Database Users

[R&D][QUALCOMM] Using QDL, EHostDL and DIAG interfaces & features

This thread is for the research, development and discussion of open source tools (initially Linux) to communicate with and utilize the various proprietary interfaces available on Qualcomm devices.
Initial development is centered around the MSM8660 and MSM8960 devices, but should be applicable to nearly any Qualcomm device which includes a modem and USB port. Older devices with a Serial port may also work. Components to be supported: DMSS Download Protocol (QDL mode), Streaming Download Protocol (EHostDL), and parts of other HDLC structured Qualcomm protocols.
An expanded description, examples, references, and test programs to follow shortly.
Goals
To provide a partial Open Source (Linux) replacement for QPST and QXDM
To enable the full recovery of various Android devices based on supported Qualcomm SoC's
To gain a better understanding of the underlying hardware in Qualcomm based Android devices
Change Log:
2013-01-06
Initial creation to consolidate OT discussions from other threads.
2013-01-07
Expanded description
Added external thread and web links
Added #QDL_Dev on IRC Freenode for open discussion
2013-01-28
Updated a few posts to correct prior mistakes.
Internal Thread Links
coming soon...
External Thread Links
[REF][R&D] MSM8960 Info, Architecture and Bootloader(s) http://forum.xda-developers.com/showthread.php?t=1856327
Lots of important information and Qualcomm PDF's. Should be considered required reading. By E:V:A
[REF][R&D] Building Bootloaders on Qualcomm Devices http://forum.xda-developers.com/showthread.php?t=1978703
By E:V:A
[DEV][REF] El Grande Partition Table Reference http://forum.xda-developers.com/showthread.php?t=1959445
The definitive resource for device partition information. By E:V:A
No JTAG [SOLVED][JTAG,BRICK]SHV-E160L Korean model http://forum.xda-developers.com/showthread.php?t=1914359
R&D for unbricking/fully recovering a SHV-E160L and various helpful utilities. By Darkspr1te
External Web Links
Code Aurora Forum https://www.codeaurora.org/
Home to various Open Source projects related to Qualcomm technologies.
Gobi https://www.codeaurora.org/contribute/projects/gobi/
A Code Aurora Forum project fueled by Qualcomm which serves as a reference for these protocol implementations.
AnyClub Blog http://www.anyclub.org/
A blog with limited yet specific information regarding Qualcomm MSM, MDM, QRD and related products. Can get technical at times and references closed source and proprietary files/programs.
Join us for live discussion in #QDL_DEV on IRC Freenode
Credits/Thanks:
E:V:A for various reference threads which both sparked my interest and fueled my initial research.
Darkspr1te for his involvement with initial and ongoing development.
Ralekdev for providing additional insight in to msm8960 PBL
.
Yarrimapirate for creation of JET (Jewel Evita Toolkit) which served as my first hands-on with QDL and led me down the path to here.
Fuses for his emmc_recover program, which gave me my first glimpse of using HDLC to communicate with a Qualcomm based phone. Also for his typically brief and discouraging posts, which in turn drives my desire to prove him wrong
Captain_Throwback for providing firmware zips, testing, and more bricked phones then anyone else I've met.
others whom I'll add as I think of them.

Knowledge Base
Definitions:
PBL = Primary Boot Loader
SBL = Secondary Boot Loader
RPM = Resource and Power Management
TZ = Trust Zone
HDLC = High-level Data Link Control
MSM = Mobile Station Modem
DMSS = Dual-Mode Subscriber Station
QDL = Qualcomm Download
QHSUSB_DLOAD = Qualcomm High Speed USB Download
EhostDL = Emergency Host Download
DCN = Document Control Number, used by Qualcomm to track their thousands of documents
Qualcomm has built in to their firmware multiple methods of communication with outside "hosts" (a computer connected to the phone). Each method serves a particular function. AT commands are used to communicate with the modem while it is "online" and their multiple diagnostic protocols communicate with the modem in "offline" mode. These diagnostic protocols use HDLC (both synchronous and asynchronous) for the framing. It is a low overhead frame/packet transport which includes a 16 bit CRC for error checking, originally used over serial connections to the phone. Today these protocols are still being used over USB. Under Linux a usb-serial connection can be established by the qcserial kernel module via a /dev/ttyUSB (ex: /dev/ttyUSB0, /dev/ttyUSB1)
HDLC: A brief overview.
The basic HDLC structure is:
Each field is a multiple of 8-bits (1 byte).
HDLC uses 0x7e for the header and flag. For AsyncHDLC the header is optional, but Qualcomm always uses it. Also, the flag of one HDLC frame is allowed to be used as the header of the next frame. It also uses 0x7d as an escape for occurrences of 0x7e and 0x7d. All escaping is done after calculating the CRC and is applied to both the packet and CRC.
The packet is further broken down in to:
The packet header consists of:
The command is a 1 byte (0x00) code that determines the layout of the packet.
The parameters vary by command and specify different command specific options and the size of any data being transferred.
The CRC is generated using the standard CRC-CCITT-16 generator polynomial of: f(x)=x^16+x^12+x^5+1
Google it for more info.
Examples:
NO-OP: 7e 06 4e 95 7e
ACK: 7e 02 6a d3 7e
Software Version Request: 7e 0c 14 3a 7e
Software Version Response: 7e 0d 0f 50 42 4c 5f 44 6c 6f 61 64 56 45 52 31 2e 30 37 41 7e
Full Documentation:
DMSS Download Protocol: DCN 80-39912-1 Revision E
Describes in detail the commands used with QHSUSB_DLOAD (both SBL and PBL)
Streaming Download Protocol: DCN 80-V5348-1 Revision J
Describes in detail the commands used with the Flash Programmer (MPRGxxxx.hex)
CDMA DMSS Serial Data: DCN 80-V1294-1 Revision YP
Describes in detail the basic commands used with the modem Diagnostic mode. This protocol supports a MASSIVE amount of extentions covered in numerous other specialized documents. There is no current plan to implement these extensions.
...more to follow...

SPECIAL NOTE ABOUT THE NEXT POST:
If you attempt to use the msimage.mbn,YOU MUST CREATE IT USING THE SAME VERSION (or newer) FIRMWARE ALREADY ON YOUR PHONE. I'm not 100% sure if this applies to older models, but at least with msm8960 and newer.
Why?
Because, in addition to checking the signature of the image, the PBL also checks the firmware version against an efuse value for rollback prevention. If the OEM enables this feature then an older firmware will cause an error and will jump back to the last successfully loaded version of QDL mode. (ie: pbl, sbl1, etc...) This behavior has been the cause of many bricks for HTC Evo 4g LTE (jewel) owners who try to downgrade their firmware via ruu or recovery (sorry captn).
The firmware images involved are:
sbl1, sbl2, sbl3, tz and rpm.

DMSS And Streaming Protocol Tool
UPDATE: Code updated as of 17-01-2013, post will update to follow new code soon - Darkspr1te
First POC, Thats Proof of concept , not piece of c**p.
The concept behind this came from Soul Shadow, who like me feel that in a world without walls and fences who need windows and gates.
The original script was pulled from some git/website i dont remember belonging to a person i only know as scotty (please step forward )
JCSullins over from rootzwiki went running with the script to give us this working concept.
What is it?
This script fire's HDLC encoded frames at the serial port, namely qcserial for a Qualcomm HS_USB QDLOAD device 05c6:9008
within these frames are commands for various functions with great names like Hello, and Open MI.
Here is a example frame
Code:
0x7e 0x0a 0x63 0x74 0x7e
0x7e start of frame
0x0a command (this one is with out data)
0x63 crc low bit
0x74 crc high bit
0x7e close of frame
HDLC is all well document around the net so i wont go over it too much just yet. the important part is knowing the commands, what they do and what the payload, if any is and how that's formatted.
Why Do We need it?
The QDLOAD and EDLOAD protocols allow further control over your device, possible debrick solutions too, thats why we are developing it, some have mentioned other possible benifits but to reduce the google crew sending eveyone here looking for off-s solution and this thread going off topic we are avoiding that.Please can you also avoid topics of that nature.
What About Windows
You already have QPST and QXDM, us poor linux users dont. I am sure cygwin can help you there, some code changes may be required.
Enough Already, Gimme
https://github.com/jcsullins/qdloader
How Do I use it?
First you need to get the hex file for your device, if it's a msm8660 then your need mrpg8660.hex, they are found elsewhere, links will be posted later but for now use the search
then you need to run hex2bin on the hex file to have mrpgXXXX.bin which you rename hex.bin
then you need your emmc payload, this normally would be xxxx_msimage.mbn which you rename hex2.bin
then perl qdload.pl while you device is plugged in, there will be some debug output showing first and second stage uploads.
It's Didnt work,my device is still bricked, Answer my PM dammit!!
As I mentioned , this is a proof of concept file for study and not really ment to be a oneclick solution. Feed back is most welcome but dont mail the developers with questions for debricking the device, this is a tool to study and develop.
I REPEAT, stay away from this tool if you are not already familiar with qualcomm boot procedures, emmc system and the like.
EDIT: We have Found the original author of the script which we based the above on.
Scotty Walker
https://github.com/tmzt/g2root-kmod/tree/master/scotty2/pbl
Credits to The Man for making his work public.

deleted

SouL Shadow said:
SPECIAL NOTE ABOUT THE NEXT POST:
If you attempt to use the msimage.mbn,YOU MUST CREATE IT USING THE SAME VERSION (or newer) FIRMWARE ALREADY ON YOUR PHONE. I'm not 100% sure if this applies to older models, but at least with msm8960 and newer.
Why?
Because, in addition to checking the signature of the image, the PBL also checks the firmware version against an efuse value for rollback prevention. If the OEM enables this feature then an older firmware will cause an error and will jump back to the last successfully loaded version of QDL mode. (ie: pbl, sbl1, etc...) This behavior has been the cause of many bricks for HTC Evo 4g LTE (jewel) owners who try to downgrade their firmware via ruu or recovery (sorry captn).
The firmware images involved are:
sbl1, sbl2, sbl3, tz and rpm.
Click to expand...
Click to collapse
I was on 1.73 firmware(older or stock) when i bricked my phone.so you mean i have create a mbn file from a device which has 1.73 firmware?
and also how do you check whether a particular mbn file belongs to particular firmware only?.please help me
i have these files which i uploaded.can you see if these can be used for this method.
also i got the same error as i got before after following the post#4 method.i will soon upload the log file to you
sorry for being a noob
thanks

saketh91 said:
I was on 1.73 firmware(older or stock) when i bricked my phone.so you mean i have create a mbn file from a device which has 1.73 firmware?
Click to expand...
Click to collapse
Yes. All you need is the image files from an update or ruu. Check your device's forum, I'm sure someone has posted full firmware zip's. Just grab the correct one and wait for instructions.
saketh91 said:
and also how do you check whether a particular mbn file belongs to particular firmware only?.please help me
i have these files which i uploaded.can you see if these can be used for this method.
Click to expand...
Click to collapse
The msimage.mbn is created from the firmware images (sbl1, sbl2, sbl3, tz, rpm) along with the partition information for that device.
Darkspr1te has been working on tools to create this file. Once he determines them to be ready, he will post them along with instructions on how to use them.
saketh91 said:
also i got the same error as i got before after following the post#4 method.i will soon upload the log file to you
sorry for being a noob
thanks
Click to expand...
Click to collapse
Thank you for your patience and support. I know it's been frustrating being without your phone for so long. We try to share information as soon as we learn it. But sometimes it takes longer than expected to develop ways to utilize our newly found knowledge.
-SLS-

Team Unlimited has (what I believe is) the stock RUU for the Evo 4g LTE for HBOOT 1.15, 1.15 and 2.09 here (EDIT: can't post links because I am a noob with under 10 posts)
Using QPST to flash MPRG8960.HEX and 8960_msimage.mbn it always fails on 'Sending Go Command 0x2A000000', which I think is the pbl authenticating sbl1? If you are right and find a way to insert the correctly signed files into the .mbn I owe you both a beer

SouL Shadow said:
Yes. All you need is the image files from an update or ruu. Check your device's forum, I'm sure someone has posted full firmware zip's. Just grab the correct one and wait for instructions.
The msimage.mbn is created from the firmware images (sbl1, sbl2, sbl3, tz, rpm) along with the partition information for that device.
Darkspr1te has been working on tools to create this file. Once he determines them to be ready, he will post them along with instructions on how to use them.
Thank you for your patience and support. I know it's been frustrating being without your phone for so long. We try to share information as soon as we learn it. But sometimes it takes longer than expected to develop ways to utilize our newly found knowledge.
-SLS-
Click to expand...
Click to collapse
thanks for the reply.i will definitely wait for you to come up with solution.I am just trying to help you by providing you with logs.I have full confidence in you.I will wait for sure.thanks for all the help.

withRandomPrecision said:
Team Unlimited has (what I believe is) the stock RUU for the Evo 4g LTE for HBOOT 1.15, 1.15 and 2.09 here (EDIT: can't post links because I am a noob with under 10 posts)
Using QPST to flash MPRG8960.HEX and 8960_msimage.mbn it always fails on 'Sending Go Command 0x2A000000', which I think is the pbl authenticating sbl1? If you are right and find a way to insert the correctly signed files into the .mbn I owe you both a beer
Click to expand...
Click to collapse
The files you refer to on Team Unlimited's site http://www.unlimited.io are the RUU's for the HTC Evo 4g LTE (jewel). For non-Htc ppl, an RUU is a windows executable that contains the full firmware and software for the given phone. Each RUU corresponds to a software release. Yes, the firmware images needed to create an msimage.mbn for jewel are contained in the RUU.
As for the mprg8960.hex:
The PBL does not perform OEM signature checking on the hex file. The hex file is built by Qualcomm before distributing the sources to the OEM's. It's sole function is to program blank or corrupted flash memory (nand, emmc, etc...) with the firmware bootloaders (sbl1, sbl2, sbl3, tz, rpm).
The address 0x2a000000 is where the mprg.hex is stored in memory. After upload the 'GO' command is used to transfer execution to the flash programmer (the hex file). The phone is supposed to acknowledge the 'GO' command before jumping to the new code. It appears that the 8960 firmware in use by HTC and Samsung has a bug and is not sending that acknowledgement. QPST waits for this acknowledgement before moving on to the next step. This is one of the reasons that prompted the creation of this thread, to develop an alternative to QPST.
Using the perl script posted above by Darkspr1te, other ppl have shown that the 'GO' command DOES transfer execution to the flash programmer and have used it to write the firmware (msimage.mbn) to emmc flash, but have not yet had success booting the loaded firmware. That is why I pointed out the need for the correct firmware version to be used to create the msimage.mbn.
-SLS-

SouL Shadow said:
Yes. All you need is the image files from an update or ruu. Check your device's forum, I'm sure someone has posted full firmware zip's. Just grab the correct one and wait for instructions.
-SLS-
Click to expand...
Click to collapse
i don't know exactly which firmware version which i was on before bricking my phone.but i definitely flashed a rooted sense rom. however i have all zips of the roms which i probably should have installed.also will this tool apply for every device(8960) even my at&t htc one x?

Great work!
SouL Shadow said:
The PBL does not perform OEM signature checking on the hex file.
Click to expand...
Click to collapse
How do you know this? (Other sources have claimed the opposite...)
...After upload the 'GO' command is used to transfer execution to the flash programmer (the hex file). The phone is supposed to acknowledge the 'GO' command before jumping to the new code. It appears that the 8960 firmware in use by HTC and Samsung has a bug and is not sending that acknowledgement. QPST waits for this acknowledgement before moving on to the next step.
Click to expand...
Click to collapse
a) This could be an effect of PBL signature check!
b) Even if not checked, they could easily have changed the acknowledgement string to anything else.
c) It could also be an effect of a blown Qfuse...
d) Are you saying that QPST is not connecting to your phone? (What QPST version are you using?)
Using the perl script posted above by Darkspr1te, other ppl have shown that the 'GO' command DOES transfer execution to the flash programmer and have used it to write the firmware (msimage.mbn) to emmc flash, ...
Click to expand...
Click to collapse
What other people? Do they even have the same phone?

E:V:A said:
Great work!
How do you know this? (Other sources have claimed the opposite...)
Click to expand...
Click to collapse
Qualcomm docs only mention verifying the hex, they say nothing about signature checking. For all we know it's simply verifying the uncorrupted download.
The hex is built by qualcomm and distributed with *other* files to the oem's/licensee's. It only needs to be changed when the actual hardware changes. The msimage.mbn is the oem specific component. There is no oem signature on the hex, however there may be a qualcomm signature or some kind of checksum to ensure it's a valid file.
E:V:A said:
a) This could be an effect of PBL signature check!
b) Even if not checked, they could easily have changed the acknowledgement string to anything else.
Click to expand...
Click to collapse
The acknowledgment does not contain any text. It's just a simple ACK reply.
E:V:A said:
c) It could also be an effect of a blown Qfuse...
d) Are you saying that QPST is not connecting to your phone? (What QPST version are you using?)
Click to expand...
Click to collapse
QPST hangs waiting for a response from the 8960 phones (htc evita, jewel, and sgs3), but other ppl (I don't know/remember who) using the above mentioned script have uploaded the hex and been able to communicate with the flash programmer. They were even able to upload the msimage.mbm. Although the .mbn used was probably the wrong build because after writing to emmc it did not boot in to the sbl. Either due to wrong files or older versions of firmware (causing a rollback error).
E:V:A said:
What other people? Do they even have the same phone?
Click to expand...
Click to collapse
This post: http://forum.xda-developers.com/showthread.php?p=36578082
Note the code part where it mentions 'openmulti' that command is only in the streaming download protocol which is used exclusively by the flash programmer.
EDIT 2013-01-28:
After a discussion with Ralekdev on IRC and reexamination of posted test results, it seems that the mprg8960.hex is NOT being executed. Will need to check the stored error code to see excatly why. Ralekdev was able to show me evidence of possible signature checking in the PBL. Again, we'll need to check the stored error code to confirm if that is the case. While this is a set back for msm8960 devices, it doesn't diminish the need for a full featured, open source, Linux replacement for QPST/QXDM.
-SLS-

SouL Shadow said:
Qualcomm docs only mention verifying the hex, they say nothing about signature checking. For all we know it's simply verifying the uncorrupted download.
Click to expand...
Click to collapse
Well, you should never trust Qualcomm documentation! By the time they write the documentation, there have been many changes.
Probably what you say is correct, but I'm not conviced since I haven't checked the code. It was a few months ago I was looking at this. Perhaps the HEX not checked for signature, since it's just the downloader. (But this doesn't make sense, since this would break the SecureBoot3 chain of trust.) But whatever is downloaded IS signature checked.
The acknowledgment does not contain any text. It's just a simple ACK reply.
Click to expand...
Click to collapse
Well, this is not how the Odin handshake looks like! There there is a short string, like "LOKE" / "ODIN" or something like that. (I don't remember it on top of my head.) So AFAIK, Odin is not working with these device, which would be an indication that they have changed the handshake. (What other kind of tools would the mobile operators use?)
QPST hangs waiting for a response from the 8960 phones (htc evita, jewel, and sgs3), but other ppl (I don't know/remember who) using the above mentioned script have uploaded the hex and been able to communicate with the flash programmer. They were even able to upload the msimage.mbm. Although the .mbn used was probably the wrong build because after writing to emmc it did not boot in to the sbl. Either due to wrong files or older versions of firmware (causing a rollback error).
Click to expand...
Click to collapse
Exactly.

Is it possible to access the bootloader output via USB UART for htc 8960 devices? Seems like this might be useful to get PBL/SBL output for a bricked device.

E:V:A said:
Well, you should never trust Qualcomm documentation! By the time they write the documentation, there have been many changes.
Probably what you say is correct, but I'm not conviced since I haven't checked the code. It was a few months ago I was looking at this. Perhaps the HEX not checked for signature, since it's just the downloader. (But this doesn't make sense, since this would break the SecureBoot3 chain of trust.) But whatever is downloaded IS signature checked.
Click to expand...
Click to collapse
Take a look at the creation date on the hex files in the source archive. They were created in November 2011. But that build is from a later date (I don't have it in front of me, but I think it's from april 2012). That source archive is directly from qualcomm. Why is that important? Because it shows that even with most changes to the source, the hex files don't need to be rebuilt. Besides, the flash programmer is fairly limited in what it can do. It's purpose is to rewrite the bootloaders to blank or corrupted nand/nor/emmc flash. Once written the phone will shut down and attempt to boot normally. Secure Boot only covers the boot process from power on to hardware initialization, security environment setup and finally loading appsbl. Everything after that is up to the oem to do whatever they choose. Although, interestingly enough, team unlimited was able to create a custom hboot (htc's appsbl) which will load normally even with signature checking...
E:V:A said:
Well, this is not how the Odin handshake looks like! There there is a short string, like "HELLO" / "ODIN" or something like that. (I don't remember it on top of my head.) So AFAIK, Odin is not working with these device, which would be an indication that they have changed the handshake. (What other kind of tools would the mobile operators use?)
Click to expand...
Click to collapse
I don't think we're in odin anymore toto!
PBL, the good bootloader of the east suddenly appears to tell us that someone dropped a brick on secure boot. Now all these little pdf's are singing, telling us to follow the HDLC road. Along the way we'll meet some interesting new people. There's QDL who lacks a brain. The Hex-man with no heart. And Streaming Download, a protocol in need of a little courage. Together we can follow the HDLC road to reach the great wizard of qualcomm and use the ruby .mbn file to return us to odin. That's when we'll awake to find Auntie ( a || h )boot and uncle recovery. Adb is there and fastboot and android too!
(don't ask, I don't know either ...)
And back in reality:
I've never used odin (in fact the first time I even heard of it was reading the Verizon SGS3 unlocking thread, which is how I discovered your thread, which lead me to here), but it's my understanding that it is a Samsung only feature that is integrated on the appsbl level, providing similar functionality to HTC's RUU mechanism. Although odin appears to be much more advanced. I've seen numerous samsung users with qualcomm hardware mention how they were stuck in qdl mode and no longer able to access odin to recover.
Now if you'll excuse me, I suddenly have the urge to listen to Dark Side of the Moon...
-SLS-

withRandomPrecision said:
Is it possible to access the bootloader output via USB UART for htc 8960 devices? Seems like this might be useful to get PBL/SBL output for a bricked device.
Click to expand...
Click to collapse
Sort of. Only JTAG can access full output. Error and other diagnostic info can be read from memory using the DMSS Download Protocol or through the DIAG interface.
Under Linux all communication is done via usb serial converter kernel module qcserial and device node /dev/ttyUSBn where n = your device number reported by the kernel dmesg. This goes for any modern qualcomm device using a usb port. Older products used a proprietary serial wiring (outlined in the DMSS Serial Data ICD document 80-V1294-1) to access these same protocols.
The pbl/sbl's all share the same qdl code base. They will transmit a "magic" string over usb, waiting only a programmed amount of time for a connection.
If you mount debugfs
Code:
mount -t debugfs none_debugfs /sys/kernel/debug
and load a kernel module usbmon
Code:
modprobe usbmon
then you can access raw usb streams, either per bus or for the entire computer. There's a raw text interface at /sys/kernel/debug/usb/usbmon
There's also raw binary interface through /dev/usbmon[N]
Also, see the kernel source docs:
<kernel source>/Documentation/usb/usbmon.txt
On a bricked phone qcserial will recognise the device and a ttyUSB will become available OR if sbl3 was successfully loaded usb mass storage will provide the enumerated emmc partitions (although using them is still a work in progress, I have an idea how to properly do it. Will post details once I can test it).
To utilize the qdl usb serial interface you need to use the DMMS Download Protocol outlined in document 80-39912-1 Revision E.
On a working phone there is a usb serial interface available as well. However the qcserial kernel module is not programmed with the oem's vid/pid, so it doesn't load. I've been able to connect to it via generic serial converter:
Code:
modprobe usbserial vender=0x<vid> product=<pid>
Then disconnect and reconnect the usb cable to the phone. dmesg will show the new ttyUSB device.
Unfortunately I haven't been able to actually do anything with it yet. On a working phone it should connect you to the modem which you can use AT commands to interact with. There is also an AT command to switch to DIAG mode. From DIAG more you would use the DMSS Serial Data protocol (doc 80-V1294-1 Revision YP), another HDLC based protocol, to interact.
I have a large number of doc's covering all the above mentioned items and much more (just over 100 pdf's). Unfortunately they are all watermarked with the actual username who had access. If someone has or can point me to a program that can remove said watermarks then I would happily share all of them.
-SLS-

SouL Shadow said:
... Unfortunately they are all watermarked with the actual username who had access. If someone has or can point me to a program that can remove said watermarks then I would happily share all of them.
Click to expand...
Click to collapse
Did you actually try to google that?
http://www.slideshare.net/linsu39/5-solutions-to-remove-pdf-watermark
http://download.cnet.com/We-PDF-Watermark-Remover/3000-18497_4-75593137.html
http://online2pdf.com/
http://www.freepdfconvert.com/#
http://foxyutils.com/splitpdf/

E:V:A said:
Did you actually try to google that?
http://www.slideshare.net/linsu39/5-solutions-to-remove-pdf-watermark
http://download.cnet.com/We-PDF-Watermark-Remover/3000-18497_4-75593137.html
http://online2pdf.com/
http://www.freepdfconvert.com/#
http://foxyutils.com/splitpdf/
Click to expand...
Click to collapse
Hah, yes I did. These pdf's are encrypted so most tools want a password to edit them. Looking for a Linux command line utility so I can strip about 100 pdf's. Found pdftk but it requires a password to work on encrypted pdf's. I was able to convert an encrypted pdf to a non-encrypted pdf using the pdftocairo tool... but that changes the raw pdf data so finding the watermark data is more difficult. Now I'm searching for a pdf editor since my linux distro didn't come with one. Unfortunately I've spent half my day off working on this when I could have been programming.
EDIT:
found qpdf on sourceforge!
qpdf + grep + sed = fully automated bash script to clean all the pdf's
EDIT2:
I now have a working script to remove the watermarks. Found a few bugs while cleaning my document archive. I will post it as soon as I can work them out.
-SLS-

E:V:A said:
Well, you should never trust Qualcomm documentation! By the time they write the documentation, there have been many changes.
Probably what you say is correct, but I'm not conviced since I haven't checked the code. It was a few months ago I was looking at this. Perhaps the HEX not checked for signature, since it's just the downloader. (But this doesn't make sense, since this would break the SecureBoot3 chain of trust.) But whatever is downloaded IS signature checked.
Well, this is not how the Odin handshake looks like! There there is a short string, like "LOKE" / "ODIN" or something like that. (I don't remember it on top of my head.) So AFAIK, Odin is not working with these device, which would be an indication that they have changed the handshake. (What other kind of tools would the mobile operators use?)
Exactly.
Click to expand...
Click to collapse
Absolutely correct. The download code itself has a mechanism to verify if it is valid. Some vendors check the download code before being executed if they are signed correctly, others leave the downloader as it is, but check the md5 signature within the downloader. However we managed to exploit the md5 verification to rewrite the msm7x bootloader to let us read full flash connected to radio. Not sure if they changed a lot regarding the msm89xx chipsets, but I'm going to have a look at that again, if needed. Regarding the flashing process, the flashed files are signed and checked for validity after uploading, rsa keys are in both amss and oemsbl.
Odin Protocol mainly belongs to samsung's own cpu/bootloader and has nothing to do with the qualcomm msm's/qsd's/qsc's.
What we speak of is the such called "QC Download Mode". Using the tty interface being in QC DM Mode you can just send the "3A" command to enter the "QC Download mode". For some mobiles, even if you have access to the radio download mode (qc) you cannot flash and repair the flash that belongs to the PDA part (most seen for those OMAP / MSM combinations). It's just because both cpu's use their own flash module for their firmware parts (means the flash isn't routed to both cpus, thus technically impossible).
WBR

[Tutorial] Unlock VZW Razr M/M HD (XT907/XT926) for U.S. Carriers *CDMA WS METHOD*

THIS WORKS WITH THE LATEST UPDATE!!!! THANK YOU dreamliner2012 FOR RUNNING IT THROUGH AND CLARIFYING!
THE ORIGINAL METHODS STILL WORK FOR ANYONE WHO WANTS TO USE RADIOCOMM AND DFS INSTEAD!
ALL CREDITS TO CELLZEALOT'S THREAD AND ARNOLD SNARB'S POST
GIVE THEM YOUR PROPER THANKS!!!
this was done with stock bootloader, rom, no root, official EVERYTHING
video tutorial HERE
heres the quick rundown -
1: get the Motorola QC Diagnostics driver to install. hard with Win7 x64, but be diligent it does work.
2: boot your XT907/XT926 into BP Tools mode (Vol Up and Down + Power, scroll down to BP Tools hit Vol Up)
3: connect to your computer *duh*
4: open CDMA WS 2.7 or higher (google)
5: connect to your COM Port and press CONNECT
6: click the SECURITY tab and enter 000000 as SPC and click SEND
7: click the MAIN tab and click READ *dunno if you need to but I did for safe measure*
8: click the MEMORY tab and select READ under NV ITEMS. dismiss the SPC prompt
9: First Item to read is 8322. Last Item to read is 8323. click SAVE and name the .txt file whatever you want, just remember where you put it
10: open the .txt file you just saved and under 8322 you will see 01 00 00 00 00 etc. change 01 to 00 and save the .txt file. DONT CHANGE 8323!!!
11: back in CDMA WS click WRITE under NV ITEMS. dismiss the SPC prompt again
12: find the .txt file you just edited and click OK
13: reboot the phone and put in your preferred Sim
14: in Settings go to More... under Wireless Networks and change your Network Mode to GSM/UMTS
15: SUCK IT VERIZON
happy days ahead for all!
don't forget that THANKS button :victory:
***DISCLAIMER***
NOT RESPONSIBLE FOR YOUR LACK OF ABILITY TO FOLLOW SIMPLE DIRECTIONS RESULTING IN A BRICKED DEVICE!
originally posted this in the Motorola Droid RAZR M Q&A section but as I had originally used an XT926 to make this tutorial I thought I had better put this here >_<
---from cellzealot on how to load Win7 x64 drivers---
cellzealot said:
Here is a screenshot of Device Manager on my PC on WIN7 64 bit with the latest 6.2 Motorola USB drivers and my XT907 connected in BP Tools mode with all of the interfaces highlighted.
There are 3 modems, 1 network device and 1 COM port that should be present and installed.
The 6.2 driver set has signed versions for these device interfaces so no force loading should be required and they should install automatically when the phone is connected in BP Tools mode with USB debugging enabled.
Make note of the port number assigned to the COM Port as that is the port you will use for CDMA WS or DFS or any other QC based NV access tool.
The QC Interface is the Motorola QC Diag Port.
Right click and choose Update Drivers then choose Do not load drivers automatically. Allow me to choose from a list of available devices.
Scroll down to Ports: COM/LPT and then Motorola and then Motorola QC Diag Port.
It will warn about unsigned drivers, just click Install anyway and it will load the driver and show up with a COM port number assigned.
Use that COM port for CDMA WS to edit the NV.
If you continue to have problems, I suggest reflashing the firmware or just the modem and fsg.mbn in fastboot, and starting over.
Click to expand...
Click to collapse

dragonhart6505 said:
ALL CREDITS TO CELLZEALOT'S THREAD AND ARNOLD SNARB'S POST
GIVE THEM YOUR PROPER THANKS!!!
this was done with stock bootloader, rom, no root, official EVERYTHING
video tutorial HERE
heres the quick rundown -
1: get the Motorola QC Diagnostics driver to install. hard with Win7 x64, but be diligent it does work.
2: boot your XT907/XT926 into BP Tools mode (Vol Up and Down + Power, scroll down to BP Tools hit Vol Up)
3: connect to your computer *duh*
4: open CDMA WS 2.7 or higher (google)
5: connect to your COM Port and press CONNECT
6: click the SECURITY tab and enter 000000 as SPC and click SEND
7: click the MAIN tab and click READ *dunno if you need to but I did for safe measure*
8: click the MEMORY tab and select READ under NV ITEMS. dismiss the SPC prompt
9: First Item to read is 8322. Last Item to read is 8323. click SAVE and name the .txt file whatever you want, just remember where you put it
10: open the .txt file you just saved and under 8322 you will see 01 00 00 00 00 etc. change 01 to 00 and save the .txt file. DONT CHANGE 8323!!!
11: back in CDMA WS click WRITE under NV ITEMS. dismiss the SPC prompt again
12: find the .txt file you just edited and click OK
13: reboot the phone and put in your preferred Sim
14: in Settings go to More... under Wireless Networks and change your Network Mode to GSM/UMTS
15: SUCK IT VERIZON
happy days ahead for all!
don't forget that THANKS button :victory:
***DISCLAIMER***
NOT RESPONSIBLE FOR YOUR LACK OF ABILITY TO FOLLOW SIMPLE DIRECTIONS RESULTING IN A BRICKED DEVICE!
originally posted this in the Motorola Droid RAZR M Q&A section but as I had originally used an XT926 to make this tutorial I thought I had better put this here >_<
I NEED CONFIRMATION FROM ANYONE WITH AN XT907 ON THE LATEST UPDATE TO CONFIRM WHETHER OR NOT THIS STILL WORKS!! PLEASE LET ME KNOW SO I CAN UPDATE THE OP ACCORDINGLY!
Click to expand...
Click to collapse
If you do this can you use the phone on Verizon still or do you need to revert the changes?
sent from my xt926 RAZR maxx hd

koftheworld said:
If you do this can you use the phone on Verizon still or do you need to revert the changes?
sent from my xt926 RAZR maxx hd
Click to expand...
Click to collapse
should be able to just take out the sim and change everything back in Mobile Network settings.

This is the same method that has been posted for a long time. The only difference is that the old method used RadioComm.

Cpudan80 said:
This is the same method that has been posted for a long time. The only difference is that the old method used RadioComm.
Click to expand...
Click to collapse
Edit: I have been informed that the RadioComm and DFS methods still work with the latest updates as well. I just thought I would post a different method for anyone who wanted an easier interface to work with.
if this isnt helpful to anyone, fine. then ill send a request to remove it. not gonna step on anyone elses tutorial-territory

dragonhart6505 said:
Edit: I have been informed that the RadioComm and DFS methods still work with the latest updates as well. I just thought I would post a different method for anyone who wanted an easier interface to work with.
if this isnt helpful to anyone, fine. then ill send a request to remove it. not gonna step on anyone elses tutorial-territory
Click to expand...
Click to collapse
Yeah this method is a bit easier, given RadioComm's daunting interface. What version of CDMA WS did you use? The website lists Free/Lite/Ultimate, but it's not clear if that's just determined by the key that you enter.

Cpudan80 said:
Yeah this method is a bit easier, given RadioComm's daunting interface. What version of CDMA WS did you use? The website lists Free/Lite/Ultimate, but it's not clear if that's just determined by the key that you enter.
Click to expand...
Click to collapse
cracked version of 2.7 works fine

Will this work with GSM networks outside of US on Android 4.3?

Sensivity said:
Will this work with GSM networks outside of US on Android 4.3?
Click to expand...
Click to collapse
Its already a World Phone, there's no need to do this for any carrier outside of U.S, but yes it will

dragonhart6505 said:
Its already a World Phone, there's no need to do this for any carrier outside of U.S, but yes it will
Click to expand...
Click to collapse
Yes, my GSM SIM worked fine on stock and based on stock roms, but when I tried CM 10.2 for xt926 (Android 4.3) it just couldn't find my mobile network. CM 10.2 for xt925 finds network but can't connect to them automaticly or manually, so I want to try this tutorial for CM10.2 for xt926.

Sensivity said:
Yes, my GSM SIM worked fine on stock and based on stock roms, but when I tried CM 10.2 for xt926 (Android 4.3) it just couldn't find my mobile network. CM 10.2 for xt925 finds network but can't connect to them automaticly or manually, so I want to try this tutorial for CM10.2 for xt926.
Click to expand...
Click to collapse
There's a patch for the gsm but people are reporting no luck so far with CM 10.2 4.3 based ROMs on the Razr M. This method does not help that but if you find out otherwise id like to know

My phone xt926 is working on PacMans ROM. I followed these instructions. Did a full wipe including system. Installed the PacMan Gsm ROM. Everything but UMTS works. Edge data works fine.
UMTS works fine with the stock ROM. I wonder if of is a seem edit or build prop issue to get it working on AOSP ROMs
Sent from my EPAD using xda app-developers app

Flash Me, maybe?
I now have HSPA+ working on my phone with PacMan.
In case anyone is interested in either thanking me for being brilliant or roast me for sucking at searching for pre existing solutions, I'll post my steps here.
1. Flash to stock using RSD Lite and the newest Verizon files from here http://sbf.droid-developers.org/vanquish/list.php
2. Follow the instructions from either this thread http://forum.xda-developers.com/showthread.php?t=2389740 or this one http://forum.xda-developers.com/showthread.php?t=2166542 I used the RadioComm method because screw drivers
3. Ensure the new gsm sim is registered and working on the network.
4. Download the your favorite ROM. I am using the PacMan 4.3
5. In recovery wipe everything including the system, cache and dalvik cache
6. Install Rom and wipe cache again
7. Boot, login, and download Viaero 4g toggle or press *#*#4636#*#* and change the phone to GSM/wcdma (prl).
8. Add this to your bulid.prop thanks to mattwheat at droidrzr.com. http://www.droidrzr.com/index.php/t...et-data-and-smsmms-working-on-xt926-422-roms/
Edit build props to reflect this :
ro.carrier= T-Mobile (or your carrier)
ro.telephony.default_network = 9
telephony.rilV7NeedCDMALTEPhone = false
8. ????????
9. Profit
I hope this helps.

can anyone confirm if this is working with the 9.18.94 on the HD??

Problems!!!
I am using Win7 32b and I already installed everything moto drivers, the CDMA and put my phone on BP mode, but for some reason the program does not detect the port, why? What can I do?

dlucas8384 said:
can anyone confirm if this is working with the 9.18.94 on the HD??
Click to expand...
Click to collapse
yes it does ^_^

Pizzoro said:
I am using Win7 32b and I already installed everything moto drivers, the CDMA and put my phone on BP mode, but for some reason the program does not detect the port, why? What can I do?
Click to expand...
Click to collapse
Try this

Try use unlock root pro

Picked up a Razr M the other day for $10, this method still works awesome. Thanx for the hard work.

vwmaniacx said:
Picked up a Razr M the other day for $10, this method still works awesome. Thanx for the hard work.
Click to expand...
Click to collapse
^_^
Sent from my N800 using XDA Premium 4 mobile app

[Q] NST Frozen

Hey guys. So I picked up a NST and it has a few issues.
It will not charge (green light stays on), it is stuck on a lock screen with the "push N to wake up your Nook, will not turn on, and looks for OMAP 3630 drivers when I plug it into my usb cable.
It has already been taken apart and the battery removed. That didn't fix it, nor did the countless ways of resetting it.
I believe that this might be due to a failed root or corrupt partition table. Would anyone be able to help me fix this if I am not able to actually turn it on? I would also prefer not to use Linux if I don't have to. Any help would be appreciated. Thanks!

You can try booting it with an SD card, noogie or ClockworkMod Recovery.
You could also do USB booting of an image.
That could be a bit more effort setting it up.
Start reading here: http://forum.xda-developers.com/showthread.php?t=2559915&page=39

Renate NST said:
You can try booting it with an SD card, noogie or ClockworkMod Recovery.
You could also do USB booting of an image.
That could be a bit more effort setting it up.
Start reading here: http://forum.xda-developers.com/showthread.php?t=2559915&page=39
Click to expand...
Click to collapse
Would it boot even if the NST doesn't turn on? I'd assume that would pose a major problem with anything I try.

The problem with eInk is never knowing what it's doing.
You said that an OMAP3630 USB interface pops up, so it's not dead.
Put something on an SD card and see if it boots.

Yeah, will do.
What's odd is that is connects and disconnects the usb every three or so seconds. I can hear the unplug/plug windows alert. It looks like a bootloader issue more than anything. I was going to try the CWM method first.
Edit: So I tried Clockwork and Noogie. Neither work as the device cannot reboot or even turn on. I need to plug it into the micro USB cable for it to even turn one. When it was connected to my computer, it still tries mounting/ejecting every few seconds.

It could be that it thinks that the power is not good.
Try booting an SD card with a charger plugged in.
If this doesn't work, try taking it apart and disconnecting the battery.
If you had a kernel console connected (requires soldering) you could see what it doesn't like.

The only way I can boot it is with it being plugged in., also I've already tried booting it without the battery to no avail. This nook is quite stubborn :/

It needs the battery connected in any case.
u-boot.bin is quite strict about requiring a battery.
I meant disconnect and reconnect the battery.
Are you saying that it boots now?

Oh, in that case I did do so.
No, it does not appear to boot. What I meant was that when i connect it to my computer, it shows a green light, I hear the usb mounting noise on my computer, the LED flashes orange for a split second, and then I hear it unmount. I would assume that it's trying to boot, but can't. The screen still shows the same picture.

The screen is a higher-level function.
You won't get anything to change until the system is pretty happy.
We have no information here to go on.
We can't tell what it's doing.
You've already disconnected/reconnected the battery.
You can try the USB booting as listed above and see how far it gets.
You can solder in a level converter to UART1 and see what's going on.
That's about it.

Alright, I'll just assume it's a list cause. Thanks for the help.

You've charged it overnight and tried to boot it (30 seconds on the power button) with the charger still connected and a good noogie image on an SD card?
Can you check the voltage on the battery?
I'd go through the whole deal with the USB image booting and see if you can get anything working.

Usb image booting might work, but it looks like I'd need Linux, and I have no spare boxes left. Cant find a way to do it in windows.
I'll try charging it overnight, but i already tried changing it for about 5 hours

gustan said:
Usb image booting might work, but it looks like I'd need Linux, and I have no spare boxes left. Cant find a way to do it in windows.
Click to expand...
Click to collapse
There's an entire solution for Windows in that thread.
It uses omaplink.exe, to be found in the signature.
Start reading about here:
http://forum.xda-developers.com/showthread.php?p=49665945#post49665945
http://forum.xda-developers.com/showthread.php?p=50740002&#post50740002

I tried charging it overnight and booting with Noogie. No luck there.
I also tried the Omap usb boot. But when I try to run that from cmd with the proper location of the file/syntax, I receive this message.
http://forum.xda-developers.com/attachment.php?attachmentid=2847676&stc=1&d=1405182337
I cannot also follow the guide as the device doesn't prompt a driver install. I get this to show up as the Nook under my device manager, but it disappears after a second or two so I am unable to install drivers as stated in the guide.
http://forum.xda-developers.com/attachment.php?attachmentid=2847677&stc=1&d=1405182337
Edit: I was able to install it an it is now recognized as an "Android Bootloader Interface"

So I got it working finally.
In the OMAP Link, I have the bootloader flash red and then go back to grey. Here is a cap of what it looks like.
http://forum.xda-developers.com/attachment.php?attachmentid=2847705&stc=1&d=1405183421
http://forum.xda-developers.com/attachment.php?attachmentid=2847714&stc=1&d=1405183942

There could be three reasons why you don't get the yellow FastBoot indicator.
1) Your files you are loading could be the wrong ones. aboot.bin & u-boot12.bin are correct (check sizes).
2) u-boot does not like the state of your power system.
3) You don't have the drivers for FastBoot loaded.
When it stalls waiting for fastboot check the Device Manager for unhappy new devices.
If it asks you for any driver select specifically the driver out of the unzipped drivers in the first link above.
Here's what I use to boot into ClockworkMod Recovery:
Code:
C:\C\OmapLink>omaplink.exe aboot.bin u-boot12.bin uRecImg uRecRam
Waiting for bootloader... 0451:D00E, OMAP3630, pbi, ok
Received ASIC id, 69 bytes
OMAP36XX, rev 07
Unlocked
ID12: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ID14: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
CRC1: EF3EBF13, CRC2: 00000000
Sending image file aboot.bin, 3480 bytes... ok
Received a-boot response
Sending image file u-boot12.bin, 170572 bytes... ok
Waiting for disconnect... ok
Waiting for fastboot... 0451:CAFE, 3621GOSSAMER, Android Fastboot, ok
product 3621GOSSAMER
version 0.5
Making boot image... ok
Sending boot image, 4087808 bytes... ok
Waiting for disconnect... ok
Waiting for ADB... 2080:0003, NOOK, ok
Version: 01000000, payload: 4096, type: recovery
uid=0(root) gid=0(root)
I've been wanting to patch a u-boot to make it work even without a battery.
That would be a good test for people with battery problems.
(The stock Android would still raise a stink, but noogie & CWM should work.)

Renate NST said:
There could be three reasons why you don't get the yellow FastBoot indicator.
1) Your files you are loading could be the wrong ones. aboot.bin & u-boot12.bin are correct (check sizes).
2) u-boot does not like the state of your power system.
3) You don't have the drivers for FastBoot loaded.
Click to expand...
Click to collapse
1) would I get the files from the link in the zip?
2) How would I fix that? Seems like a hardware issue in this case.
3) Wouldn't the drivers load with Noogie? Or are they from my computer.
After installing the reccomended drivers, the device doesnt show up as Omap 3630 anymore.

I've lost track of where the files are in that thread.
I did link directly to the aboot.bin (as a zip).
The Windows driver (which I linked above) is for all three device presentations, bootloader, FastBoot, ADB.
Yes, it could be a battery/hardware problem but we don't know that yet.

Okay, so I found your aboot.bin. I also read that I should be using uBoot-12.bin instead of 13. I looked around but was unable to find it.
usbboot-ng2-aboot-noogie-images-v01.zip is what I'm using for most of the .bin, but I'm using the new aboot.bin.
This was gotten off of:
http://forum.xda-developers.com/showpost.php?p=49779966&postcount=285
The aboot.bin was taken off of this page that you had sent me to:
http://forum.xda-developers.com/showthread.php?p=50740002&#post50740002
It doesn't have a yellow yield sign on the device anymore either. Instead it shows up as:
http://forum.xda-developers.com/attachment.php?attachmentid=2848218&stc=1&d=1405215211

shield TV 2015 bricked ?? no root no update...

Hi,
I never root or do anykind of development or advance usage of my shield 2015 pro,
but about 15days ago it just deside do not boot anymore . i don't think it got the last update, so i have no clue why it suddenly not boot anymore
The green light is there, but there is no output.
i tried to invoke the android fastboot with this nethod : http://nvidia.custhelp.com/app/answ...NNXg0SmNhUFlvNHpHMGkwM29mRlZxTVdQUVElMjElMjE=
i also tried to factory reset with :
http://nvidia.custhelp.com/app/answ...hen-you-are-unable-to-access-android-settings
but didn't succeed to see anything, there is no output at all (the TV says so, and i try other stuff the TV works)
i don't know what to do ?
is it actually bricked ? can i do somthing about it ?
Thank you in advance
Bobzer

bobzer said:
Hi,
I never root or do anykind of development or advance usage of my shield 2015 pro,
but about 15days ago it just deside do not boot anymore . i don't think it got the last update, so i have no clue why it suddenly not boot anymore
The green light is there, but there is no output.
i tried to invoke the android fastboot with this nethod : http://nvidia.custhelp.com/app/answ...NNXg0SmNhUFlvNHpHMGkwM29mRlZxTVdQUVElMjElMjE=
i also tried to factory reset with :
http://nvidia.custhelp.com/app/answ...hen-you-are-unable-to-access-android-settings
but didn't succeed to see anything, there is no output at all (the TV says so, and i try other stuff the TV works)
i don't know what to do ?
is it actually bricked ? can i do somthing about it ?
Thank you in advance
Bobzer
Click to expand...
Click to collapse
You didn't mention it so i ask, did you try with other HDMI cables? If still no go and as it is the pro which is more tricky, then better request RMA.
Have you also tried running fastboot commands blindly? I mean do the steps to boot into fastboot/bootloader mode, then if you haven't installed windows drivers try to do so, check device manager, does it recognize your device? What does it show?. If your device is recognized by your PC in fastboot mode and you succeed to install drivers then that will tell us something, otherwise is hard brick but still could be a hardware issue.
Sent from my Tapatalk beta Hub
If I helped hit the Thanks button. Follow Me! ~ DroidMote user ~ Full Android for Shield TV and Nexus Player

lavero.burgos said:
You didn't mention it so i ask, did you try with other HDMI cables? If still no go and as it is the pro which is more tricky, then better request RMA.
Have you also tried running fastboot commands blindly? I mean do the steps to boot into fastboot/bootloader mode, then if you haven't installed windows drivers try to do so, check device manager, does it recognize your device? What does it show?. If your device is recognized by your PC in fastboot mode and you succeed to install drivers then that will tell us something, otherwise is hard brick but still could be a hardware issue.
Sent from my Tapatalk beta Hub
If I helped hit the Thanks button. Follow Me! ~ DroidMote user ~ Full Android for Shield TV and Nexus Player
Click to expand...
Click to collapse
Hi,
thanks for trying to help me,
I tried the cable with another device so the cable is fine
i tried the fastboot blindly but no success (maybe/probably/hopefully i don't do it correctly )
about windows i didn't saw it on windows at all, but that wasn't worry me at that time because i didn't know where to look, so i thought it was maybe normal
about driver no idea of what should i do. during my search i saw little bit about adb
all my search bring me to topic where people did stuff to there shield (root, try rom , etc) i didn't do anything so i don't know what information is relevant for me or not
tonight i will install driver and try again.
just to summarize :
After installing the driver:
- if i see the device in the device manager there is hope
- if not it's hard brick and so i can do nothing ?
if that true ?
thanks you

I would have a look at the SSHD to SSD migration Threads here on XDA (Shield TV), and attempt to make a backup of the SSHD. (If possible). This will of course be of MAJOR IMPORTANCE if you wish to retain any of the Widevine L1 DRM Provider Content (e.g. Amazon, and Netflix. etc.. etc...)
It seems to me that the Bootloader got wiped / corrupted (Which is actually the good news), or the SSHD has died. (Well it probably can't get worse than that.)
In the SSD Migration Thread there is a link to download an Backed up version of someone else's Shield TV. I managed to use this to recover a hard bricked Shield before. My mistake was not making a backup of the Security Sectors of that Device, and I lost all those Services.
It is however possible to rewrite that backup over a working backup to recover the correct L1 Widevine Keys though. IF YOU REMEMBER to make that Backup first. So it's probably​ not too late to do that. The worst case scenario? Your just gonna lose a buttload of DRM Services that you may, or may not even depend on. If your more of a Kodi Person, than this shouldn't even affect you much. But, of course it would be wiser to try and, retain those Widevine Keys if possible.

bobzer said:
Hi,
thanks for trying to help me,
I tried the cable with another device so the cable is fine
i tried the fastboot blindly but no success (maybe/probably/hopefully i don't do it correctly )
about windows i didn't saw it on windows at all, but that wasn't worry me at that time because i didn't know where to look, so i thought it was maybe normal
about driver no idea of what should i do. during my search i saw little bit about adb
all my search bring me to topic where people did stuff to there shield (root, try rom , etc) i didn't do anything so i don't know what information is relevant for me or not
tonight i will install driver and try again.
just to summarize :
After installing the driver:
- if i see the device in the device manager there is hope
- if not it's hard brick and so i can do nothing ?
if that true ?
thanks you
Click to expand...
Click to collapse
Right, if your PC recognize your shield in fastboot mode then it means is alive. When people have hard bricked their devices by corrupted bootloader some are able to boot into APX mode, which confirms their device won't be able to recover (unless Nvidia release the tools), but for others the device won't even turn on.
If your pc recognizes your shield tv in fastboot mode and you are able to install windows drivers and you get an id when typing fastboot devices in cmd, then there is a 50/50 chance of recovering, don't forget the possibility of hardware failure.
The following video can help you, just follow until i open command line and start typing fastboot commands but you just have to type "fastboot devices" command nothing​ else, if you get an id it means that the link with your shield tv is successful.
https://youtu.be/LQaYb4oVHVc
Report back!. Oh but still try other good hdmi cable(s), i tell you for experience, weird **** happens. I have had weird issues with hdmi port and hdmi cable (Amazon basics brand) in the past.

Ichijoe said:
I would have a look at the SSHD to SSD migration Threads here on XDA (Shield TV), and attempt to make a backup of the SSHD. (If possible). This will of course be of MAJOR IMPORTANCE if you wish to retain any of the Widevine L1 DRM Provider Content (e.g. Amazon, and Netflix. etc.. etc...)
It seems to me that the Bootloader got wiped / corrupted (Which is actually the good news), or the SSHD has died. (Well it probably can't get worse than that.)
In the SSD Migration Thread there is a link to download an Backed up version of someone else's Shield TV. I managed to use this to recover a hard bricked Shield before. My mistake was not making a backup of the Security Sectors of that Device, and I lost all those Services.
It is however possible to rewrite that backup over a working backup to recover the correct L1 Widevine Keys though. IF YOU REMEMBER to make that Backup first. So it's probably​ not too late to do that. The worst case scenario? Your just gonna lose a buttload of DRM Services that you may, or may not even depend on. If your more of a Kodi Person, than this shouldn't even affect you much. But, of course it would be wiser to try and, retain those Widevine Keys if possible.
Click to expand...
Click to collapse
thanks, for the idea, i'll first check with the driver.
and after i'll backup the drive at the same time i'll check if there is smart value. in case is the drive which is in a bad state

lavero.burgos said:
Right, if your PC recognize your shield in fastboot mode then it means is alive.
Click to expand...
Click to collapse
to entering the fastboot mode the only way is pressing for about 3sec after powering up or thanks to the drivers it will enter automatically ?
lavero.burgos said:
The following video can help you, just follow until i open command line and start typing fastboot commands but you just have to type "fastboot devices" command nothing​ else, if you get an id it means that the link with your shield tv is successful.
https://youtu.be/LQaYb4oVHVc
Click to expand...
Click to collapse
thanks i can't watch it right now but i'll as soon as possible tonight
lavero.burgos said:
Report back!. Oh but still try other good hdmi cable(s), i tell you for experience, weird **** happens. I have had weird issues with hdmi port and hdmi cable (Amazon basics brand) in the past.
Click to expand...
Click to collapse
I will thanks

bobzer said:
to entering the fastboot mode the only way is pressing for about 3sec after powering up or thanks to the drivers it will enter automatically ?
Click to expand...
Click to collapse
Better to do it manually as i show in the video, the other method from windows never worked for me and for many.

lavero.burgos said:
Better to do it manually as i show in the video, the other method from windows never worked for me and for many.
Click to expand...
Click to collapse
ok thanks
looking forward to try this

so i'm currently trying and sadly i can confirm that the green light is on, cable plug to shield but not recognize at all in the device manager

lavero.burgos said:
Better to do it manually as i show in the video, the other method from windows never worked for me and for many.
Click to expand...
Click to collapse
i did exactly as explained and the nothing happend except that the green light turn off
so when i plug the cable i remove my fing and put it back on the shield and waiting and after a few second the light goes off and stay off but windows still not recognize

Ichijoe said:
I would have a look at the SSHD to SSD migration Threads here on XDA (Shield TV), and attempt to make a backup of the SSHD. (If possible). This will of course be of MAJOR IMPORTANCE if you wish to retain any of the Widevine L1 DRM Provider Content (e.g. Amazon, and Netflix. etc.. etc...)
It seems to me that the Bootloader got wiped / corrupted (Which is actually the good news), or the SSHD has died. (Well it probably can't get worse than that.)
In the SSD Migration Thread there is a link to download an Backed up version of someone else's Shield TV. I managed to use this to recover a hard bricked Shield before. My mistake was not making a backup of the Security Sectors of that Device, and I lost all those Services.
It is however possible to rewrite that backup over a working backup to recover the correct L1 Widevine Keys though. IF YOU REMEMBER to make that Backup first. So it's probably​ not too late to do that. The worst case scenario? Your just gonna lose a buttload of DRM Services that you may, or may not even depend on. If your more of a Kodi Person, than this shouldn't even affect you much. But, of course it would be wiser to try and, retain those Widevine Keys if possible.
Click to expand...
Click to collapse
so i removed the sshd and try to backup it...
that's first that i wasn't able to recover anything from a drive that's appear on my computer
it's so strange because it's there the smart see it but i can't read nothing at all :
Code:
[email protected]:/mnt/raid/backup/shield# ls -l /dev/sdb
brw-rw---- 1 root disk 8, 16 juin 14 02:56 /dev/sdb
[email protected]:/mnt/raid/backup/shield# fdisk -l /dev/sdb
fdisk: impossible d'ouvrir /dev/sdb: Aucun fichier ou dossier de ce type
[email protected]:/mnt/raid/backup/shield# ddrescue -f -n /dev/sdb shield.dd mapfile
GNU ddrescue 1.19
Press Ctrl-C to interrupt
rescued: 0 B, errsize: 0 B, current rate: 0 B/s
ipos: 0 B, errors: 0, average rate: 0 B/s
opos: 0 B, run time: 1 s, successful read: 1 s ago
Finished
commande : 'smartctl' -i -H -c '/dev/sdb'
smartctl 6.4 2014-10-07 r4002 [x86_64-linux-3.16.0-4-amd64] (local build)
Copyright (C) 2002-14, Bruce Allen, Christian Franke, www.smartmontools.org
=== START OF INFORMATION SECTION ===
Model Family: Seagate Laptop SSHD
Device Model: ST500LM000-1EJ162
Serial Number: W764J2R0
LU WWN Device Id: 5 000c50 082dc3e28
Firmware Version: NV9D
Rotation Rate: 5400 rpm
Form Factor: 2.5 inches
Device is: In smartctl database [for details use: -P show]
ATA Version is: ACS-2, ACS-3 T13/2161-D revision 3b
SATA Version is: SATA 3.1, 6.0 Gb/s (current: 1.5 Gb/s)
Local Time is: Wed Jun 14 03:02:44 2017 CEST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled
=== START OF READ SMART DATA SECTION ===
SMART Status not supported: Invalid status byte (0x00) [JMicron]
SMART overall-health self-assessment test result: PASSED
Warning: This result is based on an Attribute check.
General SMART Values:
Offline data collection status: (0x00) Offline data collection activity
was never started.
Auto Offline Data Collection: Disabled.
Self-test execution status: ( 0) The previous self-test routine completed
without error or no self-test has ever
been run.
Total time to complete Offline
data collection: ( 139) seconds.
Offline data collection
capabilities: (0x73) SMART execute Offline immediate.
Auto Offline data collection on/off support.
Suspend Offline collection upon new
command.
No Offline surface scan supported.
Self-test supported.
Conveyance Self-test supported.
Selective Self-test supported.
SMART capabilities: (0x0003) Saves SMART data before entering
power-saving mode.
Supports SMART auto save timer.
Error logging capability: (0x01) Error logging supported.
General Purpose Logging supported.
Short self-test routine
recommended polling time: ( 1) minutes.
Extended self-test routine
recommended polling time: ( 99) minutes.
Conveyance self-test routine
recommended polling time: ( 2) minutes.
SCT capabilities: (0x10b1) SCT Status supported.
SCT Feature Control supported.
SCT Data Table supported.
here the dmesg :
[270724.389743] usb-storage 3-2:1.0: USB Mass Storage device detected
[270724.389819] scsi6 : usb-storage 3-2:1.0
[270724.389901] usbcore: registered new interface driver usb-storage
[270727.372913] scsi 6:0:0:0: Direct-Access ST500LM0 00-1EJ162 PQ: 0 ANSI: 2 CCS
[270727.373406] sd 6:0:0:0: Attached scsi generic sg2 type 0
[270730.079345] sd 6:0:0:0: [sdb] Very big device. Trying to use READ CAPACITY(16).
[270730.079514] sd 6:0:0:0: [sdb] 72057594037927936 512-byte logical blocks: (0 B/0 B)
[270730.079798] sd 6:0:0:0: [sdb] Write Protect is off
[270730.079802] sd 6:0:0:0: [sdb] Mode Sense: 28 00 00 00
[270730.080127] sd 6:0:0:0: [sdb] No Caching mode page found
[270730.080137] sd 6:0:0:0: [sdb] Assuming drive cache: write through
[270730.080827] sd 6:0:0:0: [sdb] Very big device. Trying to use READ CAPACITY(16).
[270730.081756] sdb: unknown partition table
[270730.082349] sd 6:0:0:0: [sdb] Very big device. Trying to use READ CAPACITY(16).
[270730.083081] sd 6:0:0:0: [sdb] Attached SCSI disk
[270736.012772] usb 3-2: USB disconnect, device number 5
someone ? do you have any idea ? what could i do ?

Did you follow this Guide?* Essentially you make this backup in Two parts uninspiredly called "firstpart.bin" (Which is the first Six Gigabytes of the SSHD which also encompasses​ the unique DRM Keys for your Shield.). The lastpart.bin is more or less just the list of checksums for the GPT Partitions.
I wouldn't expect that you would, could or should be able to see anything from the Drive. As most of it is written in a RAW Partition. That is personally beyond my knowledge of how to mount it. That's why you have to make *.bin files which you can then view with a Hex Editor. If you wanted to.
*https://forum.xda-developers.com/shield-tv/general/guide-migrate-to-ssd-hdd-size-satv-pro-t3440195

Ichijoe said:
Did you follow this Guide?* Essentially you make this backup in Two parts uninspiredly called "firstpart.bin" (Which is the first Six Gigabytes of the SSHD which also encompasses​ the unique DRM Keys for your Shield.). The lastpart.bin is more or less just the list of checksums for the GPT Partitions.
I wouldn't expect that you would, could or should be able to see anything from the Drive. As most of it is written in a RAW Partition. That is personally beyond my knowledge of how to mount it. That's why you have to make *.bin files which you can then view with a Hex Editor. If you wanted to.
*https://forum.xda-developers.com/shield-tv/general/guide-migrate-to-ssd-hdd-size-satv-pro-t3440195
Click to expand...
Click to collapse
i did follow this topic but the problem is that dd doesn't works event fdisk don't work
Code:
[email protected]:/mnt/raid/backup/shield# fdisk -l /dev/sdb
fdisk: impossible d'ouvrir /dev/sdb: Aucun fichier ou dossier de ce type
it's fdisk telling me that it can't open my drive sdb no file or directory
i even tried ddrecue so i feel like i'm screwed
but i don't understand because i never saw this kind of problem with dd, i mean even a damage drive i always could start at least , copy a few bytes ... i don't understand what i miss ...

Did you remember to enter elevated root first?
Code:
$ sudo -s
If you don't do this, or you just throw up a sudo fdisk -l. I don't think it'll work. You have to be in an elevated root shell first.
Then you can use:
Code:
# fdisk -l
To list all the Drives currently in your System. Which will be more complicated depending on how many Drives you have.
Again this should list all the Drives currently on your System. You can easily, spot the Shields SSHD by the fact that it is exactly 499GB. Within in this context is the Drive Address. For me this has always been /dev/sda. Where as the local OS was on dev/sdb.
So when you get to this point:
Code:
dd if=/dev/sdX of=firstpart.bin count=6899870
You need to replace sdX with the correct Address of the Shield TVs SSHD. This will then hopefully create a ~3GB File called 'firstpart.bin'
Likewise
Code:
dd if=/dev/sdX bs=512 skip=976773158 of=lastpart.bin
Will create a 5kb File that hosts the Partition Map?
Again you have to replace sdX with the correct Address where the Shield TVs SSHD is hosted.

Ichijoe said:
Did you remember to enter elevated root first?
Code:
$ sudo -s
If you don't do this, or you just throw up a sudo fdisk -l. I don't think it'll work. You have to be in an elevated root shell first.
Then you can use:
Code:
# fdisk -l
To list all the Drives currently in your System. Which will be more complicated depending on how many Drives you have.
Again this should list all the Drives currently on your System. You can easily, spot the Shields SSHD by the fact that it is exactly 499GB. Within in this context is the Drive Address. For me this has always been /dev/sda. Where as the local OS was on dev/sdb.
So when you get to this point:
Code:
dd if=/dev/sdX of=firstpart.bin count=6899870
You need to replace sdX with the correct Address of the Shield TVs SSHD. This will then hopefully create a ~3GB File called 'firstpart.bin'
Likewise
Code:
dd if=/dev/sdX bs=512 skip=976773158 of=lastpart.bin
Will create a 5kb File that hosts the Partition Map?
Again you have to replace sdX with the correct Address where the Shield TVs SSHD is hosted.
Click to expand...
Click to collapse
thanks I will double check tonight but i'm pretty sure that i was root

Ichijoe said:
Did you remember to enter elevated root first?
Code:
$ sudo -s
If you don't do this, or you just throw up a sudo fdisk -l. I don't think it'll work. You have to be in an elevated root shell first.
Then you can use:
Code:
# fdisk -l
Click to expand...
Click to collapse
fdisk don't see the disk
i don't know what to do
I bought a new adapter because at first i thought it could be the adapter but no it's the drive that is like dead. so i bought a new drive but because i can't get a backup of the old one i don't know what to do
can i find somewhere a full backup that i could put in my drive ?
thx

i try to copy with dd and ddrescue, until now i got 0 bytes rescued so i guess my only luck would be to get a backup somewhere else, but even there would i be able to run netflix ?

You should contact Nvidia for replacement, hardware died, not your fault. Unfortunately if you didn't backup the relevant partitions containing your keys, then no you wont be able to watch Netflix.
Sent from my Tapatalk beta Hub
If I helped hit the Thanks button. Follow Me! ~ DroidMote user ~ Full Android for Shield TV and Nexus Player

Hiyas. Welcome a fresh corpse.
Shield 2015, non-pro, bricked by flashing a wrong image.
Bricked well, no adb, no screen, no button - just green led on powerup.
Nvidia says there's no official service in our swamps (lovely, huh) and I'm up to myself.
Anyone with succesful revival? Thanks guys.

[NST] BOOT partition "boot" flag unset...permanently bricked?

I was resizing partitions on my much loved original Nook Simple Touch and I accidently failed to set the "boot" flag on the first partition before restarting. Now the system does not boot, of course. If it won't boot to Android or CWM, then as far as I know, I can't ADB to it in order to set the boot flag. Is there any other way of getting access to the partitions in Windows or Linux that might work?
I searched a bit and see that some other people with partition errors on NSTs have used SD card booting tools like Noogie to fix their partitions, but the mSD slot on my Nook long ago failed and I actually desoldered it from the board since it was shorting. I could potentially buy a new slot component on eBay and try to solder it on, though I'm not so good at soldering and those solder pads look tiny. Would this work for me if I did it, thouh? Would I be able to boot Noogie and restore the BOOT partition even though there's no "boot" flag set at all? I do notice that very briefly "OMAP3630" appears in Windows Device Manager if I plug the Nook into my computer and hold the power button. Maybe that's a good sign?
Any advice would be helpful as I'd really like to get the system working again. I've been using this thing almost daily for 10 years and it's like an old friend to me. I don't think I would like a new reader nearly as much.

Yeah, I wrote a utility for this donkey years ago. It's omaplink.exe
It's in my sig, download it.
Then you need aboot.bin and u-boot12.bin
Then you need a boot image and a ramdisk image out of an update.
Code:
C:\>omaplink.exe aboot.bin u-boot12.bin boot.img ramdisk.img
You can issue the command, then reset the NST and hopefully it will all work out.
If it doesn't, copy/paste the text.

Hi Renate, I would be so happy if you could help me get this system working again!
Unfortunately, I get a message from omaplink.exe that says
Waiting for bootloader or Fastboot or ADB...
The omaplink window appears with a bunch of empty radio buttons. Clicking on it does nothing that I can tell.
If I hold power so that the OMAP3630 appears briefly in device manager, this doesn't seem to do anything either. This OMAP3630 device disappears from the Device Manager almost as soon as it shows up. For the second that it appears, the icon for that OMAP3630 device has an exclamation point anyway, so I think it means there's no drivers for it.
When you say "boot image," you mean a uImage file that normally goes in BOOT, right? and the ramdisk should be the uRamdisk file?
EDIT: I should add that the Nook itself has no activity on the screen at any time. It still shows the CWM menu with "reboot system now" highlighted just like it was when I restarted it after mmucking about with the partitions. Even if I hold the power button (and see the OMAP3630 device in Windows), the screen does not refresh, so it's just on that CWM screen indefinitely.

Yeah, the bootloader 0451/d00e needs a WinUSB device driver.
Use https://zadig.akeo.ie/
Show all devices and look for the 0451/d00e, install WinUSB.
You also need the Google driver for fastboot.
Code:
C:\>omaplink.exe aboot.bin u-boot12.bin uImage uRamdisk
Waiting for bootloader or Fastboot or ADB...
Received ASIC id, 69 bytes
OMAP36XX, rev 07
Unlocked
ID12: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ID14: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
CRC1: EF3EBF13, CRC2: 00000000
Sending image file aboot.bin, 3480 bytes... ok
Received a-boot response
Sending image file u-boot12.bin, 170572 bytes... ok
Waiting for disconnect...
Waiting for Fastboot or ADB...
product 3621GOSSAMER
version 0.5
Making boot image... ok
Sending boot image, 2816000 bytes... ok
Waiting for disconnect...
Waiting for ADB...
Could not open device
(This could not open ADB because the ADB server was already running and it was using it.)

The Zadig tool does seem to have installed a driver. At least the OMAP3630 device now shows in "USB Devices" instead of "Other devices" anyway.
omaplink.exe still just sits with that same message, though. The OMAP3630 device still disappears from the Device Manager after about 1 second, so that seems like the issue. There's no time for omaplink.exe to do anything. It's not even clear that the driver loads before the device is gone. I think the system shuts down right away since holding the power button again will make it appear again in Device Manager pretty quickly.

Are you running omaplink before resetting? You should.
Does the red "LED" flash on reset?

Yes, I start omaplink first. I've tried launching it before plugging in the Nook as well as after plugging it in but before holding down the power button.
I'm not sure which "LED" you mean. On the Nook? The original NST doen't have any red LED that I know of. I've only ever seen it orange when charging or otherwise green. The light currently stays green whenever the USB cable is plugged in. No other colors.
To be clear about this, there's no missing files in the BOOT partition on my system. There's already u-boot, uImage, uRamdisk, and everything else already there. The issue is that the "boot" flag is not set for the partition, so the system doesn't even look at the partition when I start it up. If I can get it to recognize the system, will omaplink set the "boot" flag or does it just transfer these boot files?

The "LEDs" are the colored things on the popup, that you are calling radio buttons.
If you have some other devices, just type omaplink.exe and plug something in.
The ADB (or fastboot) "LED" should light and it should type stuff and exit.
No, this was all just getting something to boot.
I realize that the stuff in flash is ok, but it's going to be ignored.

Just to provide an ending here, I was never able to get omaplink to work with my bricked NST. Then I got the bright idea of just physically holding a microSD card with Noogie on it to the contacts where the card slot used to be. This almost worked and I got a screen refresh out of the system and some changed charging behavior, but then apparently I must have shorted something because now nothing happens at all no matter what I do. No OMAP3630 device in Device Manager, no charging lights, nothing. I think I truly killed the poor baby.
Oh well. I saw another original NST on eBay for $17, bought it, and have now rooted and restored an old backup to it. The fact is, this is a pleasant upgrade for the price since my old one was in pretty poor condition (worn battery, holes in the rubber above the buttons, scratches on the screen, the broken card slot, etc.) and this one I got is virtually new.
Here's to another 10 years of Simple Touching (hm...)!