https://drive.google.com/file/d/0B2twXJIOgv-UR0dZTVJUeFFsVU0/view?usp=sharing and unpack it. Two folders inside - fw and tools.
2. Install ./tools/MiPhone2015731.exe
2a. For x64 system you need disable drivers signature verification before installing. Google it.
3. Start and setup Miflash:
3a. Press 'Browse' and select folder "fw" from archive. Press OK.
3b. Press down arrow on this button, Press "Advanced" and fill fields with files in folder 'fw' by "Browse" :
- flashprogrammer - .\fw\prog_emmc_firehose_8974.mbn
- raw xml file - .\fw\rawprogram0.xml
- patch xml file - .\fw\patch0.xml
- other fields no need to touch
4. Ok. Now you need put your device in QHSUSB Bulk - mode and install Drivers.
4a. Your device can be in this state already. Just connect it to PC.
4b. If you have working adb (who knows) - type "adb reboot oem-2" or "adb reboot emergency" in cmd (i suppose you know that is adb drivers and adb). This is reboot kindle into emergency mode Qdloader 9008.
4c. Your device is stucked at greylogo or bootlooping without adb access. You need fastboot cable. Reboot device with plugged fastboot-cable.
5. Navigate to device manager and check for new device named QHSUSB_BULK . Drivers will install automatically or you need install it manually from .\tools\QualcommDrv.
In device manager at COM-Ports section you must obtain HS-USB Qdloader 9008 (COMx) without exclamation!
6. Go to Miflash , press Refresh, you should see your com port and empty bar under "progress" section.
7. Press "Flash". You should see messages like "WriteFile position 0x00000000840000, size 131072"
8. If all gone successfully disconnect kindle from PC and reboot it by holding power+vol up.
8a. If unsuccessful - reboot device and start over. In this mode for reboot sometimes needs above 5 min holding of power button.
If you get "Opening port" after some loading - you probably have > 1314.3.2.6 fw version.
9. Grats. You are in TWRP. You could flash this stock 1314.4.5.5 image - http://forum.xda-developers.com/kindle-fire-hdx/development/twrp-flashable-stock-images-t3194914
10. BTW you aboot partition is 13.3.2.3 version so you can do procedure of unlock without downgrading to 13.3.2.3 - http://forum.xda-developers.com/kindle-fire-hdx/general/multi-platform-1-click-bootloader-t3241014
Apollo users !!! - you need to replace recovery.img at folder "fw" with this one - https://drive.google.com/file/d/0B2twXJIOgv-UYzhORVczQ3E3cWM/view?usp=sharing
CREdits:
bournezhang - for leaked programmer.
FSmp - for testing at 13.3.2.4
For advanced users - this works with any unlocked devices too (aboot<= 13.2.3.2).
By filling "filename" at rawprogram0.xml you can flash any partition to your device. Big partition like system.img must be sparsed I assume and rawprogram0 need to correct.
Of course all of it could be done with dd or maybe with fastboot. But just FYI.
ps. Anyone who knows something about newest version of emmcbld.mbn or lab126 insiders =) feel free to send anonymous e-mail to 2457678atgmaildotcom. Thank you.
Click to expand...
Click to collapse
Great job bro. About one year ago I was reading many posts on this forum to get enough information to unbrick my Kindle Fire HDX (stuck on grey logo). by reading most of the posts related to Kindle Fire HDX I found out that the only way to unbrick it was a FactoryCable/ FastbootCable. so I made a factory cable and got my Kindle be recognised by my PC as Qdloader 9008 or Qcomm HS-USB Bulk or something like that. but after that I did not know how to flash files on it so my KFHDX was taking rest till today
thanks to you that I am able to revive it now thanks again. I have a lot of usefull files and information including some interesting drivers which might help you create tools or find other methods to unbrick the KFHDX. if you need some help or files just drop me a message to my inbox. I will be checking it frequently thank you
it's really worked method!
I restored gray logo (QHUSB_BULK) 3rd HDX 8.9 Apollo. I have been waiting this for 2 years))
the only thing I have not load the firmware http://forum.xda-developers.com/kindle-fire-hdx/development/twrp-flashable-stock-images-t3194914 - it's not loaded
http://forum.xda-developers.com/kin...ent/rom-cm-12-unofficial-apollo-thor-t3050199 - it's work
BIG THX!
Thanks for response. I'll edit manual soon.
ONYXis said:
Thanks for response. I'll edit manual soon.
Click to expand...
Click to collapse
I congratulate you for your work and effort.
you are very good
need help.. I did the roll back, re-installed 4.5.2. 4.5.2 is now rooted. I followed the disable OTA instructions in the forum, (rename the file etc...)..
However that information may not be totally correct, because as soon as I connected to Wi Fi , kindle fire stated downloading 4.5.4. I shut the Wi Fi off, found another tutorial on disabling OTA updates. This one worked. However, I have a 100% downloaded update, and I'm fearful it will try to install itself. I need to know where to go with ES File Explorer to Delete this update file, so it does not install itself.
Thanks to all who can help.
why are you posted this here?
anyway, update file locates in /cache. need root to navigate there.
please do not offtop in this thread. thank you.
rlkellyjr said:
need help.. I did the roll back, re-installed 4.5.2. 4.5.2 is now rooted. I followed the disable OTA instructions in the forum, (rename the file etc...)..
However that information may not be totally correct, because as soon as I connected to Wi Fi , kindle fire stated downloading 4.5.4. I shut the Wi Fi off, found another tutorial on disabling OTA updates. This one worked. However, I have a 100% downloaded update, and I'm fearful it will try to install itself. I need to know where to go with ES File Explorer to Delete this update file, so it does not install itself.
Thanks to all who can help.
Click to expand...
Click to collapse
Third duplicate post in as many threads. Great way NOT to get noticed next time you need help.
I guess I should say thanks for the point in the right direction, but you coming across and telling me in different areas is not a way to get help. I posted in the wrong area to start with, and was told so. So thanks for the help.
---------- Post added at 11:33 PM ---------- Previous post was at 11:32 PM ----------
[/COLOR]
Davey126 said:
Third duplicate post in as many threads. Great way NOT to get noticed next time you need help.
Click to expand...
Click to collapse
Ali Ejea Mc said:
Great job bro. About one year ago I was reading many posts on this forum to get enough information to unbrick my Kindle Fire HDX (stuck on grey logo). by reading most of the posts related to Kindle Fire HDX I found out that the only way to unbrick it was a FactoryCable/ FastbootCable. so I made a factory cable and got my Kindle be recognised by my PC as Qdloader 9008 or Qcomm HS-USB Bulk or something like that. but after that I did not know how to flash files on it so my KFHDX was taking rest till today
thanks to you that I am able to revive it now thanks again. I have a lot of usefull files and information including some interesting drivers which might help you create tools or find other methods to unbrick the KFHDX. if you need some help or files just drop me a message to my inbox. I will be checking it frequently thank you
Click to expand...
Click to collapse
Good evening: I have an Apollo HDX that is an continuous gray and yellow splash screen when booted.
I have no idea what OS version it is running since it has been a long while setting in my junk pile.
I also do not know the history of the HDX since I acquired the unit second hand.
It sounds like there is some hope for recovery?
Can someone point me in the right direction for getting this unit resurrected?
On my LINUX workstation I do not see any logging when plugged in using a standard USB cable:
However, when a Kindle fire HD factory cable (2012 HD Fastboot cable) is used to connect to the HDX, I receive this logging:
Jan 31 20:38:43 me-9100 kernel: [193518.636064] usb 1-4: new high-speed USB device number 12 using ehci-pci
Jan 31 20:38:43 me-9100 kernel: [193518.768771] usb 1-4: New USB device found, idVendor=05c6, idProduct=9008
Jan 31 20:38:43 me-9100 kernel: [193518.768779] usb 1-4: New USB device strings: Mfr=1, Product=2, SerialNumber=0
Jan 31 20:38:43 me-9100 kernel: [193518.768784] usb 1-4: Product: QHSUSB__BULK
Jan 31 20:38:43 me-9100 kernel: [193518.768789] usb 1-4: Manufacturer: Qualcomm CDMA Technologies MSM
Jan 31 20:38:43 me-9100 kernel: [193518.769693] qcserial 1-4:1.0: Qualcomm USB modem converter detected
Jan 31 20:38:43 me-9100 kernel: [193518.769908] usb 1-4: Qualcomm USB modem converter now attached to ttyUSB0
Jan 31 20:38:43 me-9100 mtp-probe: checking bus 1, device 12: "/sys/devices/pci0000:00/0000:00:04.1/usb1/1-4"
Jan 31 20:38:43 me-9100 mtp-probe: bus: 1, device: 12 was not an MTP device
Jan 31 20:38:43 me-9100 kernel: [193518.636064] usb 1-4: new high-speed USB device number 12 using ehci-pci
Jan 31 20:38:43 me-9100 kernel: [193518.768771] usb 1-4: New USB device found, idVendor=05c6, idProduct=9008
Jan 31 20:38:43 me-9100 kernel: [193518.768779] usb 1-4: New USB device strings: Mfr=1, Product=2, SerialNumber=0
Jan 31 20:38:43 me-9100 kernel: [193518.768784] usb 1-4: Product: QHSUSB__BULK
Jan 31 20:38:43 me-9100 kernel: [193518.768789] usb 1-4: Manufacturer: Qualcomm CDMA Technologies MSM
Jan 31 20:38:43 me-9100 kernel: [193518.769693] qcserial 1-4:1.0: Qualcomm USB modem converter detected
Jan 31 20:38:43 me-9100 kernel: [193518.769908] usb 1-4: Qualcomm USB modem converter now attached to ttyUSB0
Jan 31 20:38:43 me-9100 mtp-probe: checking bus 1, device 12: "/sys/devices/pci0000:00/0000:00:04.1/usb1/1-4"
Jan 31 20:38:43 me-9100 mtp-probe: bus: 1, device: 12 was not an MTP device
When USB is disconnected:
Jan 31 20:40:16 me-9100 kernel: [193612.201809] usb 1-4: USB disconnect, device number 12
Jan 31 20:40:16 me-9100 kernel: [193612.202101] qcserial ttyUSB0: Qualcomm USB modem converter now disconnected from ttyUSB0
Jan 31 20:40:16 me-9100 kernel: [193612.202128] qcserial 1-4:1.0: device disconnected
Is the factory cable mentioned in this post the same factory cable used on the 2012 Kindle Fire HD?
I have worked on hundreds of the 2012 HD fires but, don't do anything with the HDX devices since they can't be bootloader unlocked. However, I would like to bring the HDX back to life it is possible. The tools for the HDX I see in this and other posts are for windows I presume and not LINUX?
Any help and direction would be helpful:::
Regards

D802 bricked, tried everything

Hello everyone. Here's my story
I've been using CM13. After installing their OTA update it ruined my android. So I downloaded new cm13 rom, wiped everything, accidentally clicked reboot (without flashing new rom) and it was over (At least I think this happened, it was some time ago and I'm already trying to fix this for a long).
I am stuck in LG logo. Can't access recovery (I've had this issue before. Could get to recovery only by command from adb).
I can get to Download mode. But PC can't see my device. Tried several PC's, windows, ubuntu. I flashed other phones with this method, only G2 is not visible. I'm doing here everything fine.
Also I tried this:
http://forum.xda-developers.com/lg-g2/general/lg-g2-unbrickable-fix-real-hard-brick-t2904404
Success but my phone keeps flashing on and off. I've got access to partitions like every 5 seconds and only for a second. I think I managed to flash those 3 partitions, but there's no difference, pc still can't see phone when in download mode.
Should I trow it to the ocean?
Keep it
Here is my story
Bricked my device (d802) with your stuation no recovey no download mode
My phone's partition table deleted any way, tried wire method which you've already tried
Tried several times and release this wire method put in 2 seperate modes
Found the mode it shows in ubuntu a sda block (with several tries with wire method)
I've got full 32 gig backup, thats my advantage between your stuation
In ubuntu fdisk - l shows all disk and shows my phone as a disk but no information about disk or partitions etc. only sda block
In the end pushed the 32 gig backup with dd if=/(path of my backup) of=/dev/block/sd* bs=4k
Wait some time until process done (30-45 minutes I guess)
Thats all, phone boots normally everything is fine
If you're using 32 gig version I can send you my backup (with imei deleted) so you can boot your device and install kdz
Or I can show you how to backup another LG phone and recover from that backup. http://forum.xda-developers.com/lg-g2/general/how-to-backup-data-16-gb-32-gb-size-t3236558
Thank you for your reply lynxrz
I've got bigger problem. When I enter qhsusb mode, backlight of my screen keeps switching on and off every 3-4 seconds. I can see partition only for a second.
Vergil333 said:
Thank you for your reply lynxrz
I've got bigger problem. When I enter qhsusb mode, backlight of my screen keeps switching on and off every 3-4 seconds. I can see partition only for a second.
Click to expand...
Click to collapse
Not necesaary to see partitions
In ubuntu or any linux enviroment open up a teeminal emulator and "sudo fdisk -l" and it will be like that;
Code:
$ sudo fdisk -l
Disk /dev/sda: 8589 MB, 8589934592 bytes
255 heads, 63 sectors/track, 1044 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x00008ec7
Device Boot Start End Blocks Id System
/dev/sda1 * 1 1013 8136891 8e Linux LVM
/dev/sda2 1014 1044 249007+ 5 Extended
/dev/sda5 1014 1044 248976 83 Linux
sda sdb sdc means a phisicial disk. sda1 sda2 sda3 means partitions of "sda" disk. My process depends on overwriting sda disk not partitions, so you don't need to see partitions
Just type "sudo fdisk -l" and tell me you can see any sdb sdc phisical disk permenately. We must know connection can be dropped or not(it can be bootloop). Partitions might disappear but phisical disk have to be there. Look for it.
If you can't see in qhsusb mode try another mode, this is the lucky part of tring the wire method. I don't know exactly how to swich "another" mode but you can detect in window device manager, then switch to linux (Don't be afraid to losing this mode it stays when you plug off usb if you connected battery)
Sorry I don't remember that "another" mode's name but it is exists
Firstly you need to know qhsusb mode can see a "phisical" disc or not?
I'm in work now, but I tried this yesterday.
Phone appears as sdc when I typed
Code:
$ ls /dev/sd*
while in qhsusb mode. (I had to type it several times repeatedly to catch the right moment)
I can get to download mode, so I typed
Code:
$ sudo fdisk -l
and couldn't see sdc there.
Vergil333 said:
I'm in work now, but I tried this yesterday.
Phone appears as sdc when I typed
Code:
$ ls /dev/sd*
while in qhsusb mode. (I had to type it several times repeatedly to catch the right moment)
Click to expand...
Click to collapse
Probably it can be bootloop.
Did you plug off the battery when touching capacitor ? Just asking to be sure.
Sure, I unplugged the battery So qhsusb not stable and download mod not visible to computers.
I already gave up of hope
Ok I will solve how to enter "another" mode (not qhsusb)
But I need time to backup all my data in any case
If I solve, prepare a backup for you and it'll be 32 GB
Edit: Can not find out "another" mode because of data cable problem (severed usb cable charging but not transferring data) You're on your own now to find another usb mode, It can be the "holding time" of cable on capacitor.
Good luck with that
Prepairing your backup with otg
Really thanks for your help lynxrz. I appreciate all effort
Vergil333 said:
Really thanks for your help lynxrz. I appreciate all effort
Click to expand...
Click to collapse
You're welcome
PS: Did I send pm the download link?
You did. 29.1GB rar file. I have no use for it till I find another mode to be able to flash partition.
I already bought G3. Probably I will sell G2 for parts
Uploading now and it was %17 maybe tomorrow will be uploaded %100
20,4 GB and compressed seperated 1 GB rar parts (21 parts)
Realised by you broken usb, I'll solder it but no time for that now, 2 days later I'll try it.
I'm stuborn as hell with that Just wait we'll fix it don't sell
Maybe I can make a tutorial and help the others
UPDATE: Usb works I'll try it tomorrow

shield TV 2015 bricked ?? no root no update...

Hi,
I never root or do anykind of development or advance usage of my shield 2015 pro,
but about 15days ago it just deside do not boot anymore . i don't think it got the last update, so i have no clue why it suddenly not boot anymore
The green light is there, but there is no output.
i tried to invoke the android fastboot with this nethod : http://nvidia.custhelp.com/app/answ...NNXg0SmNhUFlvNHpHMGkwM29mRlZxTVdQUVElMjElMjE=
i also tried to factory reset with :
http://nvidia.custhelp.com/app/answ...hen-you-are-unable-to-access-android-settings
but didn't succeed to see anything, there is no output at all (the TV says so, and i try other stuff the TV works)
i don't know what to do ?
is it actually bricked ? can i do somthing about it ?
Thank you in advance
Bobzer
bobzer said:
Hi,
I never root or do anykind of development or advance usage of my shield 2015 pro,
but about 15days ago it just deside do not boot anymore . i don't think it got the last update, so i have no clue why it suddenly not boot anymore
The green light is there, but there is no output.
i tried to invoke the android fastboot with this nethod : http://nvidia.custhelp.com/app/answ...NNXg0SmNhUFlvNHpHMGkwM29mRlZxTVdQUVElMjElMjE=
i also tried to factory reset with :
http://nvidia.custhelp.com/app/answ...hen-you-are-unable-to-access-android-settings
but didn't succeed to see anything, there is no output at all (the TV says so, and i try other stuff the TV works)
i don't know what to do ?
is it actually bricked ? can i do somthing about it ?
Thank you in advance
Bobzer
Click to expand...
Click to collapse
You didn't mention it so i ask, did you try with other HDMI cables? If still no go and as it is the pro which is more tricky, then better request RMA.
Have you also tried running fastboot commands blindly? I mean do the steps to boot into fastboot/bootloader mode, then if you haven't installed windows drivers try to do so, check device manager, does it recognize your device? What does it show?. If your device is recognized by your PC in fastboot mode and you succeed to install drivers then that will tell us something, otherwise is hard brick but still could be a hardware issue.
Sent from my Tapatalk beta Hub
If I helped hit the Thanks button. Follow Me! ~ DroidMote user ~ Full Android for Shield TV and Nexus Player
lavero.burgos said:
You didn't mention it so i ask, did you try with other HDMI cables? If still no go and as it is the pro which is more tricky, then better request RMA.
Have you also tried running fastboot commands blindly? I mean do the steps to boot into fastboot/bootloader mode, then if you haven't installed windows drivers try to do so, check device manager, does it recognize your device? What does it show?. If your device is recognized by your PC in fastboot mode and you succeed to install drivers then that will tell us something, otherwise is hard brick but still could be a hardware issue.
Sent from my Tapatalk beta Hub
If I helped hit the Thanks button. Follow Me! ~ DroidMote user ~ Full Android for Shield TV and Nexus Player
Click to expand...
Click to collapse
Hi,
thanks for trying to help me,
I tried the cable with another device so the cable is fine
i tried the fastboot blindly but no success (maybe/probably/hopefully i don't do it correctly )
about windows i didn't saw it on windows at all, but that wasn't worry me at that time because i didn't know where to look, so i thought it was maybe normal
about driver no idea of what should i do. during my search i saw little bit about adb
all my search bring me to topic where people did stuff to there shield (root, try rom , etc) i didn't do anything so i don't know what information is relevant for me or not
tonight i will install driver and try again.
just to summarize :
After installing the driver:
- if i see the device in the device manager there is hope
- if not it's hard brick and so i can do nothing ?
if that true ?
thanks you
I would have a look at the SSHD to SSD migration Threads here on XDA (Shield TV), and attempt to make a backup of the SSHD. (If possible). This will of course be of MAJOR IMPORTANCE if you wish to retain any of the Widevine L1 DRM Provider Content (e.g. Amazon, and Netflix. etc.. etc...)
It seems to me that the Bootloader got wiped / corrupted (Which is actually the good news), or the SSHD has died. (Well it probably can't get worse than that.)
In the SSD Migration Thread there is a link to download an Backed up version of someone else's Shield TV. I managed to use this to recover a hard bricked Shield before. My mistake was not making a backup of the Security Sectors of that Device, and I lost all those Services.
It is however possible to rewrite that backup over a working backup to recover the correct L1 Widevine Keys though. IF YOU REMEMBER to make that Backup first. So it's probably​ not too late to do that. The worst case scenario? Your just gonna lose a buttload of DRM Services that you may, or may not even depend on. If your more of a Kodi Person, than this shouldn't even affect you much. But, of course it would be wiser to try and, retain those Widevine Keys if possible.
bobzer said:
Hi,
thanks for trying to help me,
I tried the cable with another device so the cable is fine
i tried the fastboot blindly but no success (maybe/probably/hopefully i don't do it correctly )
about windows i didn't saw it on windows at all, but that wasn't worry me at that time because i didn't know where to look, so i thought it was maybe normal
about driver no idea of what should i do. during my search i saw little bit about adb
all my search bring me to topic where people did stuff to there shield (root, try rom , etc) i didn't do anything so i don't know what information is relevant for me or not
tonight i will install driver and try again.
just to summarize :
After installing the driver:
- if i see the device in the device manager there is hope
- if not it's hard brick and so i can do nothing ?
if that true ?
thanks you
Click to expand...
Click to collapse
Right, if your PC recognize your shield in fastboot mode then it means is alive. When people have hard bricked their devices by corrupted bootloader some are able to boot into APX mode, which confirms their device won't be able to recover (unless Nvidia release the tools), but for others the device won't even turn on.
If your pc recognizes your shield tv in fastboot mode and you are able to install windows drivers and you get an id when typing fastboot devices in cmd, then there is a 50/50 chance of recovering, don't forget the possibility of hardware failure.
The following video can help you, just follow until i open command line and start typing fastboot commands but you just have to type "fastboot devices" command nothing​ else, if you get an id it means that the link with your shield tv is successful.
https://youtu.be/LQaYb4oVHVc
Report back!. Oh but still try other good hdmi cable(s), i tell you for experience, weird **** happens. I have had weird issues with hdmi port and hdmi cable (Amazon basics brand) in the past.
Ichijoe said:
I would have a look at the SSHD to SSD migration Threads here on XDA (Shield TV), and attempt to make a backup of the SSHD. (If possible). This will of course be of MAJOR IMPORTANCE if you wish to retain any of the Widevine L1 DRM Provider Content (e.g. Amazon, and Netflix. etc.. etc...)
It seems to me that the Bootloader got wiped / corrupted (Which is actually the good news), or the SSHD has died. (Well it probably can't get worse than that.)
In the SSD Migration Thread there is a link to download an Backed up version of someone else's Shield TV. I managed to use this to recover a hard bricked Shield before. My mistake was not making a backup of the Security Sectors of that Device, and I lost all those Services.
It is however possible to rewrite that backup over a working backup to recover the correct L1 Widevine Keys though. IF YOU REMEMBER to make that Backup first. So it's probably​ not too late to do that. The worst case scenario? Your just gonna lose a buttload of DRM Services that you may, or may not even depend on. If your more of a Kodi Person, than this shouldn't even affect you much. But, of course it would be wiser to try and, retain those Widevine Keys if possible.
Click to expand...
Click to collapse
thanks, for the idea, i'll first check with the driver.
and after i'll backup the drive at the same time i'll check if there is smart value. in case is the drive which is in a bad state
lavero.burgos said:
Right, if your PC recognize your shield in fastboot mode then it means is alive.
Click to expand...
Click to collapse
to entering the fastboot mode the only way is pressing for about 3sec after powering up or thanks to the drivers it will enter automatically ?
lavero.burgos said:
The following video can help you, just follow until i open command line and start typing fastboot commands but you just have to type "fastboot devices" command nothing​ else, if you get an id it means that the link with your shield tv is successful.
https://youtu.be/LQaYb4oVHVc
Click to expand...
Click to collapse
thanks i can't watch it right now but i'll as soon as possible tonight
lavero.burgos said:
Report back!. Oh but still try other good hdmi cable(s), i tell you for experience, weird **** happens. I have had weird issues with hdmi port and hdmi cable (Amazon basics brand) in the past.
Click to expand...
Click to collapse
I will thanks
bobzer said:
to entering the fastboot mode the only way is pressing for about 3sec after powering up or thanks to the drivers it will enter automatically ?
Click to expand...
Click to collapse
Better to do it manually as i show in the video, the other method from windows never worked for me and for many.
lavero.burgos said:
Better to do it manually as i show in the video, the other method from windows never worked for me and for many.
Click to expand...
Click to collapse
ok thanks
looking forward to try this
so i'm currently trying and sadly i can confirm that the green light is on, cable plug to shield but not recognize at all in the device manager
lavero.burgos said:
Better to do it manually as i show in the video, the other method from windows never worked for me and for many.
Click to expand...
Click to collapse
i did exactly as explained and the nothing happend except that the green light turn off
so when i plug the cable i remove my fing and put it back on the shield and waiting and after a few second the light goes off and stay off but windows still not recognize
Ichijoe said:
I would have a look at the SSHD to SSD migration Threads here on XDA (Shield TV), and attempt to make a backup of the SSHD. (If possible). This will of course be of MAJOR IMPORTANCE if you wish to retain any of the Widevine L1 DRM Provider Content (e.g. Amazon, and Netflix. etc.. etc...)
It seems to me that the Bootloader got wiped / corrupted (Which is actually the good news), or the SSHD has died. (Well it probably can't get worse than that.)
In the SSD Migration Thread there is a link to download an Backed up version of someone else's Shield TV. I managed to use this to recover a hard bricked Shield before. My mistake was not making a backup of the Security Sectors of that Device, and I lost all those Services.
It is however possible to rewrite that backup over a working backup to recover the correct L1 Widevine Keys though. IF YOU REMEMBER to make that Backup first. So it's probably​ not too late to do that. The worst case scenario? Your just gonna lose a buttload of DRM Services that you may, or may not even depend on. If your more of a Kodi Person, than this shouldn't even affect you much. But, of course it would be wiser to try and, retain those Widevine Keys if possible.
Click to expand...
Click to collapse
so i removed the sshd and try to backup it...
that's first that i wasn't able to recover anything from a drive that's appear on my computer
it's so strange because it's there the smart see it but i can't read nothing at all :
Code:
[email protected]:/mnt/raid/backup/shield# ls -l /dev/sdb
brw-rw---- 1 root disk 8, 16 juin 14 02:56 /dev/sdb
[email protected]:/mnt/raid/backup/shield# fdisk -l /dev/sdb
fdisk: impossible d'ouvrir /dev/sdb: Aucun fichier ou dossier de ce type
[email protected]:/mnt/raid/backup/shield# ddrescue -f -n /dev/sdb shield.dd mapfile
GNU ddrescue 1.19
Press Ctrl-C to interrupt
rescued: 0 B, errsize: 0 B, current rate: 0 B/s
ipos: 0 B, errors: 0, average rate: 0 B/s
opos: 0 B, run time: 1 s, successful read: 1 s ago
Finished
commande : 'smartctl' -i -H -c '/dev/sdb'
smartctl 6.4 2014-10-07 r4002 [x86_64-linux-3.16.0-4-amd64] (local build)
Copyright (C) 2002-14, Bruce Allen, Christian Franke, www.smartmontools.org
=== START OF INFORMATION SECTION ===
Model Family: Seagate Laptop SSHD
Device Model: ST500LM000-1EJ162
Serial Number: W764J2R0
LU WWN Device Id: 5 000c50 082dc3e28
Firmware Version: NV9D
Rotation Rate: 5400 rpm
Form Factor: 2.5 inches
Device is: In smartctl database [for details use: -P show]
ATA Version is: ACS-2, ACS-3 T13/2161-D revision 3b
SATA Version is: SATA 3.1, 6.0 Gb/s (current: 1.5 Gb/s)
Local Time is: Wed Jun 14 03:02:44 2017 CEST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled
=== START OF READ SMART DATA SECTION ===
SMART Status not supported: Invalid status byte (0x00) [JMicron]
SMART overall-health self-assessment test result: PASSED
Warning: This result is based on an Attribute check.
General SMART Values:
Offline data collection status: (0x00) Offline data collection activity
was never started.
Auto Offline Data Collection: Disabled.
Self-test execution status: ( 0) The previous self-test routine completed
without error or no self-test has ever
been run.
Total time to complete Offline
data collection: ( 139) seconds.
Offline data collection
capabilities: (0x73) SMART execute Offline immediate.
Auto Offline data collection on/off support.
Suspend Offline collection upon new
command.
No Offline surface scan supported.
Self-test supported.
Conveyance Self-test supported.
Selective Self-test supported.
SMART capabilities: (0x0003) Saves SMART data before entering
power-saving mode.
Supports SMART auto save timer.
Error logging capability: (0x01) Error logging supported.
General Purpose Logging supported.
Short self-test routine
recommended polling time: ( 1) minutes.
Extended self-test routine
recommended polling time: ( 99) minutes.
Conveyance self-test routine
recommended polling time: ( 2) minutes.
SCT capabilities: (0x10b1) SCT Status supported.
SCT Feature Control supported.
SCT Data Table supported.
here the dmesg :
[270724.389743] usb-storage 3-2:1.0: USB Mass Storage device detected
[270724.389819] scsi6 : usb-storage 3-2:1.0
[270724.389901] usbcore: registered new interface driver usb-storage
[270727.372913] scsi 6:0:0:0: Direct-Access ST500LM0 00-1EJ162 PQ: 0 ANSI: 2 CCS
[270727.373406] sd 6:0:0:0: Attached scsi generic sg2 type 0
[270730.079345] sd 6:0:0:0: [sdb] Very big device. Trying to use READ CAPACITY(16).
[270730.079514] sd 6:0:0:0: [sdb] 72057594037927936 512-byte logical blocks: (0 B/0 B)
[270730.079798] sd 6:0:0:0: [sdb] Write Protect is off
[270730.079802] sd 6:0:0:0: [sdb] Mode Sense: 28 00 00 00
[270730.080127] sd 6:0:0:0: [sdb] No Caching mode page found
[270730.080137] sd 6:0:0:0: [sdb] Assuming drive cache: write through
[270730.080827] sd 6:0:0:0: [sdb] Very big device. Trying to use READ CAPACITY(16).
[270730.081756] sdb: unknown partition table
[270730.082349] sd 6:0:0:0: [sdb] Very big device. Trying to use READ CAPACITY(16).
[270730.083081] sd 6:0:0:0: [sdb] Attached SCSI disk
[270736.012772] usb 3-2: USB disconnect, device number 5
someone ? do you have any idea ? what could i do ?
Did you follow this Guide?* Essentially you make this backup in Two parts uninspiredly called "firstpart.bin" (Which is the first Six Gigabytes of the SSHD which also encompasses​ the unique DRM Keys for your Shield.). The lastpart.bin is more or less just the list of checksums for the GPT Partitions.
I wouldn't expect that you would, could or should be able to see anything from the Drive. As most of it is written in a RAW Partition. That is personally beyond my knowledge of how to mount it. That's why you have to make *.bin files which you can then view with a Hex Editor. If you wanted to.
*https://forum.xda-developers.com/shield-tv/general/guide-migrate-to-ssd-hdd-size-satv-pro-t3440195
Ichijoe said:
Did you follow this Guide?* Essentially you make this backup in Two parts uninspiredly called "firstpart.bin" (Which is the first Six Gigabytes of the SSHD which also encompasses​ the unique DRM Keys for your Shield.). The lastpart.bin is more or less just the list of checksums for the GPT Partitions.
I wouldn't expect that you would, could or should be able to see anything from the Drive. As most of it is written in a RAW Partition. That is personally beyond my knowledge of how to mount it. That's why you have to make *.bin files which you can then view with a Hex Editor. If you wanted to.
*https://forum.xda-developers.com/shield-tv/general/guide-migrate-to-ssd-hdd-size-satv-pro-t3440195
Click to expand...
Click to collapse
i did follow this topic but the problem is that dd doesn't works event fdisk don't work
Code:
[email protected]:/mnt/raid/backup/shield# fdisk -l /dev/sdb
fdisk: impossible d'ouvrir /dev/sdb: Aucun fichier ou dossier de ce type
it's fdisk telling me that it can't open my drive sdb no file or directory
i even tried ddrecue so i feel like i'm screwed
but i don't understand because i never saw this kind of problem with dd, i mean even a damage drive i always could start at least , copy a few bytes ... i don't understand what i miss ...
Did you remember to enter elevated root first?
Code:
$ sudo -s
If you don't do this, or you just throw up a sudo fdisk -l. I don't think it'll work. You have to be in an elevated root shell first.
Then you can use:
Code:
# fdisk -l
To list all the Drives currently in your System. Which will be more complicated depending on how many Drives you have.
Again this should list all the Drives currently on your System. You can easily, spot the Shields SSHD by the fact that it is exactly 499GB. Within in this context is the Drive Address. For me this has always been /dev/sda. Where as the local OS was on dev/sdb.
So when you get to this point:
Code:
dd if=/dev/sdX of=firstpart.bin count=6899870
You need to replace sdX with the correct Address of the Shield TVs SSHD. This will then hopefully create a ~3GB File called 'firstpart.bin'
Likewise
Code:
dd if=/dev/sdX bs=512 skip=976773158 of=lastpart.bin
Will create a 5kb File that hosts the Partition Map?
Again you have to replace sdX with the correct Address where the Shield TVs SSHD is hosted.
Ichijoe said:
Did you remember to enter elevated root first?
Code:
$ sudo -s
If you don't do this, or you just throw up a sudo fdisk -l. I don't think it'll work. You have to be in an elevated root shell first.
Then you can use:
Code:
# fdisk -l
To list all the Drives currently in your System. Which will be more complicated depending on how many Drives you have.
Again this should list all the Drives currently on your System. You can easily, spot the Shields SSHD by the fact that it is exactly 499GB. Within in this context is the Drive Address. For me this has always been /dev/sda. Where as the local OS was on dev/sdb.
So when you get to this point:
Code:
dd if=/dev/sdX of=firstpart.bin count=6899870
You need to replace sdX with the correct Address of the Shield TVs SSHD. This will then hopefully create a ~3GB File called 'firstpart.bin'
Likewise
Code:
dd if=/dev/sdX bs=512 skip=976773158 of=lastpart.bin
Will create a 5kb File that hosts the Partition Map?
Again you have to replace sdX with the correct Address where the Shield TVs SSHD is hosted.
Click to expand...
Click to collapse
thanks I will double check tonight but i'm pretty sure that i was root
Ichijoe said:
Did you remember to enter elevated root first?
Code:
$ sudo -s
If you don't do this, or you just throw up a sudo fdisk -l. I don't think it'll work. You have to be in an elevated root shell first.
Then you can use:
Code:
# fdisk -l
Click to expand...
Click to collapse
fdisk don't see the disk
i don't know what to do
I bought a new adapter because at first i thought it could be the adapter but no it's the drive that is like dead. so i bought a new drive but because i can't get a backup of the old one i don't know what to do
can i find somewhere a full backup that i could put in my drive ?
thx
i try to copy with dd and ddrescue, until now i got 0 bytes rescued so i guess my only luck would be to get a backup somewhere else, but even there would i be able to run netflix ?
You should contact Nvidia for replacement, hardware died, not your fault. Unfortunately if you didn't backup the relevant partitions containing your keys, then no you wont be able to watch Netflix.
Sent from my Tapatalk beta Hub
If I helped hit the Thanks button. Follow Me! ~ DroidMote user ~ Full Android for Shield TV and Nexus Player
Hiyas. Welcome a fresh corpse.
Shield 2015, non-pro, bricked by flashing a wrong image.
Bricked well, no adb, no screen, no button - just green led on powerup.
Nvidia says there's no official service in our swamps (lovely, huh) and I'm up to myself.
Anyone with succesful revival? Thanks guys.

Bricked Nook Glowlight 3

I installed relaunchx and rooted the device sucessfully. It was running okay. I set the home button to restart in relaunch rather than the nook software. I rebooted and all it would do is go to the front-screen with the nook barnes and noble logo on the front. I could turn it on and off, but that was it. It charged. I tried to start packages on the device via adb but it said the system wasn't running. I could see processes system processes with ps.
I issued a reboot recovery command via adb. The Nook finally responded with something other than a reboot and it went into recovery and did a full factory reset. I thought I was in the clear. But no. It rebooted and went back to the logo screen as before. However, now I no longer have adb access.This might be because the factory reset turned off usb debugging. So now I can't access the device at all. Does anyone have any ideas how I might be able to proceed? I think the device is functional, but the bootloader is damaged somehow so I can't start Android on the device. Without adb access, I think it's effectively gone.
It's likely that you don't have any home application working.
Or maybe it's completely borked.
Have you tried holding various buttons on a power up to see if you can try recovery again?
The next worst case is just using the hardware console connection (inside the case) to see if you have a shell and what's going on.
For the old NST we had a whole setup to boot over USB even with a totally wiped out flash.
That hasn't been looked at for the newer iMX6 (vs OMAP) Nooks.
Hi,
Renate NST said:
For the old NST we had a whole setup to boot over USB even with a totally wiped out flash.
That hasn't been looked at for the newer iMX6 (vs OMAP) Nooks.
Click to expand...
Click to collapse
I tried to manually root using https://forum.xda-developers.com/showpost.php?p=76496894&postcount=13, replicating commands on Linux, and I totally bricked my Nook - probably bad repacking on boot image.
Code:
[884213.478979] usb 3-3: new high-speed USB device number 123 using xhci_hcd
[884213.607636] usb 3-3: New USB device found, idVendor=15a2, idProduct=0063
[884213.607642] usb 3-3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[884213.607645] usb 3-3: Product: SE Blank MEGREZ
[884213.607648] usb 3-3: Manufacturer: Freescale SemiConductor Inc
[884213.609540] hid-generic 0003:15A2:0063.000C: hiddev0,hidraw0: USB HID v1.10 Device [Freescale SemiConductor
Inc SE Blank MEGREZ] on usb-0000:00:14.0-3/input0
Can you point me to NST setup to recover over USB, I would spend some time to try to recover my Nook.
Thank you!
If you had just wiped out P1 you should still have recovery (on P2) just fine.
Do a restart holding the Home button down.
If this doesn't work you somehow managed to wipe the bootloader.
To get the USB HID bootloader to work would be a bit of a project.
There is the starting point of this tool: https://github.com/boundarydevices/imx_usb_loader
Anything that is written about USB recovery on the NST (which uses OMAP) has nothing to do with the new Glows (iMX6SL).
Hmmm, the Kindle Paper White 2 seems to have the same processor/ROM bootloader...
For what it's worth, here is an overview of the low-level MMC:
Code:
Name 32kB units 512B sectors Byte addresses /dev/block
Start End Start Size Start End
---------- ----- --- ----- ----- ------- ------- ----------
mbr 0 1 0 1FF
sn 1 1 200 3FF
bootloader 2 1022 400 7FFFF
hwcfg 1024 2 80000 803FF
ntxfw 1030 256 80C00 A0BFF
bootenv 1536 510 C0000 FFBFF
boot 33 223 2048 12224 100000 6F7FFF mmcblk0p1
waveform 225 544 14336 20480 700000 10FFFFF
logo 545 608 34816 4096 1100000 12FFFFF
recovery 609 1632 38912 65536 1300000 32FFFFF mmcblk0p2
Renate NST said:
If you had just wiped out P1 you should still have recovery (on P2) just fine.
Do a restart holding the Home button down.
If this doesn't work you somehow managed to wipe the bootloader.
Click to expand...
Click to collapse
I was lucky!
Restart holding the Home button down made no difference.
Trying randomly, I observed restart holding the Home and Right Up buttons goes into fastboot.
I recovered P1 partition for which I had backup and my Nook is live again.
Many thanks!!!
imx_usb_loader would have taken some time to learn.
So you're stuck in the ROM USB bootloader?
To look into a solution I had to get the ROM USB bootloader to run on my Nook to test things.
I didn't feel like bricking the Nook, so that was out.
I disassembled the ROM bootloader and found the correct, erm, workable entry point in the ROM.
Code:
eBR-1A # go [i]<entry address>[/i]
Code:
iManufacturer: 0x01
0x0409: "Freescale SemiConductor Inc "
iProduct: 0x02
0x0409: "SE Blank MEGREZ"
So now I can play around with the ROM USB bootloader.
Renate NST said:
So you're stuck in the ROM USB bootloader?
Click to expand...
Click to collapse
No.
After fastboot got enabled I booted nnglow3.img and then I recovered P1 partition with dd.
My Nook is like new
Thanks,
C
cipibad said:
No.
After fastboot got enabled I booted nnglow3.img and then I recovered P1 partition with dd.
My Nook is like new
Thanks,
C
Click to expand...
Click to collapse
I'm having the same issue as yours, could you please help me to unbrick my device?
I'm a newbie to technology so please help me step by step

Categories

Resources