Database Users

shield TV 2015 bricked ?? no root no update...

Hi,
I never root or do anykind of development or advance usage of my shield 2015 pro,
but about 15days ago it just deside do not boot anymore . i don't think it got the last update, so i have no clue why it suddenly not boot anymore
The green light is there, but there is no output.
i tried to invoke the android fastboot with this nethod : http://nvidia.custhelp.com/app/answ...NNXg0SmNhUFlvNHpHMGkwM29mRlZxTVdQUVElMjElMjE=
i also tried to factory reset with :
http://nvidia.custhelp.com/app/answ...hen-you-are-unable-to-access-android-settings
but didn't succeed to see anything, there is no output at all (the TV says so, and i try other stuff the TV works)
i don't know what to do ?
is it actually bricked ? can i do somthing about it ?
Thank you in advance
Bobzer

bobzer said:
Hi,
I never root or do anykind of development or advance usage of my shield 2015 pro,
but about 15days ago it just deside do not boot anymore . i don't think it got the last update, so i have no clue why it suddenly not boot anymore
The green light is there, but there is no output.
i tried to invoke the android fastboot with this nethod : http://nvidia.custhelp.com/app/answ...NNXg0SmNhUFlvNHpHMGkwM29mRlZxTVdQUVElMjElMjE=
i also tried to factory reset with :
http://nvidia.custhelp.com/app/answ...hen-you-are-unable-to-access-android-settings
but didn't succeed to see anything, there is no output at all (the TV says so, and i try other stuff the TV works)
i don't know what to do ?
is it actually bricked ? can i do somthing about it ?
Thank you in advance
Bobzer
Click to expand...
Click to collapse
You didn't mention it so i ask, did you try with other HDMI cables? If still no go and as it is the pro which is more tricky, then better request RMA.
Have you also tried running fastboot commands blindly? I mean do the steps to boot into fastboot/bootloader mode, then if you haven't installed windows drivers try to do so, check device manager, does it recognize your device? What does it show?. If your device is recognized by your PC in fastboot mode and you succeed to install drivers then that will tell us something, otherwise is hard brick but still could be a hardware issue.
Sent from my Tapatalk beta Hub
If I helped hit the Thanks button. Follow Me! ~ DroidMote user ~ Full Android for Shield TV and Nexus Player

lavero.burgos said:
You didn't mention it so i ask, did you try with other HDMI cables? If still no go and as it is the pro which is more tricky, then better request RMA.
Have you also tried running fastboot commands blindly? I mean do the steps to boot into fastboot/bootloader mode, then if you haven't installed windows drivers try to do so, check device manager, does it recognize your device? What does it show?. If your device is recognized by your PC in fastboot mode and you succeed to install drivers then that will tell us something, otherwise is hard brick but still could be a hardware issue.
Sent from my Tapatalk beta Hub
If I helped hit the Thanks button. Follow Me! ~ DroidMote user ~ Full Android for Shield TV and Nexus Player
Click to expand...
Click to collapse
Hi,
thanks for trying to help me,
I tried the cable with another device so the cable is fine
i tried the fastboot blindly but no success (maybe/probably/hopefully i don't do it correctly )
about windows i didn't saw it on windows at all, but that wasn't worry me at that time because i didn't know where to look, so i thought it was maybe normal
about driver no idea of what should i do. during my search i saw little bit about adb
all my search bring me to topic where people did stuff to there shield (root, try rom , etc) i didn't do anything so i don't know what information is relevant for me or not
tonight i will install driver and try again.
just to summarize :
After installing the driver:
- if i see the device in the device manager there is hope
- if not it's hard brick and so i can do nothing ?
if that true ?
thanks you

I would have a look at the SSHD to SSD migration Threads here on XDA (Shield TV), and attempt to make a backup of the SSHD. (If possible). This will of course be of MAJOR IMPORTANCE if you wish to retain any of the Widevine L1 DRM Provider Content (e.g. Amazon, and Netflix. etc.. etc...)
It seems to me that the Bootloader got wiped / corrupted (Which is actually the good news), or the SSHD has died. (Well it probably can't get worse than that.)
In the SSD Migration Thread there is a link to download an Backed up version of someone else's Shield TV. I managed to use this to recover a hard bricked Shield before. My mistake was not making a backup of the Security Sectors of that Device, and I lost all those Services.
It is however possible to rewrite that backup over a working backup to recover the correct L1 Widevine Keys though. IF YOU REMEMBER to make that Backup first. So it's probably​ not too late to do that. The worst case scenario? Your just gonna lose a buttload of DRM Services that you may, or may not even depend on. If your more of a Kodi Person, than this shouldn't even affect you much. But, of course it would be wiser to try and, retain those Widevine Keys if possible.

bobzer said:
Hi,
thanks for trying to help me,
I tried the cable with another device so the cable is fine
i tried the fastboot blindly but no success (maybe/probably/hopefully i don't do it correctly )
about windows i didn't saw it on windows at all, but that wasn't worry me at that time because i didn't know where to look, so i thought it was maybe normal
about driver no idea of what should i do. during my search i saw little bit about adb
all my search bring me to topic where people did stuff to there shield (root, try rom , etc) i didn't do anything so i don't know what information is relevant for me or not
tonight i will install driver and try again.
just to summarize :
After installing the driver:
- if i see the device in the device manager there is hope
- if not it's hard brick and so i can do nothing ?
if that true ?
thanks you
Click to expand...
Click to collapse
Right, if your PC recognize your shield in fastboot mode then it means is alive. When people have hard bricked their devices by corrupted bootloader some are able to boot into APX mode, which confirms their device won't be able to recover (unless Nvidia release the tools), but for others the device won't even turn on.
If your pc recognizes your shield tv in fastboot mode and you are able to install windows drivers and you get an id when typing fastboot devices in cmd, then there is a 50/50 chance of recovering, don't forget the possibility of hardware failure.
The following video can help you, just follow until i open command line and start typing fastboot commands but you just have to type "fastboot devices" command nothing​ else, if you get an id it means that the link with your shield tv is successful.
https://youtu.be/LQaYb4oVHVc
Report back!. Oh but still try other good hdmi cable(s), i tell you for experience, weird **** happens. I have had weird issues with hdmi port and hdmi cable (Amazon basics brand) in the past.

Ichijoe said:
I would have a look at the SSHD to SSD migration Threads here on XDA (Shield TV), and attempt to make a backup of the SSHD. (If possible). This will of course be of MAJOR IMPORTANCE if you wish to retain any of the Widevine L1 DRM Provider Content (e.g. Amazon, and Netflix. etc.. etc...)
It seems to me that the Bootloader got wiped / corrupted (Which is actually the good news), or the SSHD has died. (Well it probably can't get worse than that.)
In the SSD Migration Thread there is a link to download an Backed up version of someone else's Shield TV. I managed to use this to recover a hard bricked Shield before. My mistake was not making a backup of the Security Sectors of that Device, and I lost all those Services.
It is however possible to rewrite that backup over a working backup to recover the correct L1 Widevine Keys though. IF YOU REMEMBER to make that Backup first. So it's probably​ not too late to do that. The worst case scenario? Your just gonna lose a buttload of DRM Services that you may, or may not even depend on. If your more of a Kodi Person, than this shouldn't even affect you much. But, of course it would be wiser to try and, retain those Widevine Keys if possible.
Click to expand...
Click to collapse
thanks, for the idea, i'll first check with the driver.
and after i'll backup the drive at the same time i'll check if there is smart value. in case is the drive which is in a bad state

lavero.burgos said:
Right, if your PC recognize your shield in fastboot mode then it means is alive.
Click to expand...
Click to collapse
to entering the fastboot mode the only way is pressing for about 3sec after powering up or thanks to the drivers it will enter automatically ?
lavero.burgos said:
The following video can help you, just follow until i open command line and start typing fastboot commands but you just have to type "fastboot devices" command nothing​ else, if you get an id it means that the link with your shield tv is successful.
https://youtu.be/LQaYb4oVHVc
Click to expand...
Click to collapse
thanks i can't watch it right now but i'll as soon as possible tonight
lavero.burgos said:
Report back!. Oh but still try other good hdmi cable(s), i tell you for experience, weird **** happens. I have had weird issues with hdmi port and hdmi cable (Amazon basics brand) in the past.
Click to expand...
Click to collapse
I will thanks

bobzer said:
to entering the fastboot mode the only way is pressing for about 3sec after powering up or thanks to the drivers it will enter automatically ?
Click to expand...
Click to collapse
Better to do it manually as i show in the video, the other method from windows never worked for me and for many.

lavero.burgos said:
Better to do it manually as i show in the video, the other method from windows never worked for me and for many.
Click to expand...
Click to collapse
ok thanks
looking forward to try this

so i'm currently trying and sadly i can confirm that the green light is on, cable plug to shield but not recognize at all in the device manager

lavero.burgos said:
Better to do it manually as i show in the video, the other method from windows never worked for me and for many.
Click to expand...
Click to collapse
i did exactly as explained and the nothing happend except that the green light turn off
so when i plug the cable i remove my fing and put it back on the shield and waiting and after a few second the light goes off and stay off but windows still not recognize

Ichijoe said:
I would have a look at the SSHD to SSD migration Threads here on XDA (Shield TV), and attempt to make a backup of the SSHD. (If possible). This will of course be of MAJOR IMPORTANCE if you wish to retain any of the Widevine L1 DRM Provider Content (e.g. Amazon, and Netflix. etc.. etc...)
It seems to me that the Bootloader got wiped / corrupted (Which is actually the good news), or the SSHD has died. (Well it probably can't get worse than that.)
In the SSD Migration Thread there is a link to download an Backed up version of someone else's Shield TV. I managed to use this to recover a hard bricked Shield before. My mistake was not making a backup of the Security Sectors of that Device, and I lost all those Services.
It is however possible to rewrite that backup over a working backup to recover the correct L1 Widevine Keys though. IF YOU REMEMBER to make that Backup first. So it's probably​ not too late to do that. The worst case scenario? Your just gonna lose a buttload of DRM Services that you may, or may not even depend on. If your more of a Kodi Person, than this shouldn't even affect you much. But, of course it would be wiser to try and, retain those Widevine Keys if possible.
Click to expand...
Click to collapse
so i removed the sshd and try to backup it...
that's first that i wasn't able to recover anything from a drive that's appear on my computer
it's so strange because it's there the smart see it but i can't read nothing at all :
Code:
[email protected]:/mnt/raid/backup/shield# ls -l /dev/sdb
brw-rw---- 1 root disk 8, 16 juin 14 02:56 /dev/sdb
[email protected]:/mnt/raid/backup/shield# fdisk -l /dev/sdb
fdisk: impossible d'ouvrir /dev/sdb: Aucun fichier ou dossier de ce type
[email protected]:/mnt/raid/backup/shield# ddrescue -f -n /dev/sdb shield.dd mapfile
GNU ddrescue 1.19
Press Ctrl-C to interrupt
rescued: 0 B, errsize: 0 B, current rate: 0 B/s
ipos: 0 B, errors: 0, average rate: 0 B/s
opos: 0 B, run time: 1 s, successful read: 1 s ago
Finished
commande : 'smartctl' -i -H -c '/dev/sdb'
smartctl 6.4 2014-10-07 r4002 [x86_64-linux-3.16.0-4-amd64] (local build)
Copyright (C) 2002-14, Bruce Allen, Christian Franke, www.smartmontools.org
=== START OF INFORMATION SECTION ===
Model Family: Seagate Laptop SSHD
Device Model: ST500LM000-1EJ162
Serial Number: W764J2R0
LU WWN Device Id: 5 000c50 082dc3e28
Firmware Version: NV9D
Rotation Rate: 5400 rpm
Form Factor: 2.5 inches
Device is: In smartctl database [for details use: -P show]
ATA Version is: ACS-2, ACS-3 T13/2161-D revision 3b
SATA Version is: SATA 3.1, 6.0 Gb/s (current: 1.5 Gb/s)
Local Time is: Wed Jun 14 03:02:44 2017 CEST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled
=== START OF READ SMART DATA SECTION ===
SMART Status not supported: Invalid status byte (0x00) [JMicron]
SMART overall-health self-assessment test result: PASSED
Warning: This result is based on an Attribute check.
General SMART Values:
Offline data collection status: (0x00) Offline data collection activity
was never started.
Auto Offline Data Collection: Disabled.
Self-test execution status: ( 0) The previous self-test routine completed
without error or no self-test has ever
been run.
Total time to complete Offline
data collection: ( 139) seconds.
Offline data collection
capabilities: (0x73) SMART execute Offline immediate.
Auto Offline data collection on/off support.
Suspend Offline collection upon new
command.
No Offline surface scan supported.
Self-test supported.
Conveyance Self-test supported.
Selective Self-test supported.
SMART capabilities: (0x0003) Saves SMART data before entering
power-saving mode.
Supports SMART auto save timer.
Error logging capability: (0x01) Error logging supported.
General Purpose Logging supported.
Short self-test routine
recommended polling time: ( 1) minutes.
Extended self-test routine
recommended polling time: ( 99) minutes.
Conveyance self-test routine
recommended polling time: ( 2) minutes.
SCT capabilities: (0x10b1) SCT Status supported.
SCT Feature Control supported.
SCT Data Table supported.
here the dmesg :
[270724.389743] usb-storage 3-2:1.0: USB Mass Storage device detected
[270724.389819] scsi6 : usb-storage 3-2:1.0
[270724.389901] usbcore: registered new interface driver usb-storage
[270727.372913] scsi 6:0:0:0: Direct-Access ST500LM0 00-1EJ162 PQ: 0 ANSI: 2 CCS
[270727.373406] sd 6:0:0:0: Attached scsi generic sg2 type 0
[270730.079345] sd 6:0:0:0: [sdb] Very big device. Trying to use READ CAPACITY(16).
[270730.079514] sd 6:0:0:0: [sdb] 72057594037927936 512-byte logical blocks: (0 B/0 B)
[270730.079798] sd 6:0:0:0: [sdb] Write Protect is off
[270730.079802] sd 6:0:0:0: [sdb] Mode Sense: 28 00 00 00
[270730.080127] sd 6:0:0:0: [sdb] No Caching mode page found
[270730.080137] sd 6:0:0:0: [sdb] Assuming drive cache: write through
[270730.080827] sd 6:0:0:0: [sdb] Very big device. Trying to use READ CAPACITY(16).
[270730.081756] sdb: unknown partition table
[270730.082349] sd 6:0:0:0: [sdb] Very big device. Trying to use READ CAPACITY(16).
[270730.083081] sd 6:0:0:0: [sdb] Attached SCSI disk
[270736.012772] usb 3-2: USB disconnect, device number 5
someone ? do you have any idea ? what could i do ?

Did you follow this Guide?* Essentially you make this backup in Two parts uninspiredly called "firstpart.bin" (Which is the first Six Gigabytes of the SSHD which also encompasses​ the unique DRM Keys for your Shield.). The lastpart.bin is more or less just the list of checksums for the GPT Partitions.
I wouldn't expect that you would, could or should be able to see anything from the Drive. As most of it is written in a RAW Partition. That is personally beyond my knowledge of how to mount it. That's why you have to make *.bin files which you can then view with a Hex Editor. If you wanted to.
*https://forum.xda-developers.com/shield-tv/general/guide-migrate-to-ssd-hdd-size-satv-pro-t3440195

Ichijoe said:
Did you follow this Guide?* Essentially you make this backup in Two parts uninspiredly called "firstpart.bin" (Which is the first Six Gigabytes of the SSHD which also encompasses​ the unique DRM Keys for your Shield.). The lastpart.bin is more or less just the list of checksums for the GPT Partitions.
I wouldn't expect that you would, could or should be able to see anything from the Drive. As most of it is written in a RAW Partition. That is personally beyond my knowledge of how to mount it. That's why you have to make *.bin files which you can then view with a Hex Editor. If you wanted to.
*https://forum.xda-developers.com/shield-tv/general/guide-migrate-to-ssd-hdd-size-satv-pro-t3440195
Click to expand...
Click to collapse
i did follow this topic but the problem is that dd doesn't works event fdisk don't work
Code:
[email protected]:/mnt/raid/backup/shield# fdisk -l /dev/sdb
fdisk: impossible d'ouvrir /dev/sdb: Aucun fichier ou dossier de ce type
it's fdisk telling me that it can't open my drive sdb no file or directory
i even tried ddrecue so i feel like i'm screwed
but i don't understand because i never saw this kind of problem with dd, i mean even a damage drive i always could start at least , copy a few bytes ... i don't understand what i miss ...

Did you remember to enter elevated root first?
Code:
$ sudo -s
If you don't do this, or you just throw up a sudo fdisk -l. I don't think it'll work. You have to be in an elevated root shell first.
Then you can use:
Code:
# fdisk -l
To list all the Drives currently in your System. Which will be more complicated depending on how many Drives you have.
Again this should list all the Drives currently on your System. You can easily, spot the Shields SSHD by the fact that it is exactly 499GB. Within in this context is the Drive Address. For me this has always been /dev/sda. Where as the local OS was on dev/sdb.
So when you get to this point:
Code:
dd if=/dev/sdX of=firstpart.bin count=6899870
You need to replace sdX with the correct Address of the Shield TVs SSHD. This will then hopefully create a ~3GB File called 'firstpart.bin'
Likewise
Code:
dd if=/dev/sdX bs=512 skip=976773158 of=lastpart.bin
Will create a 5kb File that hosts the Partition Map?
Again you have to replace sdX with the correct Address where the Shield TVs SSHD is hosted.

Ichijoe said:
Did you remember to enter elevated root first?
Code:
$ sudo -s
If you don't do this, or you just throw up a sudo fdisk -l. I don't think it'll work. You have to be in an elevated root shell first.
Then you can use:
Code:
# fdisk -l
To list all the Drives currently in your System. Which will be more complicated depending on how many Drives you have.
Again this should list all the Drives currently on your System. You can easily, spot the Shields SSHD by the fact that it is exactly 499GB. Within in this context is the Drive Address. For me this has always been /dev/sda. Where as the local OS was on dev/sdb.
So when you get to this point:
Code:
dd if=/dev/sdX of=firstpart.bin count=6899870
You need to replace sdX with the correct Address of the Shield TVs SSHD. This will then hopefully create a ~3GB File called 'firstpart.bin'
Likewise
Code:
dd if=/dev/sdX bs=512 skip=976773158 of=lastpart.bin
Will create a 5kb File that hosts the Partition Map?
Again you have to replace sdX with the correct Address where the Shield TVs SSHD is hosted.
Click to expand...
Click to collapse
thanks I will double check tonight but i'm pretty sure that i was root

Ichijoe said:
Did you remember to enter elevated root first?
Code:
$ sudo -s
If you don't do this, or you just throw up a sudo fdisk -l. I don't think it'll work. You have to be in an elevated root shell first.
Then you can use:
Code:
# fdisk -l
Click to expand...
Click to collapse
fdisk don't see the disk
i don't know what to do
I bought a new adapter because at first i thought it could be the adapter but no it's the drive that is like dead. so i bought a new drive but because i can't get a backup of the old one i don't know what to do
can i find somewhere a full backup that i could put in my drive ?
thx

i try to copy with dd and ddrescue, until now i got 0 bytes rescued so i guess my only luck would be to get a backup somewhere else, but even there would i be able to run netflix ?

You should contact Nvidia for replacement, hardware died, not your fault. Unfortunately if you didn't backup the relevant partitions containing your keys, then no you wont be able to watch Netflix.
Sent from my Tapatalk beta Hub
If I helped hit the Thanks button. Follow Me! ~ DroidMote user ~ Full Android for Shield TV and Nexus Player

Hiyas. Welcome a fresh corpse.
Shield 2015, non-pro, bricked by flashing a wrong image.
Bricked well, no adb, no screen, no button - just green led on powerup.
Nvidia says there's no official service in our swamps (lovely, huh) and I'm up to myself.
Anyone with succesful revival? Thanks guys.

Bricked Nook Glowlight 3

I installed relaunchx and rooted the device sucessfully. It was running okay. I set the home button to restart in relaunch rather than the nook software. I rebooted and all it would do is go to the front-screen with the nook barnes and noble logo on the front. I could turn it on and off, but that was it. It charged. I tried to start packages on the device via adb but it said the system wasn't running. I could see processes system processes with ps.
I issued a reboot recovery command via adb. The Nook finally responded with something other than a reboot and it went into recovery and did a full factory reset. I thought I was in the clear. But no. It rebooted and went back to the logo screen as before. However, now I no longer have adb access.This might be because the factory reset turned off usb debugging. So now I can't access the device at all. Does anyone have any ideas how I might be able to proceed? I think the device is functional, but the bootloader is damaged somehow so I can't start Android on the device. Without adb access, I think it's effectively gone.

It's likely that you don't have any home application working.
Or maybe it's completely borked.
Have you tried holding various buttons on a power up to see if you can try recovery again?
The next worst case is just using the hardware console connection (inside the case) to see if you have a shell and what's going on.
For the old NST we had a whole setup to boot over USB even with a totally wiped out flash.
That hasn't been looked at for the newer iMX6 (vs OMAP) Nooks.

Hi,
Renate NST said:
For the old NST we had a whole setup to boot over USB even with a totally wiped out flash.
That hasn't been looked at for the newer iMX6 (vs OMAP) Nooks.
Click to expand...
Click to collapse
I tried to manually root using https://forum.xda-developers.com/showpost.php?p=76496894&postcount=13, replicating commands on Linux, and I totally bricked my Nook - probably bad repacking on boot image.
Code:
[884213.478979] usb 3-3: new high-speed USB device number 123 using xhci_hcd
[884213.607636] usb 3-3: New USB device found, idVendor=15a2, idProduct=0063
[884213.607642] usb 3-3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[884213.607645] usb 3-3: Product: SE Blank MEGREZ
[884213.607648] usb 3-3: Manufacturer: Freescale SemiConductor Inc
[884213.609540] hid-generic 0003:15A2:0063.000C: hiddev0,hidraw0: USB HID v1.10 Device [Freescale SemiConductor
Inc SE Blank MEGREZ] on usb-0000:00:14.0-3/input0
Can you point me to NST setup to recover over USB, I would spend some time to try to recover my Nook.
Thank you!

If you had just wiped out P1 you should still have recovery (on P2) just fine.
Do a restart holding the Home button down.
If this doesn't work you somehow managed to wipe the bootloader.
To get the USB HID bootloader to work would be a bit of a project.
There is the starting point of this tool: https://github.com/boundarydevices/imx_usb_loader
Anything that is written about USB recovery on the NST (which uses OMAP) has nothing to do with the new Glows (iMX6SL).
Hmmm, the Kindle Paper White 2 seems to have the same processor/ROM bootloader...

For what it's worth, here is an overview of the low-level MMC:
Code:
Name 32kB units 512B sectors Byte addresses /dev/block
Start End Start Size Start End
---------- ----- --- ----- ----- ------- ------- ----------
mbr 0 1 0 1FF
sn 1 1 200 3FF
bootloader 2 1022 400 7FFFF
hwcfg 1024 2 80000 803FF
ntxfw 1030 256 80C00 A0BFF
bootenv 1536 510 C0000 FFBFF
boot 33 223 2048 12224 100000 6F7FFF mmcblk0p1
waveform 225 544 14336 20480 700000 10FFFFF
logo 545 608 34816 4096 1100000 12FFFFF
recovery 609 1632 38912 65536 1300000 32FFFFF mmcblk0p2

Renate NST said:
If you had just wiped out P1 you should still have recovery (on P2) just fine.
Do a restart holding the Home button down.
If this doesn't work you somehow managed to wipe the bootloader.
Click to expand...
Click to collapse
I was lucky!
Restart holding the Home button down made no difference.
Trying randomly, I observed restart holding the Home and Right Up buttons goes into fastboot.
I recovered P1 partition for which I had backup and my Nook is live again.
Many thanks!!!
imx_usb_loader would have taken some time to learn.

So you're stuck in the ROM USB bootloader?
To look into a solution I had to get the ROM USB bootloader to run on my Nook to test things.
I didn't feel like bricking the Nook, so that was out.
I disassembled the ROM bootloader and found the correct, erm, workable entry point in the ROM.
Code:
eBR-1A # go [i]<entry address>[/i]
Code:
iManufacturer: 0x01
0x0409: "Freescale SemiConductor Inc "
iProduct: 0x02
0x0409: "SE Blank MEGREZ"
So now I can play around with the ROM USB bootloader.

Renate NST said:
So you're stuck in the ROM USB bootloader?
Click to expand...
Click to collapse
No.
After fastboot got enabled I booted nnglow3.img and then I recovered P1 partition with dd.
My Nook is like new
Thanks,
C

cipibad said:
No.
After fastboot got enabled I booted nnglow3.img and then I recovered P1 partition with dd.
My Nook is like new
Thanks,
C
Click to expand...
Click to collapse
I'm having the same issue as yours, could you please help me to unbrick my device?
I'm a newbie to technology so please help me step by step

I bricked my HD 8 2017 after downgrading from 5.6.4 to 5.6.0.1

Hi, i was happen to wander around the forum to find a method to root my HD 8 2017, and seems that my tablet has automatically update to the point where root is not possible (the current version was 5.6.4.0 build 636559820), therefore i tried to downgrade to 5.6.0.1,since the root method only covers the 636558520 build version, and after using adb sideload, i found out that the device has been totally bricked and can't be turned on, after a few googling. i've found the post about debricking, but requires me to short the TP28 circuit (which i don't know where it was after removing the cover), so i use amonet and it still didn't work, please help!!
--- and here is the log of the terminal:
[email protected]:~/Downloads/amonet$ sudo ./bootrom-step.sh
[2019-11-04 14:00:27.420553] Waiting for bootrom
[2019-11-04 14:00:43.250282] Found port = /dev/ttyACM0
[2019-11-04 14:00:43.287246] Handshake
* * * If you have a short attached, remove it now * * *
* * * Press Enter to continue * * *
b''
b'\x00\x01'
Traceback (most recent call last):
File "main.py", line 256, in <module>
main()
File "main.py", line 129, in main
load_payload(dev, "../brom-payload/build/payload.bin")
File "/home/lubuntu/Downloads/amonet/modules/load_payload.py", line 123, in load_payload
dev.write32(0x10007008, 0x1971) # low-level watchdog kick
File "/home/lubuntu/Downloads/amonet/modules/common.py", line 163, in write32
self.check(self.dev.read(2), b'\x00\x01') # arg check
File "/home/lubuntu/Downloads/amonet/modules/common.py", line 90, in check
raise RuntimeError("ERROR: Serial protocol mismatch")
RuntimeError: ERROR: Serial protocol mismatch

Dkhanh0412 said:
Hi, i was happen to wander around the forum to find a method to root my HD 8 2017, and seems that my tablet has automatically update to the point where root is not possible (the current version was 5.6.4.0 build 636559820), therefore i tried to downgrade to 5.6.0.1,since the root method only covers the 636558520 build version, and after using adb sideload, i found out that the device has been totally bricked and can't be turned on, after a few googling. i've found the post about debricking, but requires me to short the TP28 circuit (which i don't know where it was after removing the cover), so i use amonet and it still didn't work, please help!!
--- and here is the log of the terminal:
[email protected]:~/Downloads/amonet$ sudo ./bootrom-step.sh
[2019-11-04 14:00:27.420553] Waiting for bootrom
[2019-11-04 14:00:43.250282] Found port = /dev/ttyACM0
[2019-11-04 14:00:43.287246] Handshake
* * * If you have a short attached, remove it now * * *
* * * Press Enter to continue * * *
b''
b'\x00\x01'
Traceback (most recent call last):
File "main.py", line 256, in <module>
main()
File "main.py", line 129, in main
load_payload(dev, "../brom-payload/build/payload.bin")
File "/home/lubuntu/Downloads/amonet/modules/load_payload.py", line 123, in load_payload
dev.write32(0x10007008, 0x1971) # low-level watchdog kick
File "/home/lubuntu/Downloads/amonet/modules/common.py", line 163, in write32
self.check(self.dev.read(2), b'\x00\x01') # arg check
File "/home/lubuntu/Downloads/amonet/modules/common.py", line 90, in check
raise RuntimeError("ERROR: Serial protocol mismatch")
RuntimeError: ERROR: Serial protocol mismatch
Click to expand...
Click to collapse
Wow my PM
Please don't pm me for this things, create a thread as you done or ask in the UNBRICK thread.
So about your error..
Mean that you're in Preloader Mode instead of BootROM Mode:
Code:
RuntimeError: ERROR: Serial protocol mismatch
Be sure to have modemmanager disabled.
Try to short again, it can take a lot of tries (For me like 20+).
If still no, change the object that you're using to short.
If thse same, try other USB cable and other USB port (BETTER 2.0 instead 3.0).
If after try all the suggestions still the same error, do the process with the battery disconnected, that worked in most cases.
Cheers!

Rortiz2 said:
Wow my PM
Please don't pm me for this things, create a thread as you done or ask in the UNBRICK thread.
So about your error..
Mean that you're in Preloader Mode instead of BootROM Mode:
Code:
RuntimeError: ERROR: Serial protocol mismatch
Be sure to have modemmanager disabled.
Try to short again, it can take a lot of tries (For me like 20+).
If still no, change the object that you're using to short.
If thse same, try other USB cable and other USB port (BETTER 2.0 instead 3.0).
If after try all the suggestions still the same error, do the process with the battery disconnected, that worked in most cases.
Cheers!
Click to expand...
Click to collapse
Thanks for replying! But can you be more specific about the short process? since i don't know where is the CLK test point of the board, the original guide showed that it is near the the emmc, it would be nice if you can show me the image of where to short on the motherboard? And about the Preloader mode? So i have to use the brick-9820.sh to confirm the brick then proceed to bootrom-step.sh?

Dkhanh0412 said:
Thanks for replying! But can you be more specific about the short process? since i don't know where is the CLK test point of the board, the original guide showed that it is near the the emmc, it would be nice if you can show me the image of where to short on the motherboard? And about the Preloader mode? So i have to use the brick-9820.sh to confirm the brick then proceed to bootrom-step.sh?
Click to expand...
Click to collapse
No, you don't need to run any brick.sh since you already bricked but in the WRONG WAY, so you need to short TP28.
If you search a bit, you can find the TP28 image
https://imgur.com/9ThIUqK (The Light blue one) (thanks @<br />)
You need to short that point with something conductive as a paper clip or a little or a small cable with bare ends.
One end of the object you put in TP28 and the other in any place with metal that is on the motherboard (a screw for example).
At same moment that you're doing this the script should be executed and waiting for handshake the bootROM:
Code:
sudo ./bootrom-step.sh
After that short the point as described and connect the tablet into the computer AT SAME TIME. If all goes OK it will ask to remove the short. Remove it and press enter, the script will do the magic
If you still getting the Serial Protocol error, use my suggestions of my previous post.
That's all, a bit tricky but has solution
Cheers!

I
Rortiz2 said:
No, you don't need to run any brick.sh since you already bricked but in the WRONG WAY, so you need to short TP28.
If you search a bit, you can find the TP28 image
https://imgur.com/9ThIUqK (The Light blue one)
You need to short that point with something conductive as a paper clip or a little or a small cable with bare ends.
One end of the object you put in TP28 and the other in any place with metal that is on the motherboard (a screw for example).
At same moment that you're doing this the script should be executed and waiting for handshake the bootROM:
Code:
sudo ./bootrom-step.sh
After that short the point as described and connect the tablet into the computer AT SAME TIME. If all goes OK it will ask to remove the short. Remove it and press enter, the script will do the magic
If you still getting the Serial Protocol error, use my suggestions of my previous post.
That's all, a bit tricky but has solution
Cheers!
Click to expand...
Click to collapse
Again, thanks bro, you saved my day

Rortiz2 said:
No, you don't need to run any brick.sh since you already bricked but in the WRONG WAY, so you need to short TP28.
If you search a bit, you can find the TP28 image
https://imgur.com/9ThIUqK (The Light blue one) (thanks @<br />)
You need to short that point with something conductive as a paper clip or a little or a small cable with bare ends.
One end of the object you put in TP28 and the other in any place with metal that is on the motherboard (a screw for example).
At same moment that you're doing this the script should be executed and waiting for handshake the bootROM:
Code:
sudo ./bootrom-step.sh
After that short the point as described and connect the tablet into the computer AT SAME TIME. If all goes OK it will ask to remove the short. Remove it and press enter, the script will do the magic
If you still getting the Serial Protocol error, use my suggestions of my previous post.
That's all, a bit tricky but has solution
Cheers!
Click to expand...
Click to collapse
Seems like i've ran into some problems,i still get that same error after numerous times of shortening the circuit,
ModemManager disabled
USB 2.0 port used
A bare-ends wire used to short the circuit
But it still display the serial protocol mismatch error (
Here is the image: https://imgur.com/a/D4JTYhJ

Dkhanh0412 said:
Seems like i've ran into some problems,i still get that same error after numerous times of shortening the circuit,
ModemManager disabled
USB 2.0 port used
A bare-ends wire used to short the circuit
But it still display the serial protocol mismatch error (
Here is the image: https://imgur.com/a/D4JTYhJ
Click to expand...
Click to collapse
Disconnect the battery then.

Rortiz2 said:
No, you don't need to run any brick.sh since you already bricked but in the WRONG WAY, so you need to short TP28.
If you search a bit, you can find the TP28 image
https://imgur.com/9ThIUqK (The Light blue one) (thanks @<br />)
You need to short that point with something conductive as a paper clip or a little or a small cable with bare ends.
One end of the object you put in TP28 and the other in any place with metal that is on the motherboard (a screw for example).
At same moment that you're doing this the script should be executed and waiting for handshake the bootROM:
Code:
sudo ./bootrom-step.sh
After that short the point as described and connect the tablet into the computer AT SAME TIME. If all goes OK it will ask to remove the short. Remove it and press enter, the script will do the magic
If you still getting the Serial Protocol error, use my suggestions of my previous post.
That's all, a bit tricky but has solution
Cheers!
Click to expand...
Click to collapse
Rortiz2 said:
Disconnect the battery then.
Click to expand...
Click to collapse
Well the code did run, but after that nothing happens, i press the power button then the tablet plays a sound, but it still didn't boot up
here is the near end of the log:
[2019-11-05 16:01:19.097336] Force fastboot
[2019-11-05 16:01:19.406864] Flash preloader header
[4 / 4]
[4 / 4]
[2019-11-05 16:01:19.857129] Reboot

Dkhanh0412 said:
Seems like i've ran into some problems,i still get that same error after numerous times of shortening the circuit,
ModemManager disabled
USB 2.0 port used
A bare-ends wire used to short the circuit
But it still display the serial protocol mismatch error (
Here is the image: https://imgur.com/a/D4JTYhJ
Click to expand...
Click to collapse
Well i disconnect the battery and have successfully executed the bootrom-step.sh, and now it still remains bricked, for the first time, when i hold the power button, the tablet plays the start up sound but did not boot up, what should i do now!?

Rortiz2 said:
No, you don't need to run any brick.sh since you already bricked but in the WRONG WAY, so you need to short TP28.
If you search a bit, you can find the TP28 image
https://imgur.com/9ThIUqK (The Light blue one) (thanks @<br />)
You need to short that point with something conductive as a paper clip or a little or a small cable with bare ends.
One end of the object you put in TP28 and the other in any place with metal that is on the motherboard (a screw for example).
At same moment that you're doing this the script should be executed and waiting for handshake the bootROM:
Code:
sudo ./bootrom-step.sh
After that short the point as described and connect the tablet into the computer AT SAME TIME. If all goes OK it will ask to remove the short. Remove it and press enter, the script will do the magic
If you still getting the Serial Protocol error, use my suggestions of my previous post.
That's all, a bit tricky but has solution
Cheers!
Click to expand...
Click to collapse
Well since the method here is almost unusable, i was thinking of flashing the .bin file of my Fire using MiracleBox, maybe this could help with my problem: https://www.google.com/amp/s/ifindhub.com/flash-bin-firmware-files-mediatek-device.html/amp

Dkhanh0412 said:
Well since the method here is almost unusable, i was thinking of flashing the .bin file of my Fire using MiracleBox, maybe this could help with my problem: https://www.google.com/amp/s/ifindhub.com/flash-bin-firmware-files-mediatek-device.html/amp
Click to expand...
Click to collapse
Dude...
That box comunicates with Preloader which is patched on Amazon tablets.. If it were that easy we would have rooted this tablet many years ago.
About your problems, seems like a LCD cable problem. Unmount again the tablet and check all cables, specially the LCD one.
Cheers.

Rortiz2 said:
Dude...
That box comunicates with Preloader which is patched on Amazon tablets.. If it were that easy we would have rooted this tablet many years ago.
About your problems, seems like a LCD cable problem. Unmount again the tablet and check all cables, specially the LCD one.
Cheers.
Click to expand...
Click to collapse
Hmmm, i'll make sure to double check everything again to keep things intact, thanks a lot bro

Fire 8 HD 2018 boots into diagnostic mode only

I have been helping a friend to fix his Fire 8 HD 2018.
This device only boots into Diagnostic Mode with a table showing various values. Specifically
FATPSN = Invalid
Abnormal battery status = AUT
See attached image.
Any way out of this problem?
https://drive.google.com/file/d/1wrT31f-xhus-vtIP_BojSLgxv4mH4q41/view?usp=sharing
UPDATE: Problem solved. See Post #10.

I can't see the image

https://drive.google.com/file/d/1wrT31f-xhus-vtIP_BojSLgxv4mH4q41/view?usp=sharing
Hope this image works.

Just guessing, Abnormal Battery Status = AUT could mean Abnormal Upper Temperature. This is because temperature shows 310.
Any view?

I have swap the battery and the problem still persists.
It is unlikely that both the original and replaced batteries are faulty simultanously.
Thus I would deduce that either the battery checking sensor (if any) is faulty or the firmware is corrupted.
Interestingly, the replacement battery still continues to be charged up while this device is connected to a USB charger.

drdtyc said:
I have swap the battery and the problem still persists.
It is unlikely that both the original and replaced batteries are faulty simultanously.
Thus I would deduce that either the battery checking sensor (if any) is faulty or the firmware is corrupted.
Interestingly, the replacement battery still continues to be charged up while this device is connected to a USB charger.
Click to expand...
Click to collapse
How does the PC recognizes the tab while it's in that mode? (VID/PID).

Rortiz2 said:
How does the PC recognizes the tab while it's in that mode? (VID/PID).
Click to expand...
Click to collapse
Left the replacement battery to charge for a few hours.
Now battery status is back to normal. But the warning AUT still flashes as before. It can normal boot into this particular dignostic screen only as shown in the above attached image.
Powered it down and tried rebooting into fastboot mode. Voila! The tablet is now in fastboot mode waiting for further input from my computer.
I was thinking of flashing it with the latest FireOS 6.3.1.5 and then see how it goes. What adb command can I use? Is it "sudo adb sideload <image file name>"?
Please advise.

After playing with the device for awhile, here are my findings:
1. Press Power button to boot
It only boots into Diagnostic Mode (see image in Post#1)
2. Press Volume Up and Power buttons to boot
It boots into Recovery Mode and stay there for about 20 seconds.
Then automatically switches to Normal Boot.
Going back to the Diagnostic Mode screen (see image in Post #1)
3. Press Volume Up and Power buttons to boot
It boots into Fastboot Mode and stay there waiting indefinitely.
4. Tried to softbrick the device by following this thread by k4y0z for Fire karnak.
The terminal showed the following.
$ sudo ./bootrom-step.sh
[2020-06-15 10:55:09.828365] Waiting for bootrom
[2020-06-15 10:55:19.682090] Found port = /dev/ttyACM0
[2020-06-15 10:55:19.721626] Handshake
* * * If you have a short attached, remove it now * * *
* * * Press Enter to continue * * *
Traceback (most recent call last):
File "main.py", line 213, in <module>
main()
File "main.py", line 111, in main
load_payload(dev, "../brom-payload/build/payload.bin")
File "/amonet-karnak-v3.0.1/amonet/modules/load_payload.py", line 99, in load_payload
dev.write32(0x10007008, 0x1971) # low-level watchdog kick
File "/amonet-karnak-v3.0.1/amonet/modules/common.py", line 160, in write32
self.check(self.dev.read(2), b'\x00\x01') # arg check
File "/amonet-karnak-v3.0.1/amonet/modules/common.py", line 87, in check
raise RuntimeError("ERROR: Serial protocol mismatch")
RuntimeError: ERROR: Serial protocol mismatch
^Z
[2]+ Stopped sudo ./bootrom-step.sh
Click to expand...
Click to collapse
Is there anything to correct the Serial protocal mismatch above?
5. Tried to shorting contact and hard bricking the device by following this thread by k4y0z for Fire karnak.
The terminal showed the following.
$ sudo systemctl stop ModemManager
$ sudo systemctl disable ModemManager
$ sudo ./bootrom-step.sh
[2020-06-15 11:17:09.613717] Waiting for bootrom
[2020-06-15 11:17:47.845559] Found port = /dev/ttyACM3
[2020-06-15 11:17:47.846549] Handshake
^Z
[5]+ Stopped sudo ./bootrom-step.sh
Click to expand...
Click to collapse
Is there anything else I can try?
All suggestions are welcome.

Rortiz2 said:
How does the PC recognizes the tab while it's in that mode? (VID/PID).
Click to expand...
Click to collapse
I overlooked your question. Apologies!
I connected my Linux laptop to the device already booted up in Diagnostic Mode.
In a terminal on the laptop, lusbs showed the following:
$ lusbs
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 005: ID 05c8:022a Cheng Uei Precision Industry Co., Ltd (Foxlink) HP Webcam
Bus 001 Device 004: ID 0bda:b00b Realtek Semiconductor Corp. Bluetooth Radio
Bus 001 Device 003: ID 0bda:0177 Realtek Semiconductor Corp. USB2.0-CRW
Bus 001 Device 002: ID 046d:c52b Logitech, Inc. Unifying Receiver
Bus 001 Device 033: ID 1949:0230 Lab126, Inc. Fire
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Click to expand...
Click to collapse
I presume ID 1949:0230 Lab126, Inc. Fire is this Fire 8HD
What else I may try?

FINAL UPDATE:
Followed this thread to short the CLK contact and hard-brick the device after opening the back cover. The main trick is to use the sharp tips of a metallic tweezer to ensure the shorting is well performed. Otherwise, the script bootrom-step.sh simply stuck without further progress. Thus the bootloader of the device has been unlocked and TWRP has been installed successfully.
Now I have flashed Lineage OS 14.1 on this karnak device and it runs very smoothly. Problem solved in the end.

same problem on HD8(2017)
hello, I also meet this problem on my hd8 2017(we are not the same device ),my device stuck in diagnostic mode and the status shows AFT. I dont know how to boot to system .I have already tried adb reboot recovery and adb reboot system .but It didnt work .just reboot to diagnostic mode again!Have you solved the problem now?If you get a way ,please help me !thanks !:crying::crying:

[Deleted]

[Deleted]

Venvalur said:
Sorry for the extremely late reply. This "abnormal battery status" is normal, it's the same as the diags of the kindles, so you've lost money and time replacing your battery. Also, to keep this in the same reply, how did you or your friend got into diagnostics mode in the karnak? Because this firmware could be used to software downgrade kindles with OS 6.3.1.2+!!! No need to open the tab!!! Sadly no one asked you to extract the .bin of diags firmware, and I'm pretty sure you don't have it anymore. If you have any information please share, this is getting good.
Click to expand...
Click to collapse
Just noticed your comment to my old post.
That device which booted into diagnostics mode only was passed by a guy to me for fixing. I gathered he bought a lot of several pre-owned devices from eBay that also included this peculiar device. In the end, I could not boot it into FireOS. But I could unlock its bootloader, flash twrp recovery and installed LOS 14.1 on it. He was very happy about the somewhat unexpected outcome when I returned to him a fully working karnak running LOS 14.1. Needless to say, I did not extract the .bin of diags firmware. Sorry!

Fire HD10 (2019) bricked itself

Hi,
A few days ago, my Fire HD10(2019) refused to power on, or rather it would show some life (amazon screen IIRC), but go no further. Now it doesn't even do that.
On a PC I can see whats its doing across USB. "Bus 002 Device 083: ID 0e8d:0003 MediaTek Inc. MT6227 phone" on usb for about 45 seconds, then it disconnects for maybe 20s, and then repeats. Now I take the 0e8d:0003 device to be the amazon bootloader - so looks to me like the bootloder works, but crashes hard and restarts as soon as it tries to start android. So looks like the box is bricked.
I've tried the various buttons to go into fastboot - no success. Neither "adb devices" nor "fastboot devices" can see the device. On first booting, the machine brings up a serial interface (USB ACM device), alas I've not been able to connect to this.
So what are my options of getting into the machine? If I can't access the bootloader via the serial interface, are there UART pins on the board? If so where? If I can access the bootloader, can I switch to fastboot mode, so I can reflash the android OS? Where is the best place to look for info like this?

davidsummers said:
Hi,
A few days ago, my Fire HD10(2019) refused to power on, or rather it would show some life (amazon screen IIRC), but go no further. Now it doesn't even do that.
On a PC I can see whats its doing across USB. "Bus 002 Device 083: ID 0e8d:0003 MediaTek Inc. MT6227 phone" on usb for about 45 seconds, then it disconnects for maybe 20s, and then repeats. Now I take the 0e8d:0003 device to be the amazon bootloader - so looks to me like the bootloder works, but crashes hard and restarts as soon as it tries to start android. So looks like the box is bricked.
I've tried the various buttons to go into fastboot - no success. Neither "adb devices" nor "fastboot devices" can see the device. On first booting, the machine brings up a serial interface (USB ACM device), alas I've not been able to connect to this.
So what are my options of getting into the machine? If I can't access the bootloader via the serial interface, are there UART pins on the board? If so where? If I can access the bootloader, can I switch to fastboot mode, so I can reflash the android OS? Where is the best place to look for info like this?
Click to expand...
Click to collapse
It is actually the mediatek bootrom (your device can have mtk-su temp root access, if you downgrade). You must have one of the early release ones that have access to it. My guess there is something wrong with the preloader... While i can't pin it down, the information to reload is all in this thread...
New Fire HD10 2019 Bootless Root Method + Bootloader Unlock Brainstorming
There's a new Fire 10 coming out, with an Octacore processor, USB-C charging, and FireOS based on Pie: https://arstechnica.com/gadgets/2019/10/amazons-new-fire-hd-10-tablet-costs-149-and-charges-via-usb-c/ I most certainly don't need any more...
forum.xda-developers.com

Yes it was an early device. Alas it connected to the web, and updated itself from 7.3.1.0 before I disabled most of the amazon processes. So the original mtk-su for 7.3.1.0 never worked on my machine. Alas can't use this any more - as can't get into android any more.
I'm up to page 30 of the thread you posted, alas nothing read so far has managed to get into the machine.

And first progress - bypass_utility version 1.4.2. can connect (when run as root) and gives:
[2023-01-22 14:32:12.028038] Waiting for device
[2023-01-22 14:32:39.691833] Found port = /dev/ttyACM0
[2023-01-22 14:32:40.083041] Device hw code: 0x788
[2023-01-22 14:32:40.083391] Device hw sub code: 0x8a00
[2023-01-22 14:32:40.083586] Device hw version: 0xca00
[2023-01-22 14:32:40.083770] Device sw version: 0x0
[2023-01-22 14:32:40.083959] Device secure boot: True
[2023-01-22 14:32:40.084143] Device serial link authorization: False
[2023-01-22 14:32:40.087904] Device download agent authorization: True
[2023-01-22 14:32:40.088223] Disabling watchdog timer
[2023-01-22 14:32:40.092031] Disabling protection
[Errno 5] Input/Output Error
[2023-01-22 14:32:41.464834] Payload did not reply

davidsummers said:
And first progress - bypass_utility version 1.4.2. can connect (when run as root) and gives:
[2023-01-22 14:32:12.028038] Waiting for device
[2023-01-22 14:32:39.691833] Found port = /dev/ttyACM0
[2023-01-22 14:32:40.083041] Device hw code: 0x788
[2023-01-22 14:32:40.083391] Device hw sub code: 0x8a00
[2023-01-22 14:32:40.083586] Device hw version: 0xca00
[2023-01-22 14:32:40.083770] Device sw version: 0x0
[2023-01-22 14:32:40.083959] Device secure boot: True
[2023-01-22 14:32:40.084143] Device serial link authorization: False
[2023-01-22 14:32:40.087904] Device download agent authorization: True
[2023-01-22 14:32:40.088223] Disabling watchdog timer
[2023-01-22 14:32:40.092031] Disabling protection
[Errno 5] Input/Output Error
[2023-01-22 14:32:41.464834] Payload did not reply
Click to expand...
Click to collapse
It has been a long time. Maybe try disconnecting the battery, not sure if it is staying in bootrom mode.... I remember mine had to have the battery removed or it would try to goto the preloader (i think). I used the process to downgrade back to 7.3.1.0, but it was like a year ago.

Michajin said:
It has been a long time. Maybe try disconnecting the battery, not sure if it is staying in bootrom mode.... I remember mine had to have the battery removed or it would try to goto the preloader (i think). I used the process to downgrade back to 7.3.1.0, but it was like a year ago.
Click to expand...
Click to collapse
Yes - mine stayed in 0e8d:0003 mode, when the device bricked itself - made no difference with battery on or off, always when through the same minute cycle, where the device would disconnect, then reboot.
Interesting after running the bypass utility - it has stayed up in the 0e8d:0003 mode - and hasn't rebooted.

davidsummers said:
Yes - mine stayed in 0e8d:0003 mode, when the device bricked itself - made no difference with battery on or off, always when through the same minute cycle, where the device would disconnect, then reboot.
Interesting after running the bypass utility - it has stayed up in the 0e8d:0003 mode - and hasn't rebooted.
Click to expand...
Click to collapse
it disabled the watchdog timer. From what is can see everything points to a potential wrong setup..
bypass_utility/README.md at master · MTK-bypass/bypass_utility
Contribute to MTK-bypass/bypass_utility development by creating an account on GitHub.
github.com

This post shows the same error as you read through it.
Payload did not reply · Issue #13 · MTK-bypass/exploits_collection
[Errno 5] Input/Output Error Payload did not reply
github.com

OK - using SP_Flash_Tool v5.2008 to attempt to flash maverick-downgrade-7.0_PR7310_940N and I get the error:
Connect BROM failed: STATUS_SEC_AUTH_FILE_NEEDED(-1073545198)
Disconnect!
BROM Exception! ( ERROR : STATUS_SEC_AUTH_FILE_NEEDED (-1073545198) , MSP ERROE CODE : 0x00.
[HINT]:
Please select a valid authentication file or ask for help.)((ConnectBROM,../../../flashtool/Conn/Connection.cpp,105))
So where do I get the authentication file from?

Michajin said:
it disabled the watchdog timer. From what is can see everything points to a potential wrong setup..
bypass_utility/README.md at master · MTK-bypass/bypass_utility
Contribute to MTK-bypass/bypass_utility development by creating an account on GitHub.
github.com
Click to expand...
Click to collapse
ah yes - that explains why it was rebooting. So guess I have to dig into [Errno 5] Input/Output Error.
Seems like only way I have into the tablet any more is the mediatek bootrom, but as the tablet is sick - if that doesn't work, then probably its permanently dead. E.g. even getting access to a uart wouldn't help.

You have to only do file by file.
5. bypass_utility run succes with message "Protection disabled"
6. Run SPFlash Tool and flash boot, recovery, vendor, system. Wait to finish
7. Hold power button 15s to power off (check Ports in Device Manager windows)
8. Hold volume up and power boot to recovery with triactangle icon
9. Hold power and tap volume up then choose reset factory
10. Reboot

Thanks Michajin - I'm obviously having problems with the bypass_utility, whilst it connects to the MediaTek bootrom, it is not able to disable protection - and test mode bombs out. I've taken this up on the bypass_utility thread:
xda bypass utility