this thread is outdated!
please use this instead:
http://forum.xda-developers.com/one-m9/general/how-to-disable-remaining-write-t3171735
---------------------------------------------------------------------------------------------------------------------------------------------------------------------
this thread is for m9 it will NOT work on m7,m8,or any older devices(or anything other than HTC)
again,dont do this on anything other than m9. any posts stating "i bricked my whatever" will be directed back here,to this first bit of information.
this thread is to help you restore your software status: modified back to software status: original without having to run an RUU. those who have had m7,and m8 are familiar the the tampered flag wich is set when s-on by unlocking the bootloader and installing a custom recovery,kernel,or rom. this thread is the same. it is not a false or hex edited aboot,it is changing the flag that aboot checks to see if your device has been "tampered" with.
unfortunately,HTC has snuck in some evil write protections even on s off devices. as such,it is no longer possible to issue a simple adb command to re-write the flag.
at this time,this thread is for more advanced users. i will try and refine it to be more user friendly,but for now want to get the info out here.
credits
-beaups for schooling me on echo comand protocol,and pointing out that we can still fastboot flash partitions to make permanent changes.
-strace for originally discovering the location of the lock status flag(check out this thread for more info)
- @Mutasek24 for fearlessly testing all commands
- @w3by for finding and testing 00408405 flag location
the usual disclaimers:
-i have tested this on my device,but use this info at your own risk. if it melts your phone into an aluminum gooey mess,crashes your pc,or causes any other issues,its not my fault.
then the most important disclaimer:
*be very careful when editing. accidentally adding or deleting something could change all offests,and leave your device unrecoverably bricked. do NOT use someone elses modified file. p8 is device specific
in other words,if this scares you,and an RUU is available for your device,run the RUU instead.
prerequisites:
-you must be S-OFF
-you must have superuser installed
-you must have adb and fastboot,and working drivers(if required) installed on your machine
this will require the use of a hex editor. for windows,i use HxD
1)copy p8
-open a command window and change to your adb/fastboot directory
-enter the following:
adb shell
su (if needed to get a # prompt)
dd if=/dev/block/mmcblk0p8 of=/sdcard/mmcblk0p8
exit
exit (if needed to get back to a regular prompt)
adb pull /sdcard/mmcblk0p8
youll now find a copy of p8 in your adb/fastboot folder. transfer it to a safe location (alternately,you could open your internal storage on the pc and drag the file to a different folder)
2)modify p8
-fire up your hex editor and open the mmcblk0p8 file
-scroll down to 00408400. what youll see if this:
the numbers 68 25 32 C6 are a constant.dont mess with them! the fifth digit(location 00408404) is your tampered flag. in some cases,you could find your tampered flag one spot over,at 00408405(more info).
on m9,its commonly a 10,but ive also seen 08 and it really could be anything. we need to change it to a 00.
carefully click in front of then 10,and type a 0. this should overwrite the 1 and change to 00(if you have a "0-other number" youll need to enter 0 twice)
again, be very careful not to add or delete any digits!!!
what you should now see is this:
once your confident its right,save the file as mmcblk0p8mod.img ( adding the file extension is important) to your adb/fastboot directory
3)install your untampered file
in the cmd window,enter:
adb reboot bootloader (this should take you to the white bootloader screen NOT download mode)
fastboot flash pg2fs mmcblk0p8mod.img
fastboot reboot-bootloader
you should now see software status: original
your cmd window should look like this:
Code:
E:\mini_adb\miniadb_m9>[COLOR="Red"]adb shell[/COLOR]
[email protected]_himaul:/ $ [COLOR="red"]su[/COLOR]
su
[email protected]_himaul:/ # [COLOR="red"]dd if=/dev/block/mmcblk0p8 of=/sdcard/mmcblk0p8[/COLOR]
dd if=/dev/block/mmcblk0p8 of=/sdcard/mmcblk0p8
48510+0 records in
48510+0 records out
24837120 bytes transferred in 5.605 secs (4431243 bytes/sec)
[email protected]_himaul:/ #[COLOR="red"] exit[/COLOR]
exit
[email protected]_himaul:/ $[COLOR="red"] exit[/COLOR]
exit
E:\mini_adb\miniadb_m9>[COLOR="red"]adb pull /sdcard/mmcblk0p8[/COLOR]
2986 KB/s (24837120 bytes in 8.122s)
E:\mini_adb\miniadb_m9>[COLOR="Red"]adb reboot bootloader[/COLOR]
E:\mini_adb\miniadb_m9>[COLOR="Red"]fastboot flash pg2fs mmcblk0p8mod.img[/COLOR]
target reported max download size of 536870912 bytes
sending 'pg2fs' (24255 KB)...
OKAY [ 0.609s]
writing 'pg2fs'...
OKAY [ 0.213s]
finished. total time: 0.826s
E:\mini_adb\miniadb_m9>[COLOR="red"]fastboot reboot-bootloader[/COLOR]
rebooting into bootloader...
OKAY [ 0.009s]
finished. total time: 0.010s
other useful threads:
lock/unlock bootloader: http://forum.xda-developers.com/one-m9/general/how-to-lock-unlock-bootloader-htcdevs-t3092036
change mid: fastbooot oem writemid xxxxxxxxx
change cid: fastboot oem writecid xxxxxxxx
mine
Nice, glad you got it working. I would have rather done this then flash my rom.zip 3 times
an0ther said:
Nice, glad you got it working. I would have rather done this then flash my rom.zip 3 times
Click to expand...
Click to collapse
Lol,I did tell you it was coming
I wanted to come up with some way to avoid the need for hex editing, but couldn't really come up with anything. So I guess it is what it is for now
Do you know if this will need to be done every time something is flashed? Or once s off and we do it once, it sticks with official...?
Edit: worked well
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Sent From My HTC One (M9)
Eazy Peazy!
@scotty1223
german translation: http://www.android-hilfe.de/root-cu...-software-status-official-s-off-new-post.html
Rydah805 said:
Do you know if this will need to be done every time something is flashed? Or once s off and we do it once, it sticks with official...?
Edit: worked well
Sent From My HTC One (M9)
Click to expand...
Click to collapse
Just once. Once you're s off the flag is not set
It worked, thanks
If anyone should use another editor like Hex Workshop the position can be displayed as 004083FE (see attached files).
Scotty, first of: all my respect to your work, man. I have been following what you do ever since you started it, I think, but never had any reason to ask you stuff.
Now: I have one question: P8 is pg2fs_ship_signkey.img in the RUU. Can you explain to me why P8 is device specific if its also delivered in a RUU? Is the RUU image maybe just a partial P8?
Oh I should just pull it and chase it through Beyond Compare but its Sunday night, after a long workday and I am lazy.
And oh yea, I wanted to hook up and say hello and thanks and ask if you wouldn't want to discuss the one or other thing occasionally. Not sure you ever visited my firmware threads but if you did, you might have seen that my main goal is to learn and share what I learned and have people educate themselves on everything HTC Firmware. I'd be totally happy to see you linked there. Profit for everyone.
scotty1223 said:
to get a # prompt)
dd if=/dev/block/mmcblk0p8 of=/sdcard/mmcblk0p8
Click to expand...
Click to collapse
I don't have an m9 yet, but is it safe to copy and paste this command like the old devices to get the p8 from the specific one we would have now? Thanks in advance and for your great work. Wish I could give back something like this. :thumbup:
If you install RUU and puts Officer, thanks!
Enviado desde mi HTC One M9
Many THANKS Sir! Worked like a charm!
Sneakyghost said:
Scotty, first of: all my respect to your work, man. I have been following what you do ever since you started it, I think, but never had any reason to ask you stuff.
Now: I have one question: P8 is pg2fs_ship_signkey.img in the RUU. Can you explain to me why P8 is device specific if its also delivered in a RUU? Is the RUU image maybe just a partial P8?
Oh I should just pull it and chase it through Beyond Compare but its Sunday night, after a long workday and I am lazy.
And oh yea, I wanted to hook up and say hello and thanks and ask if you wouldn't want to discuss the one or other thing occasionally. Not sure you ever visited my firmware threads but if you did, you might have seen that my main goal is to learn and share what I learned and have people educate themselves on everything HTC Firmware. I'd be totally happy to see you linked there. Profit for everyone.
Click to expand...
Click to collapse
hey sneeky,unfortunately i cant explain exactly why p8 shouldnt be shared. my first desire was to simply provide an image,have users download and flash. however,all the ones ive compared have some subtle differences,so i asked beaups his thots on it,and the answer was a clear "no,thats a bad idea. p8 is device specific so users will need to mod their own",so i took his word for it. i know in the past folks have done some shady stuff like that with m7 and m8,and while it may not casue a devestating failure while s off,the prollem may arrise later when they(for whatever stupid reason) turn s on. ive seen hard bricks,soft bricks,and in many cases the reappearance of the tampered flag after a couple of reboots and factory resets. not sure what the actual consequences coulod be in this particular situation.
as for the ruu,i cant really answer that either. ive noticed it also,and my best guess is that the ruu is only having a partial image,or doing a check to mod the image present and not actualy flashing a new one. wish i had a better answer for you than that,lol.
i have been to your firmware threads,and they are a wealth of valuable information. definately hit me up if you ever want to have discussions :highfive:
darkenedpath said:
I don't have an m9 yet, but is it safe to copy and paste this command like the old devices to get the p8 from the specific one we would have now? Thanks in advance and for your great work. Wish I could give back something like this. :thumbup:
Click to expand...
Click to collapse
im not sure what youre asking. if you dont have an m9 yet,what are you wanting to run the command on?
scotty1223 said:
im not sure what youre asking. if you dont have an m9 yet,what are you wanting to run the command on?
Click to expand...
Click to collapse
Sorry. I don't have one yet, but do plan on getting an m9 soon. I'm just trying to keep up and get as much information as I can on this new thing. I re-read the OP feel like a dummy and should have deleted my post. Again, sorry and thanks.
darkenedpath said:
Sorry. I don't have one yet, but do plan on getting an m9 soon. I'm just trying to keep up and get as much information as I can on this new thing. I re-read the OP feel like a dummy and should have deleted my post. Again, sorry and thanks.
Click to expand...
Click to collapse
No prollem. It's definitely good to read and research as much as possible,even prior to acquiring a new device. ?
Sent from my HTC One max
yes it works on my both M9
thx a lot
scotty1223 said:
hey sneeky,unfortunately i cant explain exactly why p8 shouldnt be shared. my first desire was to simply provide an image,have users download and flash. however,all the ones ive compared have some subtle differences,so i asked beaups his thots on it,and the answer was a clear "no,thats a bad idea. p8 is device specific so users will need to mod their own",so i took his word for it. i know in the past folks have done some shady stuff like that with m7 and m8,and while it may not casue a devestating failure while s off,the prollem may arrise later when they(for whatever stupid reason) turn s on. ive seen hard bricks,soft bricks,and in many cases the reappearance of the tampered flag after a couple of reboots and factory resets. not sure what the actual consequences coulod be in this particular situation.
as for the ruu,i cant really answer that either. ive noticed it also,and my best guess is that the ruu is only having a partial image,or doing a check to mod the image present and not actualy flashing a new one. wish i had a better answer for you than that,lol.
i have been to your firmware threads,and they are a wealth of valuable information. definately hit me up if you ever want to have discussions :highfive:
Click to expand...
Click to collapse
I ran a pulled P8 and the pg2fs_ship_signkey.img throug Beyond Compare today and its pretty clear the image from the RUU is only partial. Its a small piece of encrypted stuff that goes into roughly the first third of the large P8, a small set of unencrypted strings that go right at the start and thats it. The rest of the partition is mostly zeroes (empty) and some very few offsets with just some tiny bits of info there, mostly encrypted. One is the tampered flag. It even says "tamper" in plain text before it. If it is that bit, it looks different to what you posted. But that plain text was some sort of clue lol.
The entire section after that encrypted block from ship_signkey is not found in the RUU image.
Worked like a charm thank you
Will tbis lock the device? I want to reset to official but unlocked with s-off. Does that make sense? I read in the re-lock bootloader thread that once re locked you can't set system to RW..
Sent from my 0PJA2 using Tapatalk
Related
Hi everybody, this is my first post, though I've been a reader from a long time ago.
Long story short: I received this milestone 2 from my brother, my other phone is a defy (cm7), I use both of them, updated to cm9 on milestone, milestone kaput, need help, has anybody got a clue on what is going on with my phone?
Last night or so I grabbed a copy of the latest CM9 rom from the forum, installed it and really loved it. Except for two messy TINY things. except for that I cannot believe I got almost 2 days of battery out of it!!!
First issue: Google apps, I mean anything google related, won't work and FC. even if I am am on the browser, and try to type an address, the second google search kicks in to show suggestion dara! dead google crap.
Second Issue: Home button won't do anything. I mean the phone does vibrate when it is pressed, by the way I already chcked for key assignments, not even long-pressing it will show any response except for the vibration.
Third issue: Say Im reading something, lock my phone... when unlocking it, it won't show me the lockscreen, even though it is activated.
at first I said "ok let's swap launchers maybe I can make it go away" and so Ive tried ADW ex, trbuchet and a couple more, with no success, going back to ADW regular, a very nice thing here, is that video recording has worked well since the first time I flashed the rom.
Thanks for your eventual responses!!
I almost forgot: this is what I have done until now: flashed and reflashed at least 6 times, flashed gapps, flashed gapps fix, in many combinations, wiping the hell out of the phone every time... I'm really stuck in here!
Ive also searched not only the forums but the internet aswell, and I find my googling skills pretty decent to be fair
New developments!
So, I got a little curious.. I had installed on my milestone the ics alike cm7... or so I remember, (if it was a theme my bad, anyway...) I was going through phone information, and I noticed something strange:
Android version: 2.3.7
mod version: CyanogenMod-72-111215..........NIGHTLY Milestone 2 gb
Build number: Gingerbread GWK74 CyanogenMilestone 2
so one does not have to be a genius to just see that I *may* have not applied the update, or that the updating process was somehow incomplete.. question has anybody who has ever applied CM9 on their phones came to this issue?? have you applied the update via cwmod or stock recovery or wtf am I doing wrong here uh?
I am really, really puzzled!!
cm7 has a theme that make it looks like ICS but its still a gingerbread (2.3.x android version).
CM9 is the real ICS.
You installed CM7 with a ICS theme, as we can see in your mod version: CyanogenMod-72-111215..........NIGHTLY Milestone 2 gb
knew that already!
yup dude, you are totally right, I may have confused you people along my post...
I have had installed CM7 with the ICS theme, the one with the 2.3.6 android
However, I grabbed a copy of CM9 from this forum (the one based on tezet's work, that first one on the dev thread...)
I flashed that file via cwm..
and I've had, as I state on mi first post here, flashed, reflashed, recontraflashed the thing, and resseted my phone to factory so much that it has got to be newer than brand new now... just kidding..
anyway, thanks for your interest man, my bad!
I've just re-read my post.. I never mentioned that I already had installed CM7 on my milestone!
LOL.
Try this:
In the bootmenu you can choose between "stock" "custom or "latest" recovery, try with a different one i think it worked for me when i used custom recovery.
LOL :S
Dude lol I think I've just messed up BIG TIME.....
well seeing how it didnt seem to work out any way, thanks for pointing out the other recovery methods btw.
I may have not told you the whooole story
the freaking usb connection wont work.. it hasn´t worked since I got the phone nor it has worked now.. the charge led will never turn on, or will the pc or mac or whatever I plug it into react somehow to it.
anyway, I may have flashed the rom again in stock recovery and this is where things got nasty... It doesnt get past the boot logo, which by the way, was the red M logo, the last time I remember it to boot (even after re re re re re re flashing the CM9 rom!!!!!) it had another one.... weird uh????
now it gets even weirder just read this thing!!!
The phone will get past the red M logo, then the screen goes black, but I can see it is lit...
I waited for a really long time (more than 30 minutes) to see no response..
took out the battery... did not power it on again as i had stuff to do..
I dont know why, but I plugged it into the usb cable.. (I was working on the computer) And the phone turned on!!!!!!! so I guess It is not a busted usb port???
I went on ahead to go to bootloader, and when I plug the cable it is shown as such!!!
sadly, rsd does not recognize the phone as plugged, even though the phone says it is indeed plugged in...
what the hell is wrong????
is there any way I can flash anything if Im stuck after the red M?
this sucks
Oh man...
There are 2 versions of gingerbread kernels, the chinese and the European. As i understand you've flashed the wrong version (CH rom over EU GB kernel or otherwise).
You can try flashing the fixed_sbf which is the CH kernel. Or you can try the below, which is my suggestion:
Download the 2.3.4 EU (UK) SBF flash it through RSDlite and then root, installl bootstrap, bootmenu and then the CM9 EU GB rom.
TWO IMPORTANT THINGS: NEVER INSTALL 2.3.6 VIVO OR PERSONAL ARGENTINA SINCE THEY ARE UNROOTABLE!! And also never use RSDlite when you are running low on battery.
And the MS2 is safe for flashing since it has a locked bootloader so its VERY hard to brick it. Your screen is black because it is in the bootloader mode.
Do not Vivo and Claro 2.3.6 roms
Be careful, VIVO and CLARO roms should not be used.
dafuq!
Nite! my man, I´ve been careful enough to avoid flashing wrong kernels so no, the answer is not there..... sadly...
I cannot interact in NO way with the device via USB, so flashing through RSD is a no-go.........
I do have another phone though.........
so the main prob here is now I do know what to do.. I think I´ve always knew rsd is the way to go.. as for the locked BL, yeah! Ive been into motomodding since the c350.. I really think I do know my way in the motorola mess if you know what I mean, OS may have changed but the system's structure's still the same **** from the old days!...
Basically now my question is this:
what the **** can I do given what I have??? (a non working usb connection, and a phone stuck at Bootloader OR stock Recovery....)
donlloreda said:
Nite! my man, I´ve been careful enough to avoid flashing wrong kernels so no, the answer is not there..... sadly...
I cannot interact in NO way with the device via USB, so flashing through RSD is a no-go.........
Click to expand...
Click to collapse
if power+up arrow and then flashing via rsd don't work for you
you only have two options - first is power+x and then @ which gets you to build in recovery (try to wipe or find an update.zip that can be flashed [if there is any - never did that myslef])
or flashing from your custom recovery if you have one installed
that is all i know (but i only have milestone since tuesday )
good luck anyway
Geez man!!!
So have you tried using another usb cable? Cause i've exhausted my theories about your problem... sorry
every freaking cable
As I got it as a gift, I thought my defy´s charger was "not powerful enought" even though that was absolutely ridiculous...
I went and try to buy the charger but nobody in here seems to know the pnhone so I would be kind of afraid to take it to service
Une petit question
so I think I found a really good site with *loads* of firmwares, branded debranded, official etc...
just to be sure, I tried to flash the update again in stock recovery (pwer + x) but at some point the installer promted some error about signature verification in the whole file.
so my question(s) are:
can I make a file *signed* in any way? if so can you point me out where and how to start?
and just to be on the safe side: If only if only I can grab something that I would be able to flash via stock recovery... I should flash a 2.3.7 based one right? If I do try and flash something lower I would make my problems worst right???
btw, If the phone freezes or sometimes goes through the red M, but there is no led lighting up, can I still go into custom recovery eg. CWM???
About the signing the zip file, yes you can, but i don't know how search in the "Android Development" section. But sbf files cannot be signed... if you discover how you will be the MS2 savior!
In the CWM you can flash just about anything as it can be reversed by flashing sbf's, on the otherside, YOU SHALL NOT FLASH!! Any VIVO or PERSONAL ARGENTINA 2.3.6 rom (sbf) cause they are unrootable. You should do just fine flashing the 2.3.4 UK.
And i don't think you will be capable of entering the CWM if the led doesn't flash cause it's an error that happens before CWM is started. In this cases you will have to flash sbf's, root.... all over again.
thaks man, but......
then the only way give I cannot flash under RSD, is making a "completeupdatewhateverCMorMIUUdafuq.zip" signed so I can load it through stock recovery rite???
remember CWM not availible.. nor USB interface...
will search though on "signing" an update file, yes that 2.3.4 UK you said.. from there I'll just try to make it match my defy
a little discovery!
Source: http://www.londatiga.net/it/how-to-sign-apk-zip-files/
When publishing an application or a custom rom you need to sign the .apk or .zip files with a certificate using a private key. The Android system uses the certificate to identify the author of an application and establish trust relationship between applications.
The classic way of doing this was to use keytool then sign it with jarsigner. In this tutorial i’ll explain an alternative method which is relatively easy to use for most people using a tool called SignApk.jar.
SignApk.jar is a tool included with the Android platform source bundle, you can download it from here.
To use SignApk.jar you have to create a private key with it’s corresponding certificate/public key. To create private/public key pair, you can use Openssl. Openssl is relatively easy to use under unix/linux system. For Windows user, you can download Windows version of Openssl here.
How to create private/public key pair using openssl (windows version)
Download openssl package from google code link.
Extract it anywhere...
Within openssl directory type (using cmd admin mode: ctrl+shift+r then cmd):
- openssl genrsa -out key.pem 1024
- openssl req -new -key key.pem -out request.pem
- openssl x509 -req -days 9999 -in request.pem -signkey key.pem -out certificate.pem
- openssl pkcs8 -topk8 -outform DER -in key.pem -inform PEM -out key.pk8 -nocrypt
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
(dload SignApk.rar)
Extract it anywhere
If you don’t have java installed, download and install it.
Copy certificate.pem and key.pk8 into your extracted SignApk directory
Within SignApk directory type (again using cmd admin mode: ctrl+shift+r then cmd):
java -jar signapk.jar certificate.pem key.pk8 your-app.apk your-signed-app.apk
OR
java -jar signapk.jar certificate.pem key.pk8 your-update.zip your-signed-update.zip
Note:
If you don’t want to create your own public/private key pair, you can use test key included in SignApk.rar.
Sooooo now what the hell do I have to sign???
LOL I'll go for the update I was trying to install at first... if anything goes wrong I'll just take it to service I guess have the USB repaired and RSD the hell out of it.. after all this is a reaaaaly great great phone uh?
maybe I should go first with the UK you suggested man?
About my last post
Hello everyone, so... the signing didnt went well LOL -.-
I guess I have to make the "signature" to match moto's right?
how can I get hold of that signature information? I mean can I download a signed (official) update, which is flashable via stock recovery (is there any???) extract the signature information, and then apply it to my package??????
Ok, now just to put things on the clear side: the instructions in the last post were not written well, but you may already knew that if you read the post.
anyway, as for the problems I ran into:
1: ctrl shift r does not do ****... just typoe cmd on the start menu, right-click it and run as admin.
2: It is EASIER if you copy everything to the root of your drive, and give files and folders short names!
3:
openssl genrsa -out key.pem 1024 <here you may run into an error regarding openss.conf.... just copy openss.conf from openss directory to openss/bin/ directory....
openssl req -new -key key.pem -out request.pem
openssl x509 -req -days 9999 -in request.pem -signkey key.pem -out certificate.pem
openssl pkcs8 -topk8 -outform DER -in key.pem -inform PEM -out key.pk8 -nocrypt
ok from now on it is pretty straightforward, I haven't got time to play around but, There is a step in which the program asks for your Company's name, adress, etc.. maybe if you knew what info is in motorola's signature you can make this fields match??
well I don't know.. but ill try and discover it!
donlloreda said:
I mean can I download a signed (official) update, which is flashable via stock recovery (is there any???) extract the signature information, and then apply it to my package??????
Click to expand...
Click to collapse
Nope and nope. Please learn something about signatures, how they work etc. You can't (obviously) "extract" the private key from the signed file... The signing would be useless then - don't you think?
donlloreda said:
anyway, as for the problems I ran into:
Click to expand...
Click to collapse
Seriously? I think you are not from IT industry, right?
donlloreda said:
ok from now on it is pretty straightforward, I haven't got time to play around but, There is a step in which the program asks for your Company's name, adress, etc.. maybe if you knew what info is in motorola's signature you can make this fields match??
well I don't know.. but ill try and discover it!
Click to expand...
Click to collapse
Stop it. You just wasting your time.
Your real options:
1) Get signed update.zip from Moto (I don't think there is any and I did not saw any)
2) get your USB port fixed and flash it via RSDLite. (if it is HW problem - just fix or get it fixed, otherwise, you are doing something wrong)
RSDLite and SBF flash is your only realistic option.
RSDLite works everytime. You can not break (except for HW issue) your M2 the way, it will not work with RSDLite.
MOD EDIT
Seems this guide, if not properly followed will cause a (soft)brick. Also there are more up to date guides.
[how to]change your MID without the eng bootloader
[TOOL] MID change without ENG HBOOT | Aroma GUI
In the interests of all users the guide is hidden, below.
If you wish to follow it go ahead. If you brick your handset, you were warned.
FIRST OF ALL THANKS AND CREDITS GOES TO THE FOLLOWING XDA MEMBERS
@fnoji111 for working on the ENG HBOOT in the Droid DNA forum
@Argumentation for creating the flashable zip that I used for this tuttorial
@daddioj for doing the leap of faith and used the ENG HBOOT on his device which lead me to writing this tutorial
NOTE: I created this tutorial because HTC One has different variants. After reading mike1986. article on HTC One variants I realized why I can't install OTA updates with my model ID (MID). Now since we have S-OFF I wanted to get updates from the UK. But since I have a different MID to the UK version, I can't install OTA updates. And this is the only solution I found to work at this time. So I hope it will help people who wants to change their MID
VIDEO LINK AT THE BOTTOM OF THIS POST
REQUIREMENTS:
1: S-OFF
2: KNOWLEDGE OF ADB COMMANDS
3: PATIENCE
PLEASE MAKE SURE YOU PAY ATTENTION TO EVERY STEP ON THIS TUTORIAL
***** I WILL NOT BE HELD RESPONSIBLE IF YOU BRICK YOUR PHONE*****
STEP 1:
Make sure you don't have HTC Sync Manager installed, if you do uninstall it!! Also make sure you have HTC drivers installed!
Step 2:
Go here http://forum.xda-developers.com/showpost.php?p=38180376&postcount=6 and download the Argumentation's zip file
Step 3:
After downloading the PL83IMG.zip you will need to edit the android-info-txt inside. Please see sample picture below:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Step 4:
Now you have to place the zip file in C:\Android SDK\sdk\platform-tools folder. I know some people don't have the same directory as I have so this is just an example. Just make sure you place in the platform-tools folder.
Step 5:
Now connect your HTC One (MAKE SURE YOUR DEVICE HAS PLENTY OF CHARGE) to your PC and start a command prompt in the "platform-tools" folder. The quickest way to do this is (see picture below):
Step 6:
When you start your command prompt follow the steps in the picture below. PLEASE BE PATIENT!! After flashing the ENG HBOOT your HTC One will not boot up but you'll just get a gray spotted screen. Your device is not bricked. You can still use adb commands to write the model ID and CID even with a gray screen. WHEN REBOOTING HOLD DOWN POWER BUTTON FOR A FEW SECONDS. You might have to press and hold power button and volume down button when rebooting your phone.
NOTE: When you run the RUU and it says "waiting for bootloader" you will need to restart your phone manually by holding down the power button for a few seconds until it reboots. EACH TIME (does it twice) the RUU says "WAITING FOR BOOTLOADER" you will need to restart the phone manually
You will not lose S-OFF and still have unlocked bootloader. I suggest that backup all important stuff before doing this I hope it helps.
If the mods feels that this doesn't belong here, please feel free to remove it. Thanks.
Here's a short video that shows how I changed my MID (model ID) on my HTC One
Just a side note: better to edit all kind of text with notepad++.
1) It formats text better (not just one single line)
2) It keeps Unix coding if needed
EDIT 05.12.2013 by the request of user @alray
THIS METHOD WILL NOT WORK USING WINDOWS 8.1
After flashing ENG hboot, Windows 8.1 won't detect the device and fastboot won't work, so you can't change MID and execute the RUU. (win 8.1 drivers issue).
I'll give this a go shortly
The warning on step six makes no sense
Does it automatically reboot after flashing the zip or what
Sent from my HTC One using xda app-developers app
tyler1234567 said:
The warning on step six makes no sense
Does it automatically reboot after flashing the zip or what
Sent from my HTC One using xda app-developers app
Click to expand...
Click to collapse
Which warning? Like it states in the last picture when you flash the ENG HBOOT it will get stuck at 3/4 of a way in the status bar. You will need to restart the phone yourself. Then you will get a gray screen and won't be able to see anything. You might think it's bricked but it's not. You just have to proceed with adb command to write the MID and then another adb command to write the CID.
Once you have changed the MID and CID. You may have to reboot your phone and then run the RUU even when it's only a gray screen you see. The RUU will flash back the proper HBOOT and you will see the RUU screen (black screen with HTC logo). Just be patient and wait until the RUU is finished its operation. And that is it.
I will make a video when I get home to assure people that this mod works.
Don't know why you started two threads like this? But you have one in General and this one in Development.
But it doesn't belong in Development.
shadowboy23 said:
Which warning? Like it states in the last picture when you flash the ENG HBOOT it will get stuck at 3/4 of a way in the status bar. You will need to restart the phone yourself. Then you will get a gray screen and won't be able to see anything. You might think it's bricked but it's not. You just have to proceed with adb command to write the MID and then another adb command to write the CID.
Once you have changed the MID and CID. You may have to reboot your phone and then run the RUU even when it's only a gray screen you see. The RUU will flash back the proper HBOOT and you will see the RUU screen (black screen with HTC logo). Just be patient and wait until the RUU is finished its operation. And that is it.
I will make a video when I get home to assure people that this mod works.
Click to expand...
Click to collapse
Oh ok I got ya. Didn't see that before.
Xstop said:
Don't know why you started two threads like this? But you have one in General and this one in Development.
But it doesn't belong in Development.
Click to expand...
Click to collapse
If it doesn't belong here then the mods can delete that is fine by me.
EDIT:
Just sent a message to one mod so he can delete this thread if it doesn't belong here.
thank you very much it worked like a charm just changed a tmous mid so far so good waiting to install ota
Xstop said:
Don't know why you started two threads like this? But you have one in General and this one in Development.
But it doesn't belong in Development.
Click to expand...
Click to collapse
False. How is this not developement. And if this isn't developement then neither is the cid thread, or all the stock rom threads.
shadowboy23 said:
If it doesn't belong here then the mods can delete that is fine by me.
Click to expand...
Click to collapse
No harm, just easier to follow one thread since I am interested in this.
I converted my ATT One to the Dev Edition (hoping that nothing ATT is on m phone now except service), easy since both have the same MID but will be doing this for the PN0710000 soon.
Thank you for the tutorial. :good:
so to make sure i just put the same info from the YOUR text file picture in the one i downloaded ?
CheesyNutz said:
so to make sure i just put the same info from the YOUR text file picture in the one i downloaded ?
Click to expand...
Click to collapse
Which one? Do you mean the "android-info-txt"? If that's what you meant then you have to put in your current model ID, CID and ROM version..If it's the same as mine then you just copy what is written in the first picture. Just remember that Argumentation's zip file is intended for Droi DNA but all you have to edit id the "android-info-txt" and you don't have to touch the HBOOT.nb0.
A video lesson would be perfect
Tried to do something, but adb is not for me, I guess...
It would be perfect to change from carrier to free uk version..
darenas said:
A video lesson would be perfect
Click to expand...
Click to collapse
Uploading now, will post it in the OP when finished. The video is not a tutorial of some sort but more of a guide. It just shows you the process of actually flashing the ENG HBOOT and what I typed using adb/fastboot commands.
shadowboy23 said:
Uploading now, will post it in the OP when finished. The video is not a tutorial of some sort but more of a guide. It just shows you the process of actually flashing the ENG HBOOT and what I typed using adb/fastboot commands.
Click to expand...
Click to collapse
It's perfect will it include only the procedure of changing mid/cid, or maybe it will also include the beginning of downloading and setting up s-off? it would be great, because i didn't find how to get and use adb correctly...
---------- Post added at 10:20 PM ---------- Previous post was at 10:18 PM ----------
darenas said:
It's perfect will it include only the procedure of changing mid/cid, or maybe it will also include the beginning of downloading and setting up s-off? it would be great, because i didn't find how to get and use adb correctly...
Click to expand...
Click to collapse
I see already.
darenas said:
It's perfect will it include only the procedure of changing mid/cid, or maybe it will also include the beginning of downloading and setting up s-off? it would be great, because i didn't find how to get and use adb correctly..
Click to expand...
Click to collapse
Well my phone has S-OFF and have a unlocked bootloader. S-OFF is a MUST! You will see in the video very clearly what I type in adb/fastboot so I'm pretty sure people can work it out.
Video link is up! It is at the bottom of the OP. I hope it helps people.
Done with OTA :thumbup:
Sent from my HTC One using Tapatalk 2
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
For HTCDEV unlocked devices :
Phiber2000 said:
Unlocked devices via HTCdev need to be prepared via Option 'h' in main menu.
This will do the downgrade too.
Click to expand...
Click to collapse
As you know, the AAHK has expired and is no longer being developed by the author and there is no official support more!
For this reason, there is now Phiber's 2000 AAHK2, which has already grown according to your wishes and will continue to grow.
The original script was adapted, bugs were fixed, and unnecessary things were removed and slightly the HBOOT was modified.This should also work with Unlocked DHDs by HTCDEV.
Code:
#include
/*
* Your warranty is now void.
*
* I am not responsible for bricked devices, dead SD cards
* YOU are choosing to make these modifications, and if you point the finger at me for messing up your device, I will laugh at you.
*/
Click to expand...
Click to collapse
The Requirements:
-PC with Windows XP, Windows 7 or (Windows 8)
-Charged battery at least 75%
-Original HTC USB Cable
-Make sure that the USB cable and the USB port of your phone and PC are in order (loose contact)
-Use USB2.0 port on the back of a PC ( Don't use an USB 3.0 port or USB Hub )
-If you use a laptop please charge the battery and use the Charger.
- original ROM
Original boot image ( this is not the HBOOT)
original Recovery
Formatted SD card (AFAT32 4KB sector size)from one of the following brands:
Samsung
SanDisk
Patriot Memory
ADATA
CAUTION: If you use an incompatible SD card, the HBOOT will not working. Android also now no longer boots. This fix is expensive and risky!
Among others the following brands lead to a soft-brick: Agfa, Hama, Trascend, No Name
-Enable USB-DEBUGGING : Settings » Applications » Development » USB debugging
-Connection Type "Charge Only": Settings » Connect to PC » Default connection type » Charge only
-HBoot-Status: *** LOCKED *** or *** LOCKED (OOW) *** or *** RELOCKED *** , or without lock status displayed
When the mode of the bootloader is "ENG S-OFF", the LOCK status does NOT play a role!
Instructions:
Install HTC Drivers v4.0.1.001
Extrackt AAHK2
Start The script with Administrator Rights (aahk2.cmd)
In the main menu "1" and confirm.
Follow the instructions on the PC strictly.
If a downgrade was necessary, the procedure must be repeated. (If you dont know you have to downgrade or not, use the script it will tell you if you need it or not)
Flash the current, (modified by Phiber2000) HTC image to prevent later problems with GPS/WiFi and sound (see FAQ).
Optional: Finally, copy a Custom ROM on the SD card and flash in recovery.
Downloads:
HTC Driver v4.0.1.001(only if you had'nt installed already driver)
AAHK2 v2.15 - Mirror
HTC WWE 3.12.405.1 with ROOT - GPS FIX(Radio: 12.65.60.29/26.14.04.28 M) (HBoot-Image) - Mirror
Required RUU images are requested by the script: (In original Thread are more mirrors)
PD98IMG DOWNLOAD LINKS
MEGA:
PD98IMG-GB1.zip
PD98IMG-GB2.zip
PD98IMG-GB3.zip
PD98IMG-GB4.zip
PD98IMG-GB5.zip
PD98IMG-GB6.zip
PD98IMG-GB7.zip
PD98IMG-GB8.zip
PD98IMG-GB9.zip
FAQ:
How do I get into the HBOOT loader and which version do I have?
-Disable Fast boot: Settings »Power» Fast boot
-Switch off you phone
-Hold "Volume Down" and "Power" button
-Once the HBOOT loader appears, release the keys
-In the upper part of green written is now available the relevant information:
-0(evtl. rosarote Zeile)Lock-Status
1 ACE PVT...HBoot-Loader Modus & Security Flag
2 HBoot-...HBoot-Loader Version
3 MICROP-...not relevant
4 TOUCH PANEL-...not relevant
5 RADIO-...RADIO-Image Version
6 ...not relevant
How do I get to FASTBOOT mode?
-Start HBOOT loader (see above)
- Navigate with the volume keys to "FASTBOOT"
-Confirm by pressing the Power button
Which CID I have ?
-Start FASTBOOT mode (see above)
-On the PC, open existing Android SDK in CMD
-Type "fastboot getvar all"
-In the line "INFOcidnum ..." is now your current CID. (8 digits)
CAUTION: Apps like CID GETTER don't work properly. Because the App asks the Build.Prop and everybody could change the build.prop.
How do I install after successfully rooting the latest ROM from HTC(modified by Phiber)? (This also fixes problems with GPS/Wifi/Soumd on custom ROMs!)
-Unzip the "RUU_Ace_Sense30_S_HTC_WWE_3.12.405.1_Radio_12.65.6 0.29_26.14.04.28_M_release_225512_rooted.zip"
-Copy the "PD98IMG.zip" as a single file on the SD card
-Start HBOOT loader and wait few seconds
-Confirm query with "Volume Up"
-After successfully flashing confirm the query with "Power"
-Remove the SD card
-Let android boot
-Insert SD card
-Delete the "PD98IMG.zip" from the SD card
Credits:
Hyuh
attn1
shad0wf0x
Anthony1s
Revskills
Genepoole
Phiber2000
Donation:PAYPAL LINK
If you want to help Phiber2000 to continue his work please donate to him ! The support takes also much time on Android-Hilfe.de
What to do next?
Read some FAQs and sticky Threads
Update the Recovery
Make a Nandroid/Backup
Install a Custom Rom {DHD Development List: ROMs, Kernels, and More}
Great but the download link i would mirror as it currently stands there is no free download slots at all so no one can download the file. Just a heads up. Use Mega if possible.
Yep but i think Phiber2000 dont wants it. So we cant mirror it.
Well Phiber2000 will find easily that people will not download the file then. Putting it on a host that has no free download slots from time to time where there is something like Mega where there is no free user slot limit is stupid. Its upto the OP all i was doing was stating a issue. I don't need AHHK i have my own way of doing the same thing from work i have done with a fellow member on here.
Ok i will ask Phiber2000
"I don't need AHHK i have my own way of doing the same thing from work i have done with a fellow member on here. "
I am interested in your work. Could tell me something more (PN)?
Its basically like AAHK using the same source but was scripted a different way. It used the same files but had more options on the recovery.img's and was also a two batch file system.
Only Difference was the Hboot after says AHHK and OP's just says Unlocked.
I asked Phiber and He said that he doesnt want mirrors. Nobody is forced to download AAHK2. If somebody is feeling sick because oft the download speed then its his personal problem.
3498BoyZ said:
I asked Phiber and He said that he doesnt want mirrors. Nobody is forced to download AAHK2. If somebody is feeling sick because oft the download speed then its his personal problem.
Click to expand...
Click to collapse
you can't even get to the part where you download it.that's a 100% chance that it won't be used.
Which is what i said but everyone to there own.
Yup, can't download, therefore I find this thread useless...
ilans93 said:
Yup, can't download, therefore I find this thread useless...
Click to expand...
Click to collapse
No free slots for free users! Hmm.. mods pls close this thread lol.
On the serious note, for someone who really really want to s-off their dhd, just use aahk. Even though it is no longer supported, if you really knows what you are doing, s-off is easily achieved. The documentation is PERFECT and all the FAQ is provided. Although the file is no longer in attn1 server, you can still download it from this thread:
http://forum.xda-developers.com/showthread.php?t=2193681 (READ THIS THOROUGHLY)
For someone who actually not confident to do this but still want to try custom rom, unlocking bootloader will be a better choice. So, ask yourself what do you really want and how is your comprehension skills. :cyclops:
Why are here all against the DL Link. If there arent any Slots then just wait. You could be some more thankful
Gesendet von meinem HTC One X mit Tapatalk 2
Because we can't use it... If the dev would make a mirror, then we would be thankful. Here, it's all about sharing.
Sent from my Desire HD using xda app-developers app
If Phiber2000 dont want mirror then i cant uplaod it on a other site
You have just wait some minutes/hours/days then you can download it.
You and I have to respect Phibers descion
-----------------------------------------------------------------------
yumm91 said:
No free slots for free users! Hmm.. mods pls close this thread lol.
On the serious note, for someone who really really want to s-off their dhd, just use aahk. Even though it is no longer supported, if you really knows what you are doing, s-off is easily achieved. The documentation is PERFECT and all the FAQ is provided. Although the file is no longer in attn1 server, you can still download it from this thread:
http://forum.xda-developers.com/showthread.php?t=2193681 (READ THIS THOROUGHLY)
For someone who actually not confident to do this but still want to try custom rom, unlocking bootloader will be a better choice. So, ask yourself what do you really want and how is your comprehension skills. :cyclops:
Click to expand...
Click to collapse
AAHK destroyed my friends DHD!
AAHK is only for skilled people!
AAHK2 is for Noobs and skilled people AND IT WILL NOT BRICK YOUR DEVICE
EDIT: THE FILES WERE MIRRORED
I was asked to test the free download links on this.
I was begining to think it was true that there are actually no Free download slots. I tried many times over several minutes and every time it said no free download slots. BUT after some minutes of clicking the "return to download link" it did actually give me free slots for all the downloads.
Not ideal, but it does seem possible to get a free download.
Mike
Thnks and as I said the files were mirrored to uploaded because of the problem with share-online
aahk was also made for noobs, but people were too dumb to read the freaking manual. that's mostly the reason why attn1 closed the door for aahk. the aahk wouldn't brick your device unless there was some human error involved.
also if anyone has the file i can mirror it.
Sent from my S4 GT-I9505
pitastrudl said:
aahk was also made for noobs, but people were too dumb to read the freaking manual. that's mostly the reason why attn1 closed the door for aahk. the aahk wouldn't brick your device unless there was some human error involved.
also if anyone has the file i can mirror it.
Sent from my S4 GT-I9505
Click to expand...
Click to collapse
I have finally managed to get the file and I could also mirror it, but the dev said that we can't mirror it...
---------- Post added at 10:45 PM ---------- Previous post was at 10:22 PM ----------
Just to be sure... @3498BoyZ Am I supposed to download all 9 PD98IMGx.zip, unzip them and zip them back together as one, or am I supposed to download only one? -that's a bit unclear to me...
[/COLOR]Just to be sure... @3498BoyZ Am I supposed to download all 9 PD98IMGx.zip, unzip them and zip them back together as one, or am I supposed to download only one? -that's a bit unclear to me...
Click to expand...
Click to collapse
No just Start then aahk2.cmd and follow the points. It will tell you which file From the 9 you will need
[email protected] from my Mobile [email protected]!
Hi there
Well, as we really need Interop Unlock for our Lumia phones, i decided to check this out myself.
As i already have ATF Box for a long time, i decided to buy JTAG activation and dolphin clip + lumia jigs, that i do not have to solder my phone.
Also i have ordered a Lumia 520 testing phone on ebay.
So, as the ATF Team made an awesome JTAG software update, i'm trying to interop unlock that Lumia 520 the hardware way, as just software seems to be too tough...
Well, what i did so far:
1. Freshly flashed Lumia 520 RM-914 with latest stock rom
2. Did the setup/beginning after turning it on for 1st time
3. developer unlocked it with SDK on PC
4. Made Full Dump with JTAG from dev-unlocked phone
5. Mounted MainOS partition of dump with program "OSFMount" (-->appears as Local harddisk example drive E: )
6.Loaded the SOFTWARE hive with regedit on PC from "E:\Windows\System32\config"
7. Edited the following values:
PortalUrlInt = http://127.0.0.1
PortalUrlProd = http://127.0.0.1
MaxUnsignedApp = 10003
8. unloaded SOFTWARE hive
9. unmounted dump-image
10. wrote image back via jtag
I thought it might be a good Idea to dev-unlock the phone before messing with the registry, to make sure "DeveloperUnlockState = 1" gets written the "legal" way, as the key is not available in registry before.
Maybe it's better to just modify an existing key, than adding a new one...
Well, long story short: The result is not totally satisfying.
After writing the modified image back to the EMMC, the phone is booting up, but i can NOT deploy homebrew apps that require interop unlock, like @GoodDayToDies "EnableAllSideloading.xap" for example.
But i can deploy "nomal" apps like @cpuguys "Toastlauncher" and @GoodDayToDies "Webserver"
The weird thing: If i check the reg-values via WebServer on the Phone, i can see my edited values.
So the changes ARE written to the phone. The phone just doesn't use them...
So, the good thing: phone is booting with modified rom :good:
But, the bad thing: Changes are not working.
EDIT:
SUCCESS!!!
After adding
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
i could successfully sideload "EnableAllSideloading.xap"
After executing enableallsideloading i could sideload latest WPHTweaks build.
Now i have 3rd tile row enabled!
awesome!
Also member @myst02 is working on interop-unlocking the lumia phones. So we decided to make this a together-project.
See his achievements here: http://forum.xda-developers.com/showthread.php?t=2713098&page=10 :good:
reserved
to be able to sideload EnableAllSideloading.xap you need to change following registry key:
Software\Microsoft\SecurityManager\CapabilityClasses
add: MultiSz String
name: ID_CAP_DEVELOPERUNLOCK_API
value: CAPABILITY_CLASS_THIRD_PARTY_APPLICATIONS
have fun.
I have found this during smurfing on the internet.
Dont know if this is something worth trying, but maybe it gives you some pointers or help.
http://windowsphonehub.in/tutorials...eloper-unlock-windows-phone-sideload-10-xaps/
lordmaxey said:
Well, as we really need Interop Unlock for our Lumia phones, i decided to check this out myself.
Click to expand...
Click to collapse
Good job!
lordmaxey said:
Let's get this rolling, guys! :good:
Click to expand...
Click to collapse
BTW, it's not a real "hack", and not acceptable/affordable for the 99.9% Lumia users and developers...
Wow you did a fantastic job
as @error0x0000034 mentioned you forget to open DeveloperUnlock_API
Software\Microsoft\SecurityManager\CapabilityClass es
add: MultiSz String
name: ID_CAP_DEVELOPERUNLOCK_API
value: CAPABILITY_CLASS_THIRD_PARTY_APPLICATIONS
sensboston said:
BTW, it's not a real "hack", and not acceptable/affordable for the 99.9% Lumia users and developers...
Click to expand...
Click to collapse
Yeah, but it's at least something worth trying
ngame said:
Wow you did a fantastic job
as @error0x0000034 mentioned you forget to open DeveloperUnlock_API
Software\Microsoft\SecurityManager\CapabilityClass es
add: MultiSz String
name: ID_CAP_DEVELOPERUNLOCK_API
value: CAPABILITY_CLASS_THIRD_PARTY_APPLICATIONS
Click to expand...
Click to collapse
Oh, i see...
I'm just wondering that this CAP was not secessary on Ativ S?
Or am i wrong?
I really thought it was just the 3 regkeys quoted in the first post...
lordmaxey said:
Yeah, but it's at least something worth trying
Oh, i see...
I'm just wondering that this CAP was not secessary on Ativ S?
Or am i wrong?
I really thought it was just the 3 regkeys quoted in the first post...
Click to expand...
Click to collapse
I don't remember Ativ S Interop but I know it had a BootStrap app
maybe that app unlock this api i'm not sure but I know you have to open this cap first to run EnableAllCapabilities
Nice work :good:
so now , you can make a small bussines with this
interop unlock for only *** $
and you are now the one and only interop unlocked retail Lumia owner
ceesheim said:
Nice work :good:
so now , you can make a small bussines with this
interop unlock for only *** $
Click to expand...
Click to collapse
Haha Yay, i'm going to be rich *lol*
ceesheim said:
and you are now the one and only interop unlocked retail Lumia owner
Click to expand...
Click to collapse
No, not yet.
I'm trying to deploy the bootstrap samsung app to the 520 this afternoon. If it works, i maybe can deploy the other apps.
If not, i'm trying to open that CAP by editing the Dump again and writing it back via JTAG.
We'll see, but i'm curious
btw: Why are these damn smileys always displayed in the next line?
btw: Why are these damn smileys always displayed in the next line?
don't know , i just seen that too
lordmaxey said:
Haha Yay, i'm going to be rich *lol*
No, not yet.
I'm trying to deploy the bootstrap samsung app to the 520 this afternoon. If it works, i maybe can deploy the other apps.
If not, i'm trying to open that CAP by editing the Dump again and writing it back via JTAG.
We'll see, but i'm curious
btw: Why are these damn smileys always displayed in the next line?
Click to expand...
Click to collapse
Samsung Bootstrap uses some Samsung-specific DLLs as far as I know. This won't help you, tried this already on my Huawei Ascend W1. This won't work on your Lumia either I think. But its worth a try of course.
You'll have to edit the registry key I mentioned before to be able to sideload EnableAllSideloading.xap. You need to load the SOFTWARE file from Windows/System32/config again into your registry and edit following key. Maybe try using a registry editor on your phone before using the method you described above, but I don't think that this will work. So, you probably have no other choice than opening up your device again and edit the SOFTWARE reg-file. Then sideload EnableAllSideloading.xap and you'll be able to sideload pretty much everything you want.
Question for more experienced devs and hackers:
Is there a registry tweak or some settings anywhere else on the phone that we can access though JTAG and that allows us to boot the phone (Lumia in this case) as a mass storage device with full filesystem access? Like on the Huawei Ascend W1. This would simplify the process of changing registry keys a lot.
Best regards and good luck.
lordmaxey said:
Haha Yay, i'm going to be rich *lol*
No, not yet.
I'm trying to deploy the bootstrap samsung app to the 520 this afternoon. If it works, i maybe can deploy the other apps.
If not, i'm trying to open that CAP by editing the Dump again and writing it back via JTAG.
We'll see, but i'm curious
btw: Why are these damn smileys always displayed in the next line?
Click to expand...
Click to collapse
Bootstrap Samsung will not work on Lumia.
error0x0000034 said:
Samsung Bootstrap uses some Samsung-specific DLLs as far as I know. This won't help you, tried this already on my Huawei Ascend W1. This won't work on your Lumia either I think. But its worth a try of course.
You'll have to edit the registry key I mentioned before to be able to sideload EnableAllSideloading.xap. You need to load the SOFTWARE file from Windows/System32/config again into your registry and edit following key. Maybe try using a registry editor on your phone before using the method you described above, but I don't think that this will work. So, you probably have no other choice than opening up your device again and edit the SOFTWARE reg-file. Then sideload EnableAllSideloading.xap and you'll be able to sideload pretty much everything you want.
Click to expand...
Click to collapse
Like this then, right?
Ok, I'll try this next week, i sadly won't have time this weekend.
error0x0000034 said:
Question for more experienced devs and hackers:
Is there a registry tweak or some settings anywhere else on the phone that we can access though JTAG and that allows us to boot the phone (Lumia in this case) as a mass storage device with full filesystem access? Like on the Huawei Ascend W1. This would simplify the process of changing registry keys a lot.
Best regards and good luck.
Click to expand...
Click to collapse
No. once JTAG halts the phone, it's halted. You can't just "pause" the phone, make changes and continue booting. Sadly.
So, only chance is by writing the modified dump back.
It's not for Lumia only, it's a universal method for every WP8 devices (including emulator) that could enter MassStorage mode
And the Bootstrap app is not a magic, it use the system service by Samsung to modify the CapabilityClasses registry key mentioned by above and this could be done by modify reg hive directly
lordmaxey said:
Like this then, right?
Ok, I'll try this next week, i sadly won't have time this weekend.
Click to expand...
Click to collapse
exactly. I have done this on my Ascend W1 several times, but its easier, because I can enter Mass Storage Mode through bootloader.
No. once JTAG halts the phone, it's halted. You can't just "pause" the phone, make changes and continue booting. Sadly.
So, only chance is by writing the modified dump back.
Click to expand...
Click to collapse
I don't know how JTAG method works exactly, I only know that the device needed isn't cheap and can restore bricked phones. How it works? I have no idea, but I'm sure I'll learn quickly.
I will do some research on that soon. I'm a learning noob. :cyclops:
best regards,
error0x0000034
error0x0000034 said:
I don't know how JTAG method works exactly, I only know that the device needed isn't cheap and can restore bricked phones. How it works? I have no idea, but I'm sure I'll learn quickly.
I will do some research on that soon. I'm a learning noob. :cyclops:
Click to expand...
Click to collapse
Me neither
Most credits go to X-Shadow from advance-box team.
Because i had the Idea of modifying the phone dump and read/write via JTAG.
But usually, ATF only supported bootloader repair via JTAG. So i contacted X-Shadow and within only two weeks he updated the jtag-application, and added Custom Read/Write to every part of the EMMC.
That's how i could dump the rom, modify it and write it back.
Absolutely awesome work from that team, just releasing a software because of ONE single inquiry. :good::good::good:
Aw crap, I totally forgot to tell you to test a pure-interop app (like the bootstrap one). You interop-unlocked but failed to capability-unlock, and most WP8 homebrew requires both so of course you couldn't sideload it. DERP
But hey, if you successfully edited the capability class of ID_CAP_DEVELOPERUNLOCK_API - and it looks like you did, or could - then you can use EnableAllSideloading to capability-unlock the phone (it just edits all the other capabilities' classes). I could probably also write a "BootstrapNokia" app if you'd like; I think we have interop-based registry functions for WP8 Lumias, which would allow (for example) making SamWP8 Tools work on your Nokia as well.
SamWP8 tools on Nokia would be great.
I'll check that monday evening, when i'm back at my computer.
I'll keep you informed
GoodDayToDie said:
Aw crap, I totally forgot to tell you to test a pure-interop app (like the bootstrap one). You interop-unlocked but failed to capability-unlock, and most WP8 homebrew requires both so of course you couldn't sideload it. DERP
But hey, if you successfully edited the capability class of ID_CAP_DEVELOPERUNLOCK_API - and it looks like you did, or could - then you can use EnableAllSideloading to capability-unlock the phone (it just edits all the other capabilities' classes). I could probably also write a "BootstrapNokia" app if you'd like; I think we have interop-based registry functions for WP8 Lumias, which would allow (for example) making SamWP8 Tools work on your Nokia as well.
Click to expand...
Click to collapse
isn't it better to put FCROUTER and other samsung dlls in Windows folder?
as far as i know ID_CAP_INTEROPSERVICES allow it
unzip the following files onto micro-sd card:
http://download.zeroepoch.com/aftv2/5.0.4/boot.img.gz
http://download.zeroepoch.com/aftv2/5.0.4/lk.img.gz
http://download.zeroepoch.com/aftv2/5.0.4/preloader.img.gz
http://download.zeroepoch.com/aftv2/5.0.4/recovery.img.gz
http://download.zeroepoch.com/aftv2/5.0.4/system.root.img.gz
double check file hashes after transfer to micro-sd because micro-sd cards suck
open up an adb shell and run the following commands:
su
rm -rf /data/dalvik-cache/*
echo 0 > /sys/block/mmcblk0boot0/force_ro
dd if=/storage/sdcard1/preloader.img of=/dev/block/mmcblk0boot0
echo 1 > /sys/block/mmcblk0boot0/force_ro
dd if=/storage/sdcard1/lk.img of=/dev/block/platform/mtk-msdc.0/by-name/lk
dd if=/storage/sdcard1/recovery.img of=/dev/block/platform/mtk-msdc.0/by-name/recovery bs=1m
dd if=/storage/sdcard1/boot.img of=/dev/block/platform/mtk-msdc.0/by-name/boot bs=1m
dd if=/storage/sdcard1/system.root.img of=/dev/block/platform/mtk-msdc.0/by-name/system bs=1m
Click to expand...
Click to collapse
wait 10 minutes or so after last dd command to help ensure cached data is written, or better yet:
zeroepoch said:
<snip> backup the sync program to /data/local/tmp or run the busybox sync applet. I'd say if you don't understand what that means it's probably not for you. There is always the 2 week method to recover so the device is not a complete brick just very annoying to recover.
Click to expand...
Click to collapse
after you're all done with your 10 minute or so wait, or have run your backed up sync pull the power and restart your device.
this is only for brave people or experts right now.
1 reported brick so far, so I guess don't do this unless you're insane like me
Is this working via LAN ADB? Or better use USB ADB?
Can anybody confirm this process? Since my aftv is unrooted again, I have to root it first before I can try this.
i did it via ethernet. actually, part of the reason i attempted this method is because i left my usb a to a cable at a friend's house.
since you're not rooted though, i fail to see how this will be of any use to you....
Sounds like a funny wilde ride
What is the echo 0 and 1 for?
make the preloader writable, then set it back to read-only
My aftv is just in the rooting process
So this is using adb shell. Is this based on a Linux OS or Windows? I have rooted many android devices, but not the Amazon fire.
use whatever OS you like. use whatever adb connection you like. make the files available to your ftv2 however you like, but in that case make sure to modify the dd arguments appropriately. you can even use magic if you like. this is OS agnostic. if you can put files on a micro-sd card and open an adb shell to your rooted ftv2, you can do this.
rester555 said:
So this is using adb shell. Is this based on a Linux OS or Windows? I have rooted many android devices, but not the Amazon fire.
Click to expand...
Click to collapse
I just did it on Windows 10 through cmd prompt. But, I currently have an issue to where after I unplugged the power, plugged it back in, it's not turning on.
did you let the last dd command finish? that's the big one and it takes a bit for it to write. i did it from win 10 as well, last command should look something like this:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Nope, the instructions didn't say "sync", "reboot" or "1s".
So now what? It's plugged in usb-usb on my laptop, I keep hearing it connect and disconnect every like 15 seconds.
"of=/dev/block/platform/mtk-msdc.0/by-name/system bs=1m" is the tail end of the last dd command, you can see the output that it should give you.
did you see that output?
if you're bricked you're probably looking at 2 weeks of writing a new system partition 512 bytes at a time. that's the only method i can think of right now :/
you would basically do the zeroepoch thing, but instead of patches you'd write the whole thing.
xenoglyph said:
"of=/dev/block/platform/mtk-msdc.0/by-name/system bs=1m" is the tail end of the last dd command, you can see the output that it should give you.
did you see that output?
if you're bricked you're probably looking at 2 weeks of writing a new system partition 512 bytes at a time. that's the only method i can think of right now :/
you would basically do the zeroepoch thing, but instead of patches you'd write the whole thing.
Click to expand...
Click to collapse
Yeah, I followed it. I entered that command, once it transferred, I unplugged the power and plugged it back in.
So, basically my 3 day old AFTV is bricked and might as well buy a new one?
edit: just read your description of the boot process
it might theoretically be a fairly quick fix if boot partition just needs repairing, for example. if you're interested i'll try putting together a diagnostic tool based on the existing python code being used for rooting right now. if you're willing to test and report back results let me know and i'll start working on it.
dinggus said:
Yeah, I followed it. I entered that command, once it transferred, I unplugged the power and plugged it back in.
Click to expand...
Click to collapse
Did you hash check the files after you copied them to the SD-card?
xenoglyph said:
did you let the last dd command finish? that's the big one and it takes a bit for it to write. i did it from win 10 as well, last command should look something like this:
Click to expand...
Click to collapse
I added a sync after the dd to stock in my guide now so it has time to flush. Probably same applies here. BTW this exact procedure would be my best guess at how to do it using dd. I didn't even think about clearing dalvik but totally makes sense.
so is this method safe?? Atm I´m not sure if it´s worth it.
Don´t want to brick my device.
Xedos9er said:
so is this method safe?? Atm I´m not sure if it´s worth it.
Don´t want to brick my device.
Click to expand...
Click to collapse
The theory behind it all makes sense and @xenoglyph has been able to do it himself successfully so there is some proof that it works. My best guess going from root to stock is that after dd finishes you need maybe 30sec to a minute if you run sync after for it to flush. Although that's between similar images. The sync command no longer works because it's been moved to a new location where with root to stock it's in the same location. You could try running sync first before starting the dd to maybe cache it but that's kind of risky as well. Better would be to copy the sync program to /data/local/tmp so you can run it after the dd is complete. That is likely my best guess why it's broken, it hasn't flushed yet. If that's true maybe using the full flash method would work better starting from the back going forward since the first part might be written already. Though I don't think I'll have time myself to add this option.
If you're willing to live fast and furious then in theory these commands should work and it changes all the necessary partitions. If you do, make sure you wait a few minutes after the system dd command finishes for it to flush to the device. Maybe even 10 minutes to be safe. A bit more explicit would be to backup the sync program to /data/local/tmp or run the busybox sync applet. I'd say if you don't understand what that means it's probably not for you. There is always the 2 week method to recover so the device is not a complete brick just very annoying to recover.
xenoglyph said:
edit: just read your description of the boot process
it might theoretically be a fairly quick fix if boot partition just needs repairing, for example. if you're interested i'll try putting together a diagnostic tool based on the existing python code being used for rooting right now. if you're willing to test and report back results let me know and i'll start working on it.
Click to expand...
Click to collapse
At this point I'll try anything to get the device working again. I can't even connect via adb she'll as it doesn't see the device anymore.
krawhitham said:
Did you hash check the files after you copied them to the SD-card?
Click to expand...
Click to collapse
Yes
zeroepoch said:
The theory behind it all makes sense and @xenoglyph has been able to do it himself successfully so there is some proof that it works. My best guess going from root to stock is that after dd finishes you need maybe 30sec to a minute if you run sync after for it to flush. Although that's between similar images. The sync command no longer works because it's been moved to a new location where with root to stock it's in the same location. You could try running sync first before starting the dd to maybe cache it but that's kind of risky as well. Better would be to copy the sync program to /data/local/tmp so you can run it after the dd is complete. That is likely my best guess why it's broken, it hasn't flushed yet. If that's true maybe using the full flash method would work better starting from the back going forward since the first part might be written already. Though I don't think I'll have time myself to add this option.
If you're willing to live fast and furious then in theory these commands should work and it changes all the necessary partitions. If you do, make sure you wait a few minutes after the system dd command finishes for it to flush to the device. Maybe even 10 minutes to be safe. A bit more explicit would be to backup the sync program to /data/local/tmp or run the busybox sync applet. I'd say if you don't understand what that means it's probably not for you. There is always the 2 week method to recover so the device is not a complete brick just very annoying to recover.
Click to expand...
Click to collapse
What is the 2 week method?
Help! i am not a linux expert!
Do i have to copy and paste all the commands in the Quote at once? (copy and paste of all block) or i have to copy and paste and run line after line (from the Quote) in my command terminal window?