[For Dev] /dev/block/mmcblk0p5 reverse engineered, boot images customizable - Samsung Galaxy W I8150

I'll start this thread by posting the IDA .idb file and a linux shell script that dumps out the stock images.
To use:
adb shell
dd if=/dev/block/mmcblk0p5 of=/mnt/sdcard/something
exit
adb pull /mnt/sdcard/something
run the script with: ./get_images.sh something
Anyone want to make some new custom themed ones?
It was only 1 day's work to disassemble the partition. (Example, Exhibit II disassembled here) If you have other dumps made with dd you want me to take a look at, I might be able to help you.

For example, here's a sample of what the original image looked like, and what the new one looks like when my phone boots.

Huh, I did this the first day I got the phone over 2 months ago. It's no hocus pocus.

soo the boot logo cant be change arcoo???

It can be changed yes.

what are the disadvantages arco? and how are youuu legend? xD
Sent from my GT-I8150 using XDA App

arco68 said:
Huh, I did this the first day I got the phone over 2 months ago. It's no hocus pocus.
Click to expand...
Click to collapse
Please post your .idb file so I can take a look.

Oops, sorry. I thought you were talking about the boot partition. My bad.

arco68 said:
Oops, sorry. I thought you were talking about the boot partition. My bad.
Click to expand...
Click to collapse
No worries.
I like reading any & all .idb's; I'll share any I can get my hands on or generate.

After completing my analysis, the only way to get added functions from odin mode (on this phone) would be to exploit it.
It stores the URB on the stack - so sending shellcode should be possible. If you're interested, please reply with your favorite IRC channel. If your name is Mr. Jongshik, you're the author of the code - mind posting the source?
What added functions? Things like diagnostic & debugging tools. The current stuff is very limited.

More EMMCBOOT versions
I have a different EMMCBOOT version on my phone — images are at some different offsets.
I have attached a file with dumps of partitions 5 and 21 (p21 looks like a boot backup, seems to be called /boot/appsbl_bkp in some places). The backup version in p21 looks like yours (at least image offsets are the same); also the md5sum of the first 1554432 bytes of it is 28ebdcd5ba941c1b9b9cd9ad6f6929f5, and exactly this value is in the table at the start of partition 1 — probably this is the version from factory, and the version which is now in p5 came with FOTA updates (initial version was I8150XXKJ1, updated with FOTA first to I8150XXKJ6, then to I8150XXLA2).

Related

Building Stock Firmwares (Verizon Specifically)

Hey guys, I've been reading for a while now, finally decided to sign up.
I'm making some modifications to the Galaxy Tab, just playing around and seeing what all is possible. Before I go start deleting potentially important system files, I wanted to get myself a little 'brick insurance'. I'm looking to get a copy of the stock firmware for the US Verizon Wireless version of the Tab (SCH-I800). It is currently running DJ11.
I don't think it is available from either Samsung or Verizon currently, although Samsung HAS provided all of the source code. If I wanted to make a backup of the firmware, something that I could load from the SDCard (ideally, just give it one of those update.zip files) how would I go about doing that?
This is my current plan, tell me if I'm not on track here. I have downloaded the Android Froyo source code available on the Android site. I downloaded the SCH-I800_OpenSource files from Samsung's open source center. If I combine these files as described in the readme from Samsung, and then build the whole project, I should get some sort of "stock" software, in basically the exact same state that it was when I got it from Verizon. Does this sound right?
I want to be able to quickly revert back to like-new set up, so I would prefer to not have to use one of the modified European/International versions if possible. Is there any other trick to getting an unmodified firmware to revert to? Any suggestions?
Thank You
I don't think it'll matter until someone creates a new recovery image. If you could get a clockwork recovery image, you'd be a hero
DavidThompson256 said:
This is my current plan, tell me if I'm not on track here. I have downloaded the Android Froyo source code available on the Android site. I downloaded the SCH-I800_OpenSource files from Samsung's open source center. If I combine these files as described in the readme from Samsung, and then build the whole project, I should get some sort of "stock" software, in basically the exact same state that it was when I got it from Verizon. Does this sound right?
Click to expand...
Click to collapse
Not even close i'm afraid!
Samsung are only required to release the Linux kernel source. The actual OS is not licensed under a "copy left" license, so Samsung are under no obligation to release their customized Android code.
So, you could create your own AOSP build, but this would be absolute stock Froyo - no Samsung launcher, or any of their custom apps.
Regards,
Dave
Yaotl said:
I don't think it'll matter until someone creates a new recovery image. If you could get a clockwork recovery image, you'd be a hero
Click to expand...
Click to collapse
You can use odin or redbend_ua to flash firmwares, you don't necessarily need clockwork - although it would be nice!
Hey infamousjax,
Do you happen to have an update.zip for the verizon tab you can upload? I managed to ninjamorph my framework so nothing opens anymore. I must have used a file that was the wrong png format or something. Anyway I do have the backup framework-res.apk, but I am unsure on the "update-script" as I can't get programs on my tab at the moment.
ninja4hire said:
Hey infamousjax,
Do you happen to have an update.zip for the verizon tab you can upload? I managed to ninjamorph my framework so nothing opens anymore. I must have used a file that was the wrong png format or something. Anyway I do have the backup framework-res.apk, but I am unsure on the "update-script" as I can't get programs on my tab at the moment.
Click to expand...
Click to collapse
I have the Sprint version... and the stock recovery can't flash update.zips unless they are signed.
infamousjax said:
I have the Sprint version... and the stock recovery can't flash update.zips unless they are signed.
Click to expand...
Click to collapse
Yeah I just tried to make an update.zip and sign it with a test signer. Now when go into recovery and run the update.zip it freezes on an Android icon with an exclamation point.
ninja4hire said:
Yeah I just tried to make an update.zip and sign it with a test signer. Now when go into recovery and run the update.zip it freezes on an Android icon with an exclamation point.
Click to expand...
Click to collapse
Can you boot up regularly?
yeah, it's just that I can't open programs or the settings menu.
edit: I have been trying to do an update.zip, but I keep getting "E: signature verification failed". I have tried to different signers already...
This one
http://www.robmcghee.com/android/creating-an-android-update-zip-package/
and this one
http://www.londatiga.net/it/how-to-create-android-update-zip-package/
Your not going to able to sign it without Samsung's signatures... and good luck finding those
yeah I pretty much gave up. I called last night and got the verizon insurance. So now I'm just gonna wait a few days then tell them I dropped it and pay $80 for a new one.
just tell them it started bootlooping for no reason... they should replace it for free if its within 30 days
So it sounds as though I'm not really on the right track here, perhaps I don't need to recompile this thing myself. From some of the replies, I've gathered that there IS at least some way to create a backup of the firmware, in case I screw it up.
Can anyone point me to specific steps on how to do a backup for the Tab? I've seen several guides for other phones before, but I believe that each device is slightly different, and may take different steps. Any suggestions?
Thanks again.
For your stock recovery
Code:
cat /dev/block/bml8 > /sdcard/recovery.bin
For your kernel
Code:
cat /dev/block/bml7 > /sdcard/zImage
Thanks a lot, that info was really helpful!
So, unrelated now, but just kind of curious... is there a reference sheet somewhere or something that explains what each of the files in /dev/block is for? I know they are different sections of the filesystem.
I have about 60 different files in that directory, and was just curious to know what each of them was for.
Thanks again for all the info.
DavidThompson256 said:
is there a reference sheet somewhere or something that explains what each of the files in /dev/block is for? I know they are different sections of the filesystem.
Click to expand...
Click to collapse
What they represent is different devices, not different sections of filesystems. At best (without RAID or LVM) each device holds one filesystem. In unix, filesystems can be mounted at various points into the root filesystem to appear as a single namespace, but they will still be separate filesystems.
Under the block dir you will see anything that is a block device, anything that can be written to randomly, as opposed to a serial type of device. So, all the random access hardware on your device (SDCARD, NAND...) will be represented there except for your RAM. Each physical device will likely have partitions on them so, if a device is named xxx, xxx01 will likely mean partition one on device xxx. Sometimes the same device will appear with several names, one may be buffered access, the other may be raw.
Your internal NAND is likely on the same device, just different partitions of that device. Some of these partitions may not hold filesystems, they may hold other blobs such as a boot loader, or the kernel. To see which ones hold filesystems, you can type df in a terminal and you will likely see which devices are mounted where in the filesystem namespace.
As for the rest of the devices and partitions, they are very hardware device specific. And I don't own a Galaxy tab, so I can't help with that, sorry. But, I hope I didn't give you info you already knew and I hope it might have been at least somewhat helpful...

New for the Devs: ROOTED system dump here

Major edit:
This is now the rooted system pull, including EVERYTHING that you'll need to dev for this phone. Links are here:
http://d-h.st/2No This link is system.img compressed to a 7z format, expect it to be HUGE (about 1.4gb) when uncompressed.
http://d-h.st/7YC This is the standard system.tar.gz pull.
http://d-h.st/wvp System.tar.gz mirror
If anyone needs another system dump uploaded let me know. Got mine today and am in no hurry to switch over to it so its a test bed.
Thanks for posting. I'm sure this will be of great help to some folks doing research on the device for some flashing goodness!
anyone wanna test TW launcher with wallpaper scrolling
already have it done.
howtomen said:
anyone wanna test TW launcher with wallpaper scrolling
already have it done.
Click to expand...
Click to collapse
You're already on a roll! Good to see some familiar SN's on this side already!
howtomen said:
anyone wanna test TW launcher with wallpaper scrolling
already have it done.
Click to expand...
Click to collapse
wut? lol the launcher doesn't have wallpaper scrolling? wow didn't know that.
HERE IS A JumboFiles MIRROR
Thanks, Neverends. Just edited my first post.
I got a T-mo version today, and would love to provide a dump, but I don't have a clue how. My Odin/adb are all good, I just don't know what the commands are. Anyone want to give me a list so I can have at it?
Janis said:
I got a T-mo version today, and would love to provide a dump, but I don't have a clue how. My Odin/adb are all good, I just don't know what the commands are. Anyone want to give me a list so I can have at it?
Click to expand...
Click to collapse
Adb pull /system and post in tmobile forum
Sent from my HTC Desire HD using xda premium
Janis said:
I got a T-mo version today, and would love to provide a dump, but I don't have a clue how. My Odin/adb are all good, I just don't know what the commands are. Anyone want to give me a list so I can have at it?
Click to expand...
Click to collapse
Make a folder to hold the dump. I did C:/SGS3Dump
Then type adb pull /system C:/SGS3Dump and it takes about 15 minutes to complete
entropism said:
Make a folder to hold the dump. I did C:/SGS3Dump
Then type adb pull /system C:/SGS3Dump and it takes about 15 minutes to complete
Click to expand...
Click to collapse
There is a better way to do this. By doing it the way that you mention windows will add a carriage return to end of every line of the basic files, since Adnroid is linux at it's base, that is not a good thing.
The better way to grab a system image is like this:
adb shell
cat /dev/block/system > /sdcard/system.img
This can be mounted like an iso on any OS.
I'll do this now. Thanks for the tip!
Edit: Says no such file or directory. odd
jimbridgman said:
There is a better way to do this. By doing it the way that you mention windows will add a carriage return to end of every line of the basic files, since Adnroid is linux at it's base, that is not a good thing.
The better way to grab a system image is like this:
adb shell
cat /dev/block/system > /sdcard/system.img
This can be mounted like an iso on any OS.
Click to expand...
Click to collapse
no root so it cant be done....
howtomen said:
no root so it cant be done....
Click to expand...
Click to collapse
Yes that is true, but still a better way for a true image. The other way, will miss any files that are not readable by "other" on the filesystem, so that can be an issue, as well.
As soon as we get root, I'll post up a proper system dump. I just need to know how to get access to the boot.img, so we can get root.
entropism said:
I'll do this now. Thanks for the tip!
Edit: Says no such file or directory. odd
Click to expand...
Click to collapse
You may have to figure out where the device for /system is at in /dev it may be something like /dev/block/mmcblk0p(1-26). Those last numbers in the parenthesis are the partition number for /system, that will be what you will need to find in /dev/block, and it will be a number between 1 and 25 usually.
You will need root to this, just like howtomen mentioned. For now how you mentioned will just sort of do the job. It would be best to do it from cygwin rather than from the windows command line though, as cygwin should NOT add the carriage returns.
OK well... I have a linux machine I can use, but I never used ADB on it. if someone wants to walk me through it, I'll do a system dump on linux. If not, well, not much I can do...
Would love to look at the dump, but that mirror ain't working well for me.
Sent from my SGH-I997 using xda premium
Me neither... I'm posting up my dropbox again.
http://dl.dropbox.com/u/6421623/ATTSGS3 System Dump.7z

[manta][CWM Advanced Edition] PhilZ Touch

Main thread + features + install instructions + dev support
http://forum.xda-developers.com/showthread.php?t=2201860
PhilZ Touch is a CWM Advanced Edition that adds all the features you could ever miss in CWM
It is a well proven recovery for many phones
It also adds a full touch interface a completely configurable GUI
Please give your feedback, what works, and any bug you could encounter
Read the features, and check if you are missing something
To take a screen shot, just slide left
Also, do not forget to read about the powerful aroma file manager integration and double tap shortcut
Download links
Last version can be found here:
Nexus 10 (manta)
http://goo.im/devs/philz_touch/CWM_Advanced_Edition
Click to expand...
Click to collapse
Phil3759 said:
Flashing can brick your phone
This will be removed after people report it is booting fine without bricking their phone
Click to expand...
Click to collapse
But... my phone is across the room and isn't even Android. Maybe I should rip the battery out just to be safe though
This sounds pretty cool though.
espionage724 said:
But... my phone is across the room and isn't even Android. Maybe I should rip the battery out just to be safe though
This sounds pretty cool though.
Click to expand...
Click to collapse
I warn people when I release an untested recovery on a given device
Most noobs tend to forget that flashing is not a safe operation. It can always turn into a nightmare
You can check the list of currently supported devices from main thread here: http://forum.xda-developers.com/showthread.php?t=2201860
And browse into the different device support forums
Till now, the warning never became true except when some people flashed the wrong file in their phone
This warning should keep noobs away from testing it
Ah, yeah I have nothing against the warning, glad it's there even The Nexus 10 is a tablet though, not phone
espionage724 said:
Ah, yeah I have nothing against the warning, glad it's there even The Nexus 10 is a tablet though, not phone
Click to expand...
Click to collapse
LoL
It is a generic copy paste message
Well, will you be the first to give a feedback ?
Phil3759 said:
Well, will you be the first to give a feedback ?
Click to expand...
Click to collapse
Sure
I went to bootloader, erased recovery and flashed this one. Rebooted to recovery.
Battery meter at top-right says -1% (my tablet was on Pogo charge for hours prior to flashing). Get an error about being unable to create brightness sys file. During key test, randomly getting constant presses when holding 3 fingers on screen (probably a touchscreen-related issue).
espionage724 said:
Sure
I went to bootloader, erased recovery and flashed this one. Rebooted to recovery.
Battery meter at top-right says -1% (my tablet was on Pogo charge for hours prior to flashing). Get an error about being unable to create brightness sys file. During key test, randomly getting constant presses when holding 3 fingers on screen (probably a touchscreen-related issue).
Click to expand...
Click to collapse
Thank you for the feedback (reached my daily limit for :good
Brightness:
Do you by case know the path for your device brightness file?
Not a big deal though as I can search / look for it in rc files. I used Samsung usual path, but it seems they used a different one for google devices
Battery:
Will check for the battery path used
Touch
It is supposed to be one finger to use
Interesting though...
Can any one run this in adb shell while in recovery
Or you can use the console terminal in aroma file manager while in recovery
Code:
find /sys/. -name '*bright*' >/sdcard/brightness.txt
Then
Code:
find /sys/. -name '*battery*' >/sdcard/battery.txt
And attach the resulting brightness.txt and battery.txt files on sdcard
About multi touch: i will look to allow only slot 0 to ignore second finger
Sent from my GT-I9100 using Tapatalk 2
Forget it. I found path in source
Sent from my GT-I9100 using Tapatalk 2
Ok, still would need battery info it seems
Code:
find /sys/class/power_supply/ -name '*' >/sdcard/battery.txt
And as described above, attach resulting battery.txt file here
Please do this in recovery, not main system
Sent from my GT-I9100 using Tapatalk 2
Phil3759 said:
Ok, still would need battery info it seems
Code:
find /sys/class/power_supply/. -name '*' >/sdcard/battery.txt
And as described above, attach resulting battery.txt file here
Please do this in recovery, not main system
Click to expand...
Click to collapse
see attached - is this what you're looking for?
Ok,
Can you do this now:
Code:
ls-l /class/power_supply/android-battery >/sdcard/battery.txt
And attach the file
Many thanks
Phil3759 said:
Ok,
Can you do this now:
Code:
ls-l /class/power_supply/android-battery >/sdcard/battery.txt
And attach the file
Many thanks
Click to expand...
Click to collapse
Sorry I'm a bit out of sync with you -- but I've attached the one you asked for just before revising your post.
find /sys/class/power_supply/ -name '*' >/sdcard/battery.txt
Result is attached. I'll run the other command in a moment.
Phil3759 said:
Ok,
Can you do this now:
Code:
ls-l /class/power_supply/android-battery >/sdcard/battery.txt
And attach the file
Many thanks
Click to expand...
Click to collapse
OK -- re-learning linux command line as I go (it's been many years!). Good to wake up that part of the brain again...
Had to modify command above: needed a space between ls and -l, and I'm assuming you want "/sys" up front in the fully qualified file name... Assuming that's all good, the new result is attached as battery2.txt
Let me know if this is what you need, or if anything else is needed. I've got some time to squeeze in a few of these today as needed. Also REALLY looking forward to trying this out on my N10 (and would love to see this on the Galaxy Nexus if ever possible!).
Sorry for the time I make you loose
Was at work, on a hurry, typing using tapatalak mess
I am at home and I could test before posting this. The symlinking is a small issue to first traverse folders wthout going into tons of links
Anyway, here's what should find the needed files
Code:
ls -l /sys/class/power_supply/android-battery/* >/sdcard/battery.txt
Thank you for your patience :good::good:
Phil3759 said:
Sorry for the time I make you loose
Was at work, on a hurry, typing using tapatalak mess
I am at home and I could test before posting this. The symlinking is a small issue to first traverse folders wthout going into tons of links
Anyway, here's what should find the needed files
Code:
ls -l /sys/class/power_supply/android-battery/* >/sdcard/battery.txt
Thank you for your patience :good::good:
Click to expand...
Click to collapse
Try the attached...
jonstrong said:
Try the attached...
Click to expand...
Click to collapse
bingo :good:
Code:
/sys/class/power_supply/android-battery/capacity
Phil3759 said:
bingo :good:
Code:
/sys/class/power_supply/android-battery/capacity
Click to expand...
Click to collapse
Great -- let me know if you need anything else -- I'm home today, and can pull some more if needed.
Does this recovery support USB OTG?
I must be in stupid mode today !!
Have been running Galaxy S3 with PhilZ Touch for some time now .... superb :good:
Got a new Nexus 10 last week and want it on there as well ..... stupid bit coming now
Downloaded latest version from this thread - but it shows as "philz_touch_5.00.7-manta.img"
Not a zip or a tar file for Odin ..... what am I missing from under my nose?
Homer

2016 version (new fingerprint scanner, combined sim/sd)

Hey guys,
It seems more and more people are receiving the new version of the P8000:
- Stock Android 6
- New fingerprint scanner that is moved slightly higher and is able to unlock phone from screen-off (I confirm this is working)
- Sim 2 is combined with the micro-sd (I haven't tried whether you can have them both in at the same time)
- Somethings new about the display, since people are reporting errors with it after flashing older roms.
Warning: do NOT flash other roms. We have no way to unbrick the soft bricks yet!
---
Other topics that refer to this version:
http://forum.xda-developers.com/elephone-p8000/general/rom-p8000-t3431571
http://forum.xda-developers.com/elephone-p8000/help/stock-rom-p8000b-t3434477
http://forum.xda-developers.com/elephone-p8000/general/p8000-version-announced-t3346848
---
For development:
- The phone does not come pre-rooted. We have no way to flash custom recovery yet. Any tips for getting root? I've tried such tools as Kingo and vRoot, they don't work.
- We need the blocks file (scatter file) for SP Flash Tools. MTKDroidTools reports "unknown rom structure". Any help? Would love to start working on this.
Looking forward to hearing from others who have this version/who can help me with these questions.
Thanks!
Emile
Nice! Can you provide a dump from /system and /boot maybe?
BlueFlame4 said:
Nice! Can you provide a dump from /system and /boot maybe?
Click to expand...
Click to collapse
I would, if I knew how to. Any pointers?
Emileh said:
I would, if I knew how to. Any pointers?
Click to expand...
Click to collapse
Sure thing. On a rooted device, go into adb shell.
Then use "mount" command to check which partitions are mounted. One should be "/dev/block/platform/mtk-msdc.0/by-name/system" or similar. Use "dd if=/dev/block/platform/mtk-msdc.0/by-name/system of=/storage/emulated/0/system.img bs=1M" to dump the system to the internal sdcard to the file "system.img". If adb complains that bs=1M is an invalid option, try again without that one. A system dump can take some time where you will not get any feedback, so be patient there
Do the same for boot. So "/dev/block/platform/mtk-msdc.0/by-name/boot" should be the way to go for the path. I cannot tell the definite pathes on Android 6.0 but I am rather sure they are more or less like this.
If you run into troubles, just ask
BlueFlame4 said:
Sure thing. On a rooted device, go into adb shell.
Then use "mount" command to check which partitions are mounted. One should be "/dev/block/platform/mtk-msdc.0/by-name/system" or similar. Use "dd if=/dev/block/platform/mtk-msdc.0/by-name/system of=/storage/emulated/0/system.img bs=1M" to dump the system to the internal sdcard to the file "system.img". If adb complains that bs=1M is an invalid option, try again without that one. A system dump can take some time where you will not get any feedback, so be patient there
Do the same for boot. So "/dev/block/platform/mtk-msdc.0/by-name/boot" should be the way to go for the path. I cannot tell the definite pathes on Android 6.0 but I am rather sure they are more or less like this.
If you run into troubles, just ask
Click to expand...
Click to collapse
Thank you for your great instructions! The problem is that we've yet to achieve root on this device. We don't have a custom recovery for this version of the P8000 yet and other 'standard' methods of rooting don't work for me.
(I'm pretty solid in shell, so I'll do this afterwards, but I guess root is actually the first step).
// Edit to say: it does not come pre-rooted
Since the elephone support on facebook didn't realize there are two different versions of the P8000 available, I still need a ROM to unbrick my phone.
flo1k said:
Since the elephone support on facebook didn't realize there are two different versions of the P8000 available, I still need a ROM to unbrick my phone.
Click to expand...
Click to collapse
Ok, we know that, but doesn't really help us
Can you write them an e-mail?
I will do
Edit: OK, see if there will be an answer.
Thank you flo1k!
I have e-mailed as well, and would like to post on the Elephone forum, but don't seem to have access (because of minimum post count, I guess)
Anyone willing to ask for a ROM for the new P8000 on the forum there?
ROM Dump
@BlueFlame4
I can provide ROM dump in two versions:
1) a dump from adress 0000 0000 to 9d80 0000 (apr. 2.5 GB in one file)
2) a readback generated with the scatter.txt of the 'old' 5.1 stock ROM (apr. 2.8 GB seperated in 23 files)
FrauHofrat said:
@BlueFlame4
I can provide ROM dump in two versions:
1) a dump from adress 0000 0000 to 9d80 0000 (apr. 2.5 GB in one file)
2) a readback generated with the scatter.txt of the 'old' 5.1 stock ROM (apr. 2.8 GB seperated in 23 files)
Click to expand...
Click to collapse
The second choice looks promising
Maybe a stupid question
where shall I upload the files - any preferred webspace?
I'm uploading the files - because they contain my NVRAM I send the link as PM as soon as the upload is finished
FrauHofrat said:
Maybe a stupid question
where shall I upload the files - any preferred webspace?
I'm uploading the files - because they contain my NVRAM I send the link as PM as soon as the upload is finished
Click to expand...
Click to collapse
Are you sure we're talking about the same version of the P8000? Cause as far as I know there isn't 5.1 available for this version... Right?
Just checking thank you for your help in any case!! Really looking forward to it.
// edit: ah, you just used the old scatter file. But does that one work for this version?
Emileh said:
Are you sure we're talking about the same version of the P8000? Cause as far as I know there isn't 5.1 available for this version... Right?
Click to expand...
Click to collapse
No, there is only one Firmware available - the mysterious P8000_6.0_20160516.
Btw, this Phone contains a new mainboard model "K06TS-L-V2.0.3" - the 'old' mainboard is moder "K05T...."
// edit: ah, you just used the old scatter file. But does that one work for this version?
Click to expand...
Click to collapse
No, it doesn't work resp. the phone boots with this firmware, but the LCD-driver is the wrong one - the display only shows coloured lines and blurry spots. And there are probabely some more bugs ....
FrauHofrat said:
No, there is only one Firmware available - the mysterious P8000_6.0_20160516.
Btw, this Phone contains a new mainboard model "K06TS-L-V2.0.3" - the 'old' mainboard is moder "K05T...."
No, it doesn't work resp. the phone boots with this firmware, but the LCD-driver is the wrong one - the display only shows coloured lines and blurry spots. And there are probabely some more bugs ....
Click to expand...
Click to collapse
But if the phone boots with the firmware, doesnt that mean that the scatter file of the regular P8000 works? Since it flashes the firmware correctly.
The problem is that I was not able to flash the 'readback files' to the faulty phone.
When selecting 'Only Download' at SP-Flashtool I got the error "PMT... must be download"
When selecting 'Firmware Upgrade" I got some BROM error code
In both cases I used the same scatter,txt which I used to 'readback' the firmware from the working phone
Actually I have to correct my statement in post #15:
I flashed the faulty phone with the last 5.1 stock ROM (160711) - with this stock ROM the phone boots up but LCD (and probably more things) is not working.
I have actually gotten alot further
You have the use the scatter.txt from Android 6.0, which works perfectly fine. I have been able to extract boot.img, system.img and recovery.img that way (using Readback in SP Flash Tools)
Which ones do you need?
They probably flash fine (only thing I've flashed so far are custom recoveries, and although my ported PhilZ starts, I havent gotten it to mount anything.)
A little warning: don't use anything that has anything to do with Android 5.1. Those scatter files don't work
These are great news!
"Which ones do you need?"
Probably all of them
Ok this contains the scatter file, preloader, system.img, boot.img and stock recovery.img
https://ehaffmans.stackstorage.com/index.php/s/uKGKCir0BociydU
You need SP Flash Tools v5, select the scatter file first, then deselect everything, and only select these 4 and manually select the correct files.
Btw, the name of the preloader file is wrong, don't worry. It came from this phone
I am of course not responsible for anything!
Can you guys please confirm this doesn't contain anything personal? Like personal files or IMEI or something. Thanks!

One of the BEST things you can do to Moto Z Play XDA Community (Takes a while! ;) )

EDIT: THE DEVDB PROJECT HAS RISEN UP!
https://forum.xda-developers.com/moto-z-play/development/project-real-unbrick-hard-bricked-moto-t3927107
This is so easy to do, and can be sooo helpful if one day You will end with hard-brick.
If you have any questions send me a private message. :good:
Hey! My name is Jacob and I must tell you that there is one common problem with Moto Z Play - OTA after downgroading results in hardbrick :silly:
I have also bricked my device some days ago, since then I have gathered interesting info, probably all old and not so old blankflash files (these were used in the past to unbrick, but don't work now) and two tools, that allowed me to make proper rawprogram0, patch0 and gpt_main0.bin needed for making files, that will allow everyone to unbrick.
But this can be worth nothing without your help. Problem with unbricking, is that last OTA, updated chip security making unable to flash older chip firmware rendering all flashfiles useless. To make new one, I must get some files that are not present in the internet, but are present in ALL working phones. All I need is full mmcblk0 backup. If you want to help follow these easy-peasy instructions:
INFO: Procedure bellow excludes EFS, MODEMST1, MODEMST2, FSG, BACKUP partitions from backup. These are your phone specific partitions, that contain sensitive information like IMEI, serial numbers etc, but this guide shows how to avoid them while backing up so you don't have to worry about it
Prerequisites:
1. Your phone might be rooted (but doesn't have to be), definitelly should be working and not messed up too much.
2. You must have at least 32 GB micro sd card
3. Any ROM, even custom will be good, but if you have stock, you get +1 point
Steps:
1. If you have TWRP recovery, boot into it and go to step 2.
If you don't have, here is official one https://eu.dl.twrp.me/addison/ - rename it to "twrp.img" and boot to it with
Code:
fastboot boot twrp.img
2. Backup your /data partition and keep it in safe place
3. Format sdcard in ext4 (it is more robust and failsafe) or FAT32/exFAT (if you are on windows).[/URL]
4. Wipe /data on your phone and insert sdcard. Under "Mount" tab in TWRP, check box next to SD-CARD.
5. Open TWRP terminal emulator (It is in advamced tab), type "su" and run these command:
If you trust me that I won't do bad things with your IMEI:
Code:
dd if=/dev/block/mmcblk0 of=/[U][I]"Ext sd location here"[/I][/U]/Loader.img bs=4096
This just makes full-backup of your all partitions from Qualcomm chip.
OR
If you don't trust me:
Code:
dd if=/dev/block/mmcblk0p[B][COLOR="Red"]X[/COLOR][/B] of=/[B][COLOR="DeepSkyBlue"]Y[/COLOR][/B]/mmcblk0p[COLOR="Red"]X[/COLOR] bs=4096
Where X is number of partition from 1 to 54 BUT NOT: 27 (modemst1), 28 (modemst2), 29 (fsg)
and Y is location of your SD-CARD. This will only back up partitions without IMEI, and other phone-specific info.
6 Generated files will be HUGE (~27GB). Copy them to pc and upload to cloud. Maby https://mega.nz/ - probably only they have enough space for that file for free.
7 Post link here or send it to me via Private Message.
8 That's all! If you managed to get here, all comunity is grateful, :highfive: you will be included as biggest contribuor to the new thread I will make in near future!
If I find the time I will throw my old Z Play back to stock and try this. But can take a while before I have that time. Especially uploading that amount of data which would take me at least 12 hours. So if I do that, I will most likely get it into a split archive
Unfortunately I don't have a 32Gb sdcard. If there's another way to do this, I'm willing to help
Camarda said:
Unfortunately I don't have a 32Gb sdcard. If there's another way to do this, I'm willing to help
Click to expand...
Click to collapse
The only other way I know would be a USB C OTG adapter and a USB stick...
Artim_96 said:
If I find the time I will throw my old Z Play back to stock and try this. But can take a while before I have that time. Especially uploading that amount of data which would take me at least 12 hours. So if I do that, I will most likely get it into a split archive
Click to expand...
Click to collapse
Camarda said:
Unfortunately I don't have a 32Gb sdcard. If there's another way to do this, I'm willing to help
Click to expand...
Click to collapse
Thank you very much guys! You don't even know how much did you motivated me to continue research when I got your responses. If you will have any problem, ask me for advice - I will try to help. :highfive:
In case of Artim_96, you probably know this one, but to split dd image, you can use (obviously) "skip" parameter, for example:
Code:
dd if=/dev/block/mmcblk0 of=/sdcard/mmcblk0_1.img bs=4096 count=10GB
dd if=/dev/block/mmcblk0 of=/sdcard/mmcblk0_2.img bs=4096 skip=10GB count=10GB
dd if=/dev/block/mmcblk0 of=/sdcard/mmcblk0_3.img bs=4096 skip=20GB count=10GB
dd if=/dev/block/mmcblk0 of=/sdcard/mmcblk0_4.img bs=4096 skip=30GB
In case of Camarda: ...
Code:
adb -d shell su -c busybox dd if=/dev/block/mmcblk0 bs=4096 > D:\mmc.bin
... should do the job, where "D:\mmc.bin" can be any other valid location on your pc.
To make this work, you must have root and busybox installed.
Bobernator said:
In case of Artim_96, you probably know this one, but to split dd image, you can use (obviously) "skip" parameter, for example:
Code:
dd if=/dev/block/mmcblk0 of=/sdcard/mmcblk0_1.img bs=4096 count=10GB
dd if=/dev/block/mmcblk0 of=/sdcard/mmcblk0_2.img bs=4096 skip=10GB count=10GB
dd if=/dev/block/mmcblk0 of=/sdcard/mmcblk0_3.img bs=4096 skip=20GB count=10GB
dd if=/dev/block/mmcblk0 of=/sdcard/mmcblk0_4.img bs=4096 skip=30GB
Click to expand...
Click to collapse
that would be a solution, but I guess it's way easier to create one image, zip it and let it get split to about 5 GB chunks, and probably creating a check sum for each before upload
---------- Post added at 17:02 ---------- Previous post was at 16:56 ----------
but what I don't get: I should make a backup of /data, for what? And then I should connect the phone to my PC, but the following commands look very much like linux commands, so the connection to PC seems unneccessary. Plus, for what reason does the SD Card need to be ext4? the commands should work with exFAT too plus no windows system can read ext4. And there is no program to read it for Windows that's slow as hell
Artim_96 said:
that would be a solution, but I guess it's way easier to create one image, zip it and let it get split to about 5 GB chunks, and probably creating a check sum for each before upload
---------- Post added at 17:02 ---------- Previous post was at 16:56 ----------
but what I don't get: I should make a backup of /data, for what? And then I should connect the phone to my PC, but the following commands look very much like linux commands, so the connection to PC seems unneccessary. Plus, for what reason does the SD Card need to be ext4? the commands should work with exFAT too plus no windows system can read ext4. And there is no program to read it for Windows that's slow as hell
Click to expand...
Click to collapse
Sorry, I was in a bit hurry when I was writing tutorial. I have just corected misteakes in it. :silly:
That part with backing up /data and wiping it is just for Your comfort - You probably don't want to include all you photos, videos contacts etc, in the backup, I am wrong?
EDIT: You are right, solution with splitting archive is clearly better, becouse of smaller size and auto merging archives
Bobernator said:
Sorry, I was in a bit hurry when I was writing tutorial. I have just corected misteakes in it. :silly:
That part with backing up /data and wiping it is just for Your comfort - You probably don't want to include all you photos, videos contacts etc, in the backup, I am wrong?
EDIT: You are right, solution with splitting archive is clearly better, because of smaller size and auto merging archives
Click to expand...
Click to collapse
Would it help you to get /data too? It's my old phone, screen is quite damaged so there is nothing worth looking for on it. Plus it was completely wiped twice by flashing the firmware with flashfile and unlocking the bootloader again since flashing the firmware locked it.
Data partition is absolutely not needed, but thanks for asking!
zip compressing was totally worth it. It went from 29.1 GB to just 2.58 GB?
Artim_96 said:
zip compressing was totally worth it. It went from 29.1 GB to just 2.58 GB?
Click to expand...
Click to collapse
Thanks for support!
@Camarda - You are from Brasil, so you probably have different version of software, so if you will upload it, phones outside of Europe can be safed too. Do you still want to help?
Bobernator said:
Thanks for support!
@Camarda - You are from Brasil, so you probably have different version of software, so if you will upload it, phones outside of Europe can be safed too. Do you still want to help?
Click to expand...
Click to collapse
I just sent you the file, tell me if everything is ok
Thank you! Artim's backup is not working on my phone, and I suddenly realised that my exam ending my school are in less than month (!), so I didn't have time neither to write a thread, nor to reverse engineer the file, but I will try to find time and test your backup!
Ps. Don't worry about me beeing temporiarly inactive, this thread is my current target and I won't give up!
Bobernator said:
Thank you! Artim's backup is not working on my phone, and I suddenly realised that my exam ending my school are in less than month (!), so I didn't have time neither to write a thread, nor to reverse engineer the file, but I will try to find time and test your backup!
Ps. Don't worry about me beeing temporiarly inactive, this thread is my current target and I won't give up!
Click to expand...
Click to collapse
Bobernator, I'm just posting to let you know that I am very thankful for your efforts and to take as long as you need. I have a LATAM XT1635-02 that got bricked by an automatic update quite a few months ago. It's in fastboot state. If there is anything I can do to help, let me know.
I now own a XT1710-06, so if you think the files from it could be useful, let me know.
Welcome again! My exams have just ended (I hope they went well) I am temporally at my uncle's house so I don't have access to files and info I've gathered, but I will return to home at friday and even Easter will not stop me, becouse I have decided to start DevXDA project!
Stay with me guys
Fulcano said:
Bobernator, I'm just posting to let you know that I am very thankful for your efforts and to take as long as you need. I have a LATAM XT1635-02 that got bricked by an automatic update quite a few months ago. It's in fastboot state. If there is anything I can do to help, let me know.
I now own a XT1710-06, so if you think the files from it could be useful, let me know.
Click to expand...
Click to collapse
I think I you can easly fix your phone, since fastboot works. You will need factory update zip, it is pinned somewhere in this forum, but if you feel unsure (you can brick phone even harder with this method if it goes wrong), I can assist you during the weekend and share a link with correct zip.
And thanks for support!
Device which you have is Moto Z2 Play (albus) that have next version of the chip in Moto Z Play (addison). My plan is to fix addison by combining some of the firmware from it and albus, but these files are available freely and you don't need to send them.
Bobernator said:
I think I you can easly fix your phone, since fastboot works. You will need factory update zip, it is pinned somewhere in this forum, but if you feel unsure (you can brick phone even harder with this method if it goes wrong), I can assist you during the weekend and share a link with correct zip.
And thanks for support!
Device which you have is Moto Z2 Play (albus) that have next version of the chip in Moto Z Play (addison). My plan is to fix addison by combining some of the firmware from it and albus, but these files are available freely and you don't need to send them.
Click to expand...
Click to collapse
Thanks for the reply! Sorry, i've been quite busy with exams as well.
It's been a while since the phone is bricked, and i think fastboot was the wrong word. When it is plugged in it appears as a qualcomm device and the LED blinks, but other than that the phone does absolutely nothing. I remember being unable to unbrick it because of needing a `programmer.pem` file specific to the version of android that was installed.
The phone had an unlocked bootloader, twrp and supersu. It got stuck during an OEM update from 7.1.1 (i think) to 8.0.0. It was stuck for over four hours, I turned it off by force and then it never turned on again .
With regards to the Moto Z2 files, that's fantastic to hear. If there's anything else I can do to help, please say so. I've configured email alerts now so i'll get notified when you reply .
Thanks for the effort!

Categories

Resources