[Q] Windows Phone 8S Partition Dumping - Windows Phone 8s by HTC

I have an HTC Windows Phone 8S Rio. I would like to dump the partitions, as it looks like people are doing in this thread [DEV][R&D] FW & Partition Tables (Here!). When I connect the phone in the standard booted mode, the phone connects as a camera in Ubuntu linux. When I connect it using the boot mode entered by holding camera + volume down, the phone connects as a PocketPC PDA Converter and a serial port is made available. Is there some trick that I'm missing to get the partitions to show up as a drive?
If I boot when holding down Volume Down and Camera, I get the Barcode screen. Before it's plugged in, it shows Serial at the bottom. Once the USB port is plugged in, serial changes to USB. The device then is recognized as Vendor ID 0xBB4 Product ID 0x00CE and the product string is "USB BLDR". The linux kernel uses the ipaq driver to service the device and a serial port is created in /dev.
If I boot when holding down Volume Up and Camera, I get a blank screen. The device is recognized as Vendor ID 0x5C6 and the Product ID is 0x9008. The linux kernel uses the qcserial driver to service the device and a serial port is created in /dev.
If I boot when holding Volume Down I get an exclamation mark. If I plug it in, it doesn't enumerate. The phone reboots after about 30 seconds.
If I boot when holding Volume Up I get a lightning bolt and a gear. If I plug it in, it enumerates with Vendor ID 0x045E and Product ID 0x062A. It shows up as a QUALCOMM MSM device. It doesn't appear to add any devices into /dev/.
If I boot holding nothing down, it boots into regular windows phone 8. It shows up as Vendor ID 0x045E and Product ID 0xF0CA. No devices show up in /dev/.
If it matters, here is the information on the barcode bootloader:
PM5910001 P S WP8 I
SBL1-103.054.002
SBL2-103.054.001
SBL3-001.532.011
TZ-001.030.530
UEFI-0.0.1030.54(159870)
OS-1.04.401.03
eMMC HNX 3696MB F-83
CID-HTC__J15
Radio-1.11b.3054.25_10.13.30.54
MSM8227 v2.0-p0 0x207d00e1
Krait:Fast Q6:Fast VDDCX:Slow 0x30c00
Touch FWS1:1195017,52303038,13106
==== UPDATE ====
If booted with the volume up and camera button, the device shows up as QHUSB_DLOAD. Apparently this is commonly referred to as the OSBL bootloader. According to this thread: http://forum.dailymobile.net/index.php?topic=77415.0 the QHUSB_DLOAD identifier means that it is a locked bootloader, and won't present the file system to the host. So, I think I can scratch off the whole USB partition dumping.
On a separate front, I downloaded the ROM for the phone and I found what looks to be an NTFS partition. If you delete the first 0x15F [351]bytes of the european ROM version 1.04.401.03_1.11b.3054.25_10.13.30, or 0x22 [34] bytes of the russian ROM version 1.04.411.03_1.11b.3054.25_10.13.30, to align the image on sector boundaries and run Active File Recovery, you can see some partitions. For each version you'll find 3 unnamed FAT partitions and a single NTFS partition named Boot. Unfortunately, none of these partitions appear to have the system binaries in them and overall they all appear to be involved in bootloading. Additionally, I've seen some references to BitLocker both in the binaries on the phone and here: http://www.windowsphone.com/en-us/business/security. It wouldn't be too much of a stretch to think that Microsoft may be protecting some of the file system using BitLocker and would explain the high entropy data present in the ROM.
I am getting a not-so-gently used Windows Phone 8S today and will use the motherboard to attempt to find JTAG pinouts. Hopefully there will be some traction on that angle, unless someone can help me out with an easier method before I take this fork in the road.

testone said:
I have an HTC Windows Phone 8S Rio. I would like to dump the partitions, as it looks like people are doing in this thread [DEV][R&D] FW & Partition Tables (Here!). When I connect the phone in the standard booted mode, the phone connects as a camera in Ubuntu linux. When I connect it using the boot mode entered by holding camera + volume down, the phone connects as a PocketPC PDA Converter and a serial port is made available. Is there some trick that I'm missing to get the partitions to show up as a drive?
If I boot when holding down Volume Down and Camera, I get the Barcode screen. Before it's plugged in, it shows Serial at the bottom. Once the USB port is plugged in, serial changes to USB. The device then is recognized as Vendor ID 0xBB4 Product ID 0x00CE and the product string is "USB BLDR". The linux kernel uses the ipaq driver to service the device and a serial port is created in /dev.
If I boot when holding down Volume Up and Camera, I get a blank screen. The device is recognized as Vendor ID 0x5C6 and the Product ID is 0x9008. The linux kernel uses the qcserial driver to service the device and a serial port is created in /dev.
If I boot when holding Volume Down I get an exclamation mark. If I plug it in, it doesn't enumerate. The phone reboots after about 30 seconds.
If I boot when holding Volume Up I get a lightning bolt and a gear. If I plug it in, it enumerates with Vendor ID 0x045E and Product ID 0x062A. It shows up as a QUALCOMM MSM device. It doesn't appear to add any devices into /dev/.
If I boot holding nothing down, it boots into regular windows phone 8. It shows up as Vendor ID 0x045E and Product ID 0xF0CA. No devices show up in /dev/.
If it matters, here is the information on the barcode bootloader:
PM5910001 P S WP8 I
SBL1-103.054.002
SBL2-103.054.001
SBL3-001.532.011
TZ-001.030.530
UEFI-0.0.1030.54(159870)
OS-1.04.401.03
eMMC HNX 3696MB F-83
CID-HTC__J15
Radio-1.11b.3054.25_10.13.30.54
MSM8227 v2.0-p0 0x207d00e1
Krait:Fast Q6:Fast VDDCX:Slow 0x30c00
Touch FWS1:1195017,52303038,13106
==== UPDATE ====
If booted with the volume up and camera button, the device shows up as QHUSB_DLOAD. Apparently this is commonly referred to as the OSBL bootloader. According to this thread: http://forum.dailymobile.net/index.php?topic=77415.0 the QHUSB_DLOAD identifier means that it is a locked bootloader, and won't present the file system to the host. So, I think I can scratch off the whole USB partition dumping.
On a separate front, I downloaded the ROM for the phone and I found what looks to be an NTFS partition. If you delete the first 0x15F [351]bytes of the european ROM version 1.04.401.03_1.11b.3054.25_10.13.30, or 0x22 [34] bytes of the russian ROM version 1.04.411.03_1.11b.3054.25_10.13.30, to align the image on sector boundaries and run Active File Recovery, you can see some partitions. For each version you'll find 3 unnamed FAT partitions and a single NTFS partition named Boot. Unfortunately, none of these partitions appear to have the system binaries in them and overall they all appear to be involved in bootloading. Additionally, I've seen some references to BitLocker both in the binaries on the phone and here: http://www.windowsphone.com/en-us/business/security. It wouldn't be too much of a stretch to think that Microsoft may be protecting some of the file system using BitLocker and would explain the high entropy data present in the ROM.
I am getting a not-so-gently used Windows Phone 8S today and will use the motherboard to attempt to find JTAG pinouts. Hopefully there will be some traction on that angle, unless someone can help me out with an easier method before I take this fork in the road.
Click to expand...
Click to collapse
Hey! I bricked my 8S, and need a rom in a format that the Qualcomm software will take. I can't use the RUU (or the files inside it) and need an MBN, bin, or hex file.
Can you send me the firmware? Maybe with Mega.co.nz?
You'd be a life saver!

TaylorofCanada said:
Hey! I bricked my 8S, and need a rom in a format that the Qualcomm software will take. I can't use the RUU (or the files inside it) and need an MBN, bin, or hex file.
Can you send me the firmware? Maybe with Mega.co.nz?
You'd be a life saver!
Click to expand...
Click to collapse
Hi guys I know that this is an older thread but I am in the same boat now. My 8S got stuck in QDLOADER mode and I desperately need the original DUMP so I can try reflash it. Did you managed to get it?
Thanks.

Related

Boot to RECOVERY for Intel head units

So we currently have a situation where it can be quite frightening to try anything cool on the Intel head units, since if you brick it, you might not be able to recover it.
I tried to pull this information out of the manufacturer of the units I've chosen to buy (Joying), but they started out playing retarded, then after about a hundred emails exchanged including links to videos of head units booting into recovery, and a detailed explanation of why it is needed (factory reset when android can't boot, for example), the last thing I was able to get out of them (because they landed themselves into an idiot infinite loop) was "Nice day, this is Candy from Joying, Thanks for your email and info, new model is muchly stable than old model, recovery not needed, don't worry, Hope you well-understanding, Any more questions pls feel free to contact us, Best regards, Candy".
<sarcasm>HOW BLOODY USEFUL!</sarcasm>
So lets use this thread to record known methods of booting into recovery.
If you are able to get into recovery, make note of the following details;
1) Brand and model number,
2) MCU firmware brand and version,
3) Exact reproducible process to boot into recovery.
One person here (@MMTK84) has apparently been able to get into recovery to the "no command" screen by plugging in an external keyboard and pressing some buttons on it.
This is for a Joying UL135N2: http://forum.xda-developers.com/showpost.php?p=69757832&postcount=133
Now the concerning thins about this particular procedure, is that it starts booting, and then reboots and goes into recovery. The reason this is concerning, is if it starts booting off the BOOT partition, registers the button clicks to reboot to recovery, and then reboots to recovery. This case could be bad if you happen to have a broken boot image. In other words, without further information, I wouldn't depend on it.
For... I'm not sure which unit, I found this on a Russian forum indicating pressing and holding the BACK button for about 10 seconds, releasing when the lights start flashing, and tapping it again: http://4pda.ru/pages/go/?u=https://...%3D140&usg=ALkJrhiZ8C2dCOO73ghthzievLV2mKtXyQ
*** further down in the same thread, someone else said the same process, but with the RESET button.
The reset button method might be able to apply to devices without physical buttons.
There are also TWO MORE buttons on all devices than what you see on the front panels -- the steering wheel interface buttons. Perhaps one or the other of those could, in some instances, trigger a boot to recovery?
So anybody who has these Intel head units, post your methods to achieve a boot into recovery.
Please keep the questions and discussions OUT of this thread, I'd like for it to be used exclusively to list SUCCESSFUL methods of booting into recovery.
More brainstorming;
If it becomes absolutely a problem and we find out that some devices *simply cannot* be booted into recovery, this could yield a solution;
http://forum.xda-developers.com/showthread.php?t=1522226
What that is, is an additional bootloader based on Das U-Boot, which adds in some of the missing multi-boot functionality. You stick that one in to the original boot partition, and instead of starting the kernel and Android, it instead launches a menu that lets you pick what you want to start. HOWEVER, given that this hardware is x86, we might actually have some luck with something more conventional, like GRUB.
Thanks for your work on this @doitright. I've been emailing with Joying as well and the language barrier can be frustrating.
With my previous MTCB unit I dealt with Hotaudio and they seemed to actually get useful information from their engineer rather than infinite looping at the front line customer service.
Hopefully a working recovery can be achieved independently of the manufacturer. I'm willing to test on my unit but trying not to brick it.
Unfortunately I haven't found a successful recovery method yet. But as a data point for my unit:
Its a Joying 8" non-MTC Intel unit with capacative buttons(only physical buttons are RST and POW).
MCU is dated 10/31 "Newlap", picture attached. Interestingly Serial Number in Settings > About Device reads all zeros: 00000000.
I'm getting to the same recovery screen as @MMTK84 with the laying down Android background. It first displays "No Command." soon followed by "Error!".
None of the usual recovery menu options are present to scroll up/down/select. Pressing the capacative buttons causes no change.
Short click POW does nothing, long click POW turns the screen off(short click POW again turns back on), Short or Long clicking RST reboots.
To get to recovery I used terminal on the unit itself: "su" then "reboot recovery". Unit is rooted per: http://forum.xda-developers.com/and...-intel-cpu-t3494083/post69648860#post69648860 It also works via WiFi adb: "adb connect <ip>" then "adb reboot recovery".
I have not yet found a hardware key combo to boot into recovery from power off. I tried the 4pda method you found with the RST button, held for 10 seconds but the lights never flashed, unit just rebooted after about 15 seconds of holding RST. I also tried this RST/PWR sequence that reportedly works for the 5.1.1 MTCD units but I can confirm it does not work on this non-MTC Intel unit: http://forum.xda-developers.com/showpost.php?p=66733286&postcount=2
Fingers crossed for a creative solution. U-Boot sounds promising.
I am also in a slump and unfortunately I actually need to enter recovery as my unit will not boot. I am waiting on the seller to respond and it's been a week and he still does not know. My unit is a MTCD Intel soft touch unit. Long press reset does nothing. Pressing any of the soft touch buttons while the unit is booting up also does nothing. That includes long press back, power, or anything else. If anyone comes across a way to enter recovery for a soft touch intel MTCD unit please let me know as mine is currently bricked.
Boot to recovery with USB keyboard (VIDEO)
1.) README:
As described in my post http://forum.xda-developers.com/showpost.php?p=69757832&postcount=133, here is the VIDEO how to enter recovery with hardware buttons (USB keyboard).
The device (Joying UL-135N2) was freshly resetted (factory settings), so it is not rooted.
The USB keyboard has QWERTZ design (Europe), but that is not important AFAIK.
After someone modified/adapted the "recovery.img" to TWRP (or similar), or someone patches the current recovery, we should be able to use this method to enter recovery when android is on a boot-loop..... :good:
2.) LINK to VIDEO:
http://sendvid.com/kyxa5xdz
Video created on: 12/05/2016
Device frmware from: 10/31/2016
3.) Feedback
MMTK84 said:
1.) README:
As described in my post http://forum.xda-developers.com/showpost.php?p=69757832&postcount=133, here is the VIDEO how to enter recovery with hardware buttons (USB keyboard).
The device (Joying UL-135N2) was freshly resetted (factory settings), so it is not rooted.
The USB keyboard has QWERTZ design (Europe), but that is not important AFAIK.
After someone modified/adapted the "recovery.img" to TWRP (or similar), or someone patches the current recovery, we should be able to use this method to enter recovery when android is on a boot-loop..... :good:
2.) LINK to VIDEO:
http://sendvid.com/kyxa5xdz
Video created on: 12/05/2016
Device frmware from: 10/31/2016
3.) Feedback
Click to expand...
Click to collapse
Good information there, but my only concern with this method, is whether the recovery boot is initiated from the bootloader, or from something in the primary boot partition. If it is initiated from the bootloader, we are golden. If it is initiated from something in the primary boot partition, this will not help with problems in the boot partition.
Have you tried using just the "e" button straight off the bat and skipping the alt-print?
FYI: My UL128N2's are *supposed* to arrive tomorrow, so I'll be able to start my own experiments with them. They're basically the same as your UL135N2, but all glass screen instead of buttons that click.
I greatly appreciate your information and your video, but unfortunately this did not work on my unit
Need4Camaro said:
I greatly appreciate your information and your video, but unfortunately this did not work on my unit
Click to expand...
Click to collapse
Important to note that YOUR unit is an MTCD, whereas MMTK84's is a Joying (FYT5009).
doitright said:
Important to note that YOUR unit is an MTCD, whereas MMTK84's is a Joying (FYT5009).
Click to expand...
Click to collapse
I did notice a few things while trying this.
#1 I have absolutely no power coming out of the USB ports. For example if I plug my phone into it, it does not even attempt nor do any other power consuming USB peripherals get power. I am concerned that if this is the case then even a USB keyboard may not work.
#2 when I press the reset button with ign off, then the lights on the unit flickers for 1 second then goes back off. Where as if I turn IGN ON then the units lights turn on and remain on for about 2 minutes before going off.
Need4Camaro said:
I did notice a few things while trying this.
#1 I have absolutely no power coming out of the USB ports. For example if I plug my phone into it, it does not even attempt nor do any other power consuming USB peripherals get power. I am concerned that if this is the case then even a USB keyboard may not work.
#2 when I press the reset button with ign off, then the lights on the unit flickers for 1 second then goes back off. Where as if I turn IGN ON then the units lights turn on and remain on for about 2 minutes before going off.
Click to expand...
Click to collapse
Have you tried to press and hold the reset button, and then turn on the ignition?
You need to try all kinds of different things.
hi
readme: my unit: Joying JY-UL135N2 2G RAM 32G
CPU: Intel ATOM QuadCore, GPU3D: Mali-400 MP4, RAM; 2G DDR3
MCU Version: 2016-10-31 14:30:43 JY_(NOR)_90_C9_7706_5009_CAN(GX)_Newlap
I have tried the keyboard method for booting to recovery and it was successful.
I have followed @MMTK84
1.) I hooked up a USB keyboard
2.) Pressed ALT(right one on the keyboard)+PRINT........keep it holding all the time
3.) Turned on power supply. Started pressing "E".
4.) The HU booted and the car logo appeared. After 10 seconds the HU reboots.
5.) When the logo appeared the second time I've released ALT+PRINT keys and began to press only "e" for about 10 seconds.
6.) Suddenly the "no command" screen appeared (this is according to user doitright the unusable recovery menu)
I didnt try by pressing "e" alone without pressing ALT+PRINT keys. If it is so will it make any good?
doitright said:
Good information there, but my only concern with this method, is whether the recovery boot is initiated from the bootloader, or from something in the primary boot partition. If it is initiated from the bootloader, we are golden. If it is initiated from something in the primary boot partition, this will not help with problems in the boot partition.
Have you tried using just the "e" button straight off the bat and skipping the alt-print?
FYI: My UL128N2's are *supposed* to arrive tomorrow, so I'll be able to start my own experiments with them. They're basically the same as your UL135N2, but all glass screen instead of buttons that click.
Click to expand...
Click to collapse
Are there any reported methods to recovering my unit?
https://www.aliexpress.com/store/pr...uad-Core-1-2G-4-1024/1396993_32747116176.html
I purchased a new Joying Unit as well. Will there be any way to install a recovery partition on this device?
http://www.ebay.com/itm/232157503276?_trksid=p2057872.m2749.l2649&ssPageName=STRK:MEBIDX:IT
The method MMTK84 describes also works for the UL128N2 device.
Edit:
You can even skip step 5 and 6 of the tutorial. Just keep holding ALT + printscreen and pressing e. After the logo disappears release all keys.
If you hold alt + printscreen and start pressing F when it boots the joying logo disappears and goes black for a few seconds, goes white and boots into recovery.
Open up the case and you will see that the red led stops blinking when you do above procedure.
The keys e, i and f will reboot in recovery.
When pressing j the joying logo stays and the system does nothing, the led inside blinks all the time
When pressing c the led stops blinking and the system shutsdown
When pressing b the led goes off and the system hangs.
When pressing 0 the system shutsdown
The keys q,w,r,t,y,u,p,a,s,d,g,h,k,l,z,x,v,n,m do nothing.
I tried all combinations in combination with the alt + printscreen button.
I bricked the MTCD GS (XTRONS TL702AP) when trying to install one of the root kits (I knew that doing dd if... of=/mmcblk... is not going to be 100% safe...) and I managed to find how to reliably enter the recovery:
1. make sure that ILL is connected to ACC or BATT. Without it, touch buttons won't lit up and you won't know when to release RST
2. turn off the power completely, then turn it back on (both ACC and BATT), wait 1-2 seconds, then press and hold the RST button
3. wait ~5 seconds until the touch buttons start blinking, release immediately and press RST again shortly then release it
4. wait a few seconds and recovery shows up
When I bricked mine, the LCD backlight was blinking like crazy (1-2 Hz) and the display was showing the device booting up. Instead booting to the Android 'desktop', white screen appeared and unit crashed later on. When I managed to enter the recovery, the LCD backlight was solid immediately as I started pressing the RST...
extracted recovery partition from intel joying unit
extracted recovery partition from intel joying unit.
/dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID121 -> /dev/block/mmcblk0p10
Code:
./fstab.zram
./dev
./seapp_contexts
./sys
./selinux_version
./sepolicy.ptest
./service_contexts
./res
./res/DVDBOOT_SOFIA.bin
./res/README
./res/keys
./res/images
./res/images/update_warn_en.png
./res/images/icon_error.png
./res/images/error_text.png
./res/images/icon_installing.png
./res/images/update_done.png
./res/images/stage_fill.png
./res/images/warning.bin
./res/images/installing_text.png
./res/images/progress_fill.png
./res/images/erasing_text.png
./res/images/font.png
./res/images/stage_empty.png
./res/images/fail_warn.png
./res/images/update_done_en.png
./res/images/warning_en.bin
./res/images/fail_warn_en.png
./res/images/warning_en.png
./res/images/warning.png
./res/images/progress_empty.png
./res/images/no_command_text.png
./res/images/update_warn.png
./sbin
./sbin/watchdogd
./sbin/busybox
./sbin/sh
./sbin/healthd
./sbin/e2fsck
./sbin/recovery
./sbin/newfs_msdos
./sbin/ueventd
./sbin/bootwatcher
./sbin/sqldebug
./sbin/resize2fs
./init.rc
./fstab.rk30board.bootmode.emmc
./fstab.rk30board.bootmode.unknown
./etc
./etc/recovery.fstab_emmc
./etc/recovery.fstab_nand
./data
./fstab.sofiaboard_nand
./default.prop
./init.bootmode.unknown.rc
./system
./fstab.sofiaboard_emmc
./init.bootmode.emmc.rc
./file_contexts
./property_contexts
./ueventd.sofiaboard.rc
./init.recovery.sofiaboard.rc
./tmp
./sepolicy
./proc
./ueventd.rc
./charger
./init
recovery_joying.zip extracted image with recovery in /sbin
recovery_joying_image image file.
fstab with common names for intel joying sofia units
Code:
#
# Copyright (C) 2013 Intel Mobile Communications GmbH
#
# Sec Class: Intel Confidential (IC)
#
# Android fstab file.
#<src> <mnt_point> <type> <mnt_flags and options> <fs_mgr_flags>
# The filesystem that contains the filesystem checker binary (typically /system) cannot
# specify MF_CHECK, and must come before any filesystems that do specify MF_CHECK
#
/dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID068 /system ext4 defaults defaults
/dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID069 /data ext4 defaults encryptable=footer
/dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID070 /cache ext4 defaults defaults
#/dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID069 /mnt/internal_sd vfat defaults defaults
/dev/block/mmcblk0p1 /mnt/external_sd vfat /dev/block/mmcblk0 defaults
/dev/block/mmcblk1p1 /mnt/external_sdio vfat /dev/block/mmcblk1 defaults
/dev/block/sda1 /mnt/usb_storage vfat /dev/block/sda defaults
/dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID076 /nvm_fs_partition ext4 defaults defaults
/dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID074 /misc emmc defaults defaults
/dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID071 /boot emmc defaults defaults
/dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID121 /recovery emmc defaults defaults
/dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID122 /fwu emmc defaults defaults
#/dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID122 /recoverym emmc defaults defaults
#/dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID001 /mobilevisor emmc defaults defaults
#/dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID114 /radio emmc defaults defaults
#/dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID013 /splash_screen emmc defaults defaults
#/dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID115 /mvconfig emmc defaults defaults
#/dev/block/platform/soc0/e0000000.noc/by-name/ImcPartID118 /secvm emmc defaults defaults
How to recover from a bad recovery.img flash:
In preparation of creating a modified recovery.img, I inadvertantly flashed over a malformed image file. The unit wouldn't boot at all! I thought I hard bricked the unit forever!
1. Disconnect ACC and BAT
2. Hold down the POWER BUTTON
3. Attach ACC and BAT
unit will boot.
After flash, unit refused to boot at all. Black screen. Probably trying to load from bad recovery partition. Nothing else would work, no Alt-PrnScrn combo, reset button, nada. Red light on sofia module would blink and then turn off. Research time. Then I saw that another MTCD unit was able to boot using this method. Success!
Note that this method will only work if your system partition is intact. If both recovery and system are hosed, I don't know of a way other than JTAG (possibly) to reflash the partitions.
Almost....
Has anyone tried a PC <-> PC OTG cable on one of these units?
I can reboot to recovery from the command line ( reboot recovery ). Getting into recovery mode isn't an issue, the problem is no way to access the unit once it reboots into recovery. From the recovery image, it looks like there is an adb process started from init and also wired USB support. I'm guessing you just need the right cable to connect.
gustden said:
Has anyone tried a PC <-> PC OTG cable on one of these units?
I can reboot to recovery from the command line ( reboot recovery ). Getting into recovery mode isn't an issue, the problem is no way to access the unit once it reboots into recovery. From the recovery image, it looks like there is an adb process started from init and also wired USB support. I'm guessing you just need the right cable to connect.
Click to expand...
Click to collapse
Is there anything special to the cable? I tried a USB A to A cable and neither linux nor windows detect it.
gtxaspec said:
Is there anything special to the cable? I tried a USB A to A cable and neither linux nor windows detect it.
Click to expand...
Click to collapse
An OTG cable has a chip in the middle so two USB hosts "think" they are both connecting to a device. A USB host knows a device is present, when the USB device pulls either d+ or d- line to ~3.3v to signal the connect speed. None of the signaling will happen with a straight A to A cable (connecting 2 host ports ).
I was going to get one and try it, just thought I would see if anyone else has before I buy one. Hopefully, I can find one locally so I can return it if it doesn't work.
Does anyone have experience with unpacking and repacking recovery images? I am unable to successfully repack recovery.img from the joying intel units. My repacked images will not boot! Arg!

Phone Not Entering DA mode.

So Here are the steps
1. My bootloader got unlocked.
2. I Installed factory preloader and lk images.
3. Rebooted to Fasboot and flashed TWRP 3.3.1-0924 by wzsx150 (the only Android 9 recovery that didn't get removed immediately after flashing and rebooting for 1st time to get to recovery).
4. Formatted Data, Closed AVB 2.0 and Signed TWRP.
5. Rebooted to Fastboot and flashed stock EEA Android 9 (11.0.3.0) from Global (11.0.6.0) and reflashed factory preloader and lk.
6. Rebooted to recovery, Formatted Data, Closed AVB 2.0 and Signed TWRP.
7. Using ADB sideload from Twrp Installed EEA Android 10 (11.0.2.0).
8. Rebooted into fastboot Installed Updated TWRP-3.3.1-1210 (by wzsx150).
9. Rebooted into fastboot and flashed misc.bin from same zip (according to bat file inside it should get flashed after recovery but I forgot.)
10. BRICKED. Booted to Redmi logo for 3 seconds and rebooted infinitely.
This type of brick in 4pda.ru according to google translate can be mitigated by letting battery drain and then enter DA download mode using SP Flash Tool.
I've Used the tool several time so I thought Okay no big deal.
So This is what I tried:
11. Pressed download button
12. Connected USB Cable to phone.
13. Device pauses a second (Probably for SP Flash Tool to respond) then doesn't enter DA (Unlike previous times) and screen brighten for a second or two but then turns off and repeats this process forever.
I've been using Drivers provided by Microsoft Update Catalogue but tried all the drivers on 'MTK Usb Driver v1.0.8' and 'Mediatek_Driver_Auto_Installer_1.1352.00' after disabling Driver Signature Enforcement. but even though drivers are installed they don't get loaded and after force installing them in add legacy drivers they are their but have yellow triangles and their Location lists as 'Unknown' and status as 'This device cannot start. (Code 10)'. Tried Removing them after adding them as a site suggested but that didn't work either.
I learned the hard way to never mismatch partitions with this phone. I thought having the factory preloader and lk1/2 would protect me but no.
When you say brick, do you mean you have a completely black screen with only the notification LED turning on when you plug it in?
Grab a bootable Linux image and use that on a USB stick to eliminate the driver issue you're having. Interface is identical
wang1chung said:
I learned the hard way to never mismatch partitions with this phone. I thought having the factory preloader and lk1/2 would protect me but no.
When you say brick, do you mean you have a completely black screen with only the notification LED turning on when you plug it in?
Grab a bootable Linux image and use that on a USB stick to eliminate the driver issue you're having. Interface is identical
Click to expand...
Click to collapse
So I tried Ubuntu. Problem isn't from Drivers. It's because my Windows or linux didn't ever got a chance to enter fastboot so they can load preload drivers properly.
In Windows, Mediatek USB Port is the only driver that get loaded, and that for only an instant then it disappears in Device Manager.
In Linux according to this Tutorial everything is fine but SP Flash Tool gives me a " ERROR : STATUS_ERR (-1073676287) , MSP ERROE CODE : 0x00. "
Based on this chinese site I should find my Vendor Id and Product Id specific to my system (or is it my chipset?) and then change some files but how do I get linux to recognize mediatek usb device first when It needs to enter fastboot for that to happen.
Is there any way to manually add it?
EDIT: So After some reading I realized that I have to get my phone to fastboot first to get the drivers recognized. In windows as far as I know there is no way for manually adding 'Location' to Drivers. what about Linux?
I think you're talking about a soft-brick and I'm talking about a hard-brick. If you can get to fastboot, it's a soft-brick.
Hold the volume down and power buttons simultaneously for 1min and see if your screen changes.
Don't worry about the Linux drivers, if your phone is in the correct mode, it'll work.
I don't think it's a Soft-Brick (unless Hard-Brick means even the display not turning up at all), Holding them for a minute with battery charged doesn't do anything. As soon as it boots back up it starts getting caught in Booting until Redmi logo and staying there for 2-3 seconds then reboots. I tried to hold Volume Down + Power for 3 minutes while caught in this bootloop but no fastboot. I'll retry when battery discharges again. first without usb cable attached then with.
Thanks for taking time to work this through with me. Nowadays with all service centers being closed it's really a nightmare to have something you need on internal storage and not being able to access it. First thing I'll do after this is to buy a 128GB SD card to store the important stuff.
By the way should I just use the Live Ubuntu or Install it to see if the problem is from being a live image.
When I hard bricked my phone, I didn't have anything but that white led when I plugged it in. If you have the redmi logo, should mean there is hope. I've only ever entered DA mode when I had a hard brick.
This might be one of those situations where letting the battery drop to 0% would allow you to access fastboot. MiFlash only works in fastboot and DA mode I believe. What happens when you hold volume up and power for a minute while plugged in to your computer? Run "ADB devices" to start the adb service first
I doubt it would make a difference live to installed, but it's your call if you have the time.
With Phone in Bootloop mode Holding Either Vl+ and Power or Vl- and Power doesn't make a difference.
With Phone Off and USB detached It's the same.
With USB attached Vol+ and Power for over 3 Mins result in Device Manger listing 'Mediatek USB Port' for as long as display remains 'dark but bright' (for 2-3 seconds then shuts down and turns itself back on). removing it when phone suddenly shuts down. when USB is detached phone remains shutdown.
With USB attached Vol- and Power for over 3 Mins result in Phone's Display Brightening for 5 seconds no device listing in Device Manager nor entering fastboot or being recognized by adb or fastboot (set on a permanent re-checking by a cmd script). then phone shuts itself down and back on.
LED situation:
With Vol+ and Power with USB attached LED when phone is Off is Fullbright. When Display Brightens It turns off.
With Vol- and Power with USB attached LED when Phone is Off Blinks Once Fullbright and then remains Semi-bright whether phone is on until shutdown and the Blinks Fullbright again.
I Live in Iran and with sanctions there is no way to pay anyone overseas. Unless they're willing to risk accepting cryptocurrencies from an Iranian , my only chance if I can't work it out is to wait till unofficial service centers here open.
Your phone only being detected for 5 seconds is supposed to happen. It checks for a signal from so flash and if it doesn't see it, drops off.
I'm not sure paying someone to remotely flash your phone will work if SP Flash isn't even trying or detecting your phone. With mine, it would detect and try to flash (red bar sitting at 100%) before throwing an error.
Try letting your battery die, if that doesn't work, maybe the test point mod will work. Otherwise, I think your only option is a service center.

Unable to boot Surface 2 RT - stuck on Windows Recovery

I have an old Surface 2 RT from my parents here, which I wanted to rejuvenate for my kids. I had reset it to the factory settings, but that process failed and the device ended up not booting anymore. Using some command line wizardry with dism, booted from USB, I was able to get Windows 8.1 back on the device. Because I was already working on it, I wanted the put Windows 10 on it, using this guide.
Step 1 went fine - I downloaded the recovery image
Step 2 - installing patched Windows RT image went fine too
Step 3 is where issues began
I was able to execute the "disabling UAC" step
When installing the secure boot policy and rebooting, I got an error that the secure boot policy could not be installed.
Because of this, I executed this step - by changing some files on the EFI partition
Now the device does not boot anymore because of error 0xc0000225 by which it cannot find "winload.efi" or it contains errors. Pressing the "WINDOWS KEY=recovery" it says the same error code but with a different description "A required device isn't connected or cannot be accessed". Eventually it reboots on its own and shows the error again, after the Surface boot logo.
I'm trying to follow the troubleshooting steps but the tablet does not boot from USB (anymore)
I properly safely eject the FAT32 formatted GPT partitioned USB drive of 4GB. I also tried a different USB stick of 8GB.
I use the volume down method in an attempt to get it booting, however, it always ends up at the same message. It does read the USB drive, because the light flickers a bit, but it doesn't act on it.
I cannot boot to UEFI either: I press power and volume up - it does not turn on. I am able to turn it on without the volume up button pressed however - but it does not boot of course.
My feeling is that it has forgotten that it needs to boot from USB, but I can't access the UEFI settings either. Besides, it often needs the "10 seconds power button" trick to even turn on.
What steps can I follow to at least get some more life out of it - or is it completely crapped out?
That EFI modification is for booting Windows 10 only, won't work if you have 8.1 installed instead of 10, to do the unlock you must not enter a Microsoft account or do any upgrade.
The Surface RT and 2 are very finicky about what USB they want to boot from power off, basically I have over 10 USB sticks, among which 4 are 4GB or smaller, the Surface RT and 2 only boot from one of them, which is a no brand Chinese one as well.
So basically just get the recovery image from Microsoft then try a lot of sticks till one boots.
Okay, I guess I need to scavenge some USB sticks
Use a SanDisk Ultra 3.0 drive. Worked best for me on my 1st and 2nd gen Surface RTs. Regular cruise gilded work fine, but the ultra 3.0 is better since it has better transfer rates and whatnot.
I only have three: a cheap marketing one of 4GB, a USB stick with SD card slot, and a 2GB one
But the weird thing is that I also had some connection issues in Windows itself, when it still was working. The USB sticks rapidly connected/disconnected sometimes - but I did not have this issue with the USB keyboard I plugged in. Still, perhaps the USB port is busted.

Xtrons TQ709IPL/TE706PL Recovery Method (without physical hardware buttons)

So I've recently experienced some problems booting with my Xtrons TQ709IPL, so I thought I would share the method I used to fix it. This will probably work with other Xtrons devices (especially TE706PL since it just seems to be a TQ709IPL that comes with Android 10-- which oddly my TQ709IPL did as well when it was supposed to come with 9.0) and possibly other non-physical/touch button head units with similiar setups. This method is based on a post by @marchnz found here: [url]https://forum.xda-developers.com/android-auto/mtcd-software-development/mtcd-e-android-10-upgrade-using-t4123933[/URL] but fine-tuned to Xtrons unit.
To Preface this, I was unable to find the correct method to boot directly into recovery mode from RST. If anyone knows how on this unit, it'd be appreciated if they could share.
Beyond that, this also works if your device doesn't boot at all but the hardware buttons still react to RST being held in-- this will probably be due to a bad boot.img flash.
Required items:
Rockchip Head Unit with USB Port that can be recognized
Computer with Windows or Linux
USB-A to USB-A (or USB-C if your computer has the port)
Small pin, screwdriver-- something to push in the rst button
Rockchip Drivers and Android Tools: [url]https://github.com/rockchip-linux/tools[/URL]
ROM for your device in .img format: [url]https://yadi.sk/d/umCvHqCDzHccr[/URL]
Steps:
Install Rockchip Drivers and launch RKDevTool.
Plug Computer/Laptop into the Head Unit's Yellow USB-A port (this might be different on other models-- just try each out after doing the next step if it doesn't recognize your device)
Use a pin/small screw driver/etc to push in the RST button.
Hold button down until panel lights flash then stop pressing for about a second before pressing in again and holding (this should be done before the splash screen shows).
- If you did this successfully, your computer will now recognize your device in Maskrom mode. RKDevTool should show that a device is found.
Move over to the "Upgrade Firmware" tab and click firmware.
Select the .img file for your device.
Then click the "Upgrade" tab when the firmware has loaded.
- MAKE SURE YOU DO IT FROM HERE INSTEAD OF TRYING TO FLASH INDIVIDUAL IMGS IN THE "DOWNLOAD IMAGE" TAB! This caused my unit to not boot after I flashed the boot.img of my current firmware to it. Luckily, I was still able to get into Maskrom mode. So if you really want to try, make sure to use caution using that method!
It should now start flashing the firmware.
When it finishes, it should be recovered.
- Though, it failed and booted to recovery on mine once.
Done.
Hopefully, this will be of some use to some of you.
iamrance.asa said:
So I've recently experienced some problems booting with my Xtrons TQ709IPL, so I thought I would share the method I used to fix it. This will probably work with other Xtrons devices (especially TE706PL since it just seems to be a TQ709IPL that comes with Android 10-- which oddly my TQ709IPL did as well when it was supposed to come with 9.0) and possibly other non-physical/touch button head units with similiar setups. This method is based on a post by @marchnz found here: [url]https://forum.xda-developers.com/android-auto/mtcd-software-development/mtcd-e-android-10-upgrade-using-t4123933[/URL] but fine-tuned to Xtrons unit.
To Preface this, I was unable to find the correct method to boot directly into recovery mode from RST. If anyone knows how on this unit, it'd be appreciated if they could share.
Beyond that, this also works if your device doesn't boot at all but the hardware buttons still react to RST being held in-- this will probably be due to a bad boot.img flash.
Required items:
Rockchip Head Unit with USB Port that can be recognized
Computer with Windows or Linux
USB-A to USB-A (or USB-C if your computer has the port)
Small pin, screwdriver-- something to push in the rst button
Rockchip Drivers and Android Tools: [url]https://github.com/rockchip-linux/tools[/URL]
ROM for your device in .img format: [url]https://yadi.sk/d/umCvHqCDzHccr[/URL]
Steps:
Install Rockchip Drivers and launch RKDevTool.
Plug Computer/Laptop into the Head Unit's Yellow USB-A port (this might be different on other models-- just try each out after doing the next step if it doesn't recognize your device)
Use a pin/small screw driver/etc to push in the RST button.
Hold button down until panel lights flash then stop pressing for about a second before pressing in again and holding (this should be done before the splash screen shows).
- If you did this successfully, your computer will now recognize your device in Maskrom mode. RKDevTool should show that a device is found.
Move over to the "Upgrade Firmware" tab and click firmware.
Select the .img file for your device.
Then click the "Upgrade" tab when the firmware has loaded.
- MAKE SURE YOU DO IT FROM HERE INSTEAD OF TRYING TO FLASH INDIVIDUAL IMGS IN THE "DOWNLOAD IMAGE" TAB! This caused my unit to not boot after I flashed the boot.img of my current firmware to it. Luckily, I was still able to get into Maskrom mode. So if you really want to try, make sure to use caution using that method!
It should now start flashing the firmware.
When it finishes, it should be recovered.
- Though, it failed and booted to recovery on mine once.
Done.
Hopefully, this will be of some use to some of you.
Click to expand...
Click to collapse
Please help, I'm about 2 seconds from getting a new HU...
I also have the Xtrons TQ709IPL. I installed the drivers, but no matter what I do, when I finally get the HU into the correct mode, the USB insertion noise happens but then windows tells me that the device failed to install correctly. I also am unable to manually install the driver. This was on Windows 10, but I also tried it on Windows 8.1 and Windows7 all with the same results.
I must be doing something different than you, but I followed your instructions?
Ok, my USB cable was too long, I was using an extender to get to my laptop on my workbench from my car. If anyone else has this problem, make sure your USB cable is short. I am in now!
Next question, I have the TQ709IPL just like you. So which ROM do I need from the link you provided?

Surface RT stack on BSOD's 0xc000000f & 0xc0000428

Hello! Last week I bought used Surface RT 64 Gb Model: 1516 with next problem:
BSOD
Recovery​​Your PC needs to be repaired.​​A required device isn't connected or can't be accessed.​Error code: 0xc000000f​​You'll need to use the recovery tools on your installation media. If you don't have any​installation media (like a disc or USB device), contact your system administrator or PC manufacturer.​
If I try to press the Windows key to "try again", I get:
BSOD
Recovery​​Your PC needs to be repaired.​​Windows cannot verify the digital signature for this file.​​File: \WINDOWS\System32\winload.efi​Error code: 0xc0000428​
You'll need to use the recovery tools on your installation media. If you don't have any
installation media (like a disc or USB device), contact your system administrator or PC manufacturer.
I've tried download the Recovery Image from Microsoft for my Surface RT (using serial number). Use official manual for creating Recovery USB (format flash in FAT32 and copy files from downloaded archive, Press Volume- & Power Release & Release Volume- after Surface logo shown). Trying to boot from USB - nothing happen, I got BSOD! Trying to enter UEFI/BIOS (Press Volume+ & Power Release & Release Volume+ after UEFI/BIOS shown) - nothing happen, I got BSOD! Everytime I got same errors: first 0xc000000f and 0xc0000428 after pressing Win Key.
I use different Recovery Images for different regions with Win 8.0RT and Win 8.1RT, find & download ready custom images and trying to boot from... Use USB flash-drive 2.0 and 3.0 (different sizes 8 Gb, 32 Gb)
The tablet does not respond to connected USB flash-drive (but USB port is Ok). I've tried to boot from MicroSD :/ And nothing again!
I am tired please help me to solve this problem
silkway said:
Hello! Last week I bought used Surface RT 64 Gb Model: 1516 with next problem:
BSOD
Recovery​​Your PC needs to be repaired.​​A required device isn't connected or can't be accessed.​Error code: 0xc000000f​​You'll need to use the recovery tools on your installation media. If you don't have any​installation media (like a disc or USB device), contact your system administrator or PC manufacturer.​
If I try to press the Windows key to "try again", I get:
BSOD
Recovery​​Your PC needs to be repaired.​​Windows cannot verify the digital signature for this file.​​File: \WINDOWS\System32\winload.efi​Error code: 0xc0000428​
You'll need to use the recovery tools on your installation media. If you don't have any
installation media (like a disc or USB device), contact your system administrator or PC manufacturer.
I've tried download the Recovery Image from Microsoft for my Surface RT (using serial number). Use official manual for creating Recovery USB (format flash in FAT32 and copy files from downloaded archive, Press Volume- & Power Release & Release Volume- after Surface logo shown). Trying to boot from USB - nothing happen, I got BSOD! Trying to enter UEFI/BIOS (Press Volume+ & Power Release & Release Volume+ after UEFI/BIOS shown) - nothing happen, I got BSOD! Everytime I got same errors: first 0xc000000f and 0xc0000428 after pressing Win Key.
I use different Recovery Images for different regions with Win 8.0RT and Win 8.1RT, find & download ready custom images and trying to boot from... Use USB flash-drive 2.0 and 3.0 (different sizes 8 Gb, 32 Gb)
The tablet does not respond to connected USB flash-drive (but USB port is Ok). I've tried to boot from MicroSD :/ And nothing again!
I am tired please help me to solve this problem
Click to expand...
Click to collapse
Hi I have same problem and have tried everything you have did you fix it
There is a bare metal recovery guide here:
Bare Metal Recovery - Windows
Resetting a Windows RT device using a recovery image
jwa4.gitbook.io
The device is not bootable from SD and it will only boot from USB if holding volume - while powering on.
jwa4 said:
There is a bare metal recovery guide here:
Bare Metal Recovery - Windows
Resetting a Windows RT device using a recovery image
jwa4.gitbook.io
The device is not bootable from SD and it will only boot from USB if holding volume - while powering on.
Click to expand...
Click to collapse
Thanks buddy I will give it a go

Categories

Resources