Database Users

[Build][PSFreedom for HD2][DISCONTINUED, NEW THREAD LINK IN FIRST POST.]

This thread is now outdated.
Go HERE for latest updates.
---------------------------------------------------------------
Code:
Hi guys,
I managed to get this working on the HTC HD2
Enjoy!
[B]Download:
[url]http://www.multiupload.com/5E00HNQVE5[/url][/B]
-----------------------
Major thanks to KaKaRoTo and DrMon!
-----------------------
Readme:
[QUOTE]
PSFreedom for HTC HD2
---------------------
[url]http://PSFreedom.com/[/url]
PSFreedom created by KaKaRoTo
Adapted to MSM72K devices by DrMon
----------------------
Kernel and module compiled for HD2 by darkstone
Android base by richardtrip [ [url]http://forum.xda-developers.com/showthread.php?t=690477[/url] ]
Uses homebrew payload
----------------------
USAGE:
1) Extract the Android folder on the root of your SD card.
2) Run CLRCAD.exe and haret.exe in the Android folder on your HD2. Boot the build until at home screen, ensure screen remains on.
3) Plug in the HD2 USB cable in to the Playstation 3 whilst the Playstation is turned off from mains.
4) Turn Playstation 3 mains power on.
6) Press the Power button on the Playstation then the Eject button as soon as the Power has been turned on.
7) And that should be it :)
[/QUOTE]
[QUOTE="tormox, post: 0"]Ok I'll try make this as simple as possible for you all.
[COLOR="Red"]NOTE[/COLOR]: The PS3 firnware HAS to be [COLOR="Red"]3.41[/COLOR]. No less and DO NOT install 3.42 as this blocks the ability to use these hacks.
[COLOR="Red"]NOTE[/COLOR]: To enable playing of backed up games follow instructions in updated part of post 1.
Check post 1 for download link.
[COLOR="Red"]NOTE[/COLOR]: Make sure PS3 is turned off at the mains or power switch for FAT models and the USB cable is unplugged!
Step 1 - Download
Step 2 - Extract the Android folder and place onto the root of your SD card.
Step 3 - Using Windows Mobile go to File Explorer and find the Android folder, then run CLRCAD.exe ([COLOR="Red"]NOTE[/COLOR]: It will NOT appear to have done anything but it will have) then run HaReT.exe
Step 4 - You will see white text flying up the screen this normal, wait for it to finish and the Android lockscreen will appear. Unlock the phone so your on the homescreen. ([COLOR="Red"]NOTE[/COLOR]: Make sure the phone doesnt go into standby and the screen stays on)
Step 5 - Plug the USB cable into your phone and PS3.
Step 6 - Turn the mains switch on for your PS3.
Step 7 - Press the power button and then press the eject button (NOTE: eject button must be pressed right after the power button!)
Step 8 - PS3 will take slightly longer to boot up, this is normal. Download Manager.pkg and put it onto the root of a external HDD (FAT32 filesystem only, NTFS is not supported by the PS3) or a USB stick.
Step 9 - Plug in your HDD/USB stick into the PS3 and go to the new folder under games menu called "Install Package File", open it and click X on the manager.pkg to install.
Step 10 - Enjoy!
[COLOR="Red"]NOTE[/COLOR]: If you wish to rename the PSFreedom folder from Android so that you can use your normal Android build follow these steps:
Step 1 - Open startup.txt from within the Android folder (PSFreedom version)
Step 2 - Change set cmdline "" to set cmdline "rel_path=PSFreedom"
Step 3 - Rename the Android folder to PSFreedom.[/QUOTE]
[B]***UPDATE***[/B]
To enable backup loading, download this:
[url]http://www.multiupload.com/9LHKYKBA6W[/url]
Readme:
[QUOTE]This package contains GScript Lite which has been modified by me.
Assuming your PSFreedom build folder is still named Android...
- Copy the Android folder to the root of your SD card, it will create a new folder in your Android folder on your SD card named AndroidApps.
- Boot Android.
- Enable internet connection (Either Wifi or 3G)
- In order to update PSFreedom, use GScript Lite program in Android and there will be an Update PSFreedom icon there. Keep running Update PSFreedom if all you see is a blue screen with "stderr" and nothing else. You should see the word PSFreedom pop up on the screen. Once that is done, then backups will be enabled.
The latest update will enable backup loading. Enjoy![/QUOTE]
[QUOTE]UPDATE: 22/09/2010
PSFreedom module updated to use latest payload with LV2 Peek and Poke support.
Either use GScript above and update the module or download the module yourself and push it yourself. Get the module from here: [url]http://gamesquare.co.uk/psfreedom.ko[/url]
Enjoy![/QUOTE]

Yepeeeee!!!
thanks a lot!!! will try it ASAP

thxxx woooaaaawwww ... Yes i wil try it !!!!

if i were gay i would kiss you.... jk dude

Thank you!

Doesn't work for me.

THANKS SOOO MUCH!!! Been waiting for a PSP version but no such luck so next best thing is the best phone in the world (HD2)

astronman said:
Doesn't work for me.
Click to expand...
Click to collapse
yeah mine isnt working either but maybe because im running windows ce, im going back to 6.5 with sence and try running android on top of that and see.

What ROM and RADIO is needed for this??

is this working ?

Hm, seems like theres a bug, I'll fix it ASAP

thank you so much

Great work !! Will try later.
Thanks !

can be work on kaiser? with android on nand?

If someone could make a video on how exactly does the steps needed to be done , it would be wonderful.
Step 1 is clear.
Step 2 and Step 3 question - When do I need to plug the USB cable into PS3, before running haret or after that ? If I plug it after running haret , when exactly do I need to do this , cause haret starts immediately and turns off phone in about a minute ?
Step 4 is also clear.
Step 5 - when must I see the "PSFreedom gadget: Got disconnected" text ? After pressing the front button and eject button , or before that (after switching the back button on)
Step 6 and 7 also Clear.
Thanks for the answers in advanced !!!

c0rp1 said:
If someone could make a video on how exactly does the steps needed to be done , it would be wonderful.
Step 1 is clear.
Step 2 and Step 3 question - When do I need to plug the USB cable into PS3, before running haret or after that ? If I plug it after running haret , when exactly do I need to do this , cause haret starts immediately and turns off phone in about a minute ?
Step 4 is also clear.
Step 5 - when must I see the "PSFreedom gadget: Got disconnected" text ? After pressing the front button and eject button , or before that (after switching the back button on)
Step 6 and 7 also Clear.
Thanks for the answers in advanced !!!
Click to expand...
Click to collapse
STEP 2 - Run HaReT from WinMO rom Wait for black screen with white text to load up. Wait and you will see android lock screen, go to the phones homescreen, kepping the screen turned on ie not in standby
STEP 5 - once that is done just plug phone into ps3, turn on mains, then turn ps3 on an press right away an let it boot.
However there is a bug as Darkstone said and he is working it out now.

Ok, uploaded new file, should be fine now

DarkStone1337 said:
Ok, uploaded new file, should be fine now
Click to expand...
Click to collapse
wow that was a quick fix
testing now
thanks

Does the phone need to be connected to the PS3 all the time to enable PSFreedom to work or do you just do this once and that is it?
Bry.

Can anyone explain what is this exactly ?

Fire 8 HD 2018 boots into diagnostic mode only

I have been helping a friend to fix his Fire 8 HD 2018.
This device only boots into Diagnostic Mode with a table showing various values. Specifically
FATPSN = Invalid
Abnormal battery status = AUT
See attached image.
Any way out of this problem?
https://drive.google.com/file/d/1wrT31f-xhus-vtIP_BojSLgxv4mH4q41/view?usp=sharing
UPDATE: Problem solved. See Post #10.

I can't see the image

https://drive.google.com/file/d/1wrT31f-xhus-vtIP_BojSLgxv4mH4q41/view?usp=sharing
Hope this image works.

Just guessing, Abnormal Battery Status = AUT could mean Abnormal Upper Temperature. This is because temperature shows 310.
Any view?

I have swap the battery and the problem still persists.
It is unlikely that both the original and replaced batteries are faulty simultanously.
Thus I would deduce that either the battery checking sensor (if any) is faulty or the firmware is corrupted.
Interestingly, the replacement battery still continues to be charged up while this device is connected to a USB charger.

drdtyc said:
I have swap the battery and the problem still persists.
It is unlikely that both the original and replaced batteries are faulty simultanously.
Thus I would deduce that either the battery checking sensor (if any) is faulty or the firmware is corrupted.
Interestingly, the replacement battery still continues to be charged up while this device is connected to a USB charger.
Click to expand...
Click to collapse
How does the PC recognizes the tab while it's in that mode? (VID/PID).

Rortiz2 said:
How does the PC recognizes the tab while it's in that mode? (VID/PID).
Click to expand...
Click to collapse
Left the replacement battery to charge for a few hours.
Now battery status is back to normal. But the warning AUT still flashes as before. It can normal boot into this particular dignostic screen only as shown in the above attached image.
Powered it down and tried rebooting into fastboot mode. Voila! The tablet is now in fastboot mode waiting for further input from my computer.
I was thinking of flashing it with the latest FireOS 6.3.1.5 and then see how it goes. What adb command can I use? Is it "sudo adb sideload <image file name>"?
Please advise.

After playing with the device for awhile, here are my findings:
1. Press Power button to boot
It only boots into Diagnostic Mode (see image in Post#1)
2. Press Volume Up and Power buttons to boot
It boots into Recovery Mode and stay there for about 20 seconds.
Then automatically switches to Normal Boot.
Going back to the Diagnostic Mode screen (see image in Post #1)
3. Press Volume Up and Power buttons to boot
It boots into Fastboot Mode and stay there waiting indefinitely.
4. Tried to softbrick the device by following this thread by k4y0z for Fire karnak.
The terminal showed the following.
$ sudo ./bootrom-step.sh
[2020-06-15 10:55:09.828365] Waiting for bootrom
[2020-06-15 10:55:19.682090] Found port = /dev/ttyACM0
[2020-06-15 10:55:19.721626] Handshake
* * * If you have a short attached, remove it now * * *
* * * Press Enter to continue * * *
Traceback (most recent call last):
File "main.py", line 213, in <module>
main()
File "main.py", line 111, in main
load_payload(dev, "../brom-payload/build/payload.bin")
File "/amonet-karnak-v3.0.1/amonet/modules/load_payload.py", line 99, in load_payload
dev.write32(0x10007008, 0x1971) # low-level watchdog kick
File "/amonet-karnak-v3.0.1/amonet/modules/common.py", line 160, in write32
self.check(self.dev.read(2), b'\x00\x01') # arg check
File "/amonet-karnak-v3.0.1/amonet/modules/common.py", line 87, in check
raise RuntimeError("ERROR: Serial protocol mismatch")
RuntimeError: ERROR: Serial protocol mismatch
^Z
[2]+ Stopped sudo ./bootrom-step.sh
Click to expand...
Click to collapse
Is there anything to correct the Serial protocal mismatch above?
5. Tried to shorting contact and hard bricking the device by following this thread by k4y0z for Fire karnak.
The terminal showed the following.
$ sudo systemctl stop ModemManager
$ sudo systemctl disable ModemManager
$ sudo ./bootrom-step.sh
[2020-06-15 11:17:09.613717] Waiting for bootrom
[2020-06-15 11:17:47.845559] Found port = /dev/ttyACM3
[2020-06-15 11:17:47.846549] Handshake
^Z
[5]+ Stopped sudo ./bootrom-step.sh
Click to expand...
Click to collapse
Is there anything else I can try?
All suggestions are welcome.

Rortiz2 said:
How does the PC recognizes the tab while it's in that mode? (VID/PID).
Click to expand...
Click to collapse
I overlooked your question. Apologies!
I connected my Linux laptop to the device already booted up in Diagnostic Mode.
In a terminal on the laptop, lusbs showed the following:
$ lusbs
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 005: ID 05c8:022a Cheng Uei Precision Industry Co., Ltd (Foxlink) HP Webcam
Bus 001 Device 004: ID 0bda:b00b Realtek Semiconductor Corp. Bluetooth Radio
Bus 001 Device 003: ID 0bda:0177 Realtek Semiconductor Corp. USB2.0-CRW
Bus 001 Device 002: ID 046d:c52b Logitech, Inc. Unifying Receiver
Bus 001 Device 033: ID 1949:0230 Lab126, Inc. Fire
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Click to expand...
Click to collapse
I presume ID 1949:0230 Lab126, Inc. Fire is this Fire 8HD
What else I may try?

FINAL UPDATE:
Followed this thread to short the CLK contact and hard-brick the device after opening the back cover. The main trick is to use the sharp tips of a metallic tweezer to ensure the shorting is well performed. Otherwise, the script bootrom-step.sh simply stuck without further progress. Thus the bootloader of the device has been unlocked and TWRP has been installed successfully.
Now I have flashed Lineage OS 14.1 on this karnak device and it runs very smoothly. Problem solved in the end.

same problem on HD8(2017)
hello, I also meet this problem on my hd8 2017(we are not the same device ),my device stuck in diagnostic mode and the status shows AFT. I dont know how to boot to system .I have already tried adb reboot recovery and adb reboot system .but It didnt work .just reboot to diagnostic mode again!Have you solved the problem now?If you get a way ,please help me !thanks !:crying::crying:

[Deleted]

[Deleted]

Venvalur said:
Sorry for the extremely late reply. This "abnormal battery status" is normal, it's the same as the diags of the kindles, so you've lost money and time replacing your battery. Also, to keep this in the same reply, how did you or your friend got into diagnostics mode in the karnak? Because this firmware could be used to software downgrade kindles with OS 6.3.1.2+!!! No need to open the tab!!! Sadly no one asked you to extract the .bin of diags firmware, and I'm pretty sure you don't have it anymore. If you have any information please share, this is getting good.
Click to expand...
Click to collapse
Just noticed your comment to my old post.
That device which booted into diagnostics mode only was passed by a guy to me for fixing. I gathered he bought a lot of several pre-owned devices from eBay that also included this peculiar device. In the end, I could not boot it into FireOS. But I could unlock its bootloader, flash twrp recovery and installed LOS 14.1 on it. He was very happy about the somewhat unexpected outcome when I returned to him a fully working karnak running LOS 14.1. Needless to say, I did not extract the .bin of diags firmware. Sorry!

Junsun V1/Pro Megathread

This thread is consolidating all the information of Junsun V1 and V1Pro devices scattered in the Android Head-Units forum. I want to write and extend this to make it easier for new people. It's sometimes difficult to find the right information.
Warning: Some of these commands are altering the system. If something goes wrong you can brick your device. Be sure you know what you're doing. I'm not responsible for any damages!
General Other Threads​Junsun V1​Junsun V1 Pro​Junsun V1 Pro Firmware (8259)​Junsun V1 Pro Firmware (8227L)​Junsun V1 (8667Q)​Firmware​Updating the device firmware​Junsun V1 Pro firmware files​Root​ADB connection​Root with Magisk​Writable System​

Updating Firmware​Preparation​
USB drive formatted as FAT32
Files for update (*.bin, *.upd) need to be in the root directory of the USB drive
Starting the Update​The update should start automatically when the USB drive is plugged in. A pop-up appears that says that an update will start. After a few seconds the device will reboot and install the update.
If this doesn't work, plug in the USB stick and restart the device with a needle in the reset button. When the device starts up move one finger on the touchscreen around and wait for a green detected message at the top of the screen. The update will start.
Problem solving​I don't have a *.upd file
That is OK, the file does mot contain any information. Just create a new empty file and rename it like the *.bin file. As example, if you have a 8259.bin create a 8259.upd file.
The device doesn't recognize my USB thumb drive
There are 2 USB connectors on the back of the device. If one does not work, try the other. Make sure your thumb drive is formatted as FAT32.
Firmware Files​This list is made by taking links from different firmware threads (found in first post). Every entry has a link to the original posts. Please be careful when flashing, the files need to match the correct CPU and screen resolution. If you have files for the normal V1 or different screen resolutions you can send me a PM.
Junsun V1 Pro | 8259 | 1280 x 720:​
DownloadOriginal PostVerified8259P_军灿UI02v1280x720-国外_v20_20210907.ziphere8259P_军灿UI02v1280x720-国外_v27_20211201.ziphere8259P_军灿UI02v1280x720-国外_v31_20220225.ziphere8259P_军灿UI02v1280x720-国外11_v1_20220323.ziphere8259P_军灿UI02v1280x720-国外11_v3_20220422.ziphere8259P_军灿UI02v1280x720-国外_v44_20220920.ziphere8259P_军灿UI02v1280x720-国外_v50_20221226.zipheremopfi
Junsun V1 Pro | 8227L:​
DownloadOriginal PostVerified8227L_8军灿UI03-国外10_v7_20210814.ziphere8227L_8军灿UI03-国外10_v21_20211130.ziphere8227L_8军灿UI03-国外11_v3_20220714.ziphere
Junsun V1 | 8667Q | 720 x 1280:​
DownloadOriginal PostVerified8667Q军灿UI02-国外-VHD720x1280_v11_20211207.ziphere8667Q军灿UI02-国外-VHD720x1280_v12_20220214.ziphere8667Q军灿UI02-国外-VHD720x1280_v13_20220510.ziphere8667Q军灿UI02-国外-VHD720x1280_v23_20220801.ziphere
Factory Reset​Settings -> Car Infotainment -> About Device -> Settings Icon -> Code 8878 -> Erase all Content

ADB Connection​Preparation​
Activate Developer options. You have to click a few times on the build number until you are a developer: Settings -> System -> About Car -> Build number
Activate USB debugging. Settings -> System -> Developer options -> USB debugging
Use the 4-pin USB connection on the back of the device. Connect with a USB A <-> USB A cable. My device had a female Mini USB adapter for using a Mini USB cable.
Connect​Use adb to connect to the device
Bash:
adb shell
Problem solving​ADB can't find any devices
It could be that the ADB connection with the device is not working. This means that the corresponding option is not set. This can be done temporary or permanent.
Temporary Connection
To make the connection with adb work temporary we can change the USB setting of the device. To do that we need to set Settings -> USB Preferences -> USB controlled by -> This device. No it should be possible to connect via ADB. The connection is temporary, because after a reboot it is gone and has to be set again.​
Permanent Connection
We can enable the connection permanently by changing a value in the secret menu. Go to Settings -> About Device -> Cogwheel (top right) -> Code 8878 -> Others -> USB2 Debug -> Enable​
Can't find USB Preferences
Go to Settings and click the search icon in top right corner. Type in usb and then click USB controlled by.

Root​Create boot.img​Connect via adb to the device and find the location of the boot partition. The star '*' has to be replaced according to your device. For my Junsun V1Pro it is bootdevice. In the next step we will create a copy of the boot partition. Please be careful with dd command. It will overwrite wrong files or partitions if you do a mistake.
Bash:
adb shell
su @#zxcvbnmasdfghjklqwertyuiop1234567890,.
ls -l /dev/block/platform/*/by-name/
dd if=/dev/block/platform/*/by-name/boot of=/sdcard/boot.img
Patch boot.img​Install Magisk apk on your device. I used Magisk v23.0 from here: https://github.com/topjohnwu/Magisk
Open the app and click on top right Install button
Then click next and choose Select and Patch File
Select your boot.img and let Magisk patch it.
Copy the new created file to your computer. The filename will be similar to magisk_patched_23000_***_boot.img
Bash:
adb pull /sdcard/magisk_patched_boot.img <older_on_your_computer>
Flash magisk_patched_boot.img​
Bash:
adb reboot bootloader
fastboot flash boot magisk_patched_boot.img
fastboot reboot
Writable System​To make the system writable we need to remount the partitions.
Bash:
adb shell
su @#zxcvbnmasdfghjklqwertyuiop1234567890,.
remount
Now we need to reconnect and then we can write to the system (i.e. copy a file)
Bash:
adb shell
cp /sdcard/myapp.apk /system/app

Reserved

Reserved

Hey all, I need help with my junsun v1 pro 4gb +64gb-mtk8259- I just had it installed and everything works except Bluetooth. I can make calls from unit and or my cell phone. Apparently the people I call can hear me but I can't hear them. On occasion as it dialing I hear the ringing for a second then it cuts out. Is this a hardware issue, install issue, or something I need to change in secret menu?? I've reached out to junsun with no luck. I fixed the issue with the swc thanks to this forum!! Hoping someone can help me. Car is chrysler 300c and phone is samsung galaxy note 20.

Cubanlink81 said:
Hey all, I need help with my junsun v1 pro 4gb +64gb-mtk8259- I just had it installed and everything works except Bluetooth. I can make calls from unit and or my cell phone. Apparently the people I call can hear me but I can't hear them. On occasion as it dialing I hear the ringing for a second then it cuts out. Is this a hardware issue, install issue, or something I need to change in secret menu?? I've reached out to junsun with no luck. I fixed the issue with the swc thanks to this forum!! Hoping someone can help me. Car is chrysler 300c and phone is samsung galaxy note 20.
Click to expand...
Click to collapse
Hi, I have the same problem, if you have found a solution to the problem please share it with me! Thanks!

I am trying to mess with the secret menu. Like bt sync type, volume, three is various options in there related to Bluetooth just don't want to screw it up worse. Hopefully someone can shed some light cuz if not I'm returning it. I'll have to pay to take it out....ughh...I love the look though, if not I would just get pioneer but it don't look stock like this

So I Brought it back to my installer and he fixed it. Apparently in my car the speaker inputs were reversed, that why I couldn't hear anyone through speakers. He told me some cars with 6 plus speakers have this problem when installing these type of units. Loving the unit now that's its all fixed.

Hello
I have Junsun V1 pro 4/64g and my unit is hanging on Google boot logo (Android 9).
Does some one know how to get to recovery to do wipe cash / do factory reset?
Thanks

I have the junsun v1 1gb, it does not enter the google play services.
I would like you to provide me with a ROOM image to update or factory reset.
Thanks!

bartekm01 said:
Does some one know how to get to recovery to do wipe cash / do factory reset?
Click to expand...
Click to collapse
I'm actually also looking for a way how to boot into the recovery. Haven't found one at the moment.
For your problem you could try and flash an update (or same version again). Description is in this thread.

Hi
Unfortunately updates are also not booting / updating while reseting. Plugging USB pendrive with update files to second USB port and against resting button still can't manage to update - radio is botting "normally" and ends up with bootloop

Try both USB ports.
Plug the drive in turn the device on and then move a finger on the touchscreen. I do a left right movement. If that doesn't work you will need to do it with the mtk tools and a scatter file.

Hi!! Are there any way to disable calls from SIM card ? Thanks

Hi, I purchased the Junsun V1 pro 6gb/128gb and am pretty happy with it. All the important things connected and worked straight away which was grand. One thing I wanted to check is the battery draining problem and the cutting of the 2 wires to prevent this. I found the Junsun diagram and on there it seems it's the red and orange wires (that "look" to run from the main black block to the black power block for the head unit). The query I have is those wires on my loom run from the canbus white block to the black power block in the head unit. Pictures attached to hopefully show this a bit better. Excuse the terminology Has anyone had any experience with this at all? TIA

Hi Everyone,
Can someone please help me how to factory reset code or the new firmware my Junsun v1 pro 9 inch 8G + 128 GB Radio chip MS98. i tried 8888 or 8878 but i can see no factory reset only factory setting.
thank you advance.

Hey does anyone know how to completey reset the AutoLink app? I tried disabling and enabling again but. Nothing works. I just want to get ride of Android auto activated from AutoLink.

Sowmaxwel said:
Hi Everyone,
Can someone please help me how to factory reset code or the new firmware my Junsun v1 pro 9 inch 8G + 128 GB Radio chip MS98. i tried 8888 or 8878 but i can see no factory reset only factory setting. View attachment 5572199
thank you advance.
Click to expand...
Click to collapse
I have the 6gb, not sure what chip. When you go into the menu after code 8878 it should say on the right in the middle "Erase All" I think. Then it asks you if you want to factory reset.

Saving Dead Shield Pro 500gb

I wanted to share my experience in reviving my 2017 Shield Pro 500gb. I was at the point that it wouldn’t even turn on and all I would get is a black screen then after some time I would get 3 green flashes then the Shield would power off.
I was at the stage in which I couldn’t even backup the device and starting from scratch seemed very unlikely from my reading online. I had tried so many different things before I finally came to what follows.
Things I used
Samsung Evo 500GB
Nvidia shield TV pro files (someone kindly uploaded online) https://forum.xda-developers.com/t/nvidia-shield-tv-ssd-done.3402580/page-2#post-67426622
nv-recovery-image-shield-atv-pro-7.2.3-dev_rooted https://drivers.softpedia.com/get/g...Android-TV-Pro-Developer-Firmware-7-2-1.shtml
DD command line using Linux ( you can use Windows)
Rufus
OTG cable
ADB and Fastboot Drivers
SATA Adapter
First up I dismantled the Shield which although not overly complicated, you just have to be careful with the wires as the must be unplugged and SATA connector from the HDD.
So the HDD being completely dead I decided if I was going to successfully revive the shield I would use a SSD instead. I plugged the SSD into my windows laptop and reformatted it to a GPT partition scheme with a FAT32 filesystem using Rufus.
Now I would switch from Windows to Linux (I know you can do this with windows but all my previous successes have been through Linux) and find the folder containing – start.bin and end_976574630.bin and open your terminal. Plug your ssd into your linux running computer. Here I would use the command $sudo su and then the command fdisk -l to find what letter your drive is identified by. Let’s say the drive is identified as sdd.
Next write the command $dd if=start.bin of=/dev/sdd bs=4M
This process can take around 15 minutes give or take. Once the process has been completed enter $dd if=end_976574630.bin of=/dev/sdd seek=976574630. This will not take as long as the previous process. Make sure that you can see no errors once the process is complete and safely eject the drive.
Now it’s time to reassemble the Shield making sure again not to damage any wires and everything is correctly reconnected.
After I plugged it bag into power I just let it sit trying to boot for about ten minutes before turning it off.
For the next part I used Windows and you need to make sure you have the ADB and fastboot drivers installed on your computer. Find the folder named nv-recovery-image-shield-atv-pro-7.2.3-dev_rooted and open terminal, PowerShell etc here.
Fastboot reboot the hardware way
- Disconnect power cable
- Connect Shield to a computer using an USB cable connected to the micro USB port of the Shield.
- Connect power cable to SHIELD
- As soon as the green LED turns on -BUT NOT BEFORE- hold down the power button
- Count to three, then immediately release the power button
- i.e. one-one thousand, two-one thousand, three-one thousand.. LIFT!
- You should now see the fastboot menu on the screen.
To confirm the device is in fastboot mode type the command $fastboot devices and you should see your device listed. Now one at a time type the following commands.
fastboot flash staging blob
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash system system.img
fastboot flash vendor vendor.img
fastboot reboot
Your Shield will begin to boot and will probably appear to stay on the four dots that turn into the Android logo for a little while. Give it 15 min and then unplug the power and repower the Shield. Now you will see your past boot and next setting the language and internet settings. Once you’ve done that you will be asked for Google credentials and the moment you’ve been waiting for the Nvidia Shield home screen. When I did it there was an update for 8.0 available which I did and everything worked fine. I then noticed an update for 9.0. Do not do this you will be back to square one which I found the hard way. For some reason it seems 8.0 that is compatible for this Shield model.
I just want to say a lot of this in formation has come from sources and articles I have read and have put together to suit my needs.
Big thanks to Tilator from XDA Developers and to Yaneca XDA Developer

Hey.. I have a nvidia shield 2017 Pro (I think? Not sure if the 2017 has a pro or not).
When I try and flash anything in TWRO with adb sideload I get error:
failed to read 16777216 bytes data at offset xxxx: I/O error
Im unable to to anything with it.. tried to format and tried a lot of things.. But I suspect disk is basically dead..
Do you think I can open it up and exchange drive to a regular 2.5" SSD and solve it?

Riverphoenix said:
I wanted to share my experience in reviving my 2017 Shield Pro 500gb. I was at the point that it wouldn’t even turn on and all I would get is a black screen then after some time I would get 3 green flashes then the Shield would power off.
I was at the stage in which I couldn’t even backup the device and starting from scratch seemed very unlikely from my reading online. I had tried so many different things before I finally came to what follows.
Things I used
Samsung Evo 500GB
Nvidia shield TV pro files (someone kindly uploaded online) https://forum.xda-developers.com/t/nvidia-shield-tv-ssd-done.3402580/page-2#post-67426622
nv-recovery-image-shield-atv-pro-7.2.3-dev_rooted https://drivers.softpedia.com/get/g...Android-TV-Pro-Developer-Firmware-7-2-1.shtml
DD command line using Linux ( you can use Windows)
Rufus
OTG cable
ADB and Fastboot Drivers
SATA Adapter
First up I dismantled the Shield which although not overly complicated, you just have to be careful with the wires as the must be unplugged and SATA connector from the HDD.
So the HDD being completely dead I decided if I was going to successfully revive the shield I would use a SSD instead. I plugged the SSD into my windows laptop and reformatted it to a GPT partition scheme with a FAT32 filesystem using Rufus.
Now I would switch from Windows to Linux (I know you can do this with windows but all my previous successes have been through Linux) and find the folder containing – start.bin and end_976574630.bin and open your terminal. Plug your ssd into your linux running computer. Here I would use the command $sudo su and then the command fdisk -l to find what letter your drive is identified by. Let’s say the drive is identified as sdd.
Next write the command $dd if=start.bin of=/dev/sdd bs=4M
This process can take around 15 minutes give or take. Once the process has been completed enter $dd if=end_976574630.bin of=/dev/sdd seek=976574630. This will not take as long as the previous process. Make sure that you can see no errors once the process is complete and safely eject the drive.
Now it’s time to reassemble the Shield making sure again not to damage any wires and everything is correctly reconnected.
After I plugged it bag into power I just let it sit trying to boot for about ten minutes before turning it off.
For the next part I used Windows and you need to make sure you have the ADB and fastboot drivers installed on your computer. Find the folder named nv-recovery-image-shield-atv-pro-7.2.3-dev_rooted and open terminal, PowerShell etc here.
Fastboot reboot the hardware way
- Disconnect power cable
- Connect Shield to a computer using an USB cable connected to the micro USB port of the Shield.
- Connect power cable to SHIELD
- As soon as the green LED turns on -BUT NOT BEFORE- hold down the power button
- Count to three, then immediately release the power button
- i.e. one-one thousand, two-one thousand, three-one thousand.. LIFT!
- You should now see the fastboot menu on the screen.
To confirm the device is in fastboot mode type the command $fastboot devices and you should see your device listed. Now one at a time type the following commands.
fastboot flash staging blob
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash system system.img
fastboot flash vendor vendor.img
fastboot reboot
Your Shield will begin to boot and will probably appear to stay on the four dots that turn into the Android logo for a little while. Give it 15 min and then unplug the power and repower the Shield. Now you will see your past boot and next setting the language and internet settings. Once you’ve done that you will be asked for Google credentials and the moment you’ve been waiting for the Nvidia Shield home screen. When I did it there was an update for 8.0 available which I did and everything worked fine. I then noticed an update for 9.0. Do not do this you will be back to square one which I found the hard way. For some reason it seems 8.0 that is compatible for this Shield model.
Riverphoenix said:
I wanted to share my experience in reviving my 2017 Shield Pro 500gb. I was at the point that it wouldn’t even turn on and all I would get is a black screen then after some time I would get 3 green flashes then the Shield would power off.
I was at the stage in which I couldn’t even backup the device and starting from scratch seemed very unlikely from my reading online. I had tried so many different things before I finally came to what follows.
Things I used
Samsung Evo 500GB
Nvidia shield TV pro files (someone kindly uploaded online) https://forum.xda-developers.com/t/nvidia-shield-tv-ssd-done.3402580/page-2#post-67426622
nv-recovery-image-shield-atv-pro-7.2.3-dev_rooted https://drivers.softpedia.com/get/g...Android-TV-Pro-Developer-Firmware-7-2-1.shtml
DD command line using Linux ( you can use Windows)
Rufus
OTG cable
ADB and Fastboot Drivers
SATA Adapter
First up I dismantled the Shield which although not overly complicated, you just have to be careful with the wires as the must be unplugged and SATA connector from the HDD.
So the HDD being completely dead I decided if I was going to successfully revive the shield I would use a SSD instead. I plugged the SSD into my windows laptop and reformatted it to a GPT partition scheme with a FAT32 filesystem using Rufus.
Now I would switch from Windows to Linux (I know you can do this with windows but all my previous successes have been through Linux) and find the folder containing – start.bin and end_976574630.bin and open your terminal. Plug your ssd into your linux running computer. Here I would use the command $sudo su and then the command fdisk -l to find what letter your drive is identified by. Let’s say the drive is identified as sdd.
Next write the command $dd if=start.bin of=/dev/sdd bs=4M
This process can take around 15 minutes give or take. Once the process has been completed enter $dd if=end_976574630.bin of=/dev/sdd seek=976574630. This will not take as long as the previous process. Make sure that you can see no errors once the process is complete and safely eject the drive.
Now it’s time to reassemble the Shield making sure again not to damage any wires and everything is correctly reconnected.
After I plugged it bag into power I just let it sit trying to boot for about ten minutes before turning it off.
For the next part I used Windows and you need to make sure you have the ADB and fastboot drivers installed on your computer. Find the folder named nv-recovery-image-shield-atv-pro-7.2.3-dev_rooted and open terminal, PowerShell etc here.
Fastboot reboot the hardware way
- Disconnect power cable
- Connect Shield to a computer using an USB cable connected to the micro USB port of the Shield.
- Connect power cable to SHIELD
- As soon as the green LED turns on -BUT NOT BEFORE- hold down the power button
- Count to three, then immediately release the power button
- i.e. one-one thousand, two-one thousand, three-one thousand.. LIFT!
- You should now see the fastboot menu on the screen.
To confirm the device is in fastboot mode type the command $fastboot devices and you should see your device listed. Now one at a time type the following commands.
fastboot flash staging blob
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash system system.img
fastboot flash vendor vendor.img
fastboot reboot
Your Shield will begin to boot and will probably appear to stay on the four dots that turn into the Android logo for a little while. Give it 15 min and then unplug the power and repower the Shield. Now you will see your past boot and next setting the language and internet settings. Once you’ve done that you will be asked for Google credentials and the moment you’ve been waiting for the Nvidia Shield home screen. When I did it there was an update for 8.0 available which I did and everything worked fine. I then noticed an update for 9.0. Do not do this you will be back to square one which I found the hard way. For some reason it seems 8.0 that is compatible for this Shield model.
I just want to say a lot of this in formation has come from sources and articles I have read and have put together to suit my needs.
Big thanks to Tilator from XDA Developers and to Yaneca XDA Developer
Click to expand...
Click to collapse
Click to expand...
Click to collapse
Riverphoenix said:
I just want to say a lot of this in formation has come from sources and articles I have read and have put together to suit my needs.
Big thanks to Tilator from XDA Developers and to Yaneca XDA Developer
Click to expand...
Click to collapse
Hello,
which exact model EVO 500gb did you use ?
I have tried with the EVO 950, EVO 960 and the EVO 970 500Gb drives and neither of them are able to finish the second image file end_976574630.bin
The disk runs out of capacity. I had even tried to alter the seek sector value but then drive remains dead.
Here is my output as I posted in Tilator’s original thread
dd if=end_976574630.bin of=/dev/sdb seek=976574630
dd: writing to '/dev/sdb': No space left on device
198535+0 records in
198534+0 records out
101649408 bytes (102 MB, 97 MiB) copied, 27.1625 s, 3.7 MB/s

@Riverphoenix, I tried to write those 2 files to my ssd the other day and I am getting the "permissions denied" error. I am on a mac using terminal. Shouldn't be too different. I didn't use the sudo command though. Is that something I need to do? I am "newish" at this sort of thing and trying to understand it all. Also did you just plop the 2 files on your linux desktop or how did you access those files after you moved from your windows machine to your linux machine? Do i need to terminal into the folder with those files or terminal into the drive I am writing those files to?

Fire HD10 (2019) bricked itself

Hi,
A few days ago, my Fire HD10(2019) refused to power on, or rather it would show some life (amazon screen IIRC), but go no further. Now it doesn't even do that.
On a PC I can see whats its doing across USB. "Bus 002 Device 083: ID 0e8d:0003 MediaTek Inc. MT6227 phone" on usb for about 45 seconds, then it disconnects for maybe 20s, and then repeats. Now I take the 0e8d:0003 device to be the amazon bootloader - so looks to me like the bootloder works, but crashes hard and restarts as soon as it tries to start android. So looks like the box is bricked.
I've tried the various buttons to go into fastboot - no success. Neither "adb devices" nor "fastboot devices" can see the device. On first booting, the machine brings up a serial interface (USB ACM device), alas I've not been able to connect to this.
So what are my options of getting into the machine? If I can't access the bootloader via the serial interface, are there UART pins on the board? If so where? If I can access the bootloader, can I switch to fastboot mode, so I can reflash the android OS? Where is the best place to look for info like this?

davidsummers said:
Hi,
A few days ago, my Fire HD10(2019) refused to power on, or rather it would show some life (amazon screen IIRC), but go no further. Now it doesn't even do that.
On a PC I can see whats its doing across USB. "Bus 002 Device 083: ID 0e8d:0003 MediaTek Inc. MT6227 phone" on usb for about 45 seconds, then it disconnects for maybe 20s, and then repeats. Now I take the 0e8d:0003 device to be the amazon bootloader - so looks to me like the bootloder works, but crashes hard and restarts as soon as it tries to start android. So looks like the box is bricked.
I've tried the various buttons to go into fastboot - no success. Neither "adb devices" nor "fastboot devices" can see the device. On first booting, the machine brings up a serial interface (USB ACM device), alas I've not been able to connect to this.
So what are my options of getting into the machine? If I can't access the bootloader via the serial interface, are there UART pins on the board? If so where? If I can access the bootloader, can I switch to fastboot mode, so I can reflash the android OS? Where is the best place to look for info like this?
Click to expand...
Click to collapse
It is actually the mediatek bootrom (your device can have mtk-su temp root access, if you downgrade). You must have one of the early release ones that have access to it. My guess there is something wrong with the preloader... While i can't pin it down, the information to reload is all in this thread...
New Fire HD10 2019 Bootless Root Method + Bootloader Unlock Brainstorming
There's a new Fire 10 coming out, with an Octacore processor, USB-C charging, and FireOS based on Pie: https://arstechnica.com/gadgets/2019/10/amazons-new-fire-hd-10-tablet-costs-149-and-charges-via-usb-c/ I most certainly don't need any more...
forum.xda-developers.com

Yes it was an early device. Alas it connected to the web, and updated itself from 7.3.1.0 before I disabled most of the amazon processes. So the original mtk-su for 7.3.1.0 never worked on my machine. Alas can't use this any more - as can't get into android any more.
I'm up to page 30 of the thread you posted, alas nothing read so far has managed to get into the machine.

And first progress - bypass_utility version 1.4.2. can connect (when run as root) and gives:
[2023-01-22 14:32:12.028038] Waiting for device
[2023-01-22 14:32:39.691833] Found port = /dev/ttyACM0
[2023-01-22 14:32:40.083041] Device hw code: 0x788
[2023-01-22 14:32:40.083391] Device hw sub code: 0x8a00
[2023-01-22 14:32:40.083586] Device hw version: 0xca00
[2023-01-22 14:32:40.083770] Device sw version: 0x0
[2023-01-22 14:32:40.083959] Device secure boot: True
[2023-01-22 14:32:40.084143] Device serial link authorization: False
[2023-01-22 14:32:40.087904] Device download agent authorization: True
[2023-01-22 14:32:40.088223] Disabling watchdog timer
[2023-01-22 14:32:40.092031] Disabling protection
[Errno 5] Input/Output Error
[2023-01-22 14:32:41.464834] Payload did not reply

davidsummers said:
And first progress - bypass_utility version 1.4.2. can connect (when run as root) and gives:
[2023-01-22 14:32:12.028038] Waiting for device
[2023-01-22 14:32:39.691833] Found port = /dev/ttyACM0
[2023-01-22 14:32:40.083041] Device hw code: 0x788
[2023-01-22 14:32:40.083391] Device hw sub code: 0x8a00
[2023-01-22 14:32:40.083586] Device hw version: 0xca00
[2023-01-22 14:32:40.083770] Device sw version: 0x0
[2023-01-22 14:32:40.083959] Device secure boot: True
[2023-01-22 14:32:40.084143] Device serial link authorization: False
[2023-01-22 14:32:40.087904] Device download agent authorization: True
[2023-01-22 14:32:40.088223] Disabling watchdog timer
[2023-01-22 14:32:40.092031] Disabling protection
[Errno 5] Input/Output Error
[2023-01-22 14:32:41.464834] Payload did not reply
Click to expand...
Click to collapse
It has been a long time. Maybe try disconnecting the battery, not sure if it is staying in bootrom mode.... I remember mine had to have the battery removed or it would try to goto the preloader (i think). I used the process to downgrade back to 7.3.1.0, but it was like a year ago.

Michajin said:
It has been a long time. Maybe try disconnecting the battery, not sure if it is staying in bootrom mode.... I remember mine had to have the battery removed or it would try to goto the preloader (i think). I used the process to downgrade back to 7.3.1.0, but it was like a year ago.
Click to expand...
Click to collapse
Yes - mine stayed in 0e8d:0003 mode, when the device bricked itself - made no difference with battery on or off, always when through the same minute cycle, where the device would disconnect, then reboot.
Interesting after running the bypass utility - it has stayed up in the 0e8d:0003 mode - and hasn't rebooted.

davidsummers said:
Yes - mine stayed in 0e8d:0003 mode, when the device bricked itself - made no difference with battery on or off, always when through the same minute cycle, where the device would disconnect, then reboot.
Interesting after running the bypass utility - it has stayed up in the 0e8d:0003 mode - and hasn't rebooted.
Click to expand...
Click to collapse
it disabled the watchdog timer. From what is can see everything points to a potential wrong setup..
bypass_utility/README.md at master · MTK-bypass/bypass_utility
Contribute to MTK-bypass/bypass_utility development by creating an account on GitHub.
github.com

This post shows the same error as you read through it.
Payload did not reply · Issue #13 · MTK-bypass/exploits_collection
[Errno 5] Input/Output Error Payload did not reply
github.com

OK - using SP_Flash_Tool v5.2008 to attempt to flash maverick-downgrade-7.0_PR7310_940N and I get the error:
Connect BROM failed: STATUS_SEC_AUTH_FILE_NEEDED(-1073545198)
Disconnect!
BROM Exception! ( ERROR : STATUS_SEC_AUTH_FILE_NEEDED (-1073545198) , MSP ERROE CODE : 0x00.
[HINT]:
Please select a valid authentication file or ask for help.)((ConnectBROM,../../../flashtool/Conn/Connection.cpp,105))
So where do I get the authentication file from?

Michajin said:
it disabled the watchdog timer. From what is can see everything points to a potential wrong setup..
bypass_utility/README.md at master · MTK-bypass/bypass_utility
Contribute to MTK-bypass/bypass_utility development by creating an account on GitHub.
github.com
Click to expand...
Click to collapse
ah yes - that explains why it was rebooting. So guess I have to dig into [Errno 5] Input/Output Error.
Seems like only way I have into the tablet any more is the mediatek bootrom, but as the tablet is sick - if that doesn't work, then probably its permanently dead. E.g. even getting access to a uart wouldn't help.

You have to only do file by file.
5. bypass_utility run succes with message "Protection disabled"
6. Run SPFlash Tool and flash boot, recovery, vendor, system. Wait to finish
7. Hold power button 15s to power off (check Ports in Device Manager windows)
8. Hold volume up and power boot to recovery with triactangle icon
9. Hold power and tap volume up then choose reset factory
10. Reboot

Thanks Michajin - I'm obviously having problems with the bypass_utility, whilst it connects to the MediaTek bootrom, it is not able to disable protection - and test mode bombs out. I've taken this up on the bypass_utility thread:
xda bypass utility