Database Users

Acer A200 - BRICKED, cannot mount /data /sdcard

I did something stupid. Got an A200 that could not get OTA 4.0.3, so I managed to get it updated manually. However, I then proceeded to try to root it using the "SimpleRoot" scripts on Acertabletforum, and at this point, the thing is bricked. In Recovery, I cannot get anything to mount. /SDCard, /data, etc
Bootloader is Unlocked
I tried with some different Recoveries with slightly different results:
1) Hbwelch CWM v5.5.0.4 (the one that comes with SimpleTool) - All mounting attempts fail
2) nics-TWRP_stable (twrp v 2.1.4) - Seems to be able to mount System and Cache, but not DATA or SDCARD (Internal or External)
3) thor v 5.5.0x (thor2002ro rev1.7) - errors mounting data, sdcard and /mnt/sdcard. Is able to mount system, cache, flexrom and flex.
Any idea how to fix it? I am afraid that if I try to return the tablet where I bought it as it is now, it will get rejected. (even though the damn thing was supposed to be ICS upgradable in the first place, but wasn't... long story)
Thanks
Jerry

I finally got the tablet working again. Was very close to sending it back. Got bits and pieces of info from various other posts on this forum and on acertabletforum. For the sake of anyone else that may find this thread, here are a few things that were wrong, and how to fix them
(I cannot post outside links, so just google the file names when relevant)
1) /SDCard would not mount. Solution - PARTITION the SD card. NOTE: The card worked on a PC, and even on that tablet when Android was fully booted. However it would NOT mount in recovery until I explicitly partitioned it. Doing a FORMAT on the PC does NOT count. I had to partition it within Recovery.
NOTE: This may also be why people are unable to get the update.zip thing working.
2) /Data would not mount - I have no idea how this got screwed up, but the solution was:
* Connect the tablet to the PC in RECOVERY. At this point, ADB should work. If not, check the drivers on the PC - I had to manually specify the Acer ADB Composite driver.
* Open a Command prompt window
* Start ADB shell by typing:
ADB SHELL
* Now execute the following:
mke2fs -j -b 4096 /dev/block/mmcblk0p8
tune2fs -O extents,uninit_bg,dir_index -C 1 /dev/block/mmcblk0p8
e2fsck -fy /dev/block/mmcblk0p8
After this is done your file system on /data will be fixed. (solution posted by spoupard on XDA-Developers.com)
3) Putting it all together:
* Flashed the BOOT partition with Honeycomb 3.2.1_boot.img
* Flashed the RECOVERY partition with nics-TWRP_stable.img
* At this point, I noticed that the Bootloader was once again LOCKED. So, start into FASTBOOT mode and execute the following from the command prompt again:
fastboot oem unlock
* Re-Start in Recovery and select MOUNT and make sure that everything is mounted. If /SDCARD or /DATA refuse to mount, fix that issue first (step 2 above)
* Now I select to INSTALL Acer_AV041_A200_1.037.00_PA_CUS1.zip
Upon reboot, I noticed that it said "Updating Bootloader", then got the Acer screen and locked up. I restarted again into Recovery and again selected the option to install INSTALL Acer_AV041_A200_1.037.00_PA_CUS1.zip and reboot. This time it restarted, indicated that it has a new version of bootloader (previously was 3.1.3) and proceeded to boot up into Android 4.0.3. At that point, I think my neighbors heard me scream YES!, considering I spent 2 days on this
I hope I got all the steps. Most of it is from memory and some notes, since I did not want to experiment and go through this hell again.
Jerry

Great info but you might want to add fixed to the title. For the time being doesn't look like I will be rooting till these issues are sorted out. I am see too many people saying they are bricking with this root method.

FIXED - Acer A200 - BRICKED, cannot mount /data /sdcard
agapecs said:
Great info but you might want to add fixed to the title. For the time being doesn't look like I will be rooting till these issues are sorted out. I am see too many people saying they are bricking with this root method.
Click to expand...
Click to collapse
Didn't see a way to edit the title. As for rooting, note that after all was said and done, I am still not rooted. I just managed to get updated to 4.0.3, which should have been done OTA anyway. I may try again now that I am a bit more confident that I can get it back to working state, but will do a full backup in ADB first. Too much of a pain in the *** to have to reconfigure everything again once the OS is installed.

I cannot get the device to connect to my PC at all, or get the correct driver selected. Any tips?

crazyjimbo said:
I cannot get the device to connect to my PC at all, or get the correct driver selected. Any tips?
Click to expand...
Click to collapse
what state is the tablet in when you try to connect? Fastboot, Recovery, or fully booted up and operating?
What do you see in the device manager when the tablet is connected?

ext3 oder ext4?
1) /SDCard would not mount. Solution - PARTITION the SD card. NOTE: The card worked on a PC, and even on that tablet when Android was fully booted. However it would NOT mount in recovery until I explicitly partitioned it. Doing a FORMAT on the PC does NOT count. I had to partition it within Recovery.
Try to do this with twrp v.2.1.4: do I use ext3 or ext4 for the Partition? And which size needs the ext Partition?
Thanx
teacherHH

teacherhh said:
Try to do this with twrp v.2.1.4: do I use ext3 or ext4 for the Partition? And which size needs the ext Partition?
Click to expand...
Click to collapse
Don't think it matters. I picked the defaults.

mke2fs -j -b 4096 /dev/block/mmcblk0p8
Thanx j_medved for yor reply!
So I did and just faced the next problem: I can conect my Tablet to the PC and can finde it with adb devices and can start the shell with adb shell.
But then when I start: mke2fs -j -b 4096 /dev/block/mmcblk0p8
nothing seems to happen....waited about 30 minutes....
in the next turn I get the reply, that mmcblk0p8 is allready in use....next turn again: nothing seems to happen....
any ideas? .-(
teacherhh

teacherhh,
If I remember correctly, that command should finish pretty quick. You may want to try leaving it for a bit longer, but it seems that you may have something else wrong. I am not that familiar with this area. Haven't dealt with Linux much. Sorry.

Okay. Thanx anyway!
Sent from my GT-I9300 using xda app-developers app

again mke2fs
Once again j_medved...
did it look likes this, wenn you run mke2fs ?
Regards,
teacherhh

teacherhh said:
Once again j_medved...
did it look likes this, wenn you run mke2fs ?
Regards,
teacherhh
Click to expand...
Click to collapse
Don't remember what it was for me (was a month ago ) , but another couple users that ran it had the following:
Code:
~ # mke2fs -j -b 4096 /dev/block/mmcblk0p8
mke2fs -j -b 4096 /dev/block/mmcblk0p8
mke2fs 1.40.8 (13-Mar-2008)
Warning: 256-byte inodes not usable on older systems
Filesystem label=
OS type: Linux
Block size=4096 (log=2)
Fragment size=4096 (log=2)
1831424 inodes, 7311872 blocks
365593 blocks (5.00%) reserved for the super user
First data block=0
Maximum filesystem blocks=0
224 block groups
32768 blocks per group, 32768 fragments per group
8176 inodes per group
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
4096000
Writing inode tables: 52/224
Couple users that were hosed, were stuck at this point. Did not see any indication of resolution for those users

Driver Problems
Hi Guys,
I've the same problem. I can't wipe the Data, so I've found this instruction. unfortunenately will my PC not found my Tab. I've installed the drivers many times, but it will not work. Can anybody help, how to install? btw. fastboot is working, but not adb.
I'm using an Samsung Netbook with Win 7. THe PC's trying to install drivers, altough they are already installed, but can'T find any drivers.
If you need more informations, just let me know.

@Benninator,
If you look in Windows 7 Device Manager, does the device show up there OK? Or does it show up as unrecognized device, or as some device code with a yellow triangle and exclamation on it? Or not at all?

Yes, their is a yellow triangle. I've tried to install the driver manually, but with no success. In my driverlist were the Acer driver not listed. furthermore I've tried to configure the usb-adb.ini with also no success. I have absolutly no idea what I can do.

In device manager, and does it show up as a200 or unknown device?
Is the device I am recovery at the time?
And also, and which recovery?

Tab is missing recovery and won't boot in to android
FASTBOOT WORKS BUT I GET THIS MESSAGE EVERY TIME I TRY TO FLASH RECOVERY.IMG says unknown partiton 'C:\James\Downloads\recovery.img'
error: cannot determine image filename for 'C:\James\Downloads\recovery.img'
Please help me

jram0421 said:
FASTBOOT WORKS BUT I GET THIS MESSAGE EVERY TIME I TRY TO FLASH RECOVERY.IMG says unknown partiton 'C:\James\Downloads\recovery.img'
error: cannot determine image filename for 'C:\James\Downloads\recovery.img'
Please help me
Click to expand...
Click to collapse
I think you may be mistyping the command. What is the exact command that you are typing in that gets you this error?

cant get adb drivers installed in my pc
adb driver seems not to work at all when i try to boot my tablet on cwd when i boon on fastboot only fastboot recognice my device and when i let my acer a200 try to boot itself it gets stuck on acer screen whit this on top ( bootloader version 0.03.06-ics ) but windows recognice it but fails when installing the mtp usb drivers.
what can i do to get adb working so i can fix my mount issues so i can install my room again ?
hope you can help me tnks

[Q] Nexus 7 reboots constantly every 2 mins or so

My stock/unlocked nexus 7 2012 updated to android 4.4.0 KRT16S after being idle about 12 hours, i picked it up and just a couple minutes into browsing it started rebooting on it's own.
The weird things don't end here, since after every reboot it goes back to the exact same state it was before: if it were done updating an app, or I enabled ADB or turned off the wifi or whatever, and then suddenly reboots, all these things would go to the state they were before (WIFI on, ADB off, changes in apks, even files sideloaded).
I tried to clear the cache through recovery, but it didn't work, I also tried sideloading the ota update to 4.4.2, but it won't find the file in the root folder, as it just disappears. When i went to the nexus tool kit i was not able to unlock the bootloader, or to factory reset( not even from the device itself) or do anything to get out of this situation.
The only thing i can do for now is turn the tablet off and do nothing with it.
Has anyone an idea i can try?

Can really nobody help?
Sent from my Nexus 4 using Tapatalk

You have to create a hypothesis and then perform an experiment that tests that hypothesis. (There's a ferociously complicated processor and millions of lines of code involved; nobody is going to put their finger on the exact cause of a vaguely described problem from across the internet)
For instance:
Hypothesis A: There is a significant hardware problem which causes spontaneous reboots, and it doesn't matter what software is running for the fault to appear.
Test A: Plug the tablet in to the charger and boot it in to the recovery. Let it sit a while. Does it spontaneously reboot?
Hypotheses B: There is a software problem with the ROM I am using that causes sponateous reboots.
Test B: Back up your data, wipe the tablet, install a brand new ROM, and use it for a while. Does it still reboot?
Hypotheses C: The userdata partition got corrupted somehow which causes it to remount automatically in read-only mode. (Changes are not persistent and the ROM reboots all the time as a result)
Test C: Similar to test B, but destroy the userdata partition and reformat it using fastboot. Put a new ROM on a USB memory stick and use the OTG mounting features of the recovery to deliver a new ROM to the tablet. Is it still rebooting?
See how that goes?
Not trying to be mean or anything, but the lack of responses are probably due to several things; the leading candidate of which is that you mentioned using a toolkit - a sure sign of lack of understanding of how most of this stuff actually works.
It's OK to not understand everything - all of us are learning all the time, and everybody has to start at the beginning. Toolkits surely make some jobs faster - at the cost of hiding the details of how things actually work - and making their users helpless when something goes wrong. Try to avoid them if you can.
good luck

Thank you for the long and elaborate response! I will be the first to admit that I have limited knowledge about these things but the main reason that I used the toolkit was that everything else I tried failed. Of course, as you said there are plenty of things I could have tried, and I tried to explain everything I did to make the job easier for someone to help me out, surely not to let my questions unanswered!
So thank you for the answer, and i'll try everything as soon as possible and keep it posted up
Sent from my Nexus 4 using Tapatalk

Ok after a series of tests, and by the looks of it I think that the right hypothesis is number C, every time it boots back up it loses every change in the system. In the few minutes the tablet stays on, I managed to download the ota update to 4.4.2 but once it rebooted itself into recovery it said no command, hence the files it downloaded were erased and this was also the reason why I couldn't install the update via recovery myself, every time I put the update into the root folder and rebooted into recovery, it told me no command available. And the files would just disappear. The only option i'm left with is to destroy the user data partition using fastboot ( a method i'm not familiar with, but that i'm willing to try) I'll look for a guide, or if you be so kind to recommend one i'd be extremely thankful!
Sent from my Nexus 4 using Tapatalk

Googsx said:
Ok after a series of tests, and by the looks of it I think that the right hypothesis is number C, every time it boots back up it loses every change in the system. In the few minutes the tablet stays on, I managed to download the ota update to 4.4.2 but once it rebooted itself into recovery it said no command, hence the files it downloaded were erased and this was also the reason why I couldn't install the update via recovery myself, every time I put the update into the root folder and rebooted into recovery, it told me no command available. And the files would just disappear. The only option i'm left with is to destroy the user data partition using fastboot ( a method i'm not familiar with, but that i'm willing to try) I'll look for a guide, or if you be so kind to recommend one i'd be extremely thankful!
Sent from my Nexus 4 using Tapatalk
Click to expand...
Click to collapse
Normally user-level changes would be recorded in the /data partition, so if it got corrupted some way AND the OS mounts that filesystem with a errors=remount-ro then that would explain lack of persistence.
However, not every OS or recovery boot uses the same mount options. I'm looking at a CM boot right now and I don't see that
Code:
/dev/block/platform/sdhci-tegra.3/by-name/UDA /data ext4 rw,seclabel,nosuid,nodev,noatime,errors=panic,user_xattr,acl,barrier=1,nomblk_io_submit,data=ordered 0 0
But anyway, if you are going to reformat your "userdata" partition, try and rescue everything off of the tablet.
Is the recovery boot stable? If so, you might want to use "adb pull" to recursively pull everything off of the /sdcard. If it doesn't reboot every couple minutes, that could be of some use for backing up the /sdcard. Otherwise it will be impossible if your ROM reboots every 2 minutes.
Yes you can use fastboot to format the userdata partition. You can also use "mke2fs" as a shell command (that is, with adb) when the recovery is running.
TWRP 2.6.3.1
Code:
mke2fs
Usage: mke2fs [-c|-l filename] [-b block-size] [-f fragment-size]
[-i bytes-per-inode] [-I inode-size] [-J journal-options]
[-G meta group size] [-N number-of-inodes]
[-m reserved-blocks-percentage] [-o creator-os]
[-g blocks-per-group] [-L volume-label] [-M last-mounted-directory]
[-O feature[,...]] [-r fs-revision] [-E extended-option[,...]]
[-T fs-type] [-U UUID] [-jnqvFKSV] device [blocks-count]
.
If you use an ext2/3/4 filesystem formatter (e.g. mke2fs) running under the recovery, you need to be very very careful about specifying the exact partition name (e.g. /dev/block/mmcblk0p9 for GROUPER - data might be at a different partition number on a Tilapia device).
You can check by doing a
Code:
adb shell ls -l /dev/block/platform/sdhci-tegra.3/by-name/*
the userdata partition is "UDA".
BTW, before you go nuking your data partition, it might be useful to check to see if it is actually corrupted. For instance, with TWRP you can unmount all partitions, and then check using the program "e2fsck" :
Code:
C:\> adb shell
# e2fsck -f -n /dev/block/mmcblk0p9
the above command will perform a check (p9 = grouper /data partition) without attempting to make any repairs. You'll know if there are any problems: you will get page after page of error messages. If the filesytem is free of errors, you will only see 8-10 summary lines.

bftb0 said:
Normally user-level changes would be recorded in the /data partition, so if it got corrupted some way AND the OS mounts that filesystem with a errors=remount-ro then that would explain lack of persistence.
However, not every OS or recovery boot uses the same mount options. I'm looking at a CM boot right now and I don't see that
Code:
/dev/block/platform/sdhci-tegra.3/by-name/UDA /data ext4 rw,seclabel,nosuid,nodev,noatime,errors=panic,user_xattr,acl,barrier=1,nomblk_io_submit,data=ordered 0 0
But anyway, if you are going to reformat your "userdata" partition, try and rescue everything off of the tablet.
Is the recovery boot stable? If so, you might want to use "adb pull" to recursively pull everything off of the /sdcard. If it doesn't reboot every couple minutes, that could be of some use for backing up the /sdcard. Otherwise it will be impossible if your ROM reboots every 2 minutes.
Yes you can use fastboot to format the userdata partition. You can also use "mke2fs" as a shell command (that is, with adb) when the recovery is running.
TWRP 2.6.3.1
Code:
mke2fs
Usage: mke2fs [-c|-l filename] [-b block-size] [-f fragment-size]
[-i bytes-per-inode] [-I inode-size] [-J journal-options]
[-G meta group size] [-N number-of-inodes]
[-m reserved-blocks-percentage] [-o creator-os]
[-g blocks-per-group] [-L volume-label] [-M last-mounted-directory]
[-O feature[,...]] [-r fs-revision] [-E extended-option[,...]]
[-T fs-type] [-U UUID] [-jnqvFKSV] device [blocks-count]
.
If you use an ext2/3/4 filesystem formatter (e.g. mke2fs) running under the recovery, you need to be very very careful about specifying the exact partition name (e.g. /dev/block/mmcblk0p9 for GROUPER - data might be at a different partition number on a Tilapia device).
You can check by doing a
Code:
adb shell ls -l /dev/block/platform/sdhci-tegra.3/by-name/*
the userdata partition is "UDA".
BTW, before you go nuking your data partition, it might be useful to check to see if it is actually corrupted. For instance, with TWRP you can unmount all partitions, and then check using the program "e2fsck" :
Code:
C:\> adb shell
# e2fsck -f -n /dev/block/mmcblk0p9
the above command will perform a check (p9 = grouper /data partition) without attempting to make any repairs. You'll know if there are any problems: you will get page after page of error messages. If the filesytem is free of errors, you will only see 8-10 summary lines.
Click to expand...
Click to collapse
Ok before I start with all this i have to say a few things! The tablet now started rebooting even in recovery! and also since the first time it started rebooting I tried enabling usb debugging, but as I explained earlier after every reboot every change disappears, meaning usb debugging is not enabled when i enter the recovery! Will I be able to do anything at all with fastboot if the usb debugging is not enabled? If not do I have any other option?

Googsx said:
Ok before I start with all this i have to say a few things! The tablet now started rebooting even in recovery! and also since the first time it started rebooting I tried enabling usb debugging, but as I explained earlier after every reboot every change disappears, meaning usb debugging is not enabled when i enter the recovery! Will I be able to do anything at all with fastboot if the usb debugging is not enabled? If not do I have any other option?
Click to expand...
Click to collapse
The settings you (try to) apply when the ROM is running (eg the USB debugging toggle) do not affect the recovery. The entire point of a recovery is to have a standalone boot that doesn't depend on other partitions.
Having said that, the use of a "pseudo" SD card that is actually part of the userdata filesystem sometimes does cause problems for the recovery - it tries to mount /data to get you access to ROM files, nandroid backups, etc. I recall getting my N7 into a condition where TWRP's touch interface wouldn't come up because of problems with the userdata partition. But, adb was still available as was fastboot (in the bootloader mode). Also, I was not having spontaneous reboots.
The fact that you are observing spontaneous reboots in the recovery indicates that you might have Hypothesis A going on - flaky hardware. At a minimum however, it means you will not be able to run any long duration backups... for instance, trying to make a rescue backup of your SD card.
You could try and do
Code:
fastboot erase userdata
fastboot format userdata
with the tablet in bootloader mode. Obviously this step will destroy all of your data.
If your tablet is still spontaneously rebooting after that (in the recovery) then your only option will be to return it for repair (motherboard replacement).

[R&D][UNBRICKING] - Thread for trying to solve the OTA brick problem

Intro
Someone contacted me because of my work unbricking Amlogic tablets and sent me their bricked Nexus 7 2013 32GB Wifi version tablet. I have the same tablet and I’ve been exploring unbricking options and looking at the devices. I have not found a solution yet but I have found a lot of interesting things. I worked on several models of Ainol's AML8726-MX SoC tablets and unbricked them in from various states, including having no signs of life and jumping some pins on the nand chip to get it recognized by the computer. Some tablets had similar problems to the Nexus when the bootloader was corrupted from a bad flash. The internal memory showed as zero in TWRP and the tablets wouldn't boot into the system. Checking debug logs showed the memory chip was not initializing. The Ainol tablets don't have a bootloader with a GUI but they did have a external SD card slot, so the tablet could boot from the SD card and run a "rescue flash". If that didn't work, Amlogic also had low-level USB Burning software to write to the tablet, although special files were needed and flashing was tricky.
I don’t know if we will be able to fix the Nexus tablets with this problem or if they are even fixable with the tools available but I’m providing all this information because I’m working on the problem in my spare time and maybe other people want to experiment with their bricked devices as well. There are a couple obvious routes to explore, one being Qualcomm's QPST and QFIL software, as well as other similar software programs for these chips, like the BoardDiag Tool. Another option is try and boot the tablet from a "rescue card" like I used for the Ainol tablets but to do it through an On-The-Go cable. Even if we don't unbrick any tablets, if anything, at least this thread might provide some documentation on the Nexus 7 2013 that doesn’t seem to be available elsewhere. I’ll keep updating this thread with new info and links to drivers, software, documentation and relevant websites. I’ll post what I’ve updated into the “Updates to this thread” section.
The problem
OTA update bricks device and we get one of the following scenarios:
Users can enter fastboot but can not flash, format or erase anything. Trying to start the device or boot into recovery gets stuck on the Google screen with the lock icon.
Same as above but when entering a recovery like TWRP, device hangs on the TWRP logo screen.
Users can not enter fastboot. Plugging the device into the computer shows QHSUSB_DLOAD in the device manager
Users can not enter fastboot. Plugging the device into the computer shows Qualcomm HS-USB QDLoader 9008 in the device manager
Users can not enter fastboot. Plugging the device into the computer shows Qualcomm HS-USB Diagnostics 9006 in the device manager
In 9006 mode the storage shows as Qualcomm MMC Storage USB Device in the Device Manager
---
Trying to flash or format in fastboot returns the following error:
Code:
FAILED <status read failed <Too many links>>
I’ve figured out a way to boot into TWRP and have started collecting logs and other information about the problem. I’ve also figured out the majority of fastboot oem commands which I’ll list below. The device is not initializing the MMC card when it starts up. In dmesg we can see the error:
Code:
mmc0: error -110 whilst initialising MMC card
Where on a working device we see:
Code:
mmc0: new HS200 MMC card at address 0001
mmcblk0: mmc0:0001 MMC32G 28.8 GiB
In the TWRP log we see:
Code:
[COLOR="Red"]E: Could not mount /data and unable to find crypto footer.
E: Unable to mount ‘/data’
E: Unable to recreate /data/media folder.[/COLOR]
Updating partition details…
[COLOR="Red"]E: Unable to mount ‘/system’
E: Unable to mount ‘/data’
E: Unable to mount ‘/cache’[/COLOR]
...done
[COLOR="Red"]E: Unable to mount storage
E: Unable to mount /data/media during GUI startup
E: Unable to mount ‘/cache’[/COLOR]
Full SELinux support is present.
[COLOR="Red"]E: Unable to mount ‘/cache’
E: Unable to set emmc bootloader message.
E: Unable to mount ‘/cache’
E: Unable to mount /data/media/TWRP/ .twrps when trying to read settings file.
E: Unable to mount ‘/data’[/COLOR]
MTP Enabled
Trying to wipe partitions or flash in TWRP fails because the card isn’t mounted at all and the partition table isn’t being read. Everything is running in the RAM and the only filesystems mounted are rootfs, tmpfs, devpts, proc, sysfs, selinuxfs and tmpfs.
Checking the partition table in fastboot using “fastboot oem gpt-info” does return the same results as a working device though. When booting into TWRP we can see “Nexus 7” as an MTP device but there is nothing on it. In Qualcomm’s 9006 Diagnostics mode we can see the device under disk drives in the device manager as Qualcomm MMC Storage USB Device but it doesn’t show up in Qualcomm’s 9008 Download mode. In disk management we can see it as an Unknown 28.81 GB Unallocated Disk. We can see the same thing in MiniTool Partition Wizard but neither Windows or MiniTool can initialize or format the disk. In HDD Raw Copy Tool the device shows as Qualcomm MMC Storage with a capacity of 30.93 GB. I was unable to write a RAW image of mmcblk0.img using HDD Raw Copy Tool, getting the error “Write Error occured at offset 0 (1)”.
My Working Theory
Looking at both the most recent reports of the OTA brick and past reports, it seems like the problem occurs when there is a bootloader update packaged in with the firmware update. It is possible that the eMMC chip is fried because we've seen bugs in the past but I'm working on the assumption that it is not since the chip is recognized, shows the correct capacity and gets registered it in by the kernel. We can also see that persistent_ram has an uncorrectable error in the header and no valid data in the buffer. This could mean a bad eMMC chip but it could also mean the parts of the bootloader are gone or corrupt. It could also mean the GPT is bad.
We can also see that the device is always booting into ttyHSL0 mode which is the UART Serial Console mode for debugging. I don't know a lot about Qualcomm architecture but I do know that there are several modes including diagnostics, download and emergency download mode. It's possible that the tablet is stuck in one of these modes. I read though some Qualcomm documents and it mentions using the NPRGxxxx.hex file to flash your device but it also mentions that, if the chipset supports it, changing the name of the NPRGxxxx.hex file to eNPRGxxxx.hex "allows you to download new images to a mobile device that has an empty or currupt flash device." That function was implemented in 2008 though and I'm unsure if the implementation has changed at all.
Getting Started
I’m not going to cover any of the basics like installing ADB and Fastboot on your computer. This thread is intended for people who already have a working knowledge of using these tools and want to try and work on the bricking problem. If you are don’t have that knowledge and would still like to experiment with your bricked device you can find lots of tutorials on XDA on how to install and use ADB and Fastboot.
I will mention a couple of things I ran into though. Since I hadn't been working on tablets for a while I wasn't able to use ADB in TWRP at first. I noticed that it only worked if I disabled MTP in the TWRP menu. However, updating the Android SDK solved this problem and the updated drivers allow both an MTP and ADB connected at the same time.
There may also be times when you need to disable Windows Driver Signature Verification to be able to install unsigned drivers. Here is a link showing how to do it temporarily. There is also a way to disable it permanently which I think is to run the Command Prompt as Admin and type:
Code:
bcdedit -set loadoptions DISABLE_INTEGRITY_CHECKS
bcdedit -set TESTSIGNING ON
Lastly, you'll probably want to stop Windows from automatically installing drivers for new hardware. You can do that by right clicking on your computer and then going to "properties -> advanced system settings -> hardware -> device installation settings -> no let me choose what to do -> never install driver software from windows update". There are also guides with screenshots on how to do this if you Google it.
---
We can get into a recovery like TWRP by using the fastboot command:
Code:
fastboot boot twrp.img
If booting into recovery fails and the you get stuck on the TWRP logo screen then go back to the bootloader and use the fastboot command:
Code:
fastboot oem reset-dev_info
---
To enter Qualcomm HS-USB QDLoader 9008 “download mode” you can hold down all three hardware buttons when the device is powered off and plugged in. You can also power down the device, hold the Vol+ and the Vol- buttons and then plug in the device. To enter Qualcomm HS-USB Diagnostics 9006 “diagnostic mode” you can press the power button repeatedly then wait around 30 seconds and see if it connects in the device manager. I don’t know what the speed you are supposed to press the button is but it seems to take at least 10 presses, sometimes more. You’ll have to test it out until you get used to doing it.
Tasks
Want to help out? Here are some things I'm working on. There's a good deal of research to do, so even if you don't have a working device you can help. If you have a device that you've totally given up on and are pretty much going to throw out but can still get into the bootloader, test those fastboot oem erase_ commands before tossing the tablet. It will be fastboot oem erase_"partition name". An example is fastboot oem erase_aboot. Just run through them and write down which ones work and which ones don't.
If someone with a bricked tablet has UART off in the bootloader and can boot into TWRP, please check "adb shell cat /proc/cmdline" and tell me if "console=ttyHSL0,115200,n8" is in the commandline. You can check if UART is on or off in the bootloader by using "fastboot getvar all".
Look into other APQ8064 devices to see if files relevant to QPST work. There is a list of devices below that have the same SoC but not the 1AA or FLO tag at the end. Its possible some of these files might work well enough to at least get the memory recognized.
Pull partition table from a working device and format it in partition.bin or partition.mbn for use in QPST.
Try to write partitions pulled from working device back to the tablet in fastboot.
Format partitions from a working device as .mbn files for QPST.
Pull first few raw GB from a bricked tablet and examine it to see if there is data present. If there is then it might mean that those partitions are corrupted and we can focus on writing working partitions back to those location. Try with RAW copy tool and with dd.
Testing QPST software to resurrect the device. Will need more files first, need to structure them as .xml files necessary for the software.
Test "fastboot oem erase_" on other partitions.
Test "fastboot flash" of partitions that aren't normally included in a firmware update, like sb1.img, rpm.img, aboot.img, etc.
General Device Info
Here is a spreadsheet with all the partition info that I've pulled and sorted.
The Nexus 7 2013 is an APQ8064 1AA/FLO Snapdragon 600 series device that is advertised as a S4 Pro. The APQ8064–1AA is the WiFi version and APQ8064-FLO is the LTE version. The ASUS MeMO Pad FHD 10 ME302KL LTE also has the same SoC according to wiki. The platform board is listed as MSM8960 in most of the code.
Here are other devices with an APQ8064 soc but aren't listed as 1AA or FLO:
LG Optimus G
MDP / T
Xiaomi MI-2
Pantech Vega R3
Sharp Aquos Phone Zeta SH-02E
Oppo Find 5
Asus MeMO pad 10 LTE
Asus padfone 2
HTC J Butterfly
HTC Droid DNA
Nexus 4
HTC Butterfly
ZTE Nubia Z5
ZTE Nubia Z5 Mini
ZTE Grand S
Sony Xperia Z
Xperia ZL Sony
Sony Xperia ZR
Fujitsu Arrows S
Sony Xperia Tablet Z
LG Optimus GJ
Nexus 7 2013 Tablet’s Vendor ID is 18d1 and Hexidecimal Syntax is 0x18D1 (used in fastboot). The USB device ID's for different connections are:
Qualcomm HS-USB Diagnostics 9006 (COM3) - USB\VID_05C6&PID_9006&MI_00
Qualcomm HS-USB Diagnostics 9008 (COM4) - USB\VID_05C6&PID_9008
Android Bootloader Interface - USB\VID_18D1&PID_4EE0
Android ADB Interface - USB\VID_18D1&PID_D002
Serial Numbers I've seen are:
Bricked Device - SERIAL NUMBER 2143658709BADCFE ← According to HDD Raw Copy Tool
Bricked Device - SERIAL NUMBER 049973d5 ← According to adb get-serialno
Dumps, Unpacked Partitions and Other Files
Here is a link to a MediaFire folder with various files. So far I have:
Unpacked the 4.04 Bootloader
aboot.img
bootloader.img
rpm.img
sbl1.img
sbl2.img
sbl3.img
tz.img
Pulled all partitions from HDD Raw Copy Backup of a working device
aboot.img
abootb.img
boot.img
DDR.im
first_131071_sectors.img
fsg.img
m9kefs.img
m9kefs2.img
m9kefs3.img
m9kefsc.img
metadata.img
misc.img
modemst1.img
modemst2.img
pad.img
radio.img
recovery.img
rpm.img
rpmb.img
sbl1.img
sbl2.img
sbl2b.img
sbl3.img
sbl3b.img
ssd.img
tz.img
tzb.img
QPST Memory Debug Dump from a bricked device
CODERAM.BIN
CPU_REG.BIN
CPU0_WDT.BIN
CPU1_WDT.BIN
CPU2_WDT.BIN
CPU3_WDT.BIN
EBICS0.BIN
ETB_ERR.BIN
ETB_REG.BIN
IMEM_A.BIN
IMEM_C.BIN
load.cmm
LPASS.BIN
MM_IMEM.BIN
PMIC_PON.BIN
RPM_MSG.BIN
RPM_WDT.BIN
RST_STAT.BIN
SPS_BUFF.BIN
SPS_PIPE.BIN
SPS_RAM.BIN
Unpacked Radio partition from a working device
ACDB.MBN
APPS.MBN
DSP1.MBN
DSP2.MBN
DSP3.MBN
EFS1.MBN
EFS2.MBN
EFS3.MBN
MDM_ACDB.IMG
RPM.MBN
SBL1.MBN
SBL2.MBN

Fastboot Commands
Click To Show Content for examples of each commands usage, partitions that are excepted by a command and additional info.
Regular fastboot commands
Code:
fastboot update
Code:
fastboot update update.img
Code:
fastboot flashall
Code:
fastboot flash
Code:
fastboot flash aboot aboot.img ?
fastboot flash bootloader bootloader.img
fastboot flash rpm rpm.img ?
fastboot flash sbl1 sbl1.img ?
fastboot flash sbl2 sbl2.img ?
fastboot flash sbl3 sbl3.img ?
fastboot flash tz tz.img ?
fastboot flash boot boot.img
fastboot flash cache cache.img
fastboot flash recovery recovery.img
fastboot flash system system.img
fastboot flash userdata userdata.img
Code:
fastboot erase
Code:
fastboot erase all
fastboot erase boot
fastboot erase cache
fastboot erase recovery
fastboot erase system
fastboot erase userdata
Code:
fastboot format
Code:
fastboot format boot
fastboot format cache
fastboot format recovery
fastboot format system
fastboot format userdata
Example of advanced functions:
Code:
fastboot format cache:ext4:0x0000000023000000 cache
(hex value for 587202560 bytes (= 587 MB / 573440 don’t know what this value is but it equals a hex value of 008c000)
Code:
fastboot format cache:0x0000000023000000 cache
(skips fs type and uses default)
Code:
fastboot getvar
Code:
fastboot getvar all
fastboot getvar version-bootloader
fastboot getvar version-baseband
fastboot getvar version-hardware
fastboot getvar ersion-cdma
fastboot getvar variant
fastboot getvar serialno
fastboot getvar product
fastboot getvar secure_boot
fastboot getvar lock_state
fastboot getvar project
fastboot getvar off-mode-charge
fastboot getvar uart-on
fastboot getvar partition-type:<partition name>
fastboot getvar partition-size:<partition name>
Code:
fastboot continue
Code:
fastboot boot
Code:
fastboot boot recovery.img
fastboot boot boot.img
fastboot boot bootloader.img
Example of advanced functions:
Code:
fastboot boot <kernel> [ <ramdisk> [ <second> ] ]
Examples of booting the kernel and ramdisk:
Code:
fastboot boot zImage boot.img-ramdisk.cpio.gz
fastboot -c *cmdline* boot zImage boot.img-ramdisk.cpio.gz
Code:
fastboot flash:raw boot
Same command format as the advanced "fastboot boot" command:
Code:
fastboot flash:raw boot <kernel> [ <ramdisk> [ <second> ] ]
fastboot flash:raw boot zImage boot.img-ramdisk.cpio.gz
Code:
fastboot devices
fastboot continue
fastboot reboot
fastboot reboot-bootloader
fastboot help
Regular fastboot options that might be useful
-c <cmdline> override kernel commandline
Add -c followed by a kernel command. If more than one kernel command is in the line then they should have parenthesis around them like this "console=ttyHSL0,115200,n8 androidboot.hardware=flo". This is used for the "fastboot boot" command to boot into a kernel with different commandline parameters. Here are the kernel commandlines listed in /proc/cmdline:
Code:
console=ttyHSL0,115200,n8 androidboot.hardware=flo user_debug=31 msm_rtb.filter=0x3F ehci-hcd.park=3 androidboot.emmc=true androidboot.serialno=049973d5 bootreason=PowerKey fuse_info=Y ddr_vendor=hynix androidboot.baseband=apq asustek.hw_rev=rev_e androidboot.bootloader=FLO-04.04
-i <vendor id> specify a custom USB vendor id
Add -i and then the vendor id you want to use. The Nexus 7 vendor id is 18d1 and Hexidecimal Syntax is 0x18D1. Fastboot wants the Hex value:
Code:
-i 0x18D1
-b <base_addr> specify a custom kernel base address.
I haven't done this in long enough that I've forgotten how to use it. The default is 0x10000000 and the BOARD_KERNEL_BASE is listed as 0x80200000 in the Nexus code.
-n <page size> specify the nand page size.
The default value is 2048. Add -n and then the value you want to use:
Code:
-n 2048
-S <size>[K|M|G] automatically sparse files greater than size. 0 to disable.
I've never used this. If anyone has any insight, let me know.
fastboot oem commands
I extracted the aboot.img and used Notepad++ to look at the commands. I’m not sure what the variables are for some of them but I’m working on testing some things out. This is how how I figured out “fastboot oem reset-dev_info” would allow “fastboot boot twrp.img” though.
Code:
fastboot oem unlock
fastboot oem lock
fastboot oem device-info
fastboot oem memtest_
fastboot oem gpt-info
fastboot oem fuse_blow
fastboot oem check-fuse
fastboot oem reset-dev_info
Code:
fastboot oem erase_
Usage is erase_<partition name>. I've only tested it on persist so far. I'm assuming this is for partitions that aren't supported by the regular "fastboot erase" command.
Code:
fastboot oem erase_persist
Code:
fastboot oem off-mode-charge 1
fastboot oem off-mode charge 0
fastboot oem uart-on
fastboot oem uart-off

Links
Drivers and Software
Qualcomm Drivers - The one marked 2012 seems to be the newest I could find and is the one I've been using the most.
Qualcomm Product Support Tools (QPST)
Qualcomm Documents
HDD Raw Copy Tool
Nexus 5 Boarddiag Tool
EFS Professional
Links to relevant threads
[REF][R&D] MSM8960 Info, Architecture and Bootloader(s)
[DEV][REF] El Grande Partition Table Reference

Logs
All logs posted to Pastebin.
Fastboot Logs
Nexus 7 2013 - fastboot getvar all
Nexus 7 2013 - fastboot oem gpt-info
ADB Logs
Nexus 7 2013 - Big Collection of Partition Info
Nexus 7 2013 - mmc error - kernel log snippet
Nexus 7 2013 - Bricked Tablet - dmesg
Nexus 7 2013 - Working Tablet - dmesg
Nexus 7 2013 - Bricked Tablet - last_kmsg
Nexus 7 2013 - Working Tablet - last_kmsg
Nexus 7 2013 - Bricked Tablet - Recovery Log
Nexus 7 2013 - Working Tablet - Recovery Log
Nexus 7 2013 - adb shell dmesg | grep mmc0
Nexus 7 2013 - adb shell cat /proc/devices
Nexus 7 2013 - adb shell tail ./etc/fstab
Nexus 7 2013 - adb shell tail ./etc/recovery.fstab
Nexus 7 2013 - adb shell mount
Nexus 7 2013 - adb shell df
Nexus 7 2013 - adb shell cat /proc/cmdline
Nexus 7 2013 - adb shell ls /dev/block
Nexus 7 2013 - adb shell cat /proc/partitions

Updates to this thread
1/24/2015
- Added a link to a spreadsheet with partition info to the original post under "General Info".
- Added a section to the original post for files. Added a link to a MediaFire folder with QPST memory debug of a bricked device as well as dumped and unpacked partitions from a working device. Listed all files in each folder.
- Added another build of the QPST software to the MediaFire folder.
- Edited "Tasks" in original post.
6/01/2015
- Added info on how to pull a full raw backup of a working Nexus 7.
- Added all fastboot and adb logs I have.
- Added more documents to the MediaFire folder.
05/28/2015
- Added a working theory to the initial post.
05/26/2015
- Added more info to the Intro section and the Problem section.
- Formatted the Fastboot Command section differently.
05/25/2015
- Added links to drivers, software and relevant websites.
- Added Qualcomm Documents to the links section.
- Added info about driver installation to the Getting Started section.
- Added a list of other APQ8064 devices.
- Reformatting some things to look better. I'll keep working on it.
05/24/2015
- Initial Post

Reserved
Reserved for if there is ever a solution.

I extracted all the partitions in RAW format today. I'll add some more detailed info here in the near future on how I did it but I used software called DiskInternals Linux Reader.
-----
Update: The info on how to make a full RAW backup of the entire device without having an external SD card to save it to can be found in this thread. I made some adjustments for the Nexus 7 and I did it all in Cygwin.
To make device backup in Cygwin and TWRP open a terminal and do this:
Code:
adb forward tcp:5555 tcp:5555
adb shell
/sbin/busybox nc -l -p 5555 -e /sbin/busybox dd if=/dev/block/mmcblk0
Then open a second Cygwin Terminal and do this:
Code:
adb forward tcp:5555 tcp:5555
cd /nexus
nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0.img
You can then mount the image you pulled with DiskInternals Linux Reader. It will show you all of the individual partitions, all of the unllocated gaps between partitions and some info about each one. You can open the EXT4 partitions like /system to explore them and you can also open the radio.img and see everything inside. You can then save all the partitions as individual images. This method doesn't work with the bricked tablet. I'm building a spreadsheet with info on all the partitions.

fuser-invent said:
I extracted all the partitions in RAW format today. I'll add some more detailed info here in the near future on how I did it but I used software called DiskInternals Linux Reader.
Click to expand...
Click to collapse
From a working or an OTA-bricked device?

MattG987 said:
From a working or an OTA-bricked device?
Click to expand...
Click to collapse
I pulled them all from a working device so I can try to write them back to the bricked device but also so I can try and make the flash programming files for use in QFIL. On another note the bricked devices can show up in the Windows file manager as a single small partitions with a list of files. I found out today that those files are the contents of the radio partition. I have a folder with those files from a bricked and working device now and I'll do a hex comparison to see if they are still all intact on the bricked device. That also means the FAT partition at the very beginning of the eMMC chip is still there and working, so the whole chip isn't "dead".

Hi fuser-invent,
Thank you for your job.
Do you have any solution to write a stock rom to flash memory ?
Lollipop OTA bricked my Nexus 7 2013. Several people reporting this problem.
I can't unlock bootloader and adb sideload not work.
Thanks.

yodtc said:
Hi fuser-invent,
Thank you for your job.
Do you have any solution to write a stock rom to flash memory ?
Lollipop OTA bricked my Nexus 7 2013. Several people reporting this problem.
I can't unlock bootloader and adb sideload not work.
Thanks.
Click to expand...
Click to collapse
Still working on it but my job suddenly got really, really busy. Hoping to get back into it after the holiday rush. I wish there were other people trying to work on this problem too though.
Sent from my iPhone using Tapatalk

I just received a new Nexus 7 on 5.1.1
It isn't bricked but when I flash TWRP it shows all the unable to mount errors in your first post and I can't access the sdcard. When I use the TWRP option to boot to system it says there's no OS installed but it does boot into android. I flashed the 6.0 img without any issues. Still the same problem with TWRP.
I've never had any issues like this before.

Andrew025 said:
I just received a new Nexus 7 on 5.1.1
It isn't bricked but when I flash TWRP it shows all the unable to mount errors in your first post and I can't access the sdcard. When I use the TWRP option to boot to system it says there's no OS installed but it does boot into android. I flashed the 6.0 img without any issues. Still the same problem with TWRP.
I've never had any issues like this before.
Click to expand...
Click to collapse
Have you tried the multi-rom TWRP that fixes the mount point problems?

autocon said:
Have you tried the multi-rom TWRP that fixes the mount point problems?
Click to expand...
Click to collapse
No, I wasn't aware of that until you mentioned it.
Thanks for the suggestion. I'll give it a shot when I have a chance. Should probably fix it since apparently the devices that shipped with 5.0 have the issue.

Andrew025 said:
No, I wasn't aware of that until you mentioned it.
Thanks for the suggestion. I'll give it a shot when I have a chance. Should probably fix it since apparently the devices that shipped with 5.0 have the issue.
Click to expand...
Click to collapse
I've the same issue and used the Multirom to workaround, but what about ROMs that say "use the latest version of TWRP" ?
If this is a software-caused problem, has the Android team been notified with a bug report or something?

As owner of 2 N7 2013 devices, one of them bricked, I would like to thank you for your work and time.
I find this thread very instructive and I think I will try to follow the leads you provided and try to get my device back to life.
Alas, much study is needed on my part!
I also found some info that may or may not be useful here:
github.com/aureljared/unbrick_8960
I hope I can find and share something useful, and wish you all good luck!

N7 2013 32GB Bricked
I look forward to doing some testing my self with this tablet... Problem is, my bootloader is locked and I can't unlock it since it won't format the internal storage... can't even boot into TWRP because of that.
Anyway, I'm very interested in using DD to flash the partitions at some point if that's available. I can also get into download mode, so using the qualcomm utility to write that way. It's just sitting here, waiting to be revived!

Following the instructions above, I could get to the point where I have the partitions of the working device.
I can also put both devices in 9008 mode, and the bricked device only in 9006 mode also. Although windows registers it as diagnostic mode, QPST is reading both 9008 and 9006 as Download Mode, and does not allow me to backup the working device.
So, as far as QPST goes, I'm kind of stuck.
But, reading what I found in github.com/aureljared/unbrick_8960 I might still have a chance: I just have to understand how to set up the files that are needed though...
Wish you all a good day!

orzem said:
Following the instructions above, I could get to the point where I have the partitions of the working device.
I can also put both devices in 9008 mode, and the bricked device only in 9006 mode also. Although windows registers it as diagnostic mode, QPST is reading both 9008 and 9006 as Download Mode, and does not allow me to backup the working device.
So, as far as QPST goes, I'm kind of stuck.
But, reading what I found in github.com/aureljared/unbrick_8960 I might still have a chance: I just have to understand how to set up the files that are needed though...
Wish you all a good day!
Click to expand...
Click to collapse
I think we need to build our own flashing files using aureljared's method. I have a ton of partitions and data ripped. I'll try to upload it soon so everyone has access to expirement with.
Sent from my iPhone using Tapatalk

Yes, I think so too. Also considering the fact that those scripts are much more understandable than a closed source program, even to me and my scarce knowledge.
Just a thought: why try and rebuild the partition table and then copy each partition in its place? Wouldn't it be much easier to just "dd" the working device in one single file and then "dd" it back on the bricked one?
Of course, IF (and only if) the hex and mbn provided by aureljared succed in switching the device into Streaming Protocol and let us actually write to memory.
If there's anything I can do, I'll be glad to do it.
Have a nice day!

wifi turning itself off, driver not being loaded.

Edit: Considering all the complex processes that I've done, I'm willing to do some series of steps again with the gathered knowledge, but I still need some guidance.
Actual status: Losing my mind (not fixed)
Here's the info of my current problem:
I have a XT1563, cid12 (cl)
Working perfectly until android 6.0 OTA. After restart, in the wifi screen loading bar is constantly present and switches itself off after a couple of seconds of activated. Network list is empty, mac address appears as 02:00:00:00:00:00 in wifi details and status of the phone.
Sent it to support and they 'updated the software', when I got it back wifi was working, but when I installed sd and sim cards back it stopped working.
The most relevant logcat message that appears to be the main one is from WifiStateMachine:
Code:
WifiStateMachine: Fail to set up pno, want false now false
WifiStateMachine: Failed to load driver
Things I've done
Most of this steps have been tried with clean installs and removing sd/sim cards
Network Reset
Factory Reset
Flash different stock roms (currently on 6.0.1 MPD24.107-52)
Flashed ultra kernel R2, R3 and squid kernels 14, 15, 15 oc, 15b
Used twrp 2.8.7 and 3.0.0-r2
Used rsd to flash official firmware for my carrier (RETLA-ENTEL_6.0_MPD24.65-25.1)
Flashed CM 12 and CM 13 unofficial
Installed SuperSU and Busybox
Changed owners and permits in persist/
Copied new persist from different sources
Hex edited .bin file in persist/
downloaded WCNSS_wlan_dictionary.dat and put it in persist to comply with symlink in prima/
fastboot oem install [2 of my carriers; entel, claro]
Replaced WCNSS files in persist with the ones available the motorola repo
Copied WCNSS factory file to prima/ folder
Copied WCNSS_qcom_cfg.ini to /data/misc/wifi
went crazy with 776 permissions
Even after flashing stock with RSDLite, bootloader show the modified status as 3 when I think it should be 2. This has led me to think that something is in the file system that android does not like but is not being fixed by RSD nor clean wipes.
From what I understand, the only thing that could be surviving full flashes and wipes are contents in persist/ and modifications to the root of the system, like busybox and superSU. I've not been able to find any way of cleaning the root of the phone and I imagine that's really dangerous.
TL;DR Wifi driver is not loading, persist folder is ok and clean flash does not fix it.
Possibly relevant logcat entries:
E WifiService: Invoking mWifiStateMachine.setWifiEnable
D WifiStateMachine: setting operational mode to 1
E WifiHW : User build,dont Start logging service.
E WifiService: Invoking mWifiStateMachine.setWifiEnabled
E WifiStateMachine: Failed to load driver
D WifiStateMachine: setWifiState: unknown state
Info for nerds:
Source code of WifiStateMachine.java containing the error message:
Code:
public boolean processMessage(Message message) {
switch (message.what) {
case CMD_START_SUPPLICANT:
[B]if (mWifiNative.loadDriver())[/B] {
// Code for loading supplicant
} else {
loge("Failed to load driver");
}
break;
# More code
}
}
WifiNative.java cointains the class being instantiated where the evaluation calls a empty abstract method:
Code:
public native static boolean loadDriver();
I'm having problems for identifying where this class is being extended for this method to actually do something. If anyone knows please leave a comment.

Wifi problems and fixes
I've still not found a solution for myself, but I figured I still can give some tips for people with problems, especially considering how confusing is to get information about this.
This is a work in progress. I would gladly receive corrections and new info.
Before anything, do a backup. Even if your wifi does not work, it can save you from a lot of problems. Remember to backup the persist folder, a lot of automated recoveries don't make a backup of that folders because it's supposed to survive flashes but there's ways in which you can do it by mistake. It also helps a lot with bug hunting.
Things you should have already tried:
Plane mode on, reboot, wifi on and plane mode off
Network settings reset in android and reboot
Rebooted to safemode (longpress in power off when turning phone off]
Factory reset in android
Removal of SD and SIM cards
Factory reset in recovery
Flash Stock ROM in RDSlite
Unlock bootloader
Activate developer mode and set usb debug on
Installed custom recovery
Clean Flash stock ROM trough fastboot
Flash custom Kernels
Things you need:
adb and fastboot
usb drivers for the phone
Optional Text editor that preserves text format (avoid notepad and MS word)
Optional Busybox for extended commands in android shell (root required)
Optional If you're in windows and want to mess with adb: A decent console to work with.
Option A: cash with cmder
Install cmder
Install NodeJs
Install cash tipping in cmd npm install cash-global -g (after NodeJs)
Option B: babun
http://babun.github.io/
optional Open text editor for easy copy-paste of long paths and commands
optional Hex editor if you want to edit .bin files. I use XVI32
Useful console commands (In windows you need one of the optional shells described above)
List files and folders
Code:
ls -la [path to list]
Find file/folder in linux (and android shell)
Code:
find / -iname '*[word you're looking]*'
* are 'wildcards', they allow for matching any text (or no text at all)
you can add, before -iname, -type f (for files) or -type d (for folders)
Symlink
It's an alternative of copying files. this allows you to simulate having a file in two different places, but really all paint to one. Modifications in this source are going to affect all the links, so it's easier to configure. Android does this a lot.
Code:
ln -s [path to] [from]
Copy files and folders
Code:
cp [-R if you want to move folders] [path to source] [path to target]
logcat for essential wifi messages (short-colored) If someone know more, please let me know
Code:
adb logcat -v brief -v color WifiSerice:V WifiHW:V WifiStateMachine:V FileUtils:V QSEECOMAPI:V *:S
change owners and permissions
the flag -R makes the command work for files and subfolders
Code:
chown user:group [path to file or folder]
chmod [num of user][num of group][num of all] [path to file or folder] [SIZE="2"](e.g. chmod 660 /persist/WCNSS_qcom_wlan_nv.bin)[/SIZE]
grep
This one is awesome; It's for filtering the results of any command, so you can use it for filtering.
Code:
[command you want to filter] | grep -i [term you're looking for]
For example, [adb logcat] gives you a huge list of messages, but [adb logcat | grep -i wifi] gives you just the lines that contain 'wifi'
From my experience, this are the common folders related to wifi configs:
Code:
/persist/
/system/etc/firmware/wlan/prima/
/system/etc/wifi/
/data/misc/wifi/
Command list for do a full clean flash:
please note that system.img_sparsechunk can vary in number according to ROM, but I've put 9 in here because failed commands don't write to phone
note: fastboot flash partition gpt.bin works perfectly when used first, but for me it's failing when I erase system and boot first.
Code:
fastboot erase system -w
fastboot erase boot
fastboot erase fsg
fastboot flash partition gpt.bin
fastboot flash bootloader bootloader.img
fastboot flash logo logo.bin
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash system system.img_sparsechunk.0
fastboot flash system system.img_sparsechunk.1
fastboot flash system system.img_sparsechunk.2
fastboot flash system system.img_sparsechunk.3
fastboot flash system system.img_sparsechunk.4
fastboot flash system system.img_sparsechunk.5
fastboot flash system system.img_sparsechunk.6
fastboot flash system system.img_sparsechunk.7
fastboot flash system system.img_sparsechunk.8
fastboot flash system system.img_sparsechunk.9
fastboot flash modem NON-HLOS.bin.
fastboot erase modemst1
fastboot erase modemst2
fastboot flash fsg fsg.mbn
fastboot erase cache
fastboot erase userdata
fastboot erase customize
fastboot erase clogo
fastboot reboot (or reboot-bootloader)
Important: Every time you flash, do a clean wipe. In fastboot this usually means using erase system -w and erase boot before flashing.
Be aware that for getting the logcat your phone must be booted to android OS.
Be aware that for copying and modifying important files you must access the phone's shell either in recovery mode or switching to root with the command (su) that's only accesible if you're rooted.
Ok. If you made it this far you're probably losing your mind. To debug this, especially if you're going to post asking for help, get the catlog of your phone and/or a precise description to look for clues to your problem (I have a command ready for you above).
Here's some common solutions I've found while trying to solve my own problem: (Credits to the authors of the solutions)
Bad permissions/users
These appear to be correct or usable permissions for relevant files. Consider that there's a lot of fragmentation in this info so they might be wrong.
Confirmation of these would be great:
Code:
-rwxrwx--- wifi wifi /system/etc/wifi
-rw-rw---- wifi wifi /system/etc/wifi/wpa_supplicant.conf
-rwxrwx--- wifi wifi /data/misc/wifi
-rwxrwx--- wifi wifi /data/misc/wifi/sockets
-rw-rw---- wifi wifi /data/misc/wifi/wpa_supplicant.conf
-rw-rw---- system:wifi /data/misc/wifi/WCNSS_qcom_cfg.ini
-rw-rw---- wifi wifi WCNSS_qcom_wlan_nv.bin
-rw-rw---- root root WCNSS_wlan_dictionary.dat
-rwxrwx--- is 770, -rw-rw---- is 660
Is reported in some places that the parent folder of wpa_supplicant.conf should be -rw-rw---- wifi wifi
Missing or badly configured wpa_supplicant.conf
The solution is place a new copy of the file in the correct folders. If someone has a 'oficial' source or more info let me know
I remember reading that some people had success deleting the file so the SO rebuilds it. Do it to your discretion and remember to backup
Missing WCNSS files
These files are essential and must be in the correct paths for wifi drivers to load.
There's a lot of different sources for this files, but from my experiencie they don't change a lot (last commits are more than one year old).
Files in oficial source repository from motorola
These posts have info and files
http://forum.xda-developers.com/showthread.php?t=2589790
http://forum.xda-developers.com/showpost.php?p=48861415&postcount=19
Paths of relevant files. Please consider that not just because it's here means you need it
Code:
/persist/WCNSS_qcom_wlan_nv.bin
/persist/WCNSS_qcom_wlan_factory_nv.bin
/persist/WCNSS_qcom_wlan_dictionary.dat
/system/etc/firmware/wlan/prima/WCNSS_qcom_cfg.ini
/system/etc/firmware/wlan/prima/WCNSS_cfg.dat
/system/etc/firmware/wlan/prima/WCNSS_qcom_wlan_nv.bin
/system/etc/firmware/wlan/prima/WCNSS_qcom_wlan_dictionary.dat
/system/etc/firmware/wlan/prima/WCNSS_qcom_wlan_factory_nv.bin
/data/misc/wifi/WCNSS_qcom_cfg.ini
/data/misc/wifi/wpa_supplicant.conf
Missing /persist/drm/widevine and/or /persist/prov
Check this two posts:
http://forum.xda-developers.com/showthread.php?t=2589790
http://forum.xda-developers.com/showpost.php?p=48861415&postcount=19
In there you can find backups to get the folders, restore them to /persist/ and check permissions.
Bad MAC address in WCNSS_qcom_wlan_nv.bin
Sometimes the file WCNSS_qcom_wlan_nv.bin needs to be updated with the correct mac address.
Since it's a .bin file, it cannot be changed with a text editor. You need to use a hex editor (XVI32 link is in 'things you need' above).
The mac address starts at 'A' (since is hex) or, more simply, after 10 'cells'. Be aware that in this editor changes get 'inserted' instead of modified, so you have to delete the initial 6 addresses of the old mac.
Put the file back, and check permissions. There's two copies of this file: one in /persist/ and another in /system/etc/firmware/wlan/prima/ change one or both according with your situation
Some logcat messages and details about them
For getting more messages about wifiHW you need a userdebug build like CyanogenMod. Stock roms don't log wifiHW.
Code:
WifiStateMachine: failed to load driver
WCNSS_qcom_cfg.ini and/or WCNSS_cfg.dat is missing somewhere. In my case this was missing from /system/etc/wifi.
Code:
wcnss_service: CAL file not found
This refers to the calibration file. The source of wcnss-service.c defines this file as "WCNSS_qcom_wlan_cal.bin" in the path "/data/misc/wifi/WCNSS_qcom_wlan_cal.bin". however, source show that CAL file is not used if the factory file is present. Source in link gives this address '"/data/misc/wifi/WCN_FACTORY" which is weird because from posts in xda this file has the name "CNSS_qcom_wlan_factory_nv.bin" I'll update if I have more info
Info for nerds:
How android Wifi works:
https://community.freescale.com/docs/DOC-93603
source code for wifi opt framework - android 6.0.1 r22
source code for wifi qcom framework - android 6.0.1 r22

you need hex editor to edit those .bin files.www.droidrzr.com/topic/65438-how-to-change-your-mac-address-xt926/
forum.xda-developers.com/nexus-4/help/nexus-4-mac-changer-spoofing-t2180809/page3

Thank you for your answer!
I'll make the edit in the file but I'll take a while to report back on the results because it's already too late in here.
Considering this, would it make sense for a nonmatching mac address show up as 02:00:00:00:00 in the wifi details screen?

RoDeltaLambda said:
Thank you for your answer!
I'll make the edit in the file but I'll take a while to report back on the results because it's already too late in here.
Considering this, would it make sense for a nonmatching mac address show up as 02:00:00:00:00 in the wifi details screen?
Click to expand...
Click to collapse
Yes, your Mac address is fine, just checked I also have the same
try this and report if its working
1. Put the phone into airplane mode.
2. Restart the phone.
3. Turn on WiFi.
4. Connect to the WiFi network.
5. Turn off airplane mode.

bablu048 said:
Yes, your Mac address is fine, just checked I also have the same
try this and report if its working
1. Put the phone into airplane mode.
2. Restart the phone.
3. Turn on WiFi.
4. Connect to the WiFi network.
5. Turn off airplane mode.
Click to expand...
Click to collapse
I've tried those steps and it's not working.
Logcat shows "WifiStateMachine: Failed to load driver" in each attempt.
I will update the .bin modifications results in a couple of minutes

bablu048 said:
you need hex editor to edit those .bin files.www.droidrzr.com/topic/65438-how-to-change-your-mac-address-xt926/
forum.xda-developers.com/nexus-4/help/nexus-4-mac-changer-spoofing-t2180809/page3
Click to expand...
Click to collapse
I have tried the modifications to no avail.
Steps I did:
get the wifi mac address from the recovery logs
adb pull the files on recovery with persist mounted
hex edited the lines taken from the screenshot on your second link (Both _factory_nv.bin and _nv.bin
adb pushed lines back to mounted persist on recovery
cleaned data/cache/dalvik
rebooted to system
Is there something in the /data/ folder that could be causing the issue? Now both files show back at -rw-r--r-- permissions with root:root owner. I'll try again without wiping data this time and post the report.

RoDeltaLambda said:
I have tried the modifications to no avail.
Click to expand...
Click to collapse
I think this thread solved the problem just by replacing the files from another device forum.cyanogenmod.org/topic/84876-wifi-failure-after-cm11-install-still-present-after-restore-from-backup/

bablu048 said:
I think this thread solved the problem just by replacing the files from another device forum.cyanogenmod.org/topic/84876-wifi-failure-after-cm11-install-still-present-after-restore-from-backup/
Click to expand...
Click to collapse
I have tried the steps in that topic, copying the exact same files in /persist and /prima. Problem still persists
From that topic I've learned that at flash time the files from persist are taken out and sent to system folders. I will try to reflash now with the new files and permissions set up

After the actions of my last post and before the new flash, I scanned the results of adb logcat *: D | grep Wifi
Here are some entries that could be of interest:
more possibly relevant logcat entries:
Code:
[SIZE="2"][I]Initially country code appears to be empty:[/I][/SIZE]
I WifiService: WifiService trying to set country code to with persist set to true
WifiService: Client connection lost with reason: 4
I WifiService: WifiService trying to set country code to cl with persist set to true
E WifiService: Invoking mWifiStateMachine.setWifiEnable
D WifiStateMachine: setting operational mode to 1
E WifiHW : User build,dont Start logging service.
E WifiService: Invoking mWifiStateMachine.setWifiEnabled
E WifiStateMachine: Failed to load driver
D WifiStateMachine: setWifiState: unknown state

RoDeltaLambda said:
I have tried the steps in that topic, copying the exact same files in /persist and /prima. Problem still persists
From that topic I've learned that at flash time the files from persist are taken out and sent to system folders. I will try to reflash now with the new files and permissions set up
Click to expand...
Click to collapse
I've fully flashed the device with RSD and problem still persist.
Eager to hear some more ideas.

I noticed that in system/etc/firmware/prima, adding to the files I copied, there's one symlink: WCNSS_wlan_dictionary.dat -> /persist/WCNSS_wlan_dictionary.dat
This file is not present in my persist folder (nor the rest of the files in the phone, based on adb shell find . -name WCNSS_wlan_dictionary.dat). I imagine this could clearly cause a problem with the wifi driver looking for a file that does not exist.
Someone has a reliable source where I could get this file? I can try to delete it to see if the SO tries to rebuild something, but I would prefer the safest option first.

have you tried flashing back stock recovery then do a factory reset from there?

copy WCNSS_qcom_wlan_factory_nv.bin to your SD card. Use your filemanger to copy this file to /prima. Reboot
Activate wi-fi, the you'll find your mac adress under Settings > About Phone > Status > Wi-fi MAC Adress
Open WCNSS_qcom_wlan_factory_nv.bin on your phone or PC with a hex editor and type your mac adress inside that file and save it.
File attached just remove .txt
The file is from xt1562

bablu048 said:
copy WCNSS_qcom_wlan_factory_nv.bin to your SD card. Use your filemanger to copy this file to /prima. Reboot
Activate wi-fi, the you'll find your mac adress under Settings > About Phone > Status > Wi-fi MAC Adress
Open WCNSS_qcom_wlan_factory_nv.bin on your phone or PC with a hex editor and type your mac adress inside that file and save it.
File attached just remove .txt
The file is from xt1562
Click to expand...
Click to collapse
Thank you for the file and the instructions. I've checked the diff with 3 different sources:
Meninblack007 - vendor
huawei_msm8916
google android source code
All match, so I'll asume this is a universal file without modifications.
Moving this file to persist/ folder made no difference
I've also tried taking the files from motorola official github repo, copy them to persist/ and flash. Without success this far.
I'll send factory_nv.bin to prima folder and report back

flash the firmware through rsd lite, lock the bootloader and take it again to service center.
I am out of ideas and also Google searches.. I'll keep looking and report if I find anything else.

bablu048 said:
copy WCNSS_qcom_wlan_factory_nv.bin to your SD card. Use your filemanger to copy this file to /prima. Reboot
Activate wi-fi, the you'll find your mac adress under Settings > About Phone > Status > Wi-fi MAC Adress
Open WCNSS_qcom_wlan_factory_nv.bin on your phone or PC with a hex editor and type your mac adress inside that file and save it.
File attached just remove .txt
The file is from xt1562
Click to expand...
Click to collapse
I've copied the file between the locations trough adb shell and there's no noticeable difference.
MAC address does not appear either in this screen:
I'll post this image and the versions of the phone in the OP

did u try ultra kernel?
i have same problem.
i flash ultra kernel(r3), and my wifi work fine.

jalal-jap said:
did u try ultra kernel?
i have same problem.
i flash ultra kernel(r3), and my wifi work fine.
Click to expand...
Click to collapse
Yes I've tried.
Flashed ultra kernel R2, R3 and squid kernels 14, 15, 15 oc, 15b
Click to expand...
Click to collapse
Considering all the changes I've done, it was a good idea to try again.
I've tried the last release of squid kernel, since the dev of ultra kernel recommended this one for 6.0.1.
Installed the kernel, wiped cache/dalvik and rebooted without success. Logcat is still showing failure at loading drivers.
The main problem I'm having is that the failure point is not correctly specified, so now I'll try to dig deeper into logcats to see if I pinpoint the source of the issue. If anyone can let me know about some complementary logs, I would be super grateful.

I've installed CM to have a userdebug build, in order to debug more in detail thanks to the logs of wifiHW.
After fixing an error of missing WCNSS_qcom_cfg.ini in /system/etc/wifi (Copied from prima folder) I've came across this error appearing persistently:
Code:
wcnss_service: Failed to open /dev/wcnss_ctrl : Bad address
I've looked around but there's no info of how could I deal with this. I will dig around a little more but if someone has a tip I would gladly hear

build.prop missing in OPR1.170623.026.8.1.10 (Android O)?

Hi,
I recently got my M1 A1 from Elisa, in Estonia(packages says Global Version). I've been looking for a guide to enable camera2 API, and since I'm not interested in root or other functionalities, I figured I could only edit build.prop file in /system with the relevant
Code:
persist.camera.HAL3.enabled=1
line.
My steps so far:
1. Unlock the bootloader.
2.Temporarily boot into TWRP:
Code:
PS C:\platform-tools> .\adb reboot bootloader
PS C:\platform-tools> .\fastboot devices
28833e59 fastboot
PS C:\platform-tools> .\fastboot boot recovery-tissot.img
downloading 'boot.img'...
OKAY [ 0.755s]
booting...
OKAY [ 0.592s]
finished. total time: 1.353s
3. Mount /system from TWRP
4. Try to pull out build.prop:
Code:
PS C:\platform-tools> .\adb pull /system/build.prop c:\platform-tools
adb: error: failed to stat remote object '/system/build.prop': No such file or directory
At this point, I was starting to worry: wrong TWRP, /system was not mounted properly, etc.. But then I tried:
Code:
PS C:\platform-tools> .\adb pull /system/default.prop
/system/default.prop: 1 file pulled. 0.0 MB/s (893 bytes in 0.052s)
...and it worked perfectly:
Code:
#
# ADDITIONAL_DEFAULT_PROPERTIES
#
ro.secure=1
security.perf_harden=1
ro.adb.secure=1
ro.allow.mock.location=0
ro.debuggable=0
ro.oem_unlock_supported=true
ro.zygote=zygote64_32
dalvik.vm.image-dex2oat-Xms=64m
dalvik.vm.image-dex2oat-Xmx=64m
dalvik.vm.dex2oat-Xms=64m
dalvik.vm.dex2oat-Xmx=512m
ro.dalvik.vm.native.bridge=0
dalvik.vm.usejit=true
dalvik.vm.usejitprofiles=true
dalvik.vm.dexopt.secondary=true
dalvik.vm.appimageformat=lz4
pm.dexopt.first-boot=quicken
pm.dexopt.boot=verify
pm.dexopt.install=quicken
pm.dexopt.bg-dexopt=speed-profile
pm.dexopt.ab-ota=speed-profile
debug.atrace.tags.enableflags=0
ro.logdumpd.enabled=0
#
# BOOTIMAGE_BUILD_PROPERTIES
#
ro.bootimage.build.date=Wed Jan 10 14:39:53 WIB 2018
ro.bootimage.build.date.utc=1515569993
ro.bootimage.build.fingerprint=xiaomi/tissot/tissot_sprout:8.0.0/OPR1.170623.026/8.1.10:user/release-keys
persist.sys.usb.config=mtp
So, my question: where does that build.prop live or hides? And can default.prop be used instead for the same purposes as build.prop?
What other steps I've tried so far:
- factory reset(twice);
- full firmware flash with MiFlash(and factory reset after);
- different versions of TWRP(best one from here:https://forum.xda-developers.com/showpost.php?p=75357241&postcount=817 )

Oh, and what I've noticed weird is this message, when invoking adb shell:
Code:
PS C:\platform-tools> .\adb shell
linker: error reading config file "/system/etc/ld.config.txt" for "/sbin/busybox" (will use default configuration): error reading file "/system/etc/ld.config.txt": Too many symbolic links encountered
WARNING: linker: error reading config file "/system/etc/ld.config.txt" for "/sbin/busybox" (will use default configuration): error reading file "/system/etc/ld.config.txt": Too many symbolic links encountered

/system/system/build.prop

You should be interested in root in this case, because whenever you mount the system with write privileges which you do, you loose OTAs. Magisk let you to modify the system systemlessly and whenever you receive OTA, you can install it.

sorry but which is the utility of OPR..?

maross said:
You should be interested in root in this case, because whenever you mount the system with write privileges which you do, you loose OTAs. Magisk let you to modify the system systemlessly and whenever you receive OTA, you can install it.
Click to expand...
Click to collapse
I guess I'll just dirty flash new firmwares with MiFlash . Maybe even restore original build.prop, MiFlash, then modify build.prop again. Rooting sometimes affects some apps, i.e. some banking apps won't install, Neflix won't let you download content, and so on.

sidbyron said:
sorry but which is the utility of OPR..?
Click to expand...
Click to collapse
It's just a naming convension for the firmware filename that Xiaomi uses.

quad_bx said:
I guess I'll just dirty flash new firmwares with MiFlash . Maybe even restore original build.prop, MiFlash, then modify build.prop again. Rooting sometimes affects some apps, i.e. some banking apps won't install, Neflix won't let you download content, and so on.
Click to expand...
Click to collapse
Just use Magisk with Magisk hide feature. You will achieve the same with less effort. Btw. direct modification of system will break Safetynet as far as I know, so you won't be able to install Netflix anyway [emoji846]

_mysiak_ said:
Just use Magisk with Magisk hide feature. You will achieve the same with less effort. Btw. direct modification of system will break Safetynet as far as I know, so you won't be able to install Netflix anyway [emoji846]
Click to expand...
Click to collapse
Well, let's take for example TWRP installation.... The official variant does not work on the last Oreo build(internal storage size is seen as 0, can't install). And for Magisk, I could not find a detailed tutorial to follow.
Anyway, let me see if I can find the hidden build.prop and what happens.

quad_bx said:
Anyway, let me see if I can find the hidden build.prop and what happens.
Click to expand...
Click to collapse
So, I've found it. On the plus side, editing it and re-uploading it did not trip SafetyNet. But... camera2 API is not enabled
I've even managed to edit it twice, in system_a and system_b, same result. Rebooting, clearing the app cache for the apps where I wanted to get RAW shooting did not help either.

I confirm build.prop is in /system/system after mounting it with TWRP.
I can pull it, change it, and push it, but nothing actually changes in the phone.
I confirm that going into "adb shell" generates that error.
Issue is: I DON'T WANT to install Magisk, I DON'T WANT to root.
I want auxiliary tele lens exposed to OpenCamera and gCam porting, and I want Whatsapp forced to use HAL1 specifics (as inner Whatsapp camera brakes after enabling Camera2api).
It means to convert this line:
camera.hal1.packagelist=com.skype.raider,com.google.android.talk
To this
camera.hal1.packagelist=com.skype.raider,com.google.android.talk,com.whatsapp
... and nothing more.
To me it sounds stupid to root, installa Magisk and leave the phone unlocked just to tell Whatsapp to use HAL1.
Also for exposing aux camera, it means to turn:
#Expose aux camera for below packages
vendor.camera.aux.packagelist=org.codeaurora.snapcam,com.android.camera,com.huaqin.factory,com.mi.AutoTest
#add by yaoshaorong for Expose aux camera for D2AO-892 for packagelist can't more than 91 byte
vendor.camera.aux.packagelist2=com.android.systemui
to
#Expose aux camera for below packages
vendor.camera.aux.packagelist=org.codeaurora.snapcam,com.android.camera,com.huaqin.factory,com.mi.AutoTest
#add by yaoshaorong for Expose aux camera for D2AO-892 for packagelist can't more than 91 byte
vendor.camera.aux.packagelist2=com.android.systemui,net.sourceforge.opencamera
But it simply doesn't work.
Is this the right file, or do we need to modify something else?

Dm verity and the related error correction changes your modifications back to the stock build.prop