[INFO/DEV] A500 ICS Bootloader (plus unlocked patched version) - Acer Iconia A500

Info about A500 ICS bootloader (and only ICS Bootloader, HC bootloader files don't have that - it was partly discussed in leak thread):
What we know so far:
- ICS bootloader has fastboot
- ICS bootloader is built as unlockable and relockable; however this right now doesn't work on A500/A100, it's confirmed to work on A200
Currently I don't know if the "unlock process" can be done "manually" - that is whether it's not forcibly disabled or just "not yet implemented" (It's just a leak, so keep that in mind). Lock command looks like to be fully in effect. On the other hand, old bootloader and itsmagic will do just fine, at least for now (for A500/A501).
Fastboot has these variables:
Code:
version-bootloader
version-baseband
version
secure
serialno
mid
product
(serialno will probably be your UID)
Fastboot OEM commands are:
Code:
fastboot oem debug on
fastboot oem debug off
fastboot oem lock
fastboot oem unlock
If you try to relock locked device, you'll get:
Code:
Fastboot: Device is already locked! Abort ...
Unlocked BL also supports these commands:
Code:
flash
boot
download
erase
(normal FB commands: so if you screw up your boot / recovery image, you can quite easily restore it).
PATCHED BOOTLOADER - !!!TO BE FLASHED WITH NVFLASH!!!
- overriden GetUnlockMode to return 1 (=Unlocked)
- overriden SetUnlockMode to return 0 (=Error)
- when booting to recovery it won't add the update command
- fastboot oem lock / fastboot oem unlock commands removed
DL: http://forum.xda-developers.com/attachment.php?attachmentid=919618&d=1330199867
In V2 there is additionally
- says "Custom Mode" instead of "Unlock Mode"
- fastboot variable secure: no
- boot command works (for some reason tight to secure variable)
- booting recovery manually with VOL_Down is like booting it via "adb reboot recovery": i.e won't erase cache etc.
DL: http://forum.xda-developers.com/attachment.php?attachmentid=922059&d=1330348851
Also fastboot is buggy (sometimes failed flashing recovery), but flashing boot.img works for instance. And yeah you won't have to use itsmagic for this one. Also, I flashed the stock ICS leak, and wasn't testing how it goes with HC.
CWM for ICS bootloader: http://forum.xda-developers.com/showpost.php?p=22978118&postcount=49
CLASSIC STUFF - YOU DO EVERYTHING AT YOUR OWN RISK!!!

This guy seems to have been around a very long time . I am not a DEV but this might be worth someone to take a look at . Here is the Link to his post.. He claims he if i read right repacked ics rom . guessing self signed and flashed with FAST BOOT.
or im lame and misread
http://www.acertabletforum.com/forum/acer-a200-general-discussions/3649-how-unlock-boot-loader.html
check the link
Hope this helps you.

erica_renee said:
This guy seems to have been around a very long time . I am not a DEV but this might be worth someone to take a look at . Here is the Link to his post.. He claims he if i read right repacked ics rom . guessing self signed and flashed with FAST BOOT.
or im lame and misread
http://www.acertabletforum.com/forum/acer-a200-general-discussions/3649-how-unlock-boot-loader.html
check the link
Hope this helps you.
Click to expand...
Click to collapse
Makes sense. I had to use fastboot to unlock the bootloader, flash recovery, and then flash a new system/boot/data img to my Galaxy Nexus for the first time. It seemed the unlock process wiped the operating system, so it was required to push the files from my computer to the phone manually in order to restore it.

Yeah, fastboot erases literally everything for security reasons IIRC.

Well reading that post on the other forum, it seems that they get the option to unlock like on the Google nexus devices, although it seems that screen doesn't appear on the a500 when trying this method.
Sent from my Desire HD using xda premium

heres a text file containing some more info. I ripped apart the bootloader update in a hex editor.
starts at 88640
Code:
AKBMSCLock switched
vendor/nvidia/tegra/prebuilt_t20/../core/system/fastboot/acer_funcs.cVOL_DOWN key pressed
VOL_UP key pressed
FastbootModeFOTAFactoryResetrecovery
--update_package=SDCARD:update.zip
Erasing Cache before SD update...
CACSD update cmd: %s
Error: Data not start yet!
whole-file signature verified against key %d
failed to verify whole-file signature
Error: Not enough buffer!!!
buffer & signature cannot be NULL!ANDROID!LNX%s: No boot image found!%s: Verify failed! Please redownload official image from Acer and try again!SOS%s: No recovery image found!Please flash official system.img and try againError: System.img is not official
Please flash official flexrom.img and try againError: flexrom.img is not official
%s: LockMode verified ok!
%s: LockMode verified failed
Magic value mismatch: %c%c%c%c%c%c%c%c
%s
Failed to setup warmboot args %x
Failed to set shmoo boot argument
Critical failure: Unable to start kernel.
Load OS now via JTAG backdoor....
Failed to initialize Aboot
Platform Pre Boot configuration...
Entering OS Download mode
LockUnlockFastboot: Device is now in %s mode
Bootloader Version %s (Unlock Mode)0.03.11-ICS
Bootloader version: %s
HW version 0x%x
NOYESIs Wifi Only? %s
EB2Unable to parse odmdata for wait input
Checking for android ota recovery
Erasing Userdata...
UDAErasing Cache...
Booting recovery kernel image
Recovery Verified!
Recovery verified failed ...(UnlockMode)Bootloader v%s%s: Starting Fastboot USB download protocol
No CAC partitions found
getvar:version-bootloaderOKAY%sversion-basebandOKAYversionOKAY0.4secureOKAYyesOKAYnoserialnoOKAYKal-El001midOKAY001productdownload:Fastboot: Not support the command in Lock modeDATA%08x
Insufficient memory
Staging partition size is not big enough
bootrebootRebooting the device ...continueflash:bootloaderrecoverysystemflexuserdataFastboot: Not support!No %s partition found
Not enough space in %s partitionFastboot: Official system image checked passed!
Fastboot: Official flex image checked passed!
Fastboot: Official system image checked failed!
Fastboot: Official flex image checked failed!
erase:StorMgr Formatting %s
Erasing %s
oem debug ondebug offlockFastboot: Device is already locked! Abort ...
Fastboot: Please use left key (VOL_DOWN) to choose, and use right key (VOL_UP) to select
Please wait ...Fastboot: Device locked!!!Please reboot the device to take affect!Fastboot: Failed to set lock modeFastboot: Cancelled by user or timeoutunlockFAIL(%08x)Failed to process command %s error(0x%x)
Boot Verified!
Boot verified failed ...Unrecoverable bootloader error (0x%08x).
vendor/nvidia/tegra/prebuilt_t20/../core/system/fastboot/main_acer.cmiscAPPcachestagingUSPbcttableBCTEBTubuntuUBNmbrMBRFLXUse scroll wheel or keyboard for movement and selection
Neither Scroll Wheel nor Keyboard are detected ...Booting OS
Checking for RCK.. press <Enter> in 5 sec to enter RCK
Press <Enter> to select, Arrow key (Left, Right) for selection move
Key driver not found.. Booting OS
Checking for RCK.. press key <Menu> in 5 sec to enter RCK
Press <Menu> to select, Home(Left) and Back(Right) for selection move
Picasso2Picasso_MPicasso_EPicassoVangoghMayaChecking for RCK.. press any key in 5 sec to enter RCK
Press scroll wheel to select, Scroll for selection move
Scroll wheel not found.. Booting OS
Press <Wake> to select, Home(Left) and Back(Right) for selection move
Checking for RCK.. press key <Volume Down> in 5 sec to enter RCK
Press <Volume Down> to select, <Volume Up> for selection move
tegraid=%x.%x.%x.%x.%x.%s mem=%[email protected]%uM vmalloc=%uM androidboot.serialno=%08x%08x video=tegrafb console=ttyS0,115200n8 debug_uartport=lsport console=none debug_uartport=hsport usbcore.old_scheme_first=1 lp0_vec=%[email protected]%x tegra_fbmem=%[email protected]%x brand=acer target_product=%s a500_ww_gen1max_cpu_cur_ma=%d core_edp_mv=%d pmuboard=0x%04x:0x%04x:0x%02x:0x%02x:0x%02x displayboard=0x%04x:0x%04x:0x%02x:0x%02x:0x%02x power_supply=Adapter power_supply=Battery audio_codec=%s cameraboard=0x%04x:0x%04x:0x%02x:0x%02x:0x%02x upnosmp usbroot=/dev/nfs ip=:::::usb%c:on rw netdevwait ethroot=/dev/nfs ip=:::::eth%c:on rw netdevwait sdroot=/dev/sd%c%c rw rootwait mmchdroot=/dev/mmchd%c%c%c rw rootwait mtdblockroot=/dev/mtdblock%c rw rootwait mmcblkroot=/dev/mmcblk%c%c%c rw rootwait Unrecognized root device: %s
root=/dev/sda1 rw rootwait tegraboot=nand tegraboot=nor tegraboot=emmc tegraboot=sdmmc mtdparts=tegra_nand:mtdparts=tegra_nor:%[email protected]%uK(%s),tegrapart=gpt_sector=%d Unable to query partition %s
%s:%x:%x:%x%cmodem_id=%d androidboot.carrier=wifi-only bootloader_ver=%s gpt %s: Fail set unlock mode!
%s: Successfully %s the device!
%s: Error occured while %s the device ...
%s: Error e = 0x%x
Do not support in ACER T20 Projects
MSM-RADIO-UPDATE
Unsupported binary in blob
Start Updating %s
failed-update-%s
End Updating %s
failed-updateboot-recoverySignature length wrong!!!! %d
data length wrong!!!! %d
Clearing useless bytes ...
Not legal!!!!!!! abort
Warning: The blob package is not official ~ Abort!
blob update failed
vendor/nvidia/tegra/prebuilt_t20/../core/system/nvaboot/nvaboot.cPassedFailedClearSBKTest: %s
LockSSKTest: SSK = Zero
LockSSKTest: LockSSK %s
Jumping to kernel at:%d ms
EFI PARTFastboot: Unlock mode, Clear SSK!!!
SetPartitionToVerify failed. NvError %u NvStatus %u
GetSecondaryBootDevice failed. NvError %u NvStatus %u
LoadPartitionTable failed. NvError %u NvStatus %u
AllocateState failed. NvError %u NvStatus %u
nverror:0x%x (0x%x)
GetBct failed. NvError %u NvStatus %u
DownloadBct failed. NvError %u NvStatus %u
SetBlHash failed. NvError %u NvStatus %u
UpdateBct failed. NvError %u NvStatus %u
SetDevice failed. NvError %u NvStatus %u
StartPartitionConfiguration failed. NvError %u NvStatus %u
EndPartitionConfiguration failed. NvError %u NvStatus %u
FormatPartition failed. NvError %u NvStatus %u
Start Downloading %s
UpdateBlInfo failed. NvError %u NvStatus %u
End Downloading %s
QueryPartition failed. NvError %u NvStatus %u
CreatePartition failed. NvError %u NvStatus %u
ReadPartition failed. NvError %u NvStatus %u
RawReadPartition failed. NvError %u NvStatus %u
RawWritePartition failed. NvError %u NvStatus %u
SetBootPartition failed. NvError %u NvStatus %u
ReadPartitionTable failed. NvError %u NvStatus %u
DeleteAll failed. NvError %u NvStatus %u
Obliterate failed. NvError %u NvStatus %u
OdmOptions failed. NvError %u NvStatus %u
Error in memory allocation
FuelGaugeFwUpgrade failed. NvError %u NvStatus %u
sdram validation can not be done at bootloader level
OdmCommand failed. NvError %u NvStatus %u
Sync failed. NvError %u NvStatus %u
VerifySignature failed. NvError %u NvStatus %u
ReadVerifyData failed. NvError %u NvStatus %u
VerifyPartition failed. NvError %u NvStatus %u
SetTime failed. NvError %u NvStatus %u
DownloadPartition failed. NvError %u NvStatus %u
FormatAll failed. NvError %u NvStatus %u
LocatePartitionToVerify failed. NvError %u NvStatus %u
Error PT partition format sector start=%d, count=%d
Format partition %s PT%s: Error BCT handle!
%s: Version = %x
%s: Version = 0x%x
Bct read verify failed
Error Bct Verify: NO valid Bct found lost+foundNvDdkDispSetWindowSurface/ controller: %d window: %d count: %d
surface: 0
tiledpitchsurface width: %d height: %d Bpp: %d layout: %s
NvDdkDispSetMode/ controller: %d
width: %d height: %d bpp: %d refresh: %d frequency: %d flags: 0x%x
NvDdkDispSetMode/ null mode
NTSC/PAL1WIN3WIN_AC2WIN_A2WIN_Cdisplay %d isn't clocked
Error when writing data
Error on clock en!!! Set to Tx_only mode!!!
ByPassHdmiDll/sys/firmware/fuse/kfuse_rawlibnvodm_hdmiNvOdmDispHdmiI2cTransactionNvOdmDispHdmiI2cOpenNvOdmDispHdmiI2cCloseNvOdmDispHdcpIsRevokedKsvlibnvodm_tvoNvOdmDispTvoGetGlobNvOdmDispTvoReleaseGlobNo SmartDimmer activity has been recorded.
Constant Values:
SD_LUT = R_LUT G_LUT B_LUT
%d: 0x%02x 0x%02x 0x%02x
SD_BL_TF = PT_0 PT_1 PT_2 PT_3
%d: 0x%02x 0x%02x 0x%02x 0x%02x
Total SD3 activities count: %d
Entry(%d) Info:
SD_CONTROL = 0x%08X
SD_BL_CONTROL = 0x%08X
SD_CSC_COEFF = 0x%08X
SD_FLICKER_CONTROL = 0x%08X
SD_PIXEL_COUNT = 0x%08X
SD_BL_PARAMETERS = 0x%08X
SD_HW_K_VALUES = 0x%08x
SD_HISTOGRAM = BIN_0 BIN_1 BIN_2 BIN_3
Input Backlight Intensity = %d
Output Backlight Intensity = %d
PWM frequence = %4.2f, SD percentage = %4.2f
JEDEC
Calling simple log2 with value which is not power of 2
Failed Ddk Rd. Bad block
Failed Ddk Wr. Bad block
Failed Ddk Erase. Bad block
Failed Ddk Cpybk. Bad block
Failed Ddk unknown Operation. Bad block Error code=0x%x at chip=%d,block=%d
DDK_Ers:dev = %d, number of blks = %d
Chip: %d, Page = %d, blk = %d
NandRead Error: Number of Pages=%d < interleave count=%d
Ecc.Err pgoffset: %d, status: 0x%x
Ecc.Err in Tag pgoffset: %d, status: 0x%x
Chip: %d, Page = %d
-MAINTAG
DDK_Rd:dev = %d, %s + %s, number_of_pages = %d
DDK_Cpbk:Srcdev = %d, Dstdev = %d, number_of_pages = %d
SrcChip: %d, Page = %d, blk = %d
DstChip: %d, Page = %d, blk = %d
DDK_Write:device = %d, %s + %s, number_of_pages = %d
Factory Bad block: Chip%u Block=%u
Runtime Bad block: Chip%u Block=%u,RTB=0x%x
Scan for Region table blocks: Chip=%u, Block=%u Bad
Marking Runtime Bad block: Chip%u Block=%u
Block driver mark bad failed at Chip=%d, Block=%d
Erase Partition Error: failed to erase block chip=%d,blk=%d
Nand block driver: Write Error = 0x%x, PartId=%u, , Write: start=0x%x, sector count=0x%x
Nand block driver: Read Error = 0x%x, PartId=%u, Read: start=0x%x, sector count=0x%x
Possible forced region table load
Region Table copy at CurrBlockNum %u is probably corrupt
Device Bad block table:
{%u, %d},
Device has %d bad blocks
Error Nand block driver Load Region table call failed for part-id=%d, error code=%d
Global Nand Interleave count = %u
Error: NandUtilGetRegionEntry failed for part Id=%d
Partitions in region table: Id=%d
FTL open for partition=%d failed,code=%d
Nand Block dev open failed error 0x%x
Physical Rd/Wr on block error: req=%d,actual=%d
Bad block during Rd/Wr physical found at: Chip=%d, Block=%d
Block dev Physical Ioctl failed. Marking Chip=%d,Blk=%d
Unable to Erase Nand starting block 0x%x
Nand Block driver map logical2physical failed BlockNum=%d, DeviceNum=%d, CurrPhysBlk=%d
Error: Failed to map logical block=%d in entire Nand.
Error: As Region table is bigger than 1 sector size. Need to change Load Region table logic
Unable to Erase Nand chip=%d,block=%d
Partition %d - number of physical blocks = %d
Error: Unable to find requested blocks on Nand: req=%d,found=%d
Invalid value for PercentReserved = %d [should not exceed]%d, setting PercentReserved = %d
Insufficient space, cannot create partition
PartId %u: LB[%u %u] PB[%u %u] IL%u LS[%u %u]
Abs PartId %u: LB[%u %u] PB[%u %u] IL%u
Last Abs PartId %u: LS[%u %u] PartId %u: LB[%u %u] PB[%u %u] IL%u
Abs ** PartId %u: LS[%u %u]
Data mismatch in Copy of Region Table at BlockNum %d
Erase failed. Get Physical Sectors failed for logical start=%d,stop=%d
Erase Partition part-id=%d: Start=%d,End=%d NvDdkBlockDevIoctlType_DisableCacheNvDdkBlockDevIoctlType_EraseLogicalSectorsNvDdkBlockDevIoctlType_QueryFirstBootNvDdkBlockDevIoctlType_DefineSubRegionNvDdkBlockDevIoctlType_WriteVerifyModeSelectNvDdkBlockDevIoctlType_AllocatePartitionNvDdkBlockDevIoctlType_PartitionOperationNvDdkBlockDevIoctlType_ReadPhysicalSectorNvDdkBlockDevIoctlType_WritePhysicalSectorNvDdkBlockDevIoctlType_QueryPhysicalBlockStatusNvDdkBlockDevIoctlType_ErasePhysicalBlockNvDdkBlockDevIoctlType_LockRegionNvDdkBlockDevIoctlType_MapLogicalToPhysicalSectorNvDdkBlockDevIoctlType_FormatDeviceNvDdkBlockDevIoctlType_GetPartitionPhysicalSectorsNvDdkBlockDevIoctlType_IsGoodBlockNvDdkBlockDevIoctlType_UnprotectAllSectorsNvDdkBlockDevIoctlType_ProtectSectors
Nand Block dev ioctl opcode=%s error 0x%x
Save Region Table copy %u at CurrBlockNum %u
ftllite mark bad: chip=%d blk=%d
ftllite mark bad erase fail error=0x%x : chip=%d blk=%d
Ftl Lite bad block mark failed at Chip=%d, Block=%d
EraseAllBlocks: GetBlockInfo error=0x%x @ chip=%d,blk=%d
EraseAllBlocks: factory bad block @ chip=%d,blk=%d
EraseAllBlocks: runtime bad block @ chip=%d,blk=%d
Bad block in pba2lba ftlite map: chip=%d, blk=%d
Fatal error in pba2lba ftllite: line%d,lba=%d, startlba=%d chip=%d blk=%d
sparebuf[0]=0x%x, factory good=%d
Erasing block at chip=%d, blk=%d
continuing mapping erased blk
Erase partition error: start arg=%d, start log blk=%d
Erase partition error: count arg=%d, erase size=%d
Ftllite erase logical failed: blk start=%d,end=%d
Replace block=%d in chip=%d for read failure
New Block at: chip=%d,block=%d
Partition sequential read type: read failure at chip=%d, blk=%d
Error in FtlLitePrivCreatePba2LbaMapping: e=0x%x
Write called without PBA mapping info: chip=%d,lba=%d
Data area read verification failed in FTL Lite at Chip=%d,Blk=%d,Pg=%d
FTL Lite Read Verify error code=0x%x
Wr Error: 0x%x, Replace ftl lite bad block, PbaIndex=%d,Chip=%d,Block=%d,StartPg=%d,PgCount=%d
Rd verify error: 0x%x, Replace ftl lite bad block, PbaIndex=%d,Chip=%d,Block=%d,StartPg=%d,PgCount=%d
Replaced mapped block for lba=%d: old=%d new pba=%d
Factory bad block at chip=%d blk=%d:
Runtime bad block at chip=%d blk=%d:
Error: exhausted spare blocks toreplace lba=%d
finished remapping till index=%d out of total blocks=%d
used spare blocks=%d
Error: Unable to replace blocks with spare blocks for %d blocks
Error in FTL Lite write
RETURNING ERROR FROM NvNandWriteSector TL error=%u,Sector Start=0x%x,Count=0x%x
RETURNING ERROR FROM NvNandReadSector TL error=%u,Sector Start=0x%x,Count=0x%x
RETURNING ERROR FROM NvNandOpen
Error: trying cached read past page limits
512B Read: Page=%d, within page sector in page=%d, sector count=%d
Error: 512B buffer allocate failed earlier
Error: trying cached write past page limits
Error: failed to allocate buffer for 512B sector support
Alloc memory failed
TLvalidate FAIL1 sector offset=0x%x,count=0x%x,sectorsPerRow=%u
TLvalidate FAIL2, Interleave bank Pgs[ %d ]
TLvalidate FAIL3
TLvalidate FAIL4
TLvalidate FAIL5 page[0]=0x%x,Reqd rows=0x%x
TLEraseAll fail BtlGetPba: Chip=%d,Block=%d
GetBlock info failed: Chip=%d, Blk=%d
Marking Bad block failed forChip=%d Block=%d
Found Bad block Chip=%d Block=%d
Factory Bad: 0x%x, Run-time bad marker: 0x%x
Interleave2PhysicalPg fail1: illegal page
Interleave2PhysPg fail2: illegal device
Ddk Read error code=0x%x
In NandTLGetBlockInfo Error = 0x%x
NandTL_INVALID_ARGUMENT3
NandTL_INVALID_ARGUMENT4
NandTL_INVALID_ARGUMENT5
NandTL_INVALID_ARGUMENT6
Error: No free Blk, Region[%d]=%d
Strategy Handle Error failed in Wr Status:%d,
TL write error=%u,sector start=0x%x,count=0x%x
NandTL_INVALID_ARGUMENT1
NandTL_INVALID_ARGUMENT2
TlRead failed Status:%d,
TL read error=%u,sector start=0x%x,count=0x%x
Region=%d SD Erase start 512B-sector=%d,512B-sector-num=%d
LCM of %d and %d =%d
Part-id=%d size from %d sectors by %d sectors
SD Alloc Partid=%d, start sector=%d,num=%d NvDdkBlockDevIoctlType_ErasePartitionNvDdkBlockDevIoctlType_VerifyCriticalPartitionsUnknownIoctl
Inst=%d, SD ioctl %s failed: error code=0x%x SPIF ERROR: SpifOpen failed..
SPIF ERROR: Trying to read more than SPI flash device size..
SPIF ERROR: Trying to program more than SPI flash device size..
SPIF ERROR: Trying to erase more than chipsize NumberOfSectors[0x%x] TotalBlocks[0x%x]
SPIF ERROR: Trying to erase more than chipsize NumberOfBlocks[0x%x] TotalBlocks[0x%x]
SPIF ERROR: Illegal block driver Ioctl..
SPIF ERROR: SpifBlockDevIoctl failed error[0x%x]..
Inst=%d, SPI Flash ioctl %s failed: error code=0x%x Trying to close driver without open
SPIF ERROR: NvDdkSpifBlockDevInit failed error[0x%x]..
Error SD clear skip blocks - sector=%d
Skipping SD erase of prefix %d blocks from %d
Skipping SD erase of suffix %d blocks from %d
Hsmmc Erase start sector=%d,num=%d
Hsmmc Alloc Partid=%d, start sector=%d,num=%d
NvNandHandle: FtlStartLba=%d, FtlEndLba=%d FtlStartPba=%d, FtlEndPba=%d pBlocks[%d ] prevBlocks[]
TrackLba[%d]: lba=%d, %s
Misc start
NumOfBanksOnBoard = %d
NoOfILBanks = %d
PhysBlksPerBank = %d
ZonesPerBank = %d
PhysBlksPerZone = %d
PhysBlksPerLogicalBlock = %d
TotalLogicalBlocks = %d
TotEraseBlks = %d
NumOfBlksForTT = %d
PgsRegForTT = %d
TtPagesRequiredPerZone = %d
NumOfBlksForTAT = %d
BlksRequiredForTT = %d
PgsAlloctdForTT = %d
ExtraPagesForTTMgmt = %d
LastTTPageUsed = %d
CurrentTatLBInUse = %d
bsc4PgsPerBlk = %d
Misc end
TAT Handler start
tatBlocks[%d] bank = %d, block = %d
ttBlocks[%d] bank = %d, block = %d
tat Block bank = %d, block = %d
TtAllocBlk[%d] bank = %d, block = %d
lastUsedTTBlock bank = %d, block = %d
TAT Handler end
++++++++++++++++++
TT 32-bit entry format in dump :
=============
Region: b31-b30
BlockNotUsed: b29
BlockGood: b28
DataReserved: b27
SystemReserved: b26
TatReserved: b25
TtReserved: b24
PhysBlkNum: b23-b0
============
Dumping page %d
**SuperBlock %d
*0x%08X [%d] [SYS-RSVD]
*0x%08X [%d] [ ^^^ FREE BLK ] Region%d
*0x%08X [%d] [ USED BLK ] Region%d
*0x%08X [%d] [*** BAD BLK ***]
Total=%u,Free=%u,Bad=%u,Reserve Data=%u,System=%u,Tat=%u,Tt=%u,Illegal=%u,Region0=%u,Region1=%u,Region2=%u,Region3=%u
No free blocks Available- find out the reason, bank = %d
[Strategy] Erase Failed
Bad Block found at LBA %d
Marked blk bad bank = %d, block = %d Rev = %d lba = %d
TAT write failed page = %d, bank = %d, block = %d Rev = %d lba = %d WriteOnlyHeader = %d
NO FREE TAT BLOCKS AVAILABLE
writing to TAT blocks failedInvalid percent reserved value = %d, should not exceed%d, setting it to %d
[Nand_Strategy] Failed to mark PBAs BAD
**** Fail: Invalid Case ****
Not Expected to come here
NvError_NandNoFreeBlock1
Error: NandStrategyGetSectorPageToWrite InTracking case, No Page
Error: NandStrategyGetSectorPageToWrite GetPBA case, No Page
NvError_NandNoFreeBlock2
GetNewPBA failed Sts: 0x%x in GetSectorPage2Write #2
Error: NandStrategyGetSectorPageToWrite PBA assigned already case, No Page Crypto Engine Disabled, Returning IOCTL
AES DDK Unsupported IOCTL COMMAND
Invalidate-only cache maint not supported in NvOs
NVRM Initialized shmoo database
NVRM Got shmoo boot argument (at 0x%x)
ActiveIdleAutoHwRM power state before suspend: %s (%d)
Active Module: 0x%x*** Wakeup from LP0 ***
*** Wakeup from LP1 ***
*** Wakeup after Skipped LP0 ***
DTT: TMON initialization failed
DTT: T = %d, Range = %d (%d : %d)
DVFS set core at %dmV
Clock control balance failed for module %d, instance %d
ADJUSTED CLOCKS:
MC clock is set to %6d KHz
EMC clock is set to %6d KHz (DDR clock is at %6d KHz)
PLLX0 clock is set to %6d KHz
PLLC0 clock is set to %6d KHz
CPU clock is set to %6d KHz
System and AVP clock is set to %6d KHz
GraphicsHost clock is set to %6d KHz
3D clock is set to %6d KHz
2D clock is set to %6d KHz
Epp clock is set to %6d KHz
Mpe clock is set to %6d KHz
Vde clock is set to %6d KHz
NVRM CLOCKS: PLLX0: %d Khz
NVRM CLOCKS: PLLM0: %d Khz
NVRM CLOCKS: PLLC0: %d Khz
NVRM CLOCKS: PLLP0: %d Khz
NVRM CLOCKS: PLLA0: %d Khz
NVRM CLOCKS: CPU: %d Khz
NVRM CLOCKS: AVP: %d Khz
NVRM CLOCKS: System Bus: %d Khz
NVRM CLOCKS: Memory Controller: %d
NVRM CLOCKS: External Memory Controller: %d
ODM CPU freq request beyond SOC limit
GPUHandheldBrChipsCrushMCPCkVaioHandheld SOCSimulation Chip: 0x%x
FPGAQuickTurnEmulation (%s) Chip: 0x%x Netlist: 0x%x Patch: 0x%x
Chip Id: 0x%x (%s) Major: 0x%x Minor: 0x%x SKU: 0x%x
pNV_CFG_RMC_FILENV_CFG_CHIPLIBNV_CFG_CHIPLIB_ARGSSECURITY_VIOLATION DecErrAddress=0x%x SECURITY_VIOLATION DecErrStatus=0x%x EMEM DecErrAddress=0x%x EMEM DecErrStatus=0x%x GART DecErrAddress=0x%x GART DecErrStatus=0x%x DTT: Invalid Range = %d
Err in I2c transfer: Controller Status 0x%08x
AP20 Master I2c Isr got unwanted interrupt IntStatus 0x%08x
I2c slave rx buffer filled
%s(): Slave is not started
%s(): No space in Tx fifo
%s(): Slave is already started
I2cSlaveIsr(): Illegal transfer at this point
AP20 Slave I2c Isr got unwanted interrupt IntStatus 0x%08x
ARB EMEM Interrupt occurredSMMU DecErrAddress=0x%x SMMU DecErrStatus=0x%x QueryIface_CQueryIfacebogusOBS bus modID 0x%x index 0x%x = value 0x%xLLC Client %d Count: 0x%.8X, %u
LLC Client %d Clocks: 0x%.8X, %u
Client %.3d Count: 0x%.8X, %u
Total MC Clocks: 0x%.8X, %u
AXI DecErrAddress=0x%x AXI DecErrStatus=0x%x NvRmChannelSubmit failed (err = %d, SyncPointValue = %d)
Output FIFO does not refill, context read is stuck.Error> DSI Panel Initialization Failed
Error> DSI Panel Suspend Failed
ERROR: GPIO_PCF50626_I2cWrite8() failed.

Thanks gh123man.
Can you also try to extract the strings in the original bootloader that itsmagic works on for comparison?
namely the cmdline part which is this from the ics one
Code:
tegraid=%x.%x.%x.%x.%x.%s mem=%[email protected]%uM vmalloc=%uM androidboot.serialno=%08x%08x video=tegrafb console=ttyS0,115200n8 debug_uartport=lsport console=none debug_uartport=hsport usbcore.old_scheme_first=1 lp0_vec=%[email protected]%x tegra_fbmem=%[email protected]%x brand=acer target_product=%s a500_ww_gen1max_cpu_cur_ma=%d core_edp_mv=%d pmuboard=0x%04x:0x%04x:0x%02x:0x%02x:0x%02x displayboard=0x%04x:0x%04x:0x%02x:0x%02x:0x%02x power_supply=Adapter power_supply=Battery audio_codec=%s cameraboard=0x%04x:0x%04x:0x%02x:0x%02x:0x%02x upnosmp usbroot=/dev/nfs ip=:::::usb%c:on rw netdevwait ethroot=/dev/nfs ip=:::::eth%c:on rw netdevwait sdroot=/dev/sd%c%c rw rootwait mmchdroot=/dev/mmchd%c%c%c rw rootwait mtdblockroot=/dev/mtdblock%c rw rootwait mmcblkroot=/dev/mmcblk%c%c%c rw rootwait Unrecognized root device: %s
root=/dev/sda1 rw rootwait tegraboot=nand tegraboot=nor tegraboot=emmc tegraboot=sdmmc mtdparts=tegra_nand:mtdparts=tegra_nor:%[email protected]%uK(%s),tegrapart=gpt_sector=%d Unable to query partition %s
%s:%x:%x:%x%cmodem_id=%d androidboot.carrier=wifi-only bootloader_ver=%s gpt %s: Fail

drellisdee said:
Thanks gh123man.
Can you also try to extract the strings in the original bootloader that itsmagic works on for comparison?
namely the cmdline part which is this from the ics one
Code:
tegraid=%x.%x.%x.%x.%x.%s mem=%[email protected]%uM vmalloc=%uM androidboot.serialno=%08x%08x video=tegrafb console=ttyS0,115200n8 debug_uartport=lsport console=none debug_uartport=hsport usbcore.old_scheme_first=1 lp0_vec=%[email protected]%x tegra_fbmem=%[email protected]%x brand=acer target_product=%s a500_ww_gen1max_cpu_cur_ma=%d core_edp_mv=%d pmuboard=0x%04x:0x%04x:0x%02x:0x%02x:0x%02x displayboard=0x%04x:0x%04x:0x%02x:0x%02x:0x%02x power_supply=Adapter power_supply=Battery audio_codec=%s cameraboard=0x%04x:0x%04x:0x%02x:0x%02x:0x%02x upnosmp usbroot=/dev/nfs ip=:::::usb%c:on rw netdevwait ethroot=/dev/nfs ip=:::::eth%c:on rw netdevwait sdroot=/dev/sd%c%c rw rootwait mmchdroot=/dev/mmchd%c%c%c rw rootwait mtdblockroot=/dev/mtdblock%c rw rootwait mmcblkroot=/dev/mmcblk%c%c%c rw rootwait Unrecognized root device: %s
root=/dev/sda1 rw rootwait tegraboot=nand tegraboot=nor tegraboot=emmc tegraboot=sdmmc mtdparts=tegra_nand:mtdparts=tegra_nor:%[email protected]%uK(%s),tegrapart=gpt_sector=%d Unable to query partition %s
%s:%x:%x:%x%cmodem_id=%d androidboot.carrier=wifi-only bootloader_ver=%s gpt %s: Fail
Click to expand...
Click to collapse
sure ill have it up asap
Edit:
up. see next post

I have uploaded the archive with nvflash and some instructions on using it with A500. This is only intended for hardcore geeks who know how ARM boots. Be careful - while you can't really brick tegra2 (since it has a minimal usb-capable bootloader in the OTP area), you can screw up things and it will be quite hard to force the tablet to boot in some cases due to stupid security checks.
You can use this to download any bootloader/recovery/linux you want. That will help us with porting uboot. Someone may even write an automated tool for reflashing bootloaders and unbricking tablets..
http://www.mediafire.com/?pp97x9aahs58hzp
Let me just copy-paste the README from the archive here.
1. First, generate your sbk with http://vache-android.com/v1/index.php?site=sbk
2. Then, get a hold of mmcblk0 start sectors (at least 4KB) and copy it to mmcblk0_start
3. run the ./rip_bct.sh script and supply it with your SBK to rip BCT (boot config table. contains ram timings among other things)
4. run ./download.sh to connect nvflash to iconia (do it in APX mode). Note that you also need to supply your SBK here, but not as a long single number, but as it is displayed on the website
5. You can now play with nvflash - for example, read partitions, partition table and write your own flash_ic.cfg with partition layout
6. If you flash linux/recovery, make sure to update the magic values (like itsmagic does).
To do it, first download the 12th partition (AKB)
then, in the akb.bin, at address 0x84, replace 4 16-byte entries with the same pattern
"00 FB 30 94 99 01 4F 97 2E 4C 2B A5 18 6B DD 06"
ok, you need to patch the file once and can use it in further flashing. Just upload it to the device (like sign.sh does)
POTENTIAL PITFALLS. Listen up, I ain't gonna help you if you eff up here.
1. You must use BCT from your device. Otherwise, the bootloader will not boot.
You will still be able to use NVFLASH, but until you dump your own BCT and use it
with NVFLASH, the device will not be booting again
2. If you use the ./iconia_boot.bin that differs from the bootloader on your
device, the device will get stuck in the APX mode after a reboot. If you do it,
flash the new ./iconia_boot.bin to the device (to the partition 4).
The archive contains several bootloaders to play with - ./iconia_boot.bin is from
Honeycomb, iirc, ./ics_boot.bin is from ICS, obviously and ./tf101_boot.bin is
from transformer tf101
---------- Post added at 11:56 PM ---------- Previous post was at 11:42 PM ----------
Sorry for another off-topic post. If any of the devs is interested
Here is the uboot binary http://www.mediafire.com/?1zb2zc163tla8cj
And here is the linux kernel version 3.0 in the uboot image format http://www.mediafire.com/?j8fddkbm5fdsuu4
You can create vfat partition on the micro sd (/dev/mmcblk1p1) and copy the uImage there
The bootloader only supports booting from microsd now. The precompiled kernel tries to mount ubuntu rootfs on /dev/mmcblk1p2 and boot it.

drellisdee said:
Thanks gh123man.
Can you also try to extract the strings in the original bootloader that itsmagic works on for comparison?
namely the cmdline part which is this from the ics one
Code:
tegraid=%x.%x.%x.%x.%x.%s mem=%[email protected]%uM vmalloc=%uM androidboot.serialno=%08x%08x video=tegrafb console=ttyS0,115200n8 debug_uartport=lsport console=none debug_uartport=hsport usbcore.old_scheme_first=1 lp0_vec=%[email protected]%x tegra_fbmem=%[email protected]%x brand=acer target_product=%s a500_ww_gen1max_cpu_cur_ma=%d core_edp_mv=%d pmuboard=0x%04x:0x%04x:0x%02x:0x%02x:0x%02x displayboard=0x%04x:0x%04x:0x%02x:0x%02x:0x%02x power_supply=Adapter power_supply=Battery audio_codec=%s cameraboard=0x%04x:0x%04x:0x%02x:0x%02x:0x%02x upnosmp usbroot=/dev/nfs ip=:::::usb%c:on rw netdevwait ethroot=/dev/nfs ip=:::::eth%c:on rw netdevwait sdroot=/dev/sd%c%c rw rootwait mmchdroot=/dev/mmchd%c%c%c rw rootwait mtdblockroot=/dev/mtdblock%c rw rootwait mmcblkroot=/dev/mmcblk%c%c%c rw rootwait Unrecognized root device: %s
root=/dev/sda1 rw rootwait tegraboot=nand tegraboot=nor tegraboot=emmc tegraboot=sdmmc mtdparts=tegra_nand:mtdparts=tegra_nor:%[email protected]%uK(%s),tegrapart=gpt_sector=%d Unable to query partition %s
%s:%x:%x:%x%cmodem_id=%d androidboot.carrier=wifi-only bootloader_ver=%s gpt %s: Fail
Click to expand...
Click to collapse
here is the string section of the original bootloader. puled from the tar.gz thanks to sp3dev
Code:
UnknownChecking for RCK.. press any key in 5 sec
HarmonyTangoWhistlerVentana
Assert on %s:%d: %s
Assert on %s:%d
Signal %d raised!
vendor/nvidia/proprietary_src/prebuilt/../core/utils/nvos/aos/nvap/nvos_aos_gcc.cvendor/nvidia/proprietary_src/prebuilt/../core/utils/nvos/aos/nvap/nvos_aos_libc.c0123456789abcdefghijklmnopqrstuvwxyz**********Aos DebugSemiHosting Initialized*******
GetSkuId ************ * ************* ************* * * * * * * * * * * ** ** * * * * ** ** ************ * * * * *********** *********** ************ ************ * ************* ************ ************ * * * * * * * * * * * * * * * * * * ************** **************recovery
--update_package=SDCARD:update.zip
Erasing Cache before SD update...
CACMSCSD update cmd:%s
[%s] read gpio OK, a6=%d b5=%d a3=%d
[%s] read gpio FAIL, a6=%d b5=%d a3=%d
AKBANDROID!vendor/nvidia/proprietary_src/prebuilt/../core/system/fastboot/main.cMagic value mismatch: %c%c%c%c%c%c%c%c
%s
Failed to setup warmboot args %x
Failed to set shmoo boot argument
HarmonyVentanaCritical failure: Unable to start kernel.
Load OS now via JTAG backdoor....
TEGRA_PMC_BASE::PMC_CNTRL_0 = 0x%x
FIX TEGRA_PMC_BASE::PMC_CNTRL_0 = 0x%x
Entering Acer Download Mode
LNXFactoryResetErasing Userdata...
UDAErasing Cache...
FOTAVolume up pressed.
Volume down pressed.
SOSBooting recovery kernel image
Unrecoverable bootloader error (0x%08x).
miscrecoverybootsystemAPPcachestagingUSPuserdatabcttableBCTbootloaderEBTubuntuUBNmbrMBRUse scroll wheel or keyboard for movement and selection
Neither Scroll Wheel nor Keyboard are detected ...Booting OS
Checking for RCK.. press <Enter> in 5 sec to enter RCK
Press <Enter> to select, Arrow key (Left, Right) for selection move
Key driver not found.. Booting OS
Checking for RCK.. press key <Menu> in 5 sec to enter RCK
Press <Menu> to select, Home(Left) and Back(Right) for selection move
Checking for RCK.. press any key in 5 sec to enter RCK
Press scroll wheel to select, Scroll for selection move
Scroll wheel not found.. Booting OS
Press <Wake> to select, Home(Left) and Back(Right) for selection move
nvmem=%[email protected]%uM mem=%[email protected] vmalloc=%uM video=tegrafb console=ttyS0,115200n8 console=none usbcore.old_scheme_first=1 lp0_vec=%[email protected]%x upnosmp usbroot=/dev/nfs ip=:::::usb%c:on rw ethroot=/dev/nfs ip=:::::eth%c:on rw sdroot=/dev/sd%c%c rw rootdelay=15 mmchdroot=/dev/mmchd%c%c%c rw rootdelay=1 mtdblockroot=/dev/mtdblock%c rw rootdelay=15 mmcblkroot=/dev/mmcblk%c%c%c rw rootdelay=15 Unrecognized root device: %s
root=/dev/sda1 rw rootdelay=15 tegraboot=nand tegraboot=emmc tegraboot=sdmmc board_info=%x:%x:%x:%x:%x mtdparts=tegra_nand:%[email protected]%uK(%s),tegrapart=%s:%x:%x:%x%cUnable to query partition %s
gpt MSM-RADIO-UPDATEboot-recoveryupdatefailed-updateinvalid-updatefailed-update-%sokayWQ02824SATMA1278vendor/nvidia/proprietary_src/prebuilt/../core/system/nvaboot/nvaboot.cEFI PARTakb4820110311jeqNULLSecure boot: image %s checksum fail!nverror:0x%x (0x%x)
Error PT partition format sector start=%d, count=%d
Format partition %s PT
Bct read verify failed
Error Bct Verify: NO valid Bct found lost+foundNvDdkDispSetWindowSurface/ controller: %d window: %d count: %d
surface: 0
tiledpitchsurface width: %d height: %d Bpp: %d layout: %s
NvDdkDispSetMode/ controller: %d
width: %d height: %d bpp: %d refresh: %d frequency: %d flags: 0x%x
NvDdkDispSetMode/ null mode
NTSC/PAL1WIN3WIN_AC2WIN_A2WIN_Cdisplay %d isn't clocked
ByPassHdmiDlllibnvodm_hdmiNvOdmDispHdmiI2cTransactionNvOdmDispHdmiI2cOpenNvOdmDispHdmiI2cCloseNvOdmDispHdcpIsRevokedKsvlibnvodm_tvoNvOdmDispTvoGetGlobNvOdmDispTvoReleaseGlob====== Register Dump Start =========
Start command count=0x%x
NAND_COMMAND = 0x%8.8x
NAND_STATUS = 0x%8.8x
NAND_ISR = 0x%8.8x
NAND_IER = 0x%8.8x
NAND_CONFIG = 0x%8.8x
NAND_TIMING = 0x%8.8x
NAND_RESP = 0x%8.8x
NAND_TIMING2 = 0x%8.8x
NAND_CMD_REG1 = 0x%8.8x
NAND_CMD_REG2 = 0x%8.8x
NAND_ADDR_REG1 = 0x%8.8x
NAND_ADDR_REG2 = 0x%8.8x
NAND_DMA_MST_CTRL = 0x%8.8x
NAND_DMA_CFG.A = 0x%8.8x
NAND_DMA_CFG.B = 0x%8.8x
NAND_FIFO_CTRL = 0x%8.8x
NAND_DATA_BLOCK_PTR = 0x%8.8x
NAND_TAG_PTR = 0x%8.8x
NAND_ECC_PTR = 0x%8.8x
NAND_DEC_STATUS = 0x%8.8x
NAND_HWSTATUS_CMD = 0x%8.8x
NAND_HWSTATUS_MASK = 0x%8.8x
NAND_LL_CONFIG = 0x%8.8x
NAND_LL_PTR = 0x%8.8x
NAND_LL_STATUS = 0x%8.8x
====== Register Dump End ===========
Calling simple log2 with value which is not power of 2
Failed Ddk Rd. Bad block
Failed Ddk Wr. Bad block
Failed Ddk Erase. Bad block
Failed Ddk Cpybk. Bad block
Failed Ddk unknown Operation. Bad block Error code=0x%x at chip=%d,block=%d
NandRead Error: Number of Pages=%d < interleave count=%d
Ecc.Err pgoffset: %d, status: 0x%x
Ecc.Err in Tag pgoffset: %d, status: 0x%x
Chip: %d, Page = %d
-MAINTAG
DDK_Rd:dev = %d, %s + %s, number_of_pages = %d
Chip: %d, Page = %d, blk = %d
DDK_Cpbk:Srcdev = %d, Dstdev = %d, number_of_pages = %d
SrcChip: %d, Page = %d, blk = %d
DstChip: %d, Page = %d, blk = %d
DDK_Write:device = %d, %s + %s, number_of_pages = %d
DDK_Ers:dev = %d, number of blks = %d
Factory Bad block: Chip%u Block=%u
Runtime Bad block: Chip%u Block=%u,RTB=0x%x
Scan for Region table blocks: Chip=%u, Block=%u Bad
Marking Runtime Bad block: Chip%u Block=%u
Block driver mark bad failed at Chip=%d, Block=%d
Erase Partition Error: failed to erase block chip=%d,blk=%d
Nand block driver: Write Error = 0x%x, PartId=%u, , Write: start=0x%x, sector count=0x%x
Nand block driver: Read Error = 0x%x, PartId=%u, Read: start=0x%x, sector count=0x%x
Possible forced region table load
Region Table copy at CurrBlockNum %u is probably corrupt
Device Bad block table:
{%u, %d},
Device has %d bad blocks
Error Nand block driver Load Region table call failed for part-id=%d, error code=%d
Global Nand Interleave count = %u
Error: NandUtilGetRegionEntry failed for part Id=%d
Partitions in region table: Id=%d
FTL open for partition=%d failed,code=%d
Nand Block dev open failed error 0x%x
Physical Rd/Wr on block error: req=%d,actual=%d
Bad block during Rd/Wr physical found at: Chip=%d, Block=%d
Block dev Physical Ioctl failed. Marking Chip=%d,Blk=%d
Unable to Erase Nand starting block 0x%x
Nand Block driver map logical2physical failed BlockNum=%d, DeviceNum=%d, CurrPhysBlk=%d
Error: Failed to map logical block=%d in entire Nand.
Error: As Region table is bigger than 1 sector size. Need to change Load Region table logic
Unable to Erase Nand chip=%d,block=%d
Partition %d - number of physical blocks = %d
Chip%d Block=%d bad
Error: Unable to find requested blocks on Nand: req=%d,found=%d
Invalid value for PercentReserved = %d [should not exceed]%d, setting PercentReserved = %d
Insufficient space, cannot create partition
PartId %u: LB[%u %u] PB[%u %u] IL%u LS[%u %u]
Abs PartId %u: LB[%u %u] PB[%u %u] IL%u
Last Abs PartId %u: LS[%u %u] PartId %u: LB[%u %u] PB[%u %u] IL%u
Abs ** PartId %u: LS[%u %u]
Data mismatch in Copy of Region Table at BlockNum %d
Erase failed. Get Physical Sectors failed for logical start=%d,stop=%d
Erase Partition part-id=%d: Start=%d,End=%d NvDdkBlockDevIoctlType_DisableCacheNvDdkBlockDevIoctlType_EraseLogicalSectorsNvDdkBlockDevIoctlType_QueryFirstBootNvDdkBlockDevIoctlType_DefineSubRegionNvDdkBlockDevIoctlType_WriteVerifyModeSelectNvDdkBlockDevIoctlType_AllocatePartitionNvDdkBlockDevIoctlType_PartitionOperationNvDdkBlockDevIoctlType_ReadPhysicalSectorNvDdkBlockDevIoctlType_WritePhysicalSectorNvDdkBlockDevIoctlType_QueryPhysicalBlockStatusNvDdkBlockDevIoctlType_ErasePhysicalBlockNvDdkBlockDevIoctlType_LockRegionNvDdkBlockDevIoctlType_MapLogicalToPhysicalSectorNvDdkBlockDevIoctlType_FormatDeviceNvDdkBlockDevIoctlType_GetPartitionPhysicalSectorsNvDdkBlockDevIoctlType_IsGoodBlock
Nand Block dev ioctl opcode=%s error 0x%x
Save Region Table copy %u at CurrBlockNum %u
Ftl Lite bad block mark failed at Chip=%d, Block=%d
New Block at: chip=%d,block=%d
Replace block=%d in chip=%d for read failure
Data area read verification failed in FTL Lite at Chip=%d,Blk=%d,Pg=%d
FTL Lite Read Verify error code=0x%x
Wr Error: 0x%x, Replace ftl lite bad block, PbaIndex=%d,Chip=%d,Block=%d,StartPg=%d,PgCount=%d
Rd verify error: 0x%x, Replace ftl lite bad block, PbaIndex=%d,Chip=%d,Block=%d,StartPg=%d,PgCount=%d
Error in FTL Lite write
RETURNING ERROR FROM NvNandWriteSector TL error=%u,Sector Start=0x%x,Count=0x%x
RETURNING ERROR FROM NvNandReadSector TL error=%u,Sector Start=0x%x,Count=0x%x
RETURNING ERROR FROM NvNandOpen
Error: trying cached read past page limits
512B Read: Page=%d, within page sector in page=%d, sector count=%d
Error: 512B buffer allocate failed earlier
Error: trying cached write past page limits
Error: failed to allocate buffer for 512B sector support
Alloc memory failed
TLvalidate FAIL1 sector offset=0x%x,count=0x%x,sectorsPerRow=%u
TLvalidate FAIL2, Interleave bank Pgs[ %d ]
TLvalidate FAIL3
TLvalidate FAIL4
TLvalidate FAIL5 page[0]=0x%x,Reqd rows=0x%x
TLEraseAll fail BtlGetPba: Chip=%d,Block=%d
GetBlock info failed: Chip=%d, Blk=%d
Marking Bad block failed forChip=%d Block=%d
Found Bad block Chip=%d Block=%d
Factory Bad: 0x%x, Run-time bad marker: 0x%x
Interleave2PhysicalPg fail1: illegal page
Interleave2PhysPg fail2: illegal device
Ddk Read error code=0x%x
In NandTLGetBlockInfo Error = 0x%x
NandTL_INVALID_ARGUMENT3
NandTL_INVALID_ARGUMENT4
NandTL_INVALID_ARGUMENT5
NandTL_INVALID_ARGUMENT6
Error: No free Blk, Region[%d]=%d
Strategy Handle Error failed in Wr Status:%d,
TL write error=%u,sector start=0x%x,count=0x%x
NandTL_INVALID_ARGUMENT1
NandTL_INVALID_ARGUMENT2
TlRead failed Status:%d,
TL read error=%u,sector start=0x%x,count=0x%x
Region=%d SD Erase start 512B-sector=%d,512B-sector-num=%d
LCM of %d and %d =%d
Part-id=%d size from %d sectors by %d sectors
SD Alloc Partid=%d, start sector=%d,num=%d NvDdkBlockDevIoctlType_ErasePartitionNvDdkBlockDevIoctlType_VerifyCriticalPartitionsUnknownIoctl
Inst=%d, SD ioctl %s failed: error code=0x%x SPIF ERROR: SpifOpen failed..
SPIF ERROR: Trying to read more than SPI flash device size..
SPIF ERROR: Trying to program more than SPI flash device size..
SPIF ERROR: Trying to erase more than chipsize NumberOfSectors[0x%x] TotalBlocks[0x%x]
SPIF ERROR: Trying to erase more than chipsize NumberOfBlocks[0x%x] TotalBlocks[0x%x]
SPIF ERROR: Illegal block driver Ioctl..
SPIF ERROR: SpifBlockDevIoctl failed error[0x%x]..
Inst=%d, SPI Flash ioctl %s failed: error code=0x%x Trying to close driver without open
SPIF ERROR: NvDdkSpifBlockDevInit failed error[0x%x]..
Error SD clear skip blocks - sector=%d
Skipping SD erase of prefix %d blocks from %d
Skipping SD erase of suffix %d blocks from %d
Hsmmc Erase start sector=%d,num=%d
Hsmmc Alloc Partid=%d, start sector=%d,num=%d
NvNandHandle: FtlStartLba=%d, FtlEndLba=%d FtlStartPba=%d, FtlEndPba=%d pBlocks[%d ] prevBlocks[]
TrackLba[%d]: lba=%d, %s
Misc start
NumOfBanksOnBoard = %d
NoOfILBanks = %d
PhysBlksPerBank = %d
ZonesPerBank = %d
PhysBlksPerZone = %d
PhysBlksPerLogicalBlock = %d
TotalLogicalBlocks = %d
TotEraseBlks = %d
NumOfBlksForTT = %d
PgsRegForTT = %d
TtPagesRequiredPerZone = %d
NumOfBlksForTAT = %d
BlksRequiredForTT = %d
PgsAlloctdForTT = %d
ExtraPagesForTTMgmt = %d
LastTTPageUsed = %d
CurrentTatLBInUse = %d
bsc4PgsPerBlk = %d
Misc end
TAT Handler start
tatBlocks[%d] bank = %d, block = %d
ttBlocks[%d] bank = %d, block = %d
tat Block bank = %d, block = %d
TtAllocBlk[%d] bank = %d, block = %d
lastUsedTTBlock bank = %d, block = %d
TAT Handler end
++++++++++++++++++
TT 32-bit entry format in dump :
=============
Region: b31-b30
BlockNotUsed: b29
BlockGood: b28
DataReserved: b27
SystemReserved: b26
TatReserved: b25
TtReserved: b24
PhysBlkNum: b23-b0
============
Dumping page %d
**SuperBlock %d
*0x%08X [%d] [SYS-RSVD]
*0x%08X [%d] [ ^^^ FREE BLK ] Region%d
*0x%08X [%d] [ USED BLK ] Region%d
*0x%08X [%d] [*** BAD BLK ***]
Total=%u,Free=%u,Bad=%u,Reserve Data=%u,System=%u,Tat=%u,Tt=%u,Illegal=%u,Region0=%u,Region1=%u,Region2=%u,Region3=%u
No free blocks Available- find out the reason, bank = %d
[Strategy] Erase Failed
Bad Block found at LBA %d
Marked blk bad bank = %d, block = %d Rev = %d lba = %d
TAT write failed page = %d, bank = %d, block = %d Rev = %d lba = %d WriteOnlyHeader = %d
NO FREE TAT BLOCKS AVAILABLE
writing to TAT blocks failedInvalid percent reserved value = %d, should not exceed%d, setting it to %d
[Nand_Strategy] Failed to mark PBAs BAD
**** Fail: Invalid Case ****
Not Expected to come here
NvError_NandNoFreeBlock1
Error: NandStrategyGetSectorPageToWrite InTracking case, No Page
Error: NandStrategyGetSectorPageToWrite GetPBA case, No Page
NvError_NandNoFreeBlock2
GetNewPBA failed Sts: 0x%x in GetSectorPage2Write #2
Error: NandStrategyGetSectorPageToWrite PBA assigned already case, No Page Crypto Engine Disabled, Returning IOCTL
AES DDK Unsupported IOCTL COMMAND
AES Engine[%d] Disabled - EngineStatus[%d]
MemMap failed.
.NVRM Initialized shmoo database
NVRM Got shmoo boot argument (at 0x%x)
ActiveIdleAutoHwRM power state before suspend: %s (%d)
Active Module: 0x%x*** Wakeup from LP0 ***
*** Wakeup from LP1 ***
*** Wakeup after Skipped LP0 ***
DTT: TMON initialization failed
DTT: T = %d, Range = %d (%d : %d)
DVFS set core at %dmV
Clock control balance failed for module %d, instance %d
ADJUSTED CLOCKS:
MC clock is set to %6d KHz
EMC clock is set to %6d KHz (DDR clock is at %6d KHz)
PLLX0 clock is set to %6d KHz
PLLC0 clock is set to %6d KHz
CPU clock is set to %6d KHz
System and AVP clock is set to %6d KHz
GraphicsHost clock is set to %6d KHz
3D clock is set to %6d KHz
2D clock is set to %6d KHz
Epp clock is set to %6d KHz
Mpe clock is set to %6d KHz
Vde clock is set to %6d KHz
NVRM CLOCKS: PLLX0: %d Khz
NVRM CLOCKS: PLLM0: %d Khz
NVRM CLOCKS: PLLC0: %d Khz
NVRM CLOCKS: PLLP0: %d Khz
NVRM CLOCKS: PLLA0: %d Khz
NVRM CLOCKS: CPU: %d Khz
NVRM CLOCKS: AVP: %d Khz
NVRM CLOCKS: System Bus: %d Khz
NVRM CLOCKS: Memory Controller: %d
NVRM CLOCKS: External Memory Controller: %d
GPUHandheldBrChipsCrushMCPCkVaioHandheld SOCSimulation Chip: 0x%x
FPGAQuickTurnEmulation (%s) Chip: 0x%x Netlist: 0x%x Patch: 0x%x
Chip Id: 0x%x (%s) Major: 0x%x Minor: 0x%x SKU: 0x%x
NV_CFG_RMC_FILENV_CFG_CHIPLIBNV_CFG_CHIPLIB_ARGSSECURITY_VIOLATION DecErrAddress=0x%x SECURITY_VIOLATION DecErrStatus=0x%x EMEM DecErrAddress=0x%x EMEM DecErrStatus=0x%x GART DecErrAddress=0x%x GART DecErrStatus=0x%x DTT: Invalid Range = %d
Err in I2c transfer: Controller Status 0x%08x
AP20 I2c Isr got unwanted interrupt IntStatus 0x%08x
QueryIface_CQueryIfacebogusOBS bus modID 0x%x index 0x%x = value 0x%xLLC Client %d Count: 0x%.8X, %u
LLC Client %d Clocks: 0x%.8X, %u
Client %.3d Count: 0x%.8X, %u
Total MC Clocks: 0x%.8X, %u
AXI DecErrAddress=0x%x AXI DecErrStatus=0x%x Output FIFO does not refill, context read is stuck.Error> DSI Panel Initialization Failed
Error> DSI Panel Suspend Failed
Max8907bRtcCountWrite() error. Max8907bRtcCountRead() error. ERROR: GPIO_PCF50626_I2cWrite8() failed.

Sorry for spamming this thread, just wanted to show off some cool pics and vids
http://img404.imageshack.us/img404/4427/20120224235839.jpg
http://www.youtube.com/watch?v=moflp1BDCpA

sp3dev said:
Sorry for spamming this thread, just wanted to show off some cool pics and vids
http://img404.imageshack.us/img404/4427/20120224235839.jpg
http://www.youtube.com/watch?v=moflp1BDCpA
Click to expand...
Click to collapse
I would not call that spam. Thats AMAZING. cant wait to see more!
edit:
so did you completely replace acers bootloader on the tab with uboot?

gh123man said:
I would not call that spam. Thats AMAZING. cant wait to see more!
edit:
so did you completely replace the bootloader on the tab with uboot?
Click to expand...
Click to collapse
Yes, but..
1. Right now it does not support the tegra's partition layout - no luck with reading emmc partitions. Probably need to port tegrapart to uboot or figure out how to use EFI partition table (possibly needs hacking GPT offset)
2. Uboot doesn't support Android's boot images. The support can be added, but it may be easier to just repack kernel and initrd to uImage.
3. There's no USB client driver, so one will need to use microsd or usb stick to flash kernel/recovery for the first time.
So. I didn't have much time to play with it, but I'll look into it further

sp3dev said:
Yes, but..
1. Right now it does not support the tegra's partition layout - no luck with reading emmc partitions. Probably need to port tegrapart to uboot or figure out how to use EFI partition table (possibly needs hacking GPT offset)
2. Uboot doesn't support Android's boot images. The support can be added, but it may be easier to just repack kernel and initrd to uImage.
3. There's no USB client driver, so one will need to use microsd or usb stick to flash kernel/recovery for the first time.
So. I didn't have much time to play with it, but I'll look into it further
Click to expand...
Click to collapse
thanks... extremely interesting... keep us updated with progress, im sure im not the only one interested in this.

sp3dev said:
I have uploaded the archive with nvflash and some instructions on using it with A500. This is only intended for hardcore geeks who know how ARM boots. Be careful - while you can't really brick tegra2 (since it has a minimal usb-capable bootloader in the OTP area), you can screw up things and it will be quite hard to force the tablet to boot in some cases due to stupid security checks.
Click to expand...
Click to collapse
Just curious, you are using 0x300d8011 as odmdata, when EUU's are using 0xb00d8011.
My understanding is that LPSTATE=LP0 with yours (instead of LP1).
Any reason/consequences ?

wlk0 said:
Just curious, you are using 0x300d8011 as odmdata, when EUU's are using 0xb00d8011.
My understanding is that LPSTATE=LP0 with yours (instead of LP1).
Any reason/consequences ?
Click to expand...
Click to collapse
Actually you should use the value from the BCT (it's around the end of it). As far as I understand, there are several SoC revisions, and one of them is iirc A03p, which supports LP0, and the other one is A03, which does not. I think I had a file somewhere describing ODM value

In tegra devkit here
145 /// Soc low power state
146 #define TEGRA_DEVKIT_BCT_CUSTOPT_0_LPSTATE_RANGE 31:31
147 #define TEGRA_DEVKIT_BCT_CUSTOPT_0_LPSTATE_LP0 0x0UL
148 #define TEGRA_DEVKIT_BCT_CUSTOPT_0_LPSTATE_LP1 0x1UL

Other than mmcblk0 p1-8 what other hidden partitions are there? I can write the detection for mmc as I have it for recovery just haven't set the debugging to find the dtypes for iconia as I've been lazy and defined them. Can you list any partitions after p8 or hidden ones related to nvflash etc I have the usual boot, data, cache, misc, recovery, system etc please id any new ones as well.

sp3dev said:
I have uploaded the archive with nvflash and some instructions on using it with A500 ...
Click to expand...
Click to collapse
Oh, so the bootloader is actually unsigned - or I missed something? So what prevents me to patch the ICS BL and force unlock mode? I see I am a bit desoriented on Acer scene.
Back to the stock ICS BL, the unlock info is stored to BCT.

Skrilax_CZ said:
Oh, so the bootloader is actually unsigned - or I missed something? So what prevents me to patch the ICS BL and force unlock mode (so ppl can use fastboot)? I see I am a bit desoriented on Acer scene.
Back to the stock ICS BL, the unlock info is stored to BCT.
Click to expand...
Click to collapse
correct me if im wrong. now since we can generate the sbk we have full access to nvflash which gives us direct access to flash anything we want. including a new bootloader (weather its signed or not). its like a layer above the bootloader. sp3dev could explain it better...

Related

Some console commands for P3300.

Below are some commands for Artemis.
For the moment still did not find a command to backup existing ROM.
There are some interesting ones related to debug and use of TFTP.
Commands are case sensitive.
Looks like battery is charging while in bootloader mode. It was not a case with Prophet.
regards,
fdp24
*******************************************
Cmd>fm
Wrong parameters of FM Command!!
Usage:
fm [command] [frequency]
where:
if[command] = i Initialize FM.
if[command] = o Power on FM.
if[command] = f Power off FM.
if[command] = t Tune FM channel to [frequency].
if[command] = a FM auto seek test.
if[command] = m Mono(1) or Stereo(0).
if[command] = v Volume (0x00 - 0x0F).
if[command] = u Mute(0)
if[command] = g AGC(1)
if[command] = h Set seek threshold (0x00 - 0xFF).
if[command] = s Seek Up(1) or Down(0).
if[command] = r Get RSSI (0x00 - 0xFF).
if[command] = c Get current channel [frequency].
if[command] = d Get RDS data (1 - 10 groups of data).
*******************************************
Cmd>cpldver
xsvfExecute - CpldType=1
SUCCESS - Completed XSVF execution.
CPLD Ver[0]=1
CPLD Ver[1]=FC
CPLD Ver[2]=26
CPLD Ver[3]=5
Unknown yet.
*******************************************
Cmd>SetDsbDBGMSGT
Unknown yet.
*******************************************
Cmd>ReadExtROM
Dump Ext ROM to MTTY terminal
*******************************************
Cmd>WLANReset
Usage:
WLANReset 1(or0)
set SDIO: 0-WLAN ;1-SDMC.
Cmd>WLANReset 0
WLANReset(FALSE)
Cmd>WLANReset 1
WLANReset(TRUE)
*******************************************
Cmd>SDSelect
Usage:
SDSelect 1(or0)
set SDIO: 0-WLAN ;1-SDMC.
Cmd>SDSelect 1
Select SD Card
*******************************************
Cmd>emapiWlanMac
Notice: This MAC address takes effect only when your platform is EEPRON-less configuration. Please use (emapiTest) to verify it !
Copying GSM DATA image to SDRAM:00004000
Wlan data header ++++++++++++++++++++
Signature : 0xEE1250
UpdateStatus : 0x2
UpdateCount : 0xA
BodyLength : 0x1A1
BodyCRC : 0x4349311B
Wlan data header --------------------------
0x00000000
0x00000009
0x0000002D
0x000000D2
0x000000D5
0x000000FB
*******************************************
Cmd>emapiTest
+emapiTest
1. Power on WLAN
2. Reset WLAN
3. Switch MUX to WLAN
4. Enable WLAN clock
5. Init WLAN SDIO interface
6. DeviceID Test
DeviceID = 403xxxx
EEPROMless configuration!
-emapiTest
*******************************************
Cmd>emapiPwrDwn
*******************************************
Cmd>emapiRead
Parameter Wrong!!
*******************************************
Cmd>getdevinfo
Need password!
*******************************************
Cmd>wdata
Usage:
wdata [StartAddr Len]
Write data to memory(if write to ROM, need erase first).
StartAddr : Start address of memory.
Len : How many bytes will be written.
Length must not more than 0x10000 bytes(buffer limitation).
Write to RAM: 4 bytes(CRC checksum limitation).
1 byte(in user mode).
Write to ROM: 4 bytes(CRC checksum limitation).
2(16-bit)/4(32-bit) bytes(in user mode).
Write to ROM(16-bit data bus): 32 bytes(writebuffer mode).
Write to ROM(32-bit data bus): 64 bytes(writebuffer mode).
Length must be 4 bytes boundary(CRC checksum) if not in user mode.
After command execute, then send out the data to terminal.
Data format: HTCS(4 bytes)+DATA+checksum(4 bytes, if not in user mode)+HTCE(4 bytes).
*******************************************
Cmd>password
Usage:
password [String]
Enter the password string to enable wdata, erase and rbmc functions.
*******************************************
Cmd>set
Usage:
set [Type Value]
Set control flags.
Type(hex) : Control function types.
Value(hex) : Setting values for types.
Type 1(Operation mode): 1(auto) and 0(user).
Type 2(Back color on/off): 1(on) and 0(off).
Type 4(Front color value): 16 bits data
Type 5(Background color value): 16 bits data
Type 6(Set color of screen): Fill color to whole screen one time.
Current flag settings:
Type 1(Operation mode flag): g_cOpModeFlag=(0x0).
Type 2(Back color flag): cBackColorShowFlag=(0x0).
Type 4(Front color): g_dwFColor24bit=(0x0).
Type 5(Background color): g_dwBColor24bit=(0xFFFFFF).
Type 6(Set color of screen): None.
Type 32: Unlock Flash Command
Set control flags.
*******************************************
Cmd>SetDebugMethod
Copying GSM DATA image to SDRAM:00004000
Default DebugTransport Value =00000000
Current Usage:
0 No Debug
A UART MTTY Output Debug Message
B USB MTTY Output Debug Message
*******************************************
Cmd>checksum
Usage:
checksum addr len
Return CRC checksum of memory.
In user mode: Show 4 bytes of CRC checksum value on display of terminal.
In auto mode: Send 4 bytes of CRC checksum value to terminal with data format.
*******************************************
Cmd>ResetDevice
no comments
*******************************************
**When CID is locked.
Cmd>ls
clean up the image temp buffer at 0x8C100000 Length 0x03A00000
BOOTLOAD_PAGE_TABLE_BASE_C_VIRTUAL= 0x8C080000
Clear image temp buffer done .
MTTYDownloadImage
Not allow operation!
Error : DownloadImage return error (code = 0xFFFFFFFF)
**When CID is locked.
*******************************************
**When CID unlocked
Cmd>ls
clean up the image temp buffer at 0x8C100000 Length 0x03A00000
BOOTLOAD_PAGE_TABLE_BASE_C_VIRTUAL= 0x8C080000
Clear image temp buffer done .
MTTYDownloadImage
start download
==CreateFile err==
**When CID unlocked
*******************************************
Cmd>GPSRouting
Dump code to mtty console.
*******************************************
Cmd>BTRouting
Dump code to mtty console.
*******************************************
Cmd>BTRouting
+GSM_Modem_Init : include DAGON
Copying GSM DATA image to SDRAM:00004000
GSM - dwSize = 3479D
GSM Page0
GSM - dwSize = 45457
GSM Page1
GSM - dwSize = 4B768
GSM Page2
GSM - dwSize = 4E0A9
GSM Page3
GSM - dwSize = 4B4C4
GSM Page4
GSM - dwSize = 4C71F
GSM Page5
GSM - dwSize = 2958E
GSM Page6
GSM - dwSize = E8D8
GSM Page7
Copying GSM CODE image to SDRAM:00000000
ARMBOOT = 1 --> boot from CS3
Reset ARM 7 -- ok
Please close MTTY USB connection and open BT Testing program...
*******************************************
Wow.. Very VERY nice!
Wow fdp24
Please how did you found out all those comands ?
I'm curious and in the need of unbricking some.
can we use any of therse comands to make the SimLockTool_Artemis_Excalibur tool work

Please Help, I don't known anymore.........???

Hello,
I'm New here....
This is my first T-mobile sda1(Germany) without camera to upgrade/downgrade
I want downgrade back WM2003, and now this mistake!!!
What should I do?
l c:/os.bin
clean up the image temp buffer at 0x8C080000 Length 0x01B00000
MTTYDownloadImageNot allow operation!
Error : DownloadImage return error (code = 0xFFFFFFFF)
Cmd>info 2
GetDeviceInfo=0x00000002
Load Binary NORMAL partition: data from DiskOnChip to RAM
Start to read bianry partition.
Read binary partition successfully.
+ SD Controller init
- SD Controller init
+StorageInit
CMD55 failed
+ SD Controller init
- SD Controller init
+StorageInit
CMD55 failed
Load Binary NORMAL partition: data from DiskOnChip to RAM
Start to read bianry partition.
Read binary partition successfully.
HTCST-MOB001 1Å›™HTCE
Cmd>

WP8 FM Internal Settings

Missing FM? This is the thread to watch then! I'm digging to find out everything there is to know about it here. This is everything I've found in the last 30 minutes.
Code:
FM Driver
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\qcfmtransport]
"DisplayName"="@qcfmtransport8960.inf,%Bus.SVCDESC%;QUALCOMM FM Transport Driver"
"ErrorControl"=dword:00000001
"Group"="Extended Base"
;Value:\SystemRoot\System32\drivers\qcfmtransport8960.sys
"ImagePath"=hex(2):5C,00,53,00,79,00,73,00,74,00,65,00,6D,00,52,00,6F,00,6F,00,74,00,5C,00,53,00,79,00,73,00,74,00,65,00,6D,00,33,00,32,00,\
5C,00,64,00,72,00,69,00,76,00,65,00,72,00,73,00,5C,00,71,00,63,00,66,00,6D,00,74,00,72,00,61,00,6E,00,73,00,70,00,6F,00,\
72,00,74,00,38,00,39,00,36,00,30,00,2E,00,73,00,79,00,73,00,00,00
"Start"=dword:00000001
"Tag"=dword:0000000E
"Type"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\DriverDatabase\DeviceIds\QWCN\QCOM2150]
"qcfmtransport8960.inf"=hex:01,FF,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\DriverDatabase\DeviceIds\{4d36e97d-e325-11ce-bfc1-08002be10318}]
"qcfmtransport8960.inf"=hex(0):
[HKEY_LOCAL_MACHINE\SYSTEM\DriverDatabase\DriverInfFiles\qcfmtransport8960.inf]
"Active"="qcfmtransport8960.inf_arm_96763fb718a23855"
[HKEY_LOCAL_MACHINE\SYSTEM\DriverDatabase\DriverPackages\qcfmtransport8960.inf_arm_96763fb718a23855]
@="qcfmtransport8960.inf"
"Provider"="Microsoft"
"SignerName"=""
"SignerScore"=dword:0D000003
"Version"=hex:FF,FF,05,00,00,00,00,00,7D,E9,36,4D,25,E3,CE,11,BF,C1,08,00,2B,E1,03,18,00,C0,06,F4,11,63,CE,01,00,00,E5,0B,00,00,01,00,\
00,00,00,00,00,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\DriverDatabase\DriverPackages\qcfmtransport8960.inf_arm_96763fb718a23855\Configurations\Bus_Vendor.NT]
"ConfigFlags"=dword:00000000
"Service"="qcfmtransport"
[HKEY_LOCAL_MACHINE\SYSTEM\DriverDatabase\DriverPackages\qcfmtransport8960.inf_arm_96763fb718a23855\Configurations\Bus_Vendor.NT\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}]
[HKEY_LOCAL_MACHINE\SYSTEM\DriverDatabase\DriverPackages\qcfmtransport8960.inf_arm_96763fb718a23855\Configurations\Bus_Vendor.NT\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0019]
@=hex(ffff0013):01,00,04,90,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,02,00,C4,00,05,00,00,00,00,00,14,00,00,00,00,10,01,01,00,00,\
00,00,00,05,12,00,00,00,00,00,38,00,00,00,00,10,01,0A,00,00,00,00,00,0F,03,00,00,00,00,04,00,00,52,77,E4,E9,43,3B,DB,AC,\
8C,30,3E,83,EE,0C,AD,9D,F4,16,21,E5,0A,BD,A8,7F,B6,5E,2B,49,D5,C8,3A,4A,00,00,24,00,00,00,00,10,01,05,00,00,00,00,00,05,\
15,00,00,00,D1,A7,1A,A1,53,9E,65,2F,4B,7F,77,1A,06,04,00,00,00,00,24,00,00,00,00,10,01,05,00,00,00,00,00,05,15,00,00,00,\
D1,A7,1A,A1,53,9E,65,2F,4B,7F,77,1A,80,04,00,00,00,00,28,00,00,00,00,10,01,06,00,00,00,00,00,05,50,00,00,00,E2,CF,C3,5F,\
9F,4F,F9,38,0C,29,6B,A6,99,2B,3B,07,77,65,BF,0E
[HKEY_LOCAL_MACHINE\SYSTEM\DriverDatabase\DriverPackages\qcfmtransport8960.inf_arm_96763fb718a23855\Configurations\Bus_Vendor.NT\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\001D]
@=hex(ffff0007):00,01,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\DriverDatabase\DriverPackages\qcfmtransport8960.inf_arm_96763fb718a23855\Descriptors\QWCN\QCOM2150]
"Configuration"="Bus_Vendor.NT"
"Description"="%bus.devicedesc%"
"Manufacturer"="%stdmfg%"
[HKEY_LOCAL_MACHINE\SYSTEM\DriverDatabase\DriverPackages\qcfmtransport8960.inf_arm_96763fb718a23855\Strings]
"bus.devicedesc"="QUALCOMM FM Transport Driver "
"stdmfg"="(Standard system devices)"
Code:
FM Settings - Microsoft.Audio.AudioTuner.reg
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Tuner\Audio\FmRadio\Regions\1]
"FrequencyMin"=dword:0001575C
"FrequencyMax"=dword:0001A57C
"FrequencySpacing"=dword:000000C8
"Emphasis"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Tuner\Audio\FmRadio\Regions\2]
"FrequencyMin"=dword:000155CC
"FrequencyMax"=dword:0001A5E0
"FrequencySpacing"=dword:00000064
"Emphasis"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Tuner\Audio\FmRadio\Regions\3]
"FrequencyMin"=dword:000128E0
"FrequencyMax"=dword:00015F90
"FrequencySpacing"=dword:00000064
"Emphasis"=dword:00000000
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{CA48BE7D-CE1C-4CA9-A00D-DB5359E3A9A1}]
@="Microsoft-WindowsPhone-AudioTuner"
"ResourceFileName"="C:\\windows\\System32\\AudioTunerApi.dll"
"MessageFileName"="C:\\windows\\System32\\AudioTunerApi.dll"
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{B8B32416-C9C2-4817-8167-DA970B54320B}]
@="FmReceiver"
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{B8B32416-C9C2-4817-8167-DA970B54320B}\InProcServer32]
;Value:%SystemRoot%\System32\AudioTunerApi.dll
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6D,00,52,00,6F,00,6F,00,74,00,25,00,5C,00,53,00,79,00,73,00,74,00,65,00,6D,00,33,00,\
32,00,5C,00,41,00,75,00,64,00,69,00,6F,00,54,00,75,00,6E,00,65,00,72,00,41,00,70,00,69,00,2E,00,64,00,6C,00,6C,00,00,00
"ThreadingModel"="Free"
[HKEY_LOCAL_MACHINE\Software\Classes\Interface\{5E708E9F-8500-41ca-85BC-53ED2691D5C7}]
@="IAudioTuner"
[HKEY_LOCAL_MACHINE\Software\Classes\Interface\{42C0C635-EC96-40ac-953E-4FF722ED0FFF}]
@="IFmReceive"
[HKEY_LOCAL_MACHINE\Software\Classes\Interface\{12E36A78-1DDC-415a-84D9-2A92D5C42D07}]
@="IRdsCapture"
Code:
FM Driver Settings - Qualcomm.QC8960.qcfmminiport.reg
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Tuner\Audio\FmRadio]
"MiniportDll"="qcfmminiport.dll"
"newSearchAlgorithm"=dword:00000000
"NoOfSiNRSamples"=dword:0000000A
"IntDetTHLow"=dword:0000006D
"IntDetTHHigh"=dword:00000073
"SiNRTH"=dword:00000003
"CFOTH12"=dword:00003A98
"RMSSIFirstStage"=dword:FFFFFF90
"SiNRFirstStage"=dword:00000000
"SiNRFinalStage"=dword:00000003
Code:
FM FINAL SETTING - Microsoft.Media.Apps.reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\FMRadio\OEM]
"NotPresent"=dword:00000001
Code:
qcfmminiport.dll searchable strings
FDllMain FM: QFM: +%s
FM: QFM: -%s
CreateAdapterDriver AdapterDriver::CreateInstance AdapterDriver::~AdapterDriver
AdapterDriver::AddRef AdapterDriver::Release AdapterDriver::QueryInterface
AdapterDriver::CreateMiniportTunerDevice
+cleanup
-cleanup
MiniportFmRxDevice::read_thread FM: Miniport: read_thread: SSR is happening
FM: Miniport: read_thread: NULL event pointer received
FM: Miniport: read_thread: FM_RX_EV_ENABLE_RECEIVER success, time stamp %lu
FM: Miniport: read_thread: FM_RX_EV_ENABLE_RECEIVER failed
FM: Miniport: read_thread: calling Enable AsycComplete context(0x%08p)
FM: Miniport: read_thread: FM_RX_EV_DISABLE_RECEIVER success
FM: Miniport: read_thread: FM_RX_EV_DISABLE_RECEIVER failed
FM: Miniport: read_thread: calling Disable AsycComplete context(0x%08p)
FM: Miniport: read_thread: FM_RX_CANCEL_SEARCH_CMD
FM: Miniport: read_thread: cmd complete received for command %u
FM: Miniport: read_thread: FM_RX_TUNE_STATUS_EVT
FM: Miniport: read_thread: calling Tune/Region Asyc context = 0x%08p !
FM: Miniport: read_thread: calling Tune complete - Tune/Seek Asyc context = 0x%08p
FM: Miniport: read_thread: ### tune at cancelled frequency
FM: Miniport: read_thread: calling Seek cancelled - Tune/Seek Asyc context = 0x%08p
FM: Miniport: read_thread: calling Seek complete - Tune/Seek Asyc context = 0x%08p, time stamp %lu
FM: Miniport: read_thread: user defined band tune/seek complete, time stamp %lu
FM: Miniport: read_thread: cmd status event for Tune received
FM: Miniport: read_thread: calling Seek failure Async context = 0x%08p
FM: Miniport: read_thread: cmd status event for Search received, status %u
FM: Miniport: read_thread: calling Cancel Seek Failure - Tune/Seek Asyc context = 0x%08p
FM: Miniport: read_thread: calling Seek Failure - Tune/Seek Asyc context = 0x%08p
FM: Miniport: read_thread: command status received for unknown command %u
FM: Miniport: read_thread: ProcessRdsGroup failed
FM: Miniport: read_thread: FM_RX_SEARCH_IN_PROGRESS_EVT!
FM: Miniport: read_thread: FM_RX_SEARCH_COMPLETE_EVT!
FM: Miniport: read_thread: FM_RX_STEREO_STATUS_EVT!
FM: Miniport: read_thread: unknown event with opcode %x!
MiniportFmRxDevice::CreateInstance FM: Miniport: - CreateInstance Invalid pPortTunerDevice
FM: Miniport: - CreateInstance Invalid ppMiniportTunerDevice
FM: Miniport: - CreateInstance Invalid pDevice
FM: Miniport: CreateInstance - Initialize failed, hr = %x
FM: Miniport: CreateInstance - QueryInterface failed
MiniportFmRxDevice::MiniportFmRxDevice MiniportFmRxDevice::~MiniportFmRxDevice MiniportFmRxDevice::AddRef MiniportFmRxDevice::Release MiniportFmRxDevice::QueryInterface FM: Miniport: - QueryInterface Invalid ppvObject
FM: Miniport: - QueryInterface Invalid Interface
MiniportFmRxDevice::Initialize FM: Miniport: - Initialize Invalid pMddTunerDevice
FM: Miniport: ::Initialize - QueryInterface failed
FM: Miniport: : Initialize - QFM init successful
FM: Miniport: : Initialize - QFM init failed with error %d
FM: Miniport: : Initialize: Creating thread failed
FM: Miniport: : Initialize: Thread creation successful
FM: Miniport: : Initialize: Creating power event failed
FM: Miniport: : Initialize: Creating tune event failed
FM: Miniport: : Initialize: Creating cancel seek event failed
MiniportFmRxDevice::GetPowerState FM: Miniport: - GetPowerState Invalid pPowerState
MiniportFmRxDevice::SetPowerState FM: Miniport: SetPowerState: context is NULL
FM: Miniport: Already in requested power state
FM: Miniport: SetPowerState: WaitForSingleObject timeout failure
FM: Miniport: SetPowerState: Tune WaitForSingleObject timeout failure
FM: Miniport: powering on..., time stamp is %lu
FM: Miniport: SetPowerState: Failed to enable QFM! (%d)
FM: Miniport: SetPowerState: QFM enabled...Async Context = 0x%08p
FM: Miniport: SetPowerState: Failed to disable QFM! (%d)
FM: Miniport: SetPowerState: QFM disabled... Async Context = 0x%08p
MiniportFmRxDevice::GetVolume FM: Miniport: - GetVolume plVolume
FM: Miniport: GetProperty: FM is not turned on
MiniportFmRxDevice::SetVolume MiniportFmRxDevice::SetRegionParams FM: Miniport: SetRegionParams: FM is not turned on
FM: Miniport: SetRegionParams: context is NULL
FM: Miniport: SetRegionParams - SetRegionParams Invalid pRegionParams
FM: Miniport: SetRegionParams - SetRegionParams No Change in Parameters
MiniportFmRxDevice - SetRegionParams Busy
FM: Miniport: - SetPowerState Busy
FM: Miniport: SetRegionParams: Tune WaitForSingleObject timeout failure
FM: Miniport: config: Failed to config QFM! (%d)
FM: Miniport: config: Beginning Tune/config! Async Context = 0x%08p
MiniportFmRxDevice::Tune FM: Miniport: Tune: m_fTune is %d, m_fSeek is %d
FM: Miniport: Tune: FM is not turned on
FM: Miniport: Tune: context is NULL
Tune - Frequency out of band. Freq = 0x%08x
FM: Miniport: Tune - There is a pending region change. Busy
FM: Miniport: Tune: calling Tune Asyc context = 0x%08p
FM: Miniport: Tune: Failed to tune QFM! (%d)
FM: Miniport: Tune: Beginning Async Tune/Seek! Async Context = 0x%08p
FM: Miniport: Tune: FM Radio off!
MiniportFmRxDevice::GetTunedFrequency FM: Miniport: - GetTunedFrequency pFrequency
FM: Miniport: GetTunedFrequency: FM is not turned on
FM: Miniport: GetTunedFrequency: Failed to get station params! error %d
MiniportFmRxDevice::Seek Seek: m_fTune is %d, m_fSeek is %d FM: Miniport: Seek: FM is not turned on
Seek: context is NULL
Seek - There is a pending region change. Busy
Seek - SetPowerState Busy
Seek: m_TuneHandle is NULL Seek: Tune WaitForSingleObject timeout failure
Seek: Failed to seek QFM! (%d) Seek: Beginning Async Tune/Seek! Async Context = 0x%08p, SeekDir(%d) Seek: FM turned off.!
MiniportFmRxDevice::CancelSeek FM: Miniport: CancelSeek: m_fTune is %d, m_fSeek is %d FM: Miniport: CancelSeek: FM is not turned on
CancelSeek: No seek active!
CancelSeek: Failed to cancel seek QFM! (%d) CancelSeek failed.
MiniportFmRxDevice::RdsStartCapture FM: Miniport: RdsStartCapture: FM is not turned on
RdsStartCapture: Failed to start RDS capture! error (%d)
MiniportFmRxDevice::RdsStopCapture FM: Miniport: RdsStopCapture: FM is not turned on
RdsStopCapture: Failed to stop RDS capture! error (%d)
MiniportFmRxDevice::GetProperty FM: Miniport: GetProperty Invalid pvPropData/pcbReturn
MiniportFmRxDevice - GetProperty Invalid pRssiProp size
MiniportFmRxDevice - GetProperty Invalid pStereoModeProp size
MiniportFmRxDevice - GetProperty Invalid pAntennaTypeProp size
MiniportFmRxDevice - GetProperty Not Supported
MiniportFmRxDevice::SetProperty FM: Miniport: SetProperty: FM is not turned on
MiniportFmRxDevice - SetProperty Invalid pvPropData
FM: miniport: Sending seek command down, time stamp %lu
MiniportFmRxDevice - SetProperty Not Supported
Reset Read FM: QFM : Read : Invalid parameter
FM: QFM: Read : GetOverlappedResult failed with error %d
FM: QFM: Read: In default case
FM: QFM: Read: status is %d
FM: QFM: Read: FM_RX_GET_PINCONNECTIVITY_RESULTS_CMD bt_test_id %u, bt_test_result %u, fm_test_id %u, fm_test_result %u
FM: QFM: get station params is success
FM: QFM: get station params failed, error %u
FM: QFM: do calibration is success
FM: QFM: do calibration failed, error %u
old new FM: QFM: Default data read success, search algorithm is %s
FM: QFM: Default data read failed with error %u
FM: QFM: Default data write success
FM: QFM: Default data write failed with error %u
FM: QFM: command status received for unknown command
FM: QFM: Tune status event received
FM: QFM: FM_RX_PROGRAM_SERVICE_EVT: PS is %s, no. of strings %d
Write FM: QFM: Write: SSR is happening
FM: QFM : Write : Invalid parameter
FM: QFM: Write : GetOverlappedResult failed with error %d
FM: QFM: Write: In default case
FM: QFM: Write: successful
FM: QFM: Write: Wait failed with returned %lu, error %lu
Init FM: QFM: Init: WAN Event creation failed with error %lu
FM: QFM: Init: Thread creation failed with error %lu
FM: QFM: Init: SSR Thread creation failed with error %lu
FM: QFM: Init: Event creation failed with error %lu
FM: QFM: Init: Creating write evt failed with error %lu
FM: QFM: Init: Creating read evt failed with error %lu
FM: QFM: Init: Creating SSR notification evt failed with error %lu
\\.\qcfmtransportdriver FM: QFM: Init: Opening FM transport driver handle failed
FM: QFM: Init: Opening transport driver handle successful
DeInit FM: QFM: cancelling the SSR request success
FM: QFM: error cancelling the SSR request, error %lu
ReadRegistryKeys SYSTEM\ControlSet001\Control\Tuner\Audio\FmRadio FM: QFM: Opening FM reg key %s has failed with error %x
newSearchAlgorithm FM: QFM: Error reading search algorithm type key: %x
FM: QFM: search algorithm: %x
NoOfSiNRSamples FM: QFM: Error reading No of SiNR samples key: %x
IntDetTHLow FM: QFM: Error reading IntDetTHLow key: %x
IntDetTHHigh FM: QFM: Error reading IntDetTHHigh key: %x
SiNRTH FM: QFM: Error reading SiNR key: %x
CFOTH12 FM: QFM: Error reading CFOTH12 key: %x
FM: QFM: CFOTH12 read from registry is %x, %d
FM: QFM: CFOTH12 is %x %x %x %x
RMSSIFirstStage FM: QFM: Error reading RMSSIFirstStage key: %x
FM: QFM: RMSSIFirstStage %x %d
SiNRFirstStage FM: QFM: Error reading SiNRFirstStage key: %x
FM: QFM: SiNRFirstStage read from registry is %x, %d
SiNRFinalStage FM: QFM: Error reading SiNRFinalStage key: %x
bIsFmCalibrationDone FM: QFM: Error reading key: %x
FM: QFM: Calibration flag: %x
procCalData WriteRegKeys FM: QFM: Error writing calibration flag in registry: %x
FM: QFM: Error writing proc cal data in the registry: %x
DoCalibration FM: QFM: Do Calibration is successful
FM: QFM: Do Calibration failed with error %d
FM: QFM: Sending proc cal data is successful
FM: QFM: proc cal data failed with error %d
GetDefaultRxConfig FM: QFM: GetDefaultRxConfig is successful
FM: QFM: GetDefaultRxConfig failed with error %d
SetDefaultRxConfig FM: QFM: SetDefaultRxConfig is successful
FM: QFM: SetDefaultRxConfig failed with error %d
Enable FM: QFM: Enable is successful
FM: QFM: Enable failed with error %d
Disable FM: QFM: Disable is successful
FM: QFM: Disable failed with error %d
GetStationParams FM: QFM: GetStationParams is successful
FM: QFM: GetStationParams failed with error %d
SetStation FM: QFM: Tuning to freq %u
FM: QFM: Tune is successful
FM: QFM: Tune failed with error %d
ConfigRegion FM: QFM: ConfigRegion: Error setting frequency spacing (%lu) FM: QFM: ConfigRegion is successful
FM: QFM: ConfigRegion failed with error %d
ConfigUserDefinedRegion FM: QFM: ConfigUserDefinedRegion is successful
FM: QFM: ConfigUserDefinedRegion failed with error %d
Search FM: QFM: Search is successful
FM: QFM: Search failed with error %d
CancelSearch FM: QFM: CancelSearch is successful
FM: QFM: CancelSearch failed with error %d
SetRdsGroupOptions FM: QFM: SetRdsGroupOptions is successful
FM: QFM: SetRdsGroupOptions failed with error %d
FM: QFM: SetRdsGroupOptions: setting RDS group processing is successful
FM: QFM: SetRdsGroupOptions: setting RDS group processing failed with error %d
SetAntennaType FM: QFM: Setantenna type is successful
FM: QFM: Setantenna type failed with error %d
SetMuteMode FM: QFM: SetMuteMode successful
FM: QFM: SetMuteMode failed with error %d
SetHlsi FM: QFM: SetHlsi is successful
FM: QFM: SetHlsi failed with error %d
SetStereoMode FM: QFM: SetStereoMode successful
FM: QFM: SetStereoMode failed with error %d
SetNotchControl FM: QFM: SetNotchControl successful
FM: QFM: SetNotchControl failed with error %d
SetSignalThreshold FM: QFM: SetSignalThreshold successful
FM: QFM: SetSignalThreshold failed with error %d
GetSignalThreshold FM: QFM: GetSignalThreshold successful
FM: QFM: GetSignalThreshold failed with error %d
GetRDSGrpCounters FM: QFM: GetRDSGrpCounters successful
FM: QFM: GetRDSGrpCounters failed with error %d
SetRdsGroupProcessing FM: QFM: SetRdsGroupProcessing successful
FM: QFM: SetRdsGroupProcessing failed with error %d
GetPS GetPinConnResult FM: QFM: GetPinConnResult is successful
FM: QFM: GetPinConnResult failed with error %d
FM: QFM: activeBand is %d
query_rf_band_info_and_set_notch_filter FM: QFM: qmi_client_send_msg_sync failed with error %x
FM: QFM: band is above 1 GHz, setting high pass filter
FM: QFM: band is below 1 GHz, setting low pass filter
wan_cb FM: QFM: QMI_WDS_PKT_SRVC_STATUS_IND_V01 received
wan_conc_thread FM: QFM: qmi_client_get_service_instance for nas service failed with error %x
FM: QFM: qmi_client_init for nas service failed with error %x
FM: QFM: qmi_client_get_service_instance for wds port %d failed with error %x
FM: QFM: qmi_client_init for wds port %d failed with error %x
FM: QFM: qmi_client_send_msg_sync failed with error %x for WDS port %u
FM: QFM: number of data calls up are %d
FM: QFM: qmi_client_release failed with error %x
FM: QFM: WaitForSingleObject failed with error %x
FM: QFM: qmi_client_message_decode failed with error %x
FM: QFM: No. of data calls is 0, resetting the notch filter
ssr_thread FM: QFM : ssr_thread : Invalid parameter
FM: QFM: ssr_thread : GetOverlappedResult is success
FM: QFM: ssr_thread : GetOverlappedResult failed with error %d
FM: QFM: ssr_thread: In default case, GetLastError returned %lu
FM: QFM: ssr_thread: successful
P:\fm\rel\8.2.1.1\arm\Release\qcfmminiport.pdb
DisableThreadLibraryCalls OutputDebugStringA
3 WaitForSingleObject ' SetEvent InitializeCriticalSection
CreateEventA LeaveCriticalSection GetLastError
EnterCriticalSection % ResetEvent
DeleteCriticalSection CloseHandle CreateThread
GetTickCount64 CreateFileA ' RegSetValueExA
RegQueryValueExA GetOverlappedResult RegOpenKeyExA
CancelIoEx DeviceIoControl RegCloseKey
api-ms-win-core-libraryloader-l1-1-1.dll api-ms-win-core-debug-l1-1-1.dll
api-ms-win-core-synch-l1-2-0.dll api-ms-win-core-errorhandling-l1-1-1.dll
api-ms-win-core-handle-l1-1-0.dll api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-sysinfo-l1-2-0.dll api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-registry-l1-1-0.dll api-ms-win-core-io-l1-1-1.dll
sprintf_s –free malloc MSVCR110.dll ;_malloc_crt_amsg_exit _initterm_e _initterm ]__C_specific_handler ^__CppXcptFilter ð_calloc_crt Ð_onexit *_lock †__dllonexit _unlock {__clean_type_info_names_internal qmi_client_release qmi_client_send_msg_sync
qmi_client_message_decode qmi_client_init
qmi_client_get_service_instance qccium8960.dll EncodePointer DecodePointer QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime api-ms-win-core-util-l1-1-0.dll api-ms-win-core-profile-l1-1-0.dll àmemset Ümemcpy Ûmemcmp c__CxxFrameHandler3 qcfmminiport.dll CreateAdapterDriver
<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
Code:
File was located at /test/QCFMFTMApp.exe from the Lumia 928 GDR2 ROM - dotPeek couldn't recognize the file, so here is all the searchable text.
OpenDiagDrv
FM: FTMApp: +%s
\\.\DiagRouter
FM: FTMApp : DIAG Driver handle Open Failed
FM: FTMApp : DIAG Driver handle Open successful
FM: FTMApp: -%s
FM: FTMApp: InitDiag: Error creating Event HANDLE, 0x%08x
FM: FTMApp: InitDiag: IOControl for IOCTL_DIAGROUTER_CMD_INIT failed,error 0x%08x
FM: FTMApp: InitDiag: IOControl for IOCTL_DIAGROUTER_CMD_INIT success
FM: FTMApp: Error: malloc failed in RegisterWithDiag
FM: FTMApp:Error: IOControl for IOCTL_DIAGROUTER_CMD_REG failed, error 0x%08x
FM: FTMApp: IOControl for IOCTL_DIAGROUTER_CMD_REG successful.
Error in allocation of Read buffer
Error in allocation of Write buffer
FM: FTMApp: WriteRspToDiag: Wrote %lu bytes to Diag
FM: FTMApp: WriteRspToDiag: Failed to write response to Diag
FM: FTMApp:Read from diag is successful, number of bytes read is %lu
FM: FTMApp:ReadDiagCmd:Error %lu in readfile
Cleanup
FM: FTMApp: Cleaning all resources
FM: FTMapp: Disable failed with error %d
FM: FTMapp: Disable successful
FM: FTMApp :Error in closing Diag driver Handle
FM: FTMApp: All resources are freed
Exiting now..
Error in release of resource..please press ctrl+break to exit
read_thread
FM: Miniport: read_thread: error in allocating memory
FM: Miniport: read_thread: Unknown event received
FM: FTMApp:+Initialize
FM: FTMapp: Error in setting console control handler
FM: FTMApp:-Initialize
FM: FTMapp: Please wait for the app to start fully..
fmrxapp.cpp
FMFTMApp :ERROR: function FAILED in line no:%d , file: %s
FM: FTMApp: Waiting for the Event to be set from DIAG
FM: FTMApp: Error %d in initializing FM
FM: FTMapp: Sending power on cmd down, time stamp %lu
FM: FTMapp: Enable failed with error %d
FM: FTMapp: Enable successful, time stamp %lu
FM: FTMapp: SetRdsGroupProcessing failed with error %d
FM: FTMapp: SetRdsGroupProcessing successful
FM: FTMapp: FM alreadyon
FM: FTMapp: SetProperty for user defined band failed with error %d
FM: FTMapp: SetProperty for user defined band successful
FM: FTMapp: ConfigUserDefinedRegion failed with error %d
FM: FTMapp: ConfigUserDefinedRegion successful
FM: FTMapp: GetStationParams failed with error %d
FM: FTMapp: GetStationParams successful
FM : FTMapp: fmParams->ulFreq is %u, g_fmctxt.region_params.bandLoLimit %u, chSpacing %u
FM: FTMapp: SetStation failed with error %d
FM: FTMapp: SetStation successful
FM: FTMapp: Sending seek cmd down, time stamp %lu
FM: FTMapp: Seek failed with error %d
FM: FTMapp: Seek successful
FM: FTMapp: CancelSeek failed with error %d
FM: FTMapp: CancelSeek successful
FM: FTMapp: SetAntennaType failed with error %d
FM: FTMapp: SetAntennaType successful
FM: FTMapp: Setting soft mute mode failed with error %d
FM: FTMapp: Setting soft mute mode successful
FM: FTMapp: SetHlsi failed with error %d
FM: FTMapp: Set notch filter failed with error %d
FM: FTMapp: Set notch filter successful
FM: FTMapp: SetMuteMode failed with error %d
FM: FTMapp: SetMuteMode successful
FM: FTMapp: SetStereoMode failed with error %d
FM: FTMapp: SetStereoMode successful
FM: FTMapp: GetPS failed with error %d
FM: FTMapp: GetPS successful, ps is %s
FM: FTMapp: Getting RDS group counters failed with error %d
FM: FTMapp: Getting RDS group counters successful
FM: FTMapp: Setting RDS Group options failed with error %d
FM: FTMapp: Setting RDS Group options successful
FM: FTMapp: GetProperty for RDS group counters failed with error %d
FM: FTMapp: GetProperty for RDS group counters successful
FM: FTMApp: Received un-supported command
FM: FTMApp: out of while loop in main, exiting ...
Reset
FM: QFM: +%s
FM: QFM: -%s
Read
FM: QFM : Read : Invalid parameter
THe QCFMFTMApp strings are getting way too long so I have attached the file for those who want to try and take a stab at decompiling the file. dotPeek nor Telerik's JustDecompile wouldn't even open it, so I don't know what's the deal with these driver level apps.
Editing any of this will result in the phone denying your editing permissions. Also, they are mostly Dword values, which cannot be written due to permissions.
DWORD or not DWORD never matters. Accessible registry entries list is more like whitelist than blacklist...
:good::good::good::good: subscribe to this thread.. hopefully dev peeps can unlock the mystery of Windows Phone
phoy18 said:
:good::good::good::good: subscribe to this thread.. hopefully dev peeps can unlock the mystery of Windows Phone
Click to expand...
Click to collapse
Same here but, the biggest problem with WP8 hacking is that. Just because you found the Key or keys to enable FM radio (As I have a Lumia 928 and pissed that there is no FM radio), does not mean you can apply them to the phone in any way.
Time will tell, Microsoft's gota slip up someplace for everyone find a hole...
ultrashot said:
DWORD or not DWORD never matters. Accessible registry entries list is more like whitelist than blacklist...
Click to expand...
Click to collapse
There must be some file that dictates the whitelist somewhere, whether its an xml file or another regfile. Another method to work this is to probably look at provxml again (I don't recall if they do any registry modification on WP8 vs WP7.) There are some tier3 applications with extra privileges (I'm not sure what they need the extra privs, or if they even have specific needs listed) that show up inside the nokia tier3 app.
What do you mean, whitelist? It's NT. The registry has ACLs (Access Control Lists) on its keys, same as on any other version of NT (from NT 3.1 to Windows 8).
It seems there will be more to this endevor than just enabling the feature. I'm seeing that there may be a bit of hardware moding we'll need to do.
Have a look at community.verizonwireless.com/thread/803729
EquiGym said:
It seems there will be more to this endevor than just enabling the feature. I'm seeing that there may be a bit of hardware moding we'll need to do.
Have a look at community.verizonwireless.com/thread/803729
Click to expand...
Click to collapse
What did it say, Verizon stripped out any hacking stuff...
DavidinCT said:
What did it say, Verizon stripped out any hacking stuff...
Click to expand...
Click to collapse
Yeah, VZW is juat a bit overly moderating. Can't even mention XDA.
Look at NeoAndersons post just before my post and also through out the thread. He's the one who got VZW to admit to the second part of the disabling.
It seems Nokia/VZW has removed the antenna wire between the chipset and the 3.5mm headphone jack.
To me, this is an easier fix than the fixing the software. I have the tools and the know how to work with hardware.
If we can get the feature reinabled on the software side, I'll be sure to work up a "how to" fix on the hardware.
I have a .pdf file of the assembly/disassembly if needed.
Please upload it, have to solve the V- button issue. It is stuck
djtonka said:
Please upload it, have to solve the V- button issue. It is stuck
Click to expand...
Click to collapse
Here you go sir. Lumia 928 Service Manual.
http://sdrv.ms/1giUqy6
tonbonz said:
Here you go sir. Lumia 928 Service Manual.
http://sdrv.ms/1giUqy6
Click to expand...
Click to collapse
Where did you end up getting that from?
Honestly I don't remember... I Google alot.
I was sure you talking about Ativ S but do not know way. Got all SM1&2 on my website anyway
djtonka said:
I was sure you talking about Ativ S but do not know way. Got all SM1&2 on my website anyway
Click to expand...
Click to collapse
Oops...well that is probably where I got the file from. I do frequent your site quite often and find it quite informative.
First Post Updated.
I've finally got the dotPeek decompiler installed and I've got more bits for 928 owners!
thals1992 said:
I've finally got the dotPeek decompiler installed and I've got more bits for 928 owners!
Click to expand...
Click to collapse
Good stuff? I swear I've been through every preinstalled .xap and the most interesting things I've found all seem to be deliberately disabled. The one diagnostics tool I got to open had no menu or picklist, just pin tile and refresh buttons. The values are there to open menus and view lists and such but it looks like the code is written either to hide or disable them. Not that I'm an expert or dev but after staring at code for hours on end you pick up on a few things and as I said in a previous post...I Google ALOT.
Not really. I just tried to look for strings with Notepad++
I just hope @ultrashot or someone with similar knowledge of developing could help me with digging into this.

[GUIDE] Build AOSP for zerofltexx by Astrubale

DELETED
but there is some aosp build usable ( incall micro working on fine ) for galaxy s 6?
thanks for the guide Master
supera3 said:
but there is some aosp build usable ( incall micro working on fine ) for galaxy s 6?
thanks for the guide Master
Click to expand...
Click to collapse
Depend on what source zero-common, zerofltexx and kernel are based.
Very cool guide, I'll have to give this a shot later just for fun! Sorry for doubting you before.
If there are new commits, before ". build/envsetup.sh" tipe "repo sync" for upgrade.
Hi @Astrubale,
I tried to build cm-13.0 with your tutorial, but build fails non-stop on:
Code:
target SharedLib: libexpat (/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libexpat_intermediates/LINKED/libexpat.so)
/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libexpat_intermediates/lib/xmlparse.o: file not recognized: File format not recognized
collect2: error: ld returned 1 exit status
build/core/shared_library_internal.mk:80: recipe for target '/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libexpat_intermediates/LINKED/libexpat.so' failed
make: *** [/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libexpat_intermediates/LINKED/libexpat.so] Error 1
make: *** Waiting for unfinished jobs....
make[3]: Nothing to be done for 'dtbs'.
or
Code:
/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libcrypto_intermediates/android_compat_hacks.o: file not recognized: File format not recognized
collect2: error: ld returned 1 exit status
build/core/shared_library_internal.mk:80: recipe for target '/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libcrypto_intermediates/LINKED/libcrypto.so' failed
make: *** [/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libcrypto_intermediates/LINKED/libcrypto.so] Error 1
make: *** Waiting for unfinished jobs....
make: Leaving directory '/home/sebek/android/system'
The solution is to remove xmlparse.o or android_compat_hacks.o and I guess it continues the build. Almost at the end of compilation (I presume) it throws out that very error and after a while I get:
Code:
/home/sebek/android/system/kernel/samsung/exynos7420/scripts/Makefile.fwinst:45: target '/lib/firmware/tsp_stm/stm_z1.fw' given more than once in the same rule
/home/sebek/android/system/kernel/samsung/exynos7420/scripts/Makefile.fwinst:45: target '/lib/firmware/abov/abov_valley.fw' given more than once in the same rule
make[1]: Leaving directory '/home/sebek/android/system/kernel/samsung/exynos7420'
make[1]: Entering directory '/home/sebek/android/system/kernel/samsung/exynos7420'
INSTALL net/ipv4/tcp_htcp.ko
INSTALL net/ipv4/tcp_westwood.ko
/home/sebek/android/system/kernel/samsung/exynos7420/scripts/Makefile.fwinst:45: target '../../system/lib/firmware/tsp_stm/stm_z1.fw' given more than once in the same rule
/home/sebek/android/system/kernel/samsung/exynos7420/scripts/Makefile.fwinst:45: target '../../system/lib/firmware/abov/abov_valley.fw' given more than once in the same rule
DEPMOD 3.10.61
make[1]: Leaving directory '/home/sebek/android/system/kernel/samsung/exynos7420'
make: Leaving directory '/home/sebek/android/system'
#### make failed to build some targets (26:29 (mm:ss)) ####
Maybe you'd be willing to give me some advice on how I could finish this build ? I am building on Ubuntu 16.04, dl'd the newest kernel from Brandon's git repo.
My best
djseban2 said:
Hi @Astrubale,
I tried to build cm-13.0 with your tutorial, but build fails non-stop on:
Code:
target SharedLib: libexpat (/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libexpat_intermediates/LINKED/libexpat.so)
/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libexpat_intermediates/lib/xmlparse.o: file not recognized: File format not recognized
collect2: error: ld returned 1 exit status
build/core/shared_library_internal.mk:80: recipe for target '/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libexpat_intermediates/LINKED/libexpat.so' failed
make: *** [/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libexpat_intermediates/LINKED/libexpat.so] Error 1
make: *** Waiting for unfinished jobs....
make[3]: Nothing to be done for 'dtbs'.
or
Code:
/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libcrypto_intermediates/android_compat_hacks.o: file not recognized: File format not recognized
collect2: error: ld returned 1 exit status
build/core/shared_library_internal.mk:80: recipe for target '/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libcrypto_intermediates/LINKED/libcrypto.so' failed
make: *** [/home/sebek/android/system/out/target/product/zerofltexx/obj/SHARED_LIBRARIES/libcrypto_intermediates/LINKED/libcrypto.so] Error 1
make: *** Waiting for unfinished jobs....
make: Leaving directory '/home/sebek/android/system'
The solution is to remove xmlparse.o or android_compat_hacks.o and I guess it continues the build. Almost at the end of compilation (I presume) it throws out that very error and after a while I get:
Code:
/home/sebek/android/system/kernel/samsung/exynos7420/scripts/Makefile.fwinst:45: target '/lib/firmware/tsp_stm/stm_z1.fw' given more than once in the same rule
/home/sebek/android/system/kernel/samsung/exynos7420/scripts/Makefile.fwinst:45: target '/lib/firmware/abov/abov_valley.fw' given more than once in the same rule
make[1]: Leaving directory '/home/sebek/android/system/kernel/samsung/exynos7420'
make[1]: Entering directory '/home/sebek/android/system/kernel/samsung/exynos7420'
INSTALL net/ipv4/tcp_htcp.ko
INSTALL net/ipv4/tcp_westwood.ko
/home/sebek/android/system/kernel/samsung/exynos7420/scripts/Makefile.fwinst:45: target '../../system/lib/firmware/tsp_stm/stm_z1.fw' given more than once in the same rule
/home/sebek/android/system/kernel/samsung/exynos7420/scripts/Makefile.fwinst:45: target '../../system/lib/firmware/abov/abov_valley.fw' given more than once in the same rule
DEPMOD 3.10.61
make[1]: Leaving directory '/home/sebek/android/system/kernel/samsung/exynos7420'
make: Leaving directory '/home/sebek/android/system'
#### make failed to build some targets (26:29 (mm:ss)) ####
Maybe you'd be willing to give me some advice on how I could finish this build ? I am building on Ubuntu 16.04, dl'd the newest kernel from Brandon's git repo.
My best
Click to expand...
Click to collapse
Can you send me a screen of /android/system/kernel/samsung/exynos7420/ ?
Astrubale said:
Can you send me a screen of /android/system/kernel/samsung/exynos7420/ ?
Click to expand...
Click to collapse
Sure, it looks like this:
hxxp://imgur.com/M5sAjIo
@edit: I deleted exynos7420 dir and unzipped it (dl'd zip from github) once again, this time through Terminal. Turned out it was something wrong with that, therefore I succeded with building the ROM, but my S6 hangs on "Kernel is not seandroid enforcing", after flashing the ROM (tough luck, I guess). What's more I tried flahyboy's ROM, to see if it's maybe something wrong with my S6 - well, you can say flahyboy's ROM starts instantly, but in-call mic is not working. I'd be grateful for any hints on what might be wrong. One and only thing I noticed is flahyboy's ROM is slightly greater in size (~40MB) that mine.. maybe the build solution did not add something to my zip.. Anyway - great tutorial, thanks for that. Installing AOSP just made me even more anxious to wait for making this system stable :good:
djseban2 said:
Sure, it looks like this:
hxxp://imgur.com/M5sAjIo
@edit: I deleted exynos7420 dir and unzipped it (dl'd zip from github) once again, this time through Terminal. Turned out it was something wrong with that, therefore I succeded with building the ROM, but my S6 hangs on "Kernel is not seandroid enforcing", after flashing the ROM (tough luck, I guess). What's more I tried flahyboy's ROM, to see if it's maybe something wrong with my S6 - well, you can say flahyboy's ROM starts instantly, but in-call mic is not working. I'd be grateful for any hints on what might be wrong. One and only thing I noticed is flahyboy's ROM is slightly greater in size (~40MB) that mine.. maybe the build solution did not add something to my zip.. Anyway - great tutorial, thanks for that. Installing AOSP just made me even more anxious to wait for making this system stable :good:
Click to expand...
Click to collapse
Thank, but can you compile now?
Astrubale said:
Thank, but can you compile now?
Click to expand...
Click to collapse
Yeah, I compiled it at last, but if i flash the zip from out folder, then the phone hangs on first bootsplash ("Galaxy S6") with "Kernel is not seandroid enforcing"
djseban2 said:
Yeah, I compiled it at last, but if i flash the zip from out folder, then the phone hangs on first bootsplash ("Galaxy S6") with "Kernel is not seandroid enforcing"
Click to expand...
Click to collapse
Search for errors inside /proc/last_kmsg
Wow cool clean and easy Guide. Thanks for this.
Weil try myself on that.
Astrubale said:
Search for errors inside /proc/last_kmsg
Click to expand...
Click to collapse
Code:
Samsung S-Boot 4.0 for SM-G920F (Apr 22 2016 - 16:59:51)
EXYNOS7420 EVT 1.3 (Base on ARM CortexA53)
3048MB / 0MB / Rev 11 / G920FXXU3DPDP / (PKG_ID 0x0) / LOT_ID N3N1P / RST_STAT (0x10000)
__if_pmic_rev_init - MUIC API is not ready!
MON: 0x8(1)
MON[0] = (1)[0x1c, 0x7a]
MON[1] = (2)[0x1a, 0x56]
MON[2] = (3)[0x1a, 0x3d]
MON[3] = (4)[0x1c, 0x4e]
MON[4] = (5)[0x1a, 0x39]
MON[5] = (6)[0x1a, 0x30]
MON[6] = (7)[0x15, 0x44]
MON[7] = (0)[0x0c, 0x07]
pmic_asv_init
(ASV_TBL_BASE+0x00)[11:0] bigcpu_asv_group = 2184
(ASV_TBL_BASE+0x00)[15:12] bigcpu_ssa0 = 0
(ASV_TBL_BASE+0x00)[27:16] littlecpu_asv_group = 2457
(ASV_TBL_BASE+0x00)[31:28] littlecpu_ssa0 = 0
(ASV_TBL_BASE+0x04)[11:0] g3d_asv_group = 2184
(ASV_TBL_BASE+0x04)[15:12] g3d_ssa0 = 0
(ASV_TBL_BASE+0x04)[27:16] mif_asv_group = 2184
(ASV_TBL_BASE+0x04)[31:28] mif_ssa0 = 0
(ASV_TBL_BASE+0x08)[11:0] int_asv_group = 3276
(ASV_TBL_BASE+0x08)[15:12] int_ssa0 = 6
(ASV_TBL_BASE+0x08)[27:16] cam_disp_asv_group = 2184
(ASV_TBL_BASE+0x08)[31:28] cam_disp_ssa0 = 0
(ASV_TBL_BASE+0x0C)[3:0] dvfs_asv_table_version = 15
(ASV_TBL_BASE+0x0C)[4] asv_group_type = 0
(ASV_TBL_BASE+0x0C)[7:5] reserved01 = 0
(ASV_TBL_BASE+0x0C)[8] shift_type = 0
(ASV_TBL_BASE+0x0C)[9] ssa1_enable = 0
(ASV_TBL_BASE+0x0C)[10] ssa0_enable = 1
(ASV_TBL_BASE+0x0C)[15:11] reserved02 = 0
(ASV_TBL_BASE+0x0C)[16] asv_method = 1
(ASV_TBL_BASE+0x0C)[31:17] reserved03 = 0
(ASV_TBL_BASE+0x10)[3:0] main_asv_group = 0
(ASV_TBL_BASE+0x10)[7:4] main_asv_ssa = 0
(ASV_TBL_BASE+0x10)[11:8] bigcpu_ssa1 = 0
(ASV_TBL_BASE+0x10)[15:12] littlecpu_ssa1 = 0
(ASV_TBL_BASE+0x10)[19:16] g3d_ssa1 = 0
(ASV_TBL_BASE+0x10)[23:20] mif_ssa1 = 0
(ASV_TBL_BASE+0x10)[27:24] int_ssa1 = 0
(ASV_TBL_BASE+0x10)[31:28] cam_disp_ssa1 = 0
(ASV_TBL_BASE+0x14)[8:0] bigcpu_ssa_ema = 0
(ASV_TBL_BASE+0x14)[17:9] littlecpu_ssa_ema = 0
(ASV_TBL_BASE+0x14)[26:18] g3d_ssa_ema = 0
(ASV_TBL_BASE+0x14)[31:27] reserved04 = 0
chip_status = f, bin2_efuse = 0
muic_register_max77843_apis
muic_is_max77843 chip_id:0x43 muic_id:0xb5 -> matched.
MUIC rev = MAX77843(181)
init_multi_microusb_ic Active MUIC 0xb5
max77843_init_microusb_ic: MUIC: CDETCTRL:0x2d
max77843_init_microusb_ic: MUIC: CONTROL1:0x00
max77843_init_microusb_ic: MUIC: CONTROL2:0x3b
max77843_muic_get_adc_value: STATUS1:0x1f
max77843_muic_get_adc_value: ADC:0x1f
max77843_muic_get_adc_value: STATUS1:0x1f
max77843_muic_get_adc_value: ADC:0x1f
max77843_muic_get_chg_typ: STATUS2:0x00
max77843_muic_get_chg_typ: CHGTYP:0x00
max77843_muic_get_adc_value: STATUS1:0x1f
max77843_muic_get_adc_value: ADC:0x1f
max77843_muic_get_chg_typ: STATUS2:0x00
max77843_muic_get_chg_typ: CHGTYP:0x00
load Secure Payload done.
Chip ID : 060f4d16dd28 / 0x00007700
EL3 monitor information => Built : 16:48:28, Jan 18 2016
bConfigDescrLock: 1
sw_lock success
sw_lock success
sw_lock success
SCSI CMD : 55 11 00 00 00 00 00 00 14 00
SCSI Response(01) : Target Failure
SCSI Status(02) : max77843_set_muic_uart_early: MUIC: CONTROL1: 0x00
max77843_muic_get_adc_value: STATUS1:0x1f
max77843_muic_get_adc_value: ADC:0x1f
[Debug Info.]
S-BOOT : VERSION_-+F0
SecureOS : 20 (MB)
- read_bl1
blk_bread_bootsector: LUN 1, from 0x0, size 0x10, buffer 0x45708000
Verify_Binary_Signature 0x45720120 [email protected], [email protected]
pit_check_signature (PIT) valid.
PARAM ENV VERSION: v1.0..
blk_bread_bootsector: LUN 1, from 0xffe, size 0x1, buffer 0x441204c0
initialize_ddi_data: usable! (3:0xf), warranty reason : (0x0303)
MAGIC_RAM_BASE: 4000000, MAGIC_RAM_BASE2: 100001, ompin: 2000a
[ldfw] Pass LDFW partition!
[ldfw] read whole CM partition from the storage
ldfw: 0th ldfw's version 0x20151027 name : CryptoManagerV20
ldfw: 1th ldfw's version 0x20151203 name : fmp_fw
ldfw: init ldfw(s). whole ldfws size 0x204110
[ldfw] try to init 2 ldfw(s). except 0 ldfw 2 ldfw(s) have been inited done.
[mobi_drv] add: 0x43e71940, size: 11401
MobiCore IDLE flag = 0
MobiCore Driver loaded and RTM IDLE!
[OTP] 27 bit read: 0x5
[OTP] 22 bit read: 0x0
[OTP] 21 bit read: 0x0
[OTP] 23 bit read: 0x1
[OTP] 26 bit read: 0x1
[OTP] NANTIRBK0 bit reading: start
[OTP] NANTIRBK0: 3 bit
[OTP] 28 bit read: 0x1
[OTP] 29 bit read: 0x0
[OTP] 30 bit read: 0x1
[OTP] 25 bit read: 0x1
[OTP] ETC value: 0
[EFUSE] SMC Read the 0x0 ...
[EFUSE] SMC Read Count value: 3
[EFUSE] SMC Read the 0x1 ...
[EFUSE] SMC Read Count value: 1
[EFUSE] SMC Read the 0x2 ...
[EFUSE] SMC Read Count value: 0
[EFUSE] SMC Read the 0x3 ...
[EFUSE] SMC Read Count value: 1
(1,5) vs (1,5)
[EFUSE] This is commercial device.
set_tzpc_secureport: successfully protected 0
eSE Protection!!
Authenticated data read request (Swapped)
Authenticated data read response (Swapped)
RPMB: get hmac value: success
HMAC compare success !!
update_rpmb_version skip.
initialize_secdata_rpmb: usable! (0x52504d42)
DDR SIZE: 3G (0xc0000000)
LPDDR4 manufacturer : Micron
bin2_efuse = 0
[TMU] 52, 53, 51, 51
UFS vendor: SAMSUNG
FW rev : 0200
product : KLUBG4G1BD-E0B1
UFS size (GB) : 32
UFS ID : XXXXXXXXXXXXXXXX
lun:196 Query Response : 0xfc
lun:196 Query Response : 0xfc
lun:196 Query Response : 0xfc
lun:196 Query Response : 0xfc
dNumAllocUnits error at LU7 0 0
PROVISION : FAIL
PROVISION : FAIL
max77843_muic_api_print_init_regs: INTMASK[1:0x00, 2:0x00, 3:0x00]
max77843_muic_api_print_init_regs: MUIC: CDETCTRL:0x2d
max77843_muic_api_print_init_regs: MUIC: CONTROL1:0x00
max77843_muic_api_print_init_regs: MUIC: CONTROL2:0x3b
max77843_muic_api_print_init_regs: MUIC: CONTROL3:0x00
max77843_muic_api_print_init_regs: MUIC: CONTROL4[0x16]:0xb2
init_ific : MAX77843(0)
init_ific : MAX77843(0)
set_float_voltage: max77843 battery cv voltage 0x9c
set_charger_state: buck(1), chg(1), reg(0x05)
max77843_get_charger_status: Invalid charger
set_auto_current: get_charger_status(0)
max77843_muic_get_adc_value: STATUS1:0x1f
max77843_muic_get_adc_value: ADC:0x1f
max77843_muic_get_chg_typ: STATUS2:0x00
max77843_muic_get_chg_typ: CHGTYP:0x00
max77843_muic_get_adc_value: STATUS1:0x1f
max77843_muic_get_adc_value: ADC:0x1f
max77843_muic_get_chg_typ: STATUS2:0x00
max77843_muic_get_chg_typ: CHGTYP:0x00
get_wireless_charger_detect: wireless check 0
get_wireless_charger_detect : CHG_DTLS(0x00)
set_auto_current: unknown_state, curr(475)
max77843_get_charger_status: Invalid charger
get_wireless_charger_detect: wireless check 0
get_wireless_charger_detect : CHG_DTLS(0x00)
set_charger_current: chg curr(137), in curr(0)
max77843_get_charger_status: Invalid charger
get_wireless_charger_detect: wireless check 0
get_wireless_charger_detect : CHG_DTLS(0x00)
fuelguage : wpc_status(0)
set_charger_state: buck(1), chg(0), reg(0x04)
init_fuel_gauge: Start!!
init_fuel_gauge : MAX77843(0)
max77843_muic_get_adc_value: STATUS1:0x1f
max77843_muic_get_adc_value: ADC:0x1f
adc_read_temp temp_adc = 1852
init_fuel_gauge temp = 25
init_fuel_gauge : MAX77843(0)
init_fuel_gauge: Battery type : SDI, capacity: 5177, status: 128
init_fuel_gauge: Already initialized (0x1439, SDI type)
check_validation_with_tablesoc: Start!!
fuel_gauge_read_soc: SOC(32), data(0x209a)
fuel_gauge_read_ocv: VFOCV(3774), data(0xbcba)
calculate_table_soc : low(0) high(6) mid(7) table_soc(0)
calculate_table_soc : low(4) high(6) mid(3) table_soc(0)
calculate_table_soc : low(6) high(6) mid(5) table_soc(0)
calculate_table_soc : low(7) high(6) mid(6) table_soc(0)
calculate_table_soc: vcell [3774] table_soc [31]
differ(1), table_soc(31), RepSOC(32)
max77843_muic_get_adc_value: STATUS1:0x1f
max77843_muic_get_adc_value: ADC:0x1f
max77843_muic_get_chg_typ: STATUS2:0x00
max77843_muic_get_chg_typ: CHGTYP:0x00
fuel_gauge_read_vcell: VCELL(3716), data(0xb9d8)
vcell(3716),soc_diff_limit(50), low_temp_reset(0)
fuel_gauge_read_ocv: VFOCV(3774), data(0xbcba)
fuel_gauge_read_vcell: VCELL(3716), data(0xb9d8)
fuel_gauge_read_soc: SOC(32), data(0x209a)
fuel_gauge_read_vfsoc: VFSOC(30), data(0x1ef3)
init_fuel_gauge : OCV(3774), VCELL(3716), SOC(32), VFSOC(30)
AP_PMIC_SDA = 1
PMIC_ID = 0x12
OTP:0x78 PWR_SEQ:1 G3D_OCP:1 PSoff:1 INT_Volt:1
PMIC_STATUS1 = 0x2f PWRON JIGONB ACOKB MR2B PWRON1S
PMIC_STATUS2 = 0x11 RTC60SE RTC1SE
PMIC_PWRONSRC = 0x08 MRST
PMIC_OFFSRC = 0x00
PMIC_INT1 = 0xc3 PWRONF PWRONR PWRON1S MRB
PMIC_INT2 = 0x11 RTC60S RTC1S
PMIC_INT3 = 0x80 RSVD
PMIC_RTC_CTRL = 0x02
PMIC_RTC_SMPL = 0x83
RTC TIME: 2016-08-13 07:27:29(0x40)AM
s5p_check_keypad: 0x10110000
s5p_check_keypad: recovery mode
set_oneshot_recovery: recovery mode set! sys_bootm=0x80000
s5p_check_reboot_mode: INFORM3 = 0 ... skip
ATLAS_PLL = 1200MHz APOLLO_PLL = 1200MHz MIF_PLL = 3104MHz
MFC_PLL = 468MHz CCI_PLL = 532MHz
BUS0_PLL = 1600MHz BUS1_PLL = 668MHz
board_uart_rustproof ifc_sense: 0
-user build & not FAC
-rustproof mode Enabled
s5p_check_upload: MAGIC(0x4000000), RST_STAT(0x10000)
max77843_muic_get_adc_value: STATUS1:0x1f
max77843_muic_get_adc_value: ADC:0x1f
s5p_check_upload: debug level is LO! (mask: 0x220)
max77843_ific_set_mrstb: TOPSYS: MAINCTRL1[0x02]: [0x07]+[0x07]->[0x07]
s5p_check_upload: disable dump_gpr
max77843_muic_get_adc_value: STATUS1:0x1f
max77843_muic_get_adc_value: ADC:0x1f
s5p_check_download: 0
max77843_muic_get_adc_value: STATUS1:0x1f
max77843_muic_get_adc_value: ADC:0x1f
max77843_get_charger_status: Invalid charger
get_wireless_charger_detect: wireless check 0
get_wireless_charger_detect : CHG_DTLS(0x00)
check_pm_status: charger is not detected
fuel_gauge_read_vcell: VCELL(3718), data(0xb9ea)
check_pm_status: voltage(3718) is ok
check_pm_status: 7 sec reset, continue.
scr_draw_image: draw 'logo.jpg'...
read 'logo.jpg'(112504) completed.
board_set_dev_pm: s2mpb02 enable for display
42, 0, 13, 0x420013
DETECTED LCD TYPE : S6E3HA2
mipi-dsi driver(CMD mode) has been probed.
decon-int: ver0, max win7, command mode, hw trigger
single dsi mode
decon0 registered successfully
afw flag is Unknown [afw flag : 00 00 00 00]
secure info base: 45720000 and SMC Num = 0x83000013
secure smc success!!! [ret = 0]
Set debug level to low(4f4c)
DMV: Successfully informed TZ of boot mode: Recovery
load_kernel: loading boot image from 139264..
kernel size = 0x114f000, ramdisk size = 0x5fc000
dt_size:1454080, dt_actual:1454080
Verify_Binary_Signature 0x45720120 [email protected], [email protected]
Kernel Image
Verify_Binary_Signature: failed.(-18022398)
pit_check_signature (RECOVERY) invalid.
[TIMA trusted boot]: SEANDROID ENFORCING
Set invalid sign flag
No need to update kernel type.
[EFUSE] warranty bit is already set.
ace_hash_sha_digest: passed.(0)
tboot ctx base: 45720248
SMC Num = 0x83000001
mobismc success!!! [ret = 0]
SMC Num = 0x83000007
mobismc for tima info success!!! [ret = 0]
Pass. DTBH size is smaller than a page.
<dtbh_header Info>
magic:0x48425444, version:0x00000002, num_entries:0x00000008
<device info>
chip_id: 0x00001cfc
platform_id: 0x000050a6
subtype_id: 0x217584da
hw_rev: 0x0000000b
dt_entry[06]
chip_id: 0x00001cfc
platform_id: 0x000050a6
subtype_id: 0x217584da
hw_rev: 0x0000000a
hw_rev_end: 0x0000000b
offset: 0x0010a000
dtb size: 0x0002c800
Selected entry hw_ver : 11
dt_entry of hw_rev 10 is loaded at 0x4a000000.(182272 Bytes)
[EFUSE] RB count: device(0x3), binary(0x3)
[OTP] SW LOCK Success
DDI value :0x0000000f
sw_lock success
sw_lock success
Forced Enable KAP
Warranty Bit Set - Blowing KAP_VIOLATION_FUSE
KAP status = 5afe0003
ATAG_CORE: 5 54410001 0 0 0
ATAG_MEM: 4 54410002 20000000 40000000
ATAG_MEM: 4 54410002 20000000 60000000
ATAG_MEM: 4 54410002 20000000 80000000
ATAG_MEM: 4 54410002 20000000 A0000000
ATAG_MEM: 4 54410002 20000000 C0000000
ATAG_MEM: 4 54410002 1E800000 E0000000
ATAG_SERIAL: 4 54410006 XXXXXXXX XXXXXXXX
ATAG_INITRD2: 4 54420005 43000000 5fbd8f
ATAG_REVISION: 3 54410007 b
check_rustproof [0,0] On
ucs flag is Unknown
ucs flag : 00 00 00 00
ATAG_CMDLINE: f0 54410009 'console=ram loglevel=4 bootmode=2 sec_debug.level=0 sec_watchdog.sec_pet=5 androidboot.hardware=samsungexynos7420 androidboot.debug_level=0x4f4c ess_setup=0x46000000 [email protected] [email protected] charging_mode=0x3000 s3cfb.bootloaderfb=0xe2a00000 sysscope=0x6b090719 lcdtype=4325395 consoleblank=0 lpj=239616 sec_debug.reset_reason=5 ehci_hcd.park=3 oops=panic pmic_info=35 cordon=c34c0eba5576148dc662cf43a6352c3b connie=SM-G920F_OPEN_EUR_c3811d70601ea690b7b0b2afca80be2c fg_reset=0 androidboot.emmc_checksum=3 androidboot.boot_salescode= androidboot.odin_download=1 androidboot.bootloader=G920FXXU3DPDP androidboot.selinux=enforcing androidboot.security_mode=1526595585 androidboot.ucs_mode=0 androidboot.hw_rev=11 androidboot.warranty_bit=1 androidboot.hmac_mismatch=0 androidboot.sec_atd.tty=/dev/ttySAC1 androidboot.serialno=XXXXXXXXXXXXXXXX snd_soc_core.pmdown_time=1000 zero_sdchg_ic=0 androidboot.fmp_config=0'
ATAG_NONE: 0 0
pack_atags: ramdisk size start 0x43000000, size 0x5fbd8f
Updating device tree @0x4a000000: done
Starting kernel at 0x40205000...
SWITCH_SEL(3)
BOOTING TIME : 2895
Here it is, mate. I can't seem to find anything suspicious besides
Code:
dNumAllocUnits error at LU7 0 0
PROVISION : FAIL
PROVISION : FAIL
but I can only guess
Hi I am having problems compiling due to the kernel. Which kernel source should I use? How should I configure it? Help pleaase
Added "extract files" guide.
Whenever I try to download the CyanogenMod repo, I get this error:
error: Exited sync due to fetch errors
I've tried using: repo sync -f and: repo sync --force-sync
I'm trying to download the CM13 repo.
I've also followed the steps exactly as they were written.
I'm trying to build cm-14.0. Fails at
HTML:
Starting build with ninja
ninja: Entering directory `.'
ninja: error: '/home/julian/android/system/out/target/product/zerofltexx/obj_arm/SHARED_LIBRARIES/libsecril-client_intermediates/export_includes', needed by '/home/julian/android/system/out/target/product/zerofltexx/obj_arm/SHARED_LIBRARIES/audio.primary.universal7420_intermediates/import_includes', missing and no known rule to make it
build/core/ninja.mk:151: recipe for target 'ninja_wrapper' failed
make: *** [ninja_wrapper] Error 1
make: Leaving directory '/home/julian/android/system'
.
Any ideas what could be wrong?
/android/system/kernel/samsung/exynos7420 contains github.com/CyanogenMod/android_kernel_samsung_exynos7420 cm-14.0.
Thanks for the great guide anyway

[HELP] Z00TD/ZE551KL stuck in EDL mode, unsure what to do.

I have a Zenfone 2 Laser (ZE551KL) and it's currently stuck in EDL mode. The bootloader was locked when this happened, and the phone was running stock Android M rom. I'm not sure what happened, but I can guarantee it is not a hardware failure.
When I first plugged the phone in and ran EDL, the partition table (edl printgpt) was empty. After I went, grabbed the firmware and the GPT file (I tried gpt_main, gpt_backup, and gpt_both, same end result) and flashed it, I get the following:
Code:
$ edl printgpt
Parsing Lun 0:
GPT Table:
-------------
sbl1: Offset 0x0000000000004400, Length 0x0000000000140000, Flags 0x0000000000000000, UUID b6e183fd-7e32-6aab-45a0-95aa05d488ff, Type 0xdea0ba2c, Active False
DDR: Offset 0x0000000000144400, Length 0x0000000000008000, Flags 0x1000000000000000, UUID 12145d01-36e4-dabb-43ee-d41814020b99, Type 0x20a0c19c, Active False
rpm: Offset 0x000000000014c400, Length 0x0000000000080000, Flags 0x0000000000000000, UUID a6cde2ba-f246-d267-4e32-27a784384929, Type 0x98df793, Active False
tz: Offset 0x00000000001cc400, Length 0x0000000000080000, Flags 0x0000000000000000, UUID 65484ccf-89c1-6697-724e-ca807a503232, Type 0xa053aa7f, Active False
aboot: Offset 0x000000000024c400, Length 0x0000000000500000, Flags 0x1000000000000000, UUID d85a0017-ca5e-5ae5-7501-e91c6e879873, Type 0x400ffdcd, Active False
hyp: Offset 0x000000000074c400, Length 0x0000000000080000, Flags 0x0000000000000000, UUID e8e93198-beea-0f83-ba35-62b457a963c2, Type 0xe1a6a689, Active False
Total disk size:0x0000000000004400, sectors:0x0000000000000022
I made sure to flash all the partitions using the appropriate files from the latest firmware from ASUS's website. (sbl1 = sbl1.mbn, etc.)
Unfortunately, the phone simply didn't boot. I tried a final "hail mary" of sorts, and I ran the command "edl setbootablestoragedrive 0". The command returned success, but unfortunately, nothing changed.
Any help is appreciated, thanks in advance.

Categories

Resources