Database Users

FireTV stick2 (tank) - DirtyCow/Kingroot/Kingoroot exercises :

The device came with the original version of Fire OS 5.2.2.0 (555164120) - (ro.build.date=Fri Aug 19 06:41:23 UTC 2016 --- DirtyCow potential ???). The device demands network immediately, no way to bypass (some discussion on bypassing here). Then, after this Amazon connection it immediately checks for updates. Mine did so, and started to download the update.
After that comes Amazon account sign in, and finally one can turn on ADB. The way to avoid the FireOS update & buy time is to limit the bandwidth for the stick & the router, I've limited mine to 40 kbit/s. It complained that Home could not be loaded, and other screens are blank as well. But I got a bit of time to play with it via wireless ADB.
Wireless ADB allows reboot to recovery, but there are no options there at all. It states that the device will soon reboot.
Later on I used the Fire 2015 adb drivers, and was able to run wired ADB from a laptop while having stick2 hooked up to a TV for display.
DirtyCow
With DirtyCow, I attempted to replace /system/build.prop with the edited version that would at least prevent the updates as per this link. Unfortunately, none of the dirtycow executables that I found in misc XDA threads seems to work, and the device immediately crashes, and reboots.
Code:
[email protected]:/data/local/tmp $ ./dirtycow3 /system/build.prop ./build.prop_mod
./dirtycow3 /system/build.prop ./build.prop_mod
WARNING: linker: ./dirtycow3: unused DT entry: type 0x6ffffffe arg 0x600
WARNING: linker: ./dirtycow3: unused DT entry: type 0x6fffffff arg 0x1
size 6130
[] mmap 0xb6e62000
[] exploit (patch)
[] currently 0xb6e62000=6220230a
[] madvise = 0xb6e62000 6130
[] madvise = 0 1048576
[COLOR="Red"]And crash ...[/COLOR]
Kingroot
I've installed the latest Kingroot (NewKingrootV5.0.0_C161_B367_xda_release_2016_11_23_20161123203507_105243.apk) via "adb install kingroot.apk", and managed to run it by doing adb swipes and tabs, and then doing remote click for enter:
Code:
adb shell input touchscreen swipe 50 500 50 100 (swipe up)
adb shell input keyevent 61 (tab)
Kingroot reports rooting successfully, however RootChecker indicates that no SU binaries are installed No root access in shell either.
Kingoroot
I've tried V3.8, again using adb input commands to navigate the lack of touchscreen. Multiple attempts generate "Download error". So no go ...
I feel that there is still potential with DirtyCow and this FireOS build, but it's not clear on how to proceed. For reference, here is the build.prop file :
Code:
# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=LVY48F
ro.build.display.id=LVY48F
ro.build.version.incremental=288.5.5.5_user_555164120
ro.build.version.number=555164120
ro.build.version.name=Fire OS 5.2.2.0 (555164120)
ro.build.version.fireos=5.2.2.0
ro.build.version.fireos.sdk=4
ro.build.version.fireos=5.2.2.0
ro.build.version.fireos.sdk=4
ro.build.version.sdk=22
ro.build.version.codename=REL
ro.build.version.all_codenames=REL
ro.build.version.release=5.1.1
ro.build.version.security_patch=2016-06-01
ro.build.version.base_os=
ro.build.date=Fri Aug 19 06:41:23 UTC 2016
ro.build.date.utc=1471588883
ro.build.type=user
ro.build.lab126.sign.type=release
ro.build.user=build
ro.build.host=ip-10-11-3-123
ro.build.tags=release-keys
ro.build.flavor=full_tank-user
ro.build.platform.version=
ro.build.configuration=tv
ro.fireos.target.extension=default
ro.fireos.target.product=full_tank
ro.product.brand=Amazon
ro.product.name=full_tank
ro.product.device=tank
ro.product.package_name=com.amazon.tank.android.os
ro.product.board=tank
# ro.product.cpu.abi and ro.product.cpu.abi2 are obsolete,
# use ro.product.cpu.abilist instead.
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.cpu.abilist=armeabi-v7a,armeabi
ro.product.cpu.abilist32=armeabi-v7a,armeabi
ro.product.cpu.abilist64=
ro.product.manufacturer=Amazon
ro.product.locale.language=en
ro.product.locale.region=US
ro.wifi.channels=
ro.board.platform=mt8127
# ro.build.product is obsolete; use ro.product.device
ro.build.product=tank
# Do not try to parse description, fingerprint, or thumbprint
ro.build.description=full_tank-user 5.1.1 LVY48F 288.5.5.5_user_555164120 release-keys
ro.build.fingerprint=Amazon/full_tank/tank:5.1.1/LVY48F/288.5.5.5_user_555164120:user/release-keys
ro.build.characteristics=tv
# end build properties
#
# from device/amazon/tank/system.prop
#
#
# system.prop for generic sdk
#
ro.sf.lcd_density=320
#support opengles 2.0 3.0 is 196608
ro.opengles.version=131072
ro.audio.silent=0
#ACOS_MOD_BEGIN {amazon_audio}
media.aac_51_output_enabled=true
#ACOS_MOD_END {amazon_audio}
# MTK, Infinity, 20090720 {
wifi.interface=wlan0
# MTK, Infinity, 20090720 }
# MTK, mtk03034, 20101210 {
ro.mediatek.wlan.wsc=1
# MTK, mtk03034 20101210}
# MTK, mtk03034, 20110318 {
ro.mediatek.wlan.p2p=1
# MTK, mtk03034 20110318}
# MTK, mtk03034, 20101213 {
mediatek.wlan.ctia=0
# MTK, mtk03034 20101213}
#
wifi.tethering.interface=ap0
#
wifi.direct.interface=p2p0
log.tag.ControllerManagerLogs=DEBUG
# Switching Menu of Mass storage and MTP
ro.sys.usb.storage.type=mtp,mass_storage
# USB BICR function
ro.sys.usb.bicr=yes
# USB Charge only function
ro.sys.usb.charging.only=yes
#smartvolume
ro.smartvolume.config=/system/vendor/smartvolume/tank/
ro.config.notification_sound=Verso.ogg
persist.panel.orientation=0
# maximum backup size for factory reset whitelist in kB
ro.recovery.wl.maxstore=524288
#uart kernel log
persist.sys.uart.klog.enable=n
# wifi rssi->bar thresholds
persist.wifi.rssi.thresholds=-86,-79,-68,-62
# Audio Rotation
ro.audio.monitorRotation=true
#add for 8127 stick as cec playback device type
ro.hdmi.device_type=4
# btremoted control properties
btremoted.decode.enabled=1
btremoted.plc.enabled=1
btremoted.trim_length=40
btremoted.socket=btsco_audiohal
#debug.ignore.search_intent=true
# Netflix
ro.nrdp.modelgroup=FIRETVSTICK2016
#resolution setting is AUTO (1 | 0) == (true | false)
persist.sys.resolution.auto=1
# Performance - Disable dirty region for Mali which improves fluidity
debug.hwui.render_dirty_regions=false
# Disable the shimmer on the left menu and in the 1D lists
# This flag needs to be set in addition to the low performing device setting within the Launcher apk
launcher.focusAnimationEnable=false
# Dalivik flags which optimize the memory for a low Ram device
dalvik.vm.dexopt-flags=v=n,o=v,m=y
dalvik.vm.dex2oat-filter=space
dalvik.vm.image-dex2oat-filter=speed
# HWUI flags which optimize the memory usage for a 1080p low ram devices
ro.hwui.texture_cache_size=45
ro.hwui.layer_cache_size=31
ro.hwui.r_buffer_cache_size=8
ro.hwui.dt_cache_size=200
# Disable the BackupManagerService
# disabling this in addition to taking android.software.backup out of the build is needed to stop BackupManagerService from running
ro.backup.disable=true
# Disable lockscreen by default
ro.lockscreen.disable.default=1
# Skinny process. Saves Dalvik heap space for smaller processes.
# Can save up to 20 MB
dalvik.vm.skpheapgrowthlimit=20m
dalvik.vm.skpheapmaxfree=512k
dalvik.vm.skpheapminfree=128k
dalvik.vm.skpheapstartsize=2m
dalvik.vm.skpheaptargetutil=0.95
#
# ADDITIONAL_BUILD_PROPERTIES
#
ro.com.android.dateformat=MM-dd-yyyy
ro.config.ringtone=Ring_Synth_04.ogg
ro.config.notification_sound=Verso.ogg
ro.carrier=unknown
ro.config.alarm_alert=Alarm_Classic.ogg
ro.build.lab126.buildtype=Nightly
ro.build.lab126.project=full_tank_ship_5220
ro.build.lab126.build=1641
drm.service.enabled=true
mtk_in_house_tee_support=true
ro.mediatek.platform=MT8127
persist.radio.combo.chipid=-1
ro.btstack=default
dalvik.vm.heapstartsize=5m
dalvik.vm.heapgrowthlimit=96m
dalvik.vm.heapsize=256m
dalvik.vm.heaptargetutilization=0.75
dalvik.vm.heapminfree=512k
dalvik.vm.heapmaxfree=2m
ro.mediatek.chip_ver=S01
ro.mediatek.version.release=ALPS.W10.24.p0
ro.textview.marqueedelay=20
debug.log.base.path=/data/debug_service
debug.log.battery.enable=n
debug.log.battery.sleep=60
debug.log.temperature.enable=n
debug.log.temperature.sleep=10
debug.log.thermal_qa.enable=n
debug.log.dmesg.enable=n
debug.log.dmesg.wakeup=0
debug.log.logcat.enable=n
debug.log.coredump.enable=n
persist.debug.wfd.enable=1
ro.mtk_wfd_support=1
ro.mtk_wfd_sink_support=1
ro.mtk_wfd_hdcp_rx_support=1
ro.sf.hwrotation=0
ro.smartvolume.config=/system/vendor/smartvolume/tank/
persist.sys.dalvik.vm.lib.2=libart.so
persist.sys.recovery.batt_level=0
ro.amazon.fosflags=1
persist.sys.ota.verified=unverified
persist.sys.last_verified_build=none
ro.logd.size.vitals=128000
ro.logd.size.metrics=128000
dalvik.vm.isa.arm.features=div
net.bt.name=Android
dalvik.vm.stack-trace-file=/data/anr/traces.txt
And fastboot variables :
Code:
C:\Program Files\Minimal ADB and Fastboot>fastboot getvar all
(bootloader) max-download-size: 134217728
(bootloader) partition-size:userdata: 18869be00
(bootloader) partition-type:userdata: unknown
(bootloader) partition-size:cache: fa00000
(bootloader) partition-type:cache: unknown
(bootloader) partition-size:system: 35c00000
(bootloader) partition-type:system: unknown
(bootloader) partition-size:TEE2: 500000
(bootloader) partition-type:TEE2: unknown
(bootloader) partition-size:TEE1: 500000
(bootloader) partition-type:TEE1: unknown
(bootloader) partition-size:LOGO: 380000
(bootloader) partition-type:LOGO: unknown
(bootloader) partition-size:MISC: 80000
(bootloader) partition-type:MISC: unknown
(bootloader) partition-size:recovery: 1000000
(bootloader) partition-type:recovery: unknown
(bootloader) partition-size:boot: 1000000
(bootloader) partition-type:boot: unknown
(bootloader) partition-size:UBOOT: 100000
(bootloader) partition-type:UBOOT: unknown
(bootloader) partition-size:EXPDB: 1160000
(bootloader) partition-type:EXPDB: unknown
(bootloader) partition-size:DKB: 100000
(bootloader) partition-type:DKB: unknown
(bootloader) partition-size:KB: 100000
(bootloader) partition-type:KB: unknown
(bootloader) secure: yes
(bootloader) kernel: lk
(bootloader) product: TANK
(bootloader) version: 0.5
(bootloader) unlock_status: false
(bootloader) unlock_version: 1
(bootloader) unlock_code: 0x0f9ec595f8011b35
(bootloader) prod: 1
all: Done!!
finished. total time: 0.094s
And fastboot output:
Code:
C:\Program Files\Minimal ADB and Fastboot>fastboot oem get_unlock_data
...
FAILED (remote: the command you input is restricted on locked hw)
finished. total time: 0.016s
C:\Program Files\Minimal ADB and Fastboot>fastboot oem unlock
...
FAILED (remote: the command you input is restricted on locked hw)
finished. total time: 0.000s
C:\Program Files\Minimal ADB and Fastboot>fastboot boot TWRP_Fire5_2.8.7.0.img
downloading 'boot.img'...
OKAY [ 0.266s]
booting...
FAILED (remote: the command you input is restricted on locked hw)
finished. total time: 0.281s
C:\Program Files\Minimal ADB and Fastboot>fastboot oem append-cmdline "androidboot.unlocked_kernel=true"
...
FAILED (remote: the command you input is restricted on locked hw)
finished. total time: 0.016s
C:\Program Files\Minimal ADB and Fastboot>fastboot -i 0x1949 flash unlock unlock_ftv.img
target reported max download size of 134217728 bytes
sending 'unlock' (0 KB)...
OKAY [ 0.016s]
writing 'unlock'...
FAILED (remote: unlock code error)
finished. total time: 0.031s
The unlocking thread for older Fires :
http://forum.xda-developers.com/fire-hd/development/bootloader-unlock-t3129630

I haven't tried this myself, but you can try the "adb shell input touchscreen swipe x1 y1 x2 y2" command to simulate a swipe via adb.

AFTVnews.com said:
I haven't tried this myself, but you can try the "adb shell input touchscreen swipe x1 y1 x2 y2" command to simulate a swipe via adb.
Click to expand...
Click to collapse
Thanks, I did get through the swiping part! But Kingroot did not succeed ...
I've updated the original post to reflect that!

I am very interested in rooting my fire tv stick sideload on 5.2.1.1!
Keep us updated
Just tried KingRoot 5.0.1 emulating swipes/tab. Runs for a while, then fails.

Anything new?

@rbox do you plan to support Fire TV Stick 2 (tank) in the future?

rainman74 said:
@rbox do you plan to support Fire TV Stick 2 (tank) in the future?
Click to expand...
Click to collapse
It's not about rbox choosing to support or not support that device at this point. The Fire TV Stick 2 has not been rooted. If it ever gets rooted, then rbox can decide if he wants to create recovery and roms for it. At this point, there's nothing he can do.

AFTVnews.com said:
It's not about rbox choosing to support or not support that device at this point. The Fire TV Stick 2 has not been rooted. If it ever gets rooted, then rbox can decide if he wants to create recovery and roms for it. At this point, there's nothing he can do.
Click to expand...
Click to collapse
I meant in the future, when Tank possibly has been rooted.

rainman74 said:
I meant in the future, when Tank possibly has been rooted.
Click to expand...
Click to collapse
If I have the actual device, it gets rooted, and there is a 100% pure stock system image, then it is likely.

rbox said:
If I have the actual device, it gets rooted, and there is a 100% pure stock system image, then it is likely.
Click to expand...
Click to collapse
Let's get this man a Tank!

crashnova said:
Let's get this man a Tank!
Click to expand...
Click to collapse
but first it has to get rooted

rainman74 said:
but first it has to get rooted
Click to expand...
Click to collapse
The gentleman said "if he has the actual device, it gets rooted". I'll be buying a second device soon. I'll be more than willing to loan it to @rbox before I even take it out the box or we can start a thread to get funds together for a Tank for him to keep and what not.

Maybe start a bounty for root?

[Guide] Backup/dump/flash partitions in case of e.g. OTA failures - MI A2

If you have a problem with your device, a backup is always handy. Xiaomi is pushing out updates very often, but they lack quality. Most of them were withdrawn. This guide follows this thread closely.
A raw backup, made with adb and to be used with fastboot, needs this prerequisites: Root, busybox, unlocked bootloader, adb enabled.
First, open adb and find out the blockdevices associated with your partitions:
Code:
adb shell
* daemon not running; starting now at tcp:5037
* daemon started successfully
1|jasmine_sprout:/ $ su
jasmine_sprout:/ # ls -al /dev/block/bootdevice/by-name
and you get a complete listing
Code:
total 0
drwxr-xr-x 2 root root 1420 1970-09-09 07:27 .
drwxr-xr-x 3 root root 1480 1970-09-09 07:27 ..
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 abl_a -> /dev/block/mmcblk0p25
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 abl_b -> /dev/block/mmcblk0p26
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 apdp -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 bk1 -> /dev/block/mmcblk0p51
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 bluetooth_a -> /dev/block/mmcblk0p38
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 bluetooth_b -> /dev/block/mmcblk0p50
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 boot_a -> /dev/block/mmcblk0p62
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 boot_b -> /dev/block/mmcblk0p63
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 cache -> /dev/block/mmcblk0p64
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 cmnlib64_a -> /dev/block/mmcblk0p22
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 cmnlib64_b -> /dev/block/mmcblk0p24
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 cmnlib_a -> /dev/block/mmcblk0p21
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 cmnlib_b -> /dev/block/mmcblk0p23
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 ddr -> /dev/block/mmcblk0p28
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 devcfg_a -> /dev/block/mmcblk0p30
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 devcfg_b -> /dev/block/mmcblk0p31
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 devinfo -> /dev/block/mmcblk0p43
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 dip -> /dev/block/mmcblk0p27
lrwxrwxrwx 1 root root 20 1970-09-09 07:27 dpo -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 dsp_a -> /dev/block/mmcblk0p48
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 dsp_b -> /dev/block/mmcblk0p49
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 frp -> /dev/block/mmcblk0p14
lrwxrwxrwx 1 root root 20 1970-09-09 07:27 fsc -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 fsg -> /dev/block/mmcblk0p45
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 hyp_a -> /dev/block/mmcblk0p17
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 hyp_b -> /dev/block/mmcblk0p18
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 keymaster_a -> /dev/block/mmcblk0p36
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 keymaster_b -> /dev/block/mmcblk0p37
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 keystore -> /dev/block/mmcblk0p13
lrwxrwxrwx 1 root root 20 1970-09-09 07:27 limits -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 logdump -> /dev/block/mmcblk0p57
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 logfs -> /dev/block/mmcblk0p44
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 mdtp_a -> /dev/block/mmcblk0p52
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 mdtp_b -> /dev/block/mmcblk0p53
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 mdtpsecapp_a -> /dev/block/mmcblk0p34
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 mdtpsecapp_b -> /dev/block/mmcblk0p35
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 minidump -> /dev/block/mmcblk0p61
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 misc -> /dev/block/mmcblk0p42
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 modem_a -> /dev/block/mmcblk0p58
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 modem_b -> /dev/block/mmcblk0p59
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 modemst1 -> /dev/block/mmcblk0p46
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 modemst2 -> /dev/block/mmcblk0p47
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 msadp -> /dev/block/mmcblk0p12
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 oops -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 persist -> /dev/block/mmcblk0p55
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 persistbak -> /dev/block/mmcblk0p56
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 pmic_a -> /dev/block/mmcblk0p19
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 pmic_b -> /dev/block/mmcblk0p20
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 rawdump -> /dev/block/mmcblk0p60
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 rpm_a -> /dev/block/mmcblk0p15
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 rpm_b -> /dev/block/mmcblk0p16
lrwxrwxrwx 1 root root 20 1970-09-09 07:27 sec -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 splash -> /dev/block/mmcblk0p54
lrwxrwxrwx 1 root root 20 1970-09-09 07:27 ssd -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 sti -> /dev/block/mmcblk0p39
lrwxrwxrwx 1 root root 20 1970-09-09 07:27 storsec -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root root 20 1970-09-09 07:27 switch -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 system_a -> /dev/block/mmcblk0p65
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 system_b -> /dev/block/mmcblk0p66
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 toolsfv -> /dev/block/mmcblk0p29
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 tz_a -> /dev/block/mmcblk0p32
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 tz_b -> /dev/block/mmcblk0p33
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 userdata -> /dev/block/mmcblk0p69
lrwxrwxrwx 1 root root 20 1970-09-09 07:27 vbmeta_a -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root root 20 1970-09-09 07:27 vbmeta_b -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 vendor_a -> /dev/block/mmcblk0p67
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 vendor_b -> /dev/block/mmcblk0p68
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 xbl_a -> /dev/block/mmcblk0p40
lrwxrwxrwx 1 root root 21 1970-09-09 07:27 xbl_b -> /dev/block/mmcblk0p41
For example you are currently running on slot_b and want to backup the modem firmware. The A2 has no external sd card, so you want to backup into the internal Download folder. So you are looking for the modem_b partition, which is at the /dev/block/mmcblk0p59 location according to above findings. The commands are
Code:
adb shell
1|jasmine_sprout:/ $ su
jasmine_sprout:/ # dd if=/dev/block/mmcblk0p59 of=/sdcard/Download/modem_b.img
393216+0 records in
393216+0 records out
201326592 bytes transferred in 3.725 secs (54047407 bytes/sec)
You can pull the .img with adb or use windows explorer to copy the Image from the Download folder to your computer. This file contains the whole dump of the partition, including empty space, and is therefore larger than the typical fastboot image. However, this images are restoreable via fastboot. To use the backup, place the image in the adb/fastboot folder. Bring your A2 into fastboot mode by restarting it and holding the Vol- key. Then use
Code:
fastboot flash modem_b modem.img
Sending 'modem_b' (196608 KB) OKAY [ 4.617s]
Writing 'modem_b' OKAY [ 1.423s]
Finished. Total time: 6.048s

Using fastboot to repair broken OTA 10.0.5.0 to 10.0.7.0
My OTA continuously failed. First I thought there was something wrong with Magisk (and probably there is, it is not always restoring correct stock_boot.img), but installing a logcat viewer and filtering for the 'update_engine' revealed the SHA256 check sum of certain partitions is not the expected one for a 10.0.5.0 stock. Although the phone was running fine on 10.0.5.0, displaying it in the settings menu, OTA was not able to success. Particularly, the modem, the system and the vendor partition had a wrong checksum. Maybe a beta 10.0.5.0 OTA last time? Xiaomi bugs??
First, I did a backup/dump of the images just in case. Next, I needed correct images. I used the ones from FranticKernel at 4pda, because the posted 10.0.7.0 dump here is also from this source. I already had my 10.0.5.0 stock and patched boot image. I am on b slot. So the procedure is:
Get phone into fastboot mode
Flash stock boot image (10.0.5.0)
Code:
fastboot flash boot_b stock_boot.img
Reflash partitions with wrong checksums (10.0.5.0)
Code:
fastboot flash modem_b modem.img
Sending 'modem_b' (196608 KB) OKAY [ 4.617s]
Writing 'modem_b' OKAY [ 1.423s]
Finished. Total time: 6.048s
fastboot flash system_b system.img
Invalid sparse file format at header magic
Sending sparse 'system_b' 1/5 (524285 KB) OKAY [ 13.054s]
Writing sparse 'system_b' 1/5 OKAY [ 0.003s]
Sending sparse 'system_b' 2/5 (520522 KB) OKAY [ 13.694s]
Writing sparse 'system_b' 2/5 OKAY [ 0.003s]
Sending sparse 'system_b' 3/5 (470908 KB) OKAY [ 14.124s]
Writing sparse 'system_b' 3/5 OKAY [ 0.003s]
Sending sparse 'system_b' 4/5 (517238 KB) OKAY [ 17.176s]
Writing sparse 'system_b' 4/5 OKAY [ 0.002s]
Sending sparse 'system_b' 5/5 (78764 KB) OKAY [ 8.205s]
Writing sparse 'system_b' 5/5 OKAY [ 0.002s]
Finished. Total time: 72.186s
Because of this 'Invalid sparse file format' error you have to restart into fastboot. the flash itself is fine. So hold down power button until reboot and push vol- button
Code:
fastboot flash vendor_b vendor.img
Invalid sparse file format at header magic
Sending sparse 'vendor_b' 1/2 (524285 KB) OKAY [ 13.175s]
Writing sparse 'vendor_b' 1/2 OKAY [ 0.003s]
Sending sparse 'vendor_b' 2/2 (179804 KB) OKAY [ 13.025s]
Writing sparse 'vendor_b' 2/2 OKAY [ 0.003s]
Finished. Total time: 29.100s
Again restart into fastboot.
Code:
fastboot boot patched_boot.img
Downloading 'boot.img' OKAY [ 0.733s]
booting OKAY [ 10.353s]
Finished. Total time: 11.102s
Now your phone boots into temporary root. Open the OTA and let it finish the download. It asks to start the update in the background. Choose continue update, until it is finished and it asks you to restart. Now open Magisk. Go to 'install' and choose 'Install to inactive slot (after OTA)'. If finished without errors, choose restart in Magisk. The phone restarts and is finally at the newest security patch level (10.0.7.0 at the date of writing) with system-less root enabled.
Don't forget to backup files for next OTA

Fastboot commands not working

I am having an irritating issue with my Essential PH-1 and Arch. I can issue adb commands without any issue, both booted into the system as well as in recovery (TWRP) - adb devices lists it as a device or in recovery correctly, I can reboot the device into bootloader or recovery, I can push and pull files/folders consistently in both. The issue lies with fastboot.
Fastboot commands are only recognized a handful of times. Otherwise, they return "Remote: unknown command". Sometimes fastboot doesn't say it, however; it runs the command and then hangs indefinitely. I can change slots when this happens, but fastboot never confirms that the slot switching has completed (I can see it in recovery). I cannot flash anything, seemingly.
I have libmtp, android-tools, and android-udev installed (basically ensuring that my computer can use MTP, has adb and fastboot, and has the proper rules to recognize my phone). I have also tried simply using my own udev rules, using different versions of adb and fastboot (platform tools pulled directly from Google, others), not much seems to work. I can mount the device and interact with it via Thunar just fine.
The issue seems localized to my installation as when using the same laptop (Macbook Pro 11,1) the commands all work fine in OSX (Leopard+). Additionally, they work on an Ideapad running Manjaro Cinnamon (I didn't do anything except install android-tools) and Windows 10, the newest MacBook Pro in both OSX Mojave and Windows 8. Oddly they do not work on a PC running Windows 10, but I have no explanation for that. I have had this issue with Arch off and on for the last few years, but never really properly investigated - I always just booted back into OSX when I had to. I've recently removed OSX and don't want to keep it around just for fastboot, so I'd like to sort this.
I have included some logs from both dmesg and lsusb, as well as a snippet of what I see with fastboot.
I'm cross-posting this to the Arch forums just in case someone there can also shed light.
$ lsusb #adb
Code:
Bus 002 Device 002: ID 05ac:8406 Apple, Inc.
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 003: ID 05ac:0259 Apple, Inc. Internal Keyboard/Trackpad
Bus 001 Device 006: ID 05ac:8289 Apple, Inc.
Bus 001 Device 002: ID 0a5c:4500 Broadcom Corp. BCM2046B1 USB 2.0 Hub (part of BCM2046 Bluetooth)
Bus 001 Device 007: ID 2e17:c032
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
$ lsusb #bootloader
Code:
Bus 002 Device 002: ID 05ac:8406 Apple, Inc.
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 003: ID 05ac:0259 Apple, Inc. Internal Keyboard/Trackpad
Bus 001 Device 006: ID 05ac:8289 Apple, Inc.
Bus 001 Device 002: ID 0a5c:4500 Broadcom Corp. BCM2046B1 USB 2.0 Hub (part of BCM2046 Bluetooth)
Bus 001 Device 008: ID 2e17:c009
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
$ lsusb #recovery
Code:
Bus 002 Device 002: ID 05ac:8406 Apple, Inc.
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 003: ID 05ac:0259 Apple, Inc. Internal Keyboard/Trackpad
Bus 001 Device 006: ID 05ac:8289 Apple, Inc.
Bus 001 Device 002: ID 0a5c:4500 Broadcom Corp. BCM2046B1 USB 2.0 Hub (part of BCM2046 Bluetooth)
Bus 001 Device 010: ID 18d1:4ee2 Google Inc. Nexus Device (debug)
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
$ dmesg # snipped; shows adb, fastboot, and recovery in sequence
Code:
[ 155.611958] usb 1-2: new high-speed USB device number 7 using xhci_hcd
[ 155.753376] usb 1-2: New USB device found, idVendor=2e17, idProduct=c032, bcdDevice= 2.23
[ 155.753383] usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 155.753387] usb 1-2: Product: PH-1
[ 155.753391] usb 1-2: Manufacturer: Essential Products
[ 155.753393] usb 1-2: SerialNumber: PM1LHMA7B0304243
[ 194.716447] usb 1-2: USB disconnect, device number 7
[ 201.673283] usb 1-2: new high-speed USB device number 8 using xhci_hcd
[ 201.814408] usb 1-2: New USB device found, idVendor=2e17, idProduct=c009, bcdDevice= 1.00
[ 201.814411] usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 201.814413] usb 1-2: Product: Mata
[ 201.814415] usb 1-2: Manufacturer: Essential Products
[ 201.814416] usb 1-2: SerialNumber: PM1LHMA7B0304243
[ 225.328643] usb 1-2: USB disconnect, device number 8
[ 241.717526] usb 1-2: new high-speed USB device number 9 using xhci_hcd
[ 241.858738] usb 1-2: New USB device found, idVendor=18d1, idProduct=4ee7, bcdDevice= 2.23
[ 241.858744] usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 241.858747] usb 1-2: Product: PH-1
[ 241.858749] usb 1-2: Manufacturer: Essential Products
[ 241.858751] usb 1-2: SerialNumber: PM1LHMA7B0304243
[ 247.209126] usb 1-2: USB disconnect, device number 9
[ 247.597186] usb 1-2: new high-speed USB device number 10 using xhci_hcd
[ 247.738482] usb 1-2: New USB device found, idVendor=18d1, idProduct=4ee2, bcdDevice= 2.23
[ 247.738487] usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 247.738489] usb 1-2: Product: PH-1
[ 247.738492] usb 1-2: Manufacturer: Essential Products
[ 247.738493] usb 1-2: SerialNumber: PM1LHMA7B0304243
Various fastboot commands
Code:
PM1LHMA7B0304243 fastboot
$ fastboot getvar current-slot
getvar:current-slot FAILED (remote: unknown command)
Finished. Total time: 0.002s
$ fastboot getvar current-slot
current-slot:
Finished. Total time: 0.002s
$ fastboot getvar current-slot
getvar:current-slot FAILED (remote: unknown command)
Finished. Total time: 0.002s
$ fastboot getvar current-slot
current-slot:
Finished. Total time: 0.002s
$ fastboot getvar current-slot
current-slot: _a
Finished. Total time: 0.002s
$ fastboot getvar all
all:
Finished. Total time: 0.001s
$ fastboot getvar all
getvar:all FAILED (remote: unknown command)
Finished. Total time: 0.001s
$ fastboot getvar all
all:
Finished. Total time: 0.001s
$ fastboot getvar all
(bootloader) version:0.5
(bootloader) unlocked:yes
(bootloader) off-mode-charge:1
(bootloader) charger-screen-enabled:1
(bootloader) battery-soc-ok:yes
(bootloader) battery-voltage:4222
(bootloader) version-baseband:2.0.c4-M2.0.9
(bootloader) version-bootloader:mata-b9326aa
(bootloader) variant:eek:PENUS
(bootloader) partition-type:userdata:ext4
(bootloader) partition-size:userdata: 0x1986B57000
(bootloader) partition-type:system_a:ext4
(bootloader) partition-size:system_a: 0x100000000
(bootloader) has-slot:nvdef:yes
(bootloader) has-slot:dsp:yes
(bootloader) has-slot:vendor:yes
(bootloader) has-slot:devcfg:yes
(bootloader) has-slot:cmnlib64:yes
(bootloader) has-slot:cmnlib:yes
(bootloader) has-slot:boot:yes
(bootloader) has-slot:keymaster:yes
(bootloader) has-slot:abl:yes
(bootloader) has-slot:mdtp:yes
(bootloader) has-slot:mdtpsecapp:yes
(bootloader) has-slot:bluetooth:yes
(bootloader) has-slot:modem:yes
(bootloader) has-slot:pmic:yes
(bootloader) has-slot:hyp:yes
(bootloader) has-slot:tz:yes
(bootloader) has-slot:rpm:yes
(bootloader) has-slot:xbl:yes
(bootloader) has-slot:system:yes
(bootloader) current-slot:_a
(bootloader) slot-retry-count:_b:6
(bootloader) slot-unbootable:_b:no
(bootloader) slot-successful:_b:yes
(bootloader) slot-retry-count:_a:6
(bootloader) slot-unbootable:_a:no
(bootloader) slot-successful:_a:yes
(bootloader) slot-count:2
(bootloader) slot-suffixes:_a,_b,
(bootloader) secure:yes
(bootloader) serialno:PM1LHMA7B0304243
(bootloader) product:Mata
(bootloader) max-download-size:0x20000000
(bootloader) kernel:uefi
all:
Finished. Total time: 0.005s

What cable are you using to connect your device to the computer?
Sent from my PH-1 using Tapatalk

had a similar problem, fixed it with using this adb and fastboot
https://forum.xda-developers.com/essential-phone/development/stock-7-1-1-nmj20d-t3701681
also i recommend flashing the stock fastboot images as well, re-doing the process from stock with the new adb and fastboot

Sudo fastboot xxx
Sent from my PH-1 using XDA Labs

This sounds like the problem I just hit on my new AMD Ryzen/motherboard (with the latest USB spec) and an Essential PH-1.
I tried setting the ports to USB2 mode with:
Code:
sudo lspci -nn | grep USB | cut -d '[' -f4 | cut -d ']' -f1 | xargs [email protected] sudo setpci -H1 -d @ d0.l=0
and that did not work. This is on Debian Buster.
After six hours of swearing, I switched over to my 2014-era i7 laptop, also on Debian Buster, and everything worked perfectly out of the gate.
I saw some advice on another thread that ADB and USB3 behave poorly together. The suggestion there is to use a USB2 hub between the phone and computer. I haven't had a chance to try that yet, but if you're up for an experiment, it would be interesting to hear your result.
Also, be aware that Debian Buster currently has a packaging problem and mke2fs does not work from fastboot. There's a bug on it, without traction currently.

rignfool said:
What cable are you using to connect your device to the computer?
Sent from my PH-1 using Tapatalk
Click to expand...
Click to collapse
I have used three different cables, all USB A to USB C.
yenkoPR said:
had a similar problem, fixed it with using this adb and fastboot
https://forum.xda-developers.com/essential-phone/development/stock-7-1-1-nmj20d-t3701681
also i recommend flashing the stock fastboot images as well, re-doing the process from stock with the new adb and fastboot
Click to expand...
Click to collapse
I have tried this page already, successfully flashing in Manjaro and and Windows the provided links. I have attempted it in Arch with the same problem.
avd said:
Sudo fastboot xxx
Sent from my PH-1 using XDA Labs
Click to expand...
Click to collapse
I have already tried this, as well as running as super user from the start, and also have added my user to relevant groups. Still persists.
bill_mcgonigle said:
This sounds like the problem I just hit on my new AMD Ryzen/motherboard (with the latest USB spec) and an Essential PH-1.
I tried setting the ports to USB2 mode with:
Code:
sudo lspci -nn | grep USB | cut -d '[' -f4 | cut -d ']' -f1 | xargs [email protected] sudo setpci -H1 -d @ d0.l=0
and that did not work. This is on Debian Buster.
After six hours of swearing, I switched over to my 2014-era i7 laptop, also on Debian Buster, and everything worked perfectly out of the gate.
I saw some advice on another thread that ADB and USB3 behave poorly together. The suggestion there is to use a USB2 hub between the phone and computer. I haven't had a chance to try that yet, but if you're up for an experiment, it would be interesting to hear your result.
Also, be aware that Debian Buster currently has a packaging problem and mke2fs does not work from fastboot. There's a bug on it, without traction currently.
Click to expand...
Click to collapse
This is the most likely issue in my mind given the ways the problem has persisted and resolved through the use of different machines. Unfortuntaley, similar to you, the command did not work for me either.

IMEI lost in SIM2 and Fastboot boot as default

Hi people, I hope you can help me.
Yesterday I tried to flash a Custom ROM on my phone. First I tried with ArrowOS 8.1 Downloaded form XDA, but the FP was not working. Surfing here I found a firmware actualization (.zip) for Arrow OS 9, that supposedly fixed this issue, I installed it, but it didn't work Here in #3 found that zip . Also, after installing the update I realized the SIM cards had no signal, so I removed the SIM tray and put it back into the phone and started to get signal again.
I tried to install Pixel Experience 10 Again downloaded from here , and here is were the problems started. My phone stopped dettecting the sim cards, but I thought that could be a problem with the ROM.
I tried to back to Stock, but in the instalation process I get this message
Code:
C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot oem fb_mode_set
< waiting for any device >
...
OKAY [ -0.000s]
finished. total time: 0.016s
C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot flash partition gpt.bin
target reported max download size of 534773760 bytes
sending 'partition' (45 KB)...
OKAY [ -0.000s]
writing 'partition'...
(bootloader) Validating 'gpt.default.xml'
(bootloader) Security version downgrade
(bootloader) Image primary_gpt failed validation
(bootloader) Preflash validation failed
(bootloader) Cancelling 'gpt.default.xml'
FAILED (remote failure)
finished. total time: 0.094s
Also, I have to reformat all my internal storage because I couldn´t access to TWRP since it asked me for a password. So, in this point I tried to flash a Custom ROM and try to fix the IMEI issue. I followed this solution, and I get this:
Code:
C:\Program Files (x86)\Minimal ADB and Fastboot>adb shell
[email protected]:/ $ su
Permission denied
13|[email protected]:/ $ su
[email protected]:/ # ls -l /persist
total 216
drwxrwx--- 2 system system 4096 1969-12-31 18:01 alarm
drwxr-xr-x 2 vendor_mot_pwric vendor_mot_pwric 4096 2018-11-19 01:18 batt_health
drwxrwx--- 2 bluetooth bluetooth 4096 2017-05-11 10:14 bluetooth
drwx------ 2 root system 4096 1969-12-31 18:01 bms
drwxr-xr-x 2 vendor_mot_tcmd bluetooth 4096 1969-12-31 18:01 bt
drwxr-xr-x 5 vendor_mot_tcmd vendor_mot_tcmd 4096 1970-09-27 15:59 camera
drwxrwx--- 2 system system 4096 1970-09-27 15:59 chargeonly
drwx------ 6 system system 4096 2018-02-26 20:08 data
drwxrwx--- 2 system graphics 4096 1970-09-27 15:59 display
drwxrwx--- 2 system system 4096 1969-12-31 18:01 drm
drwxr-xr-x 5 vendor_mot_tcmd vendor_mot_tcmd 4096 2017-05-11 10:15 factory
drwxrwx--- 3 2905 3905 4096 1969-12-31 18:01 hlos_rfs
drwx------ 2 root root 4096 1969-12-31 18:00 lost+found
drwxrwx--- 2 radio radio 4096 2017-05-11 10:14 mdm
drwxrwx--- 2 system system 4096 1969-12-31 18:01 misc
drwxrws--- 2 9004 9004 4096 1970-09-27 15:59 paks
drwxrwx--- 2 system system 4096 1971-06-27 02:22 properties
drwxr-xr-x 11 vendor_mot_tcmd vendor_mot_tcmd 4096 1970-09-27 15:59 public
drwx--x--x 6 2905 2905 4096 1969-12-31 18:01 rfs
drwx------ 2 root root 4096 1970-09-27 15:59 sds
drwxrwx--- 2 system system 4096 1970-09-27 15:59 secnvm
drwxrws--- 2 vendor_mot_tpapi vendor_mot_tpapi 4096 2018-02-26 20:08 security
drwxrwxr-x 3 root root 4096 1970-09-27 15:59 sensors
drwxrwx--- 2 system system 4096 2018-11-19 01:18 time
drwxrwx--- 2 media media 4096 1970-09-27 15:59 vpp
drwxr-xr-x 2 vendor_mot_tcmd vendor_mot_tcmd 4096 1969-12-31 18:01 wifi
drwxrwxr-x 2 vendor_mot_drm vendor_mot_drm 4096 1969-12-31 18:01 wmdrm
[email protected]:/ # find /persist -type -f
find: bad -type '-'
1|[email protected]:/ # find /persist -type f
/persist/sensors/sensors_settings
/persist/data/prov/hOCai-D9scbsJB4cBtOkite43zjWWa0xnUjr7NiT2J
/persist/data/prov/prov
/persist/data/prov/prov.bak
/persist/data/prov/hOCai-D9scbsJB4cBtOkite43zjWWa0xnUjr7NiT2J.bak
/persist/data/prov/JdqMwT4s2iEOWC7QtOqVO3NAjlGCFKhD1XqQk4ed2F
/persist/data/prov/JdqMwT4s2iEOWC7QtOqVO3NAjlGCFKhD1XqQk4ed2F.bak
/persist/data/widevine/pMwYkvIMoTMRsxKzLi7r-jPWCO3Yy0KcV3OFQJYfOx
/persist/data/widevine/widevine
/persist/data/widevine/widevine.bak
/persist/data/widevine/pMwYkvIMoTMRsxKzLi7r-jPWCO3Yy0KcV3OFQJYfOx.bak
/persist/data/widevine/F77+MItbety79Qt23MK8V7bcmXaJiRULkCJtSDlVz-
/persist/data/widevine/F77+MItbety79Qt23MK8V7bcmXaJiRULkCJtSDlVz-.bak
/persist/data/widevine/bnqtL-wVw0py0rBd4JATOP8fMBHIK23JKjeBL70zeh
/persist/data/widevine/bnqtL-wVw0py0rBd4JATOP8fMBHIK23JKjeBL70zeh.bak
/persist/camera/ledcal/rear
/persist/batt_health/age
/persist/mdm/oma_dm_update
/persist/factory/fti
/persist/public/hiddenmenu/data/mobile_data_rx
/persist/public/hiddenmenu/data/mobile_data_tx
/persist/public/hiddenmenu/data/wifi_data_rx
/persist/public/hiddenmenu/data/wifi_data_tx
/persist/public/hiddenmenu/data/factoryreset_time
/persist/public/hiddenmenu/data/activation_date
/persist/public/hiddenmenu/life_calls
/persist/public/hiddenmenu/life_timer
/persist/security/18.bin
/persist/bluetooth/.bt_nv.bin
/persist/time/ats_1
/persist/time/ats_2
/persist/time/ats_15
/persist/time/ats_12
/persist/time/ats_13
/persist/time/ats_16
/persist/rfs/shared/server_info.txt
/persist/rfs/msm/mpss/datablock/id_00
/persist/rfs/msm/mpss/datablock/id_01
/persist/rfs/msm/mpss/server_check.txt
/persist/rfs/msm/mpss/dhob.bin
/persist/rfs/msm/mpss/shob.bin
/persist/rfs/msm/mpss/dhob.bin.bak
/persist/chargeonly/cooldown
/persist/.twrps
When I tried to repair the ownships i gave this :
Code:
2|[email protected]:/ # chown -R rfs:rfs /persist/rfs
chown: bad user 'rfs'
So, this morning I installed Havoc 2.7 also found here in XDA and I had an interesting result, it started to get signal on sim but it stopped detecting sim 2. When I run the same commands to fix the IMEI issue I get this:
Code:
13|[email protected]:/ $ su
[email protected]:/ # ls -l /persist
total 216
drwxrwx--- 2 system system 4096 1969-12-31 18:01 alarm
drwxr-xr-x 2 vendor_mot_pwric vendor_mot_pwric 4096 2018-11-19 01:18 batt_health
drwxrwx--- 2 bluetooth bluetooth 4096 2017-05-11 10:14 bluetooth
drwx------ 2 root system 4096 1969-12-31 18:01 bms
drwxr-xr-x 2 vendor_mot_tcmd bluetooth 4096 1969-12-31 18:01 bt
drwxr-xr-x 5 vendor_mot_tcmd vendor_mot_tcmd 4096 1970-09-27 15:59 camera
drwxrwx--- 2 system system 4096 1970-09-27 15:59 chargeonly
drwx------ 6 system system 4096 2018-02-26 20:08 data
drwxrwx--- 2 system graphics 4096 1970-09-27 15:59 display
drwxrwx--- 2 system system 4096 1969-12-31 18:01 drm
drwxr-xr-x 5 vendor_mot_tcmd vendor_mot_tcmd 4096 2017-05-11 10:15 factory
drwxrwx--- 3 oem_2903 oem_2904 4096 1969-12-31 18:01 hlos_rfs
drwx------ 2 root root 4096 1969-12-31 18:00 lost+found
drwxrwx--- 2 radio radio 4096 2017-05-11 10:14 mdm
drwxrwx--- 2 system system 4096 1969-12-31 18:01 misc
drwxrws--- 2 9004 9004 4096 1970-09-27 15:59 paks
drwxrwx--- 2 system system 4096 1971-06-27 02:22 properties
drwxr-xr-x 11 vendor_mot_tcmd vendor_mot_tcmd 4096 1970-09-27 15:59 public
drwx--x--x 6 oem_2903 oem_2903 4096 1969-12-31 18:01 rfs
drwx------ 2 root root 4096 1970-09-27 15:59 sds
drwxrwx--- 2 system system 4096 1970-09-27 15:59 secnvm
drwxrws--- 2 vendor_mot_tpapi vendor_mot_tpapi 4096 2018-02-26 20:08 security
drwxrwxr-x 3 root root 4096 1970-09-27 15:59 sensors
drwxrwx--- 2 system system 4096 2018-11-19 01:18 time
drwxrwx--- 2 media media 4096 1970-09-27 15:59 vpp
drwxr-xr-x 2 vendor_mot_tcmd vendor_mot_tcmd 4096 1969-12-31 18:01 wifi
drwxrwxr-x 2 vendor_mot_drm vendor_mot_drm 4096 1969-12-31 18:01 wmdrm
1|[email protected]:/ # find /persist -type f
/persist/sensors/sensors_settings
/persist/data/prov/hOCai-D9scbsJB4cBtOkite43zjWWa0xnUjr7NiT2J
/persist/data/prov/prov
/persist/data/prov/prov.bak
/persist/data/prov/hOCai-D9scbsJB4cBtOkite43zjWWa0xnUjr7NiT2J.bak
/persist/data/prov/JdqMwT4s2iEOWC7QtOqVO3NAjlGCFKhD1XqQk4ed2F
/persist/data/prov/JdqMwT4s2iEOWC7QtOqVO3NAjlGCFKhD1XqQk4ed2F.bak
/persist/data/widevine/pMwYkvIMoTMRsxKzLi7r-jPWCO3Yy0KcV3OFQJYfOx
/persist/data/widevine/widevine
/persist/data/widevine/widevine.bak
/persist/data/widevine/pMwYkvIMoTMRsxKzLi7r-jPWCO3Yy0KcV3OFQJYfOx.bak
/persist/data/widevine/F77+MItbety79Qt23MK8V7bcmXaJiRULkCJtSDlVz-
/persist/data/widevine/F77+MItbety79Qt23MK8V7bcmXaJiRULkCJtSDlVz-.bak
/persist/data/widevine/bnqtL-wVw0py0rBd4JATOP8fMBHIK23JKjeBL70zeh
/persist/data/widevine/bnqtL-wVw0py0rBd4JATOP8fMBHIK23JKjeBL70zeh.bak
/persist/camera/ledcal/rear
/persist/batt_health/age
/persist/mdm/oma_dm_update
/persist/factory/fti
/persist/public/hiddenmenu/data/mobile_data_rx
/persist/public/hiddenmenu/data/mobile_data_tx
/persist/public/hiddenmenu/data/wifi_data_rx
/persist/public/hiddenmenu/data/wifi_data_tx
/persist/public/hiddenmenu/data/factoryreset_time
/persist/public/hiddenmenu/data/activation_date
/persist/public/hiddenmenu/life_calls
/persist/public/hiddenmenu/life_timer
/persist/security/18.bin
/persist/bluetooth/.bt_nv.bin
/persist/time/ats_1
/persist/time/ats_2
/persist/time/ats_15
/persist/time/ats_12
/persist/time/ats_13
/persist/time/ats_16
/persist/rfs/shared/server_info.txt
/persist/rfs/msm/mpss/datablock/id_00
/persist/rfs/msm/mpss/datablock/id_01
/persist/rfs/msm/mpss/server_check.txt
/persist/rfs/msm/mpss/dhob.bin
/persist/rfs/msm/mpss/shob.bin
/persist/rfs/msm/mpss/dhob.bin.bak
/persist/chargeonly/cooldown
/persist/.twrps
Also, before that, I ran this in Stock flashable on TWRP solution (posted here, in XDA), but it didn´t work either.
So, how I can fix the IMEI=0 and no detected SIM in slot 2?, what do I have to do to install Stock without that error? also why does it sometimes it boot to bootlader automatically? I have TWRP installed
When i ran
Code:
fastboot gervar all
i get this:
Code:
C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot getvar all
(bootloader) version: 0.5
(bootloader) version-bootloader: moto-msm8953-C0.92
(bootloader) product: potter
(bootloader) board: potter
(bootloader) secure: yes
(bootloader) hwrev: P3B
(bootloader) radio: 2
(bootloader) storage-type: emmc
(bootloader) emmc: 32GB SAMSUNG QX13MB RV=08 PV=07 FV=0000000000000007
(bootloader) ram: 2GB SAMSUNG LP3 DIE=8Gb M5=01 M6=05 M7=00 M8=1F
(bootloader) cpu: MSM8953
(bootloader) serialno:
(bootloader) cid: 0x0032
(bootloader) channelid: 0x0a
(bootloader) uid: 93F2718900000000000000000000
(bootloader) securestate: flashing_unlocked
(bootloader) iswarrantyvoid: yes
(bootloader) max-download-size: 534773760
(bootloader) reason: UTAG "bootmode" configured as fastboot
(bootloader) imei: 351857089397515
(bootloader) meid:
(bootloader) date: 02-28-2018
(bootloader) sku: XT1681
(bootloader) carrier_sku:
(bootloader) battid: SNN5982A
(bootloader) iccid:
(bootloader) cust_md5:
(bootloader) max-sparse-size: 268435456
(bootloader) current-time:
(bootloader) ro.build.fingerprint[0]: motorola/potter_n/potter_n:8.1.0/O
(bootloader) ro.build.fingerprint[1]: PS28.85-13/b8ea:user/release-keys
(bootloader) poweroffalarm: 0
(bootloader) ro.build.version.full[0]: Blur_Version.28.51.16.potter.reta
(bootloader) ro.build.version.full[1]: il.en.US
(bootloader) ro.build.version.qcom: LA.UM.6.6.r1-08600-89xx.0
(bootloader) version-baseband: M8953_41.50.07.82u POTTER_LATAMDSDS_CUST
(bootloader) kernel.version[0]: Linux version 3.18.71-perf-g2148ea10 (hu
(bootloader) kernel.version[1]: [email protected]) (gcc version 4.9.x 201
(bootloader) kernel.version[2]: 50123 (prerelease) (GCC) ) #1 SMP PREEMP
(bootloader) kernel.version[3]: T Fri Aug 17 09:31:36 CDT 2018
(bootloader) sbl1.git: git=MBM-NG-VC0.92-0-gd009c3b
(bootloader) rpm.git: git=92e5e21-dirty
(bootloader) tz.git: git=26cc248-dirty
(bootloader) devcfg.git: git=26cc248-dirty
(bootloader) keymaster.git: git=26cc248-dirty
(bootloader) cmnlib.git: git=26cc248-dirty
(bootloader) cmnlib64.git: git=26cc248-dirty
(bootloader) prov.git: git=26cc248-dirty
(bootloader) aboot.git: git=MBM-NG-VC0.92-0-g3ea8df0
(bootloader) frp-state: no protection (0)
(bootloader) ro.carrier: tefmx
(bootloader) current-slot:
(bootloader) slot-suffixes: _a
(bootloader) slot-count: 1
(bootloader) slot-successful:_a: INVALID
(bootloader) slot-successful:_b: INVALID
(bootloader) slot-bootable:_a: INVALID
(bootloader) slot-bootable:_b: INVALID
(bootloader) slot-retry-count:_a: unknown
(bootloader) slot-retry-count:_b: unknown
all: listed above
finished. total time: 0.109s
Apologies: my English is quite basic and I do not have all the vocabulary to write, I hope someone can help me :c

V20 H990DS Help To Install TWRP And lineage rom

hello
i have a lg v20 h990ds and i want to install twrp for install custom rom on my Phone
i Download Version 7 Android Firmware KDZ and Downgrade with lg up from android 8 to 7 and After try for install twrp recovery fail !
i,m downloaded any rev of android 7 kdz and flash with lg up and try to install twrp is fail !
list android 7 KDZ Rev i downloaded and try :
H990ds10h_00_OPEN_AME_DS_OP_0117.kdz
H990ds10e_00_OPEN_AME_DS_OP_0417.kdz
H990ds10b_00_OPEN_AME_DS_OP_1103.kdz
H990ds10d_00_OPEN_AME_DS_OP_1216.kdz
after flash firmware with lgup i try to install twrp have this Problem :
Step 1 :
C:\adb>step1.bat
C:\adb>adb push dirtysanta /storage/emulated/0
654 KB/s (18760 bytes in 0.027s)
C:\adb>adb push aboot.img /storage/emulated/0
2219 KB/s (2097152 bytes in 0.922s)
C:\adb>adb push dirtycow /data/local/tmp
1218 KB/s (9984 bytes in 0.008s)
C:\adb>adb push my-run-as /data/local/tmp
1349 KB/s (13796 bytes in 0.009s)
C:\adb>adb shell chmod 0777 /data/local/tmp/*
C:\adb>adb shell /data/local/tmp/dirtycow /system/bin/run-as /data/local/tmp/my-run-as
warning: new file size (13796) and file old size (14360) differ
size 14360
[*] mmap 0x743cc53000
[*] exploit (patch)
[*] currently 0x743cc53000=10102464c457f
[*] madvise = 0x743cc53000 14360
[*] madvise = 0 1048576
[*] /proc/self/mem -2122317824 1048576
[*] exploited 0x743cc53000=10101464c457f
C:\adb>adb shell /data/local/tmp/dirtycow /system/bin/applypatch /data/local/tmp/dirtycow
warning: new file size (9984) and file old size (165144) differ
size 165144
[*] mmap 0x76d9697000
[*] exploit (patch)
[*] currently 0x76d9697000=10102464c457f
[*] madvise = 0x76d9697000 165144
[*] madvise = 0 1048576
[*] /proc/self/mem 1367343104 1048576
[*] exploited 0x76d9697000=10102464c457f
C:\adb>adb shell
elsa:/ $ run-as con
elsa:/ # chmod 0777 /storage/emulated/0/*
elsa:/ # id
uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc) context=u:r:shell:s0
elsa:/ #
Step 2 :
C:\adb>step2.bat
C:\adb>adb pull /storage/emulated/0/bootbackup.img
remote object '/storage/emulated/0/bootbackup.img' does not exist
C:\adb>adb pull /storage/emulated/0/abootbackup.img
remote object '/storage/emulated/0/abootbackup.img' does not exist
C:\adb>adb reboot bootloader
Step 3 :
C:\adb>step3.bat
C:\adb>fastboot flash boot boot1.img
target reported max download size of 536870912 bytes
sending 'boot' (40960 KB)...
OKAY [ 1.341s]
writing 'boot'...
FAILED (remote: device is locked. Cannot flash images)
finished. total time: 1.365s
C:\adb>fastboot flash recovery twrp.img
target reported max download size of 536870912 bytes
sending 'recovery' (24964 KB)...
OKAY [ 0.828s]
writing 'recovery'...
FAILED (remote: device is locked. Cannot flash images)
finished. total time: 0.854s
C:\adb>fastboot reboot
rebooting...
finished. total time: 0.009s
Please help me to resolve this problem
Thanks , Regards

mo4sa said:
Please help me to resolve this problem
Click to expand...
Click to collapse
The solution to your problem it's simple enough... You don't follow the instructions the way they are supposed to be follow.
This thread you open about the TWRP failed to install, but it's failing to unlock your device, and it has an entire thread about it. Recently there's one user who has some problems on how to perform this unlock and since I'll not write again (because you and everyone can search ) So this is my most recent post with my considerations/instructions.
How can I say with confidence that you aren't following the instructions? Because on the same thread the most appropriate guide for the H990DS (I have the same device by the way) don't need the step3. And this clear message device is locked, so the unlock failed.
So take your time, read with care and attention what was already discussed on the links that I share here, and if you still have problems, post to the right thread and we can continue this discussion there so others could benefit of this experience as well.