Related
So, this deals with a post I already made here. I've tried patching the modem.bin file with the modem.img.p patch that came with the MDL update. When flashing the patched modem to the device, the baseband version still hasn't updated to MDL. crawrj mentioned that the MDM partition seems to have write protection on it, but I never got an error in heimdall saying that the partition couldn't be written to. In fact, the modem flashed just fine.
I've already got a custom kernel loaded, and KNOXAgent files removed, so I'd rather not have to downgrade to MDC in order to update to MDL. Also, patching the files went perfectly. No errors, and the file was the size that it was expected to be after patching. So, I'm not exactly sure what's going on with this.
This isn't the only file I would like to patch manually and update myself. I'm really questioning whether certain partitions on the device have write protection enabled for some reason, and how the write protection could be disabled so that the files can be flashed manually.
Anyone that could shed some light on this situation, it would be greatly appreciated. Thought about baking some ROMs, but it's impossible to have a custom kernel without having KNOXAgent removed or SEAndroid frozen. So being able to patch these files manually for future updates is a must.
Thanks in advance, guys.
RogueSly said:
So, this deals with a post I already made here. I've tried patching the modem.bin file with the modem.img.p patch that came with the MDL update. When flashing the patched modem to the device, the baseband version still hasn't updated to MDL. crawrj mentioned that the MDM partition seems to have write protection on it, but I never got an error in heimdall saying that the partition couldn't be written to. In fact, the modem flashed just fine.
I've already got a custom kernel loaded, and KNOXAgent files removed, so I'd rather not have to downgrade to MDC in order to update to MDL. Also, patching the files went perfectly. No errors, and the file was the size that it was expected to be after patching. So, I'm not exactly sure what's going on with this.
This isn't the only file I would like to patch manually and update myself. I'm really questioning whether certain partitions on the device have write protection enabled for some reason, and how the write protection could be disabled so that the files can be flashed manually.
Anyone that could shed some light on this situation, it would be greatly appreciated. Thought about baking some ROMs, but it's impossible to have a custom kernel without having KNOXAgent removed or SEAndroid frozen. So being able to patch these files manually for future updates is a must.
Thanks in advance, guys.
Click to expand...
Click to collapse
I've run into the same issue. Yes, there is some write protection in place.
What I've also tried so far is dumping the MDL mdm and NON_HLOS modem image files directly from an untouched unrooted MDL updated system (other than recovery) Then creating a tar.md5 file for use with Odin. This gave a secure check failed when trying to flash the modem.bin.
I also tried to use recovery to flash the files. No luck here either, it acts much like the low level HTC Radio_config Write protection in that it allows the flash, and even indicates that it was successful, but really it's just writing to a buffer and then checking it later (either on a reboot or whatever) and then since it fails some check, it discards it and uses the original partition.
I verified this by dd'ing the partition before and after the flash in the same recovery session. The partition does indeed change, but after the reboot, it reverts to the original image. Thus... no change.
I'm no expert on these, but from the way this seems, we need a way to install a modified bootloader or somehow set the "WRITE PROTECT: Enabled" to disabled on the bootloader/download screen to allow changes to certain partitions. (Modem and Non-HLOS being the only two that I think are the problem children right now)
What I haven't tried yet that COULD POSSIBLY work is adapting Dan's method of LOKI patching files and using a special command of aboot to flash them. (At least that's how it looks like it works based on a brief skim of the source code)
We'd have to figure out if our aboot is compatible with his method. We'd also need to find the location of the memory addresses and whatnot of where this special command exists in our aboot/memory.
But again, I don't know enough about it to make even an educated guess as to whether or not that would work at all...
Oh, and if Loki cannot be used for Modem patching/flashing, I'd bet the other variants of the device are also going to face the same problems as ours when trying to update modem/non-hlos partitions.
To add to the above post, I also tried using the apply_patch(...) bits from the OTA Update.zip's updater-script file and pulled the corresponding patch files and put them all into an update.zip to patch the partitions, which again said it was successful and of course reverted after rebooting.
Unknownforce said:
Oh, and if Loki cannot be used for Modem patching/flashing, I'd bet the other variants of the device are also going to face the same problems as ours when trying to update modem/non-hlos partitions.
To add to the above post, I also tried using the apply_patch(...) bits from the OTA Update.zip's updater-script file and pulled the corresponding patch files and put them all into an update.zip to patch the partitions, which again said it was successful and of course reverted after rebooting.
Click to expand...
Click to collapse
Ugh. Shoot me. -_-
I'll see if I can't try to figure out something on it. Probably spend some time on it tomorrow.
If anyone has anymore tips, that'd be awesome.
If it wasn't clear, it's not just the apnhlos/mdm partitions that are affected. The list of write-protected partitions during the MDL upgrade that I observe are:
mmcblk0p1: apnhlos
mmcblk0p2: mdm
mmcblk0p4: sbl2
mmcblk0p5: sbl3
mmcblk0p6: aboot
mmcblk0p7: rpm
mmcblk0p8: tz
Unknownforce said:
which again said it was successful and of course reverted after rebooting.
Click to expand...
Click to collapse
Just to make it clear to folks, the partition contents aren't reverting in a strict sense, the writes don't happen at all.
When write-protection is enabled, writes to the eMMC are silently dropped. Linux believes the writes are successful, and so keeps the updated contents in the page cache, which it then serves on subsequent read requests. Of course, when the device is rebooted, the contents of the page cache are lost.
This has been solved with Unknownforce's thread, found here.
Does anyone have or know where to get a stock recovery image for the BTV-W09?
When I flashed the US "003" update manually through the dload folder method, my TWRP was replaced by the stock recovery. I have left it there, and since flashed TWRP to recovery2. The update failed, but I ended up with stock recovery and the tablet no longer rooted. I would try that first. If that doesn't work for you and if you are on the US version "002" firmware let me know and I should be able to send you a backup of my recovery partition bit if you need the eRecovery from the recovery2 partition, I will be unable to help you.
I am on the US version “003”, I updated before flashing TWRP and rooting. TWRP was flashed recovery not recovery2. No worries though, Im sure someone will post a recovery as rooted people will be needing to flash OTA updates soon.
If you are on "003", try updating the unzipped "Update.Zip" from the dload file. I found a copy of the update.zip on my internal SD in directory called HwOUC. If you can't find it, I still have my file. The Update will most likely fail, but that should give you the standard recovery back. then I suggest you flash TWRP to Recovery2. TWRP actually is easier to access from Recovery2 becuase all you have to do is hold the volume up key down for a few seconds from the unlocked bootloader screen to boot into TWRP. Once you have TWRP re-installed you can then just flash the super user zip file to regain your root.
I am not sure if it is because I now have unlocked the bootloader, have recovery2 with TWRP or updated the file to enable the 5Ghz modem , but even with having the standard recovery partition back my system did not pass the altered system check and allow me to flash the OTA. I am not quite experienced enough to try and use Flashfire to force the update, since there is a warning about Huawei devices being easy to hard brick. Hopefully someone who has updated and then rooted will post an .img file of the updated system partition so it can be flashed with TWRP (at least I think that is what those of us who have already rooted will need to do).
I looked for the update.zip but it doesn’t exist anywhere. These updates are usually removed after the update completes successfully. Plus I’ve done a factory reset since updating, which may have deleted it. I wanted to see if enabling the 5GHz radio would stick after the reset (it did). The 5GHz radio hack was really my only reason to root. I didn’t alter my system partition with TWRP, so I may still be able to take an OTA update if I had the factory recovery. Ive stopped rooting all of my non Nexus devices. Since Google releases almost monthly security updates which usually unroots anyway it’s just too much hassle to keep root. If you want to post the update.zip somewhere I could give it a try, if not that’s cool. Im sure a factory image will be available at some point.
I have posted the Update.zip file to the following location:
http://www.mediafire.com/file/ug1pe2w38ddkxm9/update.zip
Let me know how things go.
Coming from a Nexus 7 I'm use to many of the img files you flash for restoring.
Using update extractor I now see many of those files (003 update) and some I have no idea about or how to flash them.
BOOT.img - OK
CRC.img - ?
CURVER.img - ?
EFI.img - I know what EFI is just never flashed it on an Android device.
FASTBOOT - OK
FW_HIFI.img - ?
FW_LPM3.img - ?
RECOVERY.img - OK
SENSORHUB.img - ?
SHA256RSA.img - No what it is normally but never flashed.
TEEOS.img - ?
TRUSTFIRMWARE.img - Interesting, but have no idea. - ?
VERLIST.img - ?
XLOADER.img - ?
Like many of us I'm in the same boat. Unlocked, Flashed recovery and rooted and cannot install update 003.
I've flashed the recovery.img from update 03. I've done a factory reset a few times. Odd enough it maintains 5Ghz wifi after doing a reset. I'm stumped and not sure of so many of the other .img files. Might one of them help me get the update to pass if I flash it. That or we wait for a full release and not an OTA to grab all the files we need. Really think I need system.img to make it work but the update doesn't include it.
Thanks johe for providing the 003 update.zip. I may try flashing the recovery.img this weekend. Ill let you know how it goes.
Jmjm003, I believe the issue with updating with the OTA is due to changes detected in the system partition after rooting/unlocking. Im not sure of a way around this other than flashing the full system partition, and we don’t have the factory ROM available yet. Im also new to Huawei devices and their partition structure so hopefully the development community will grow around this device and provide better solutions. I also can confirm the 5GHz stayed enabled after a factory reset, the question remains would it hold after an OTA update.
My tablet is lenovo yoga tab 3 plus, YT-X703F.
I rooted my tablet, but I want to install an update. I have downloaded the OTA package, can I update by simply replace files? If it's possible, how to deal with those .p files?
Thank you.
zkn1021 said:
My tablet is lenovo yoga tab 3 plus, YT-X703F.
I rooted my tablet, but I want to install an update. I have downloaded the OTA package, can I update by simply replace files? If it's possible, how to deal with those .p files?
Thank you.
Click to expand...
Click to collapse
No as I told you before, you cannot replace the partition images since the update does not contain full images but only patch files (.p files which contain only differences) and a special update format for the system image. Since you have a modified system image (and boot image) it is likely that when you manually apply the patch you will brick your device!!
But to give you some background, the .p files are applied using the apply_patch recovery function (source code is here), whereas the system image patch is applied using the updater recovery function (source is here)
However, as I said fiddling with this is highly risky and I can only repeat myself that the easiest solution is to approach other Chinese users and ask them to boot TWRP and make backups of system and boot partitions of the version you are running and send them to you so that you can flash them via fastboot or TWRP.
matshias said:
No as I told you before, you cannot replace the partition images since the update does not contain full images but only patch files (.p files which contain only differences) and a special update format for the system image. Since you have a modified system image (and boot image) it is likely that when you manually apply the patch you will brick your device!!
But to give you some background, the .p files are applied using the apply_patch recovery function (source code is here), whereas the system image patch is applied using the updater recovery function (source is here)
However, as I said fiddling with this is highly risky and I can only repeat myself that the easiest solution is to approach other Chinese users and ask them to boot TWRP and make backups of system and boot partitions of the version you are running and send them to you so that you can flash them via fastboot or TWRP.
Click to expand...
Click to collapse
Alright, thank you
I'm still mostly a n00b, so apologies if this is a dumb question or one that's answered elsewhere.
I currently have a Kingroot rooted 7th gen HD 10. I got it out of the box with 5.5.0.0. I have not updated the OS, since I figure I can always update it later, and I'd hate to lock myself out of future possibilities because something magical is possible 5.5.0.0 but I can't do it now because I updated to 5.6.0.1.
Is it possible to update Amazon's internals or apps (like Kindle) without doing a full update . . . perhaps by extracting apps from the 5.6.0.1 update and installing/updating them? Or, perhaps to rephrase, is it possible to update interesting system bits to 5.6.0.1 without updating the bootloader (hopefully keeping it at 5.5.0.0 and allowing any future magic and/or easy downgrading to 5.5.0.0 in the future if some cool development is only possible on it)?
Thanks for any help!
GamerOfRassilon said:
... is it possible to update interesting system bits to 5.6.0.1 without updating the bootloader ...
Click to expand...
Click to collapse
Yes. Here are the steps:
-- Backup your current setup using FlashFire.
-- Download 5.6.0.1.zip from here.
-- Flash 5.6.0.1.zip in FlashFire (disable EverRoot)
It's safe to go back-and-forth between 5.5.0.0 and 5.6.0.1. If you do not want to use bibikalka's system image, you can create your custom 5.6.0.1 system (after adb sideloading the 5.6.0.1 update .bin), back it up using FF, adb sideload the 5.5.0.0 update .bin (which will put back the 5.5.0.0 bootloader), and then use FF to restore the 5.6.0.1 system. A lot more work, but you can pat yourself on the back after it's done.
Thanks for your help!
As an update:
I tried sideloading the 5.6.0.1 update — in the hope of just updating the system and keeping the rest of everything in place — and the tablet didn't like that (it just hung on the Fire logo). IIRC, I deleted the cache and eventually got it to boot, but it was really confused about what version it was, so I ultimately needed to wipe it and start anew. (Fortunately, I'd backed up the /data partition with FlashFire, so I only had to worry about restoring what was on the /system partition.) But what I ended up doing was loading 5.6.0.1 onto the fresh tablet, getting my System files partition how I wanted it, restoring /data with FlashFire, and then wiping and re-loading 5.5.0.0 (and then reloading the 5.6.0.1 /system image I made with dd along with the /data backup via Flashfire).
For my own edification, just to make sure I understand what happened and why this works:
Sideloading the 5.5.0.0 restored it to a straight 5.5.0.0 device; loading my backup /system and /data files from 5.6.0.1 meant that — in FlashFire parlance — the Boot partition from 5.5.0.0 was left intact.
Does that sound correct?
(And I'm assuming the Cache partition isn't really important, since the Fire can recreate it as needed [hence why it's unchecked in FlashFire]... and I don't know anything about the Recovery partition.)
Thanks again for your help. I've gotten exactly what I wanted!
GamerOfRassilon said:
Sideloading the 5.5.0.0 restored it to a straight 5.5.0.0 device; loading my backup /system and /data files from 5.6.0.1 meant that — in FlashFire parlance — the Boot partition from 5.5.0.0 was left intact.
Does that sound correct?
Click to expand...
Click to collapse
Yes. In general, you backup/restore boot.img and system.img as a pair.
The goal is to retain the old bootloaders. This refers not to boot.img, but to the preloader, lk, etc. IIRC, the only change from 5.5.0.0 to 5.6.0.0 to 5.6.0.1 is in tz.
Hello everyone,
Do you think we could set up a fastboot flashable version download archive of OOS Stock rom versions? I think it's ridiculous that 1+/T-Mobile still hasn't rolled out 10.0.36 to most of us here it seems, we're still stuck on the April 1, 2020 security patch on 10.0.35, and even worse, they don't even post OTA images online to be able to manually install.
Assuming one is good at getting into EDL mode (it takes a little practice , you can use the MSM tool to make quick easy backups of the individual partitions and then post them, assuming you are on 10.0.36 to start
All the instructions you need are here: https://forum.xda-developers.com/showpost.php?p=82694195&postcount=4
Persist.img should be backed up and not distributed. The partitions we need to go from one OOS build to the next without wiping data or losing future OTA updates (assuming they ever send them) we would need reserve, boot, dtbo, odm, product, system, vbmeta, vbmeta_system, and vendor.
Of course the way you want to pull them from the phone, that's up to you. I just recently learned about the "hidden" partition backup features in MSM tool and find it really quick and easy.
But if anyone who is on 10.0.36 and could pull and post those partition images, it'd be very much appreciated.
Thanks!
Chris
Anyone, please? Still waiting on the OTA here... Only been a month and a half...