[Work in progress] Alcatel Pop D5 - Hardware Hacking General

So I was dumb enough to brick my OT 5038X by flashing boot image via fastboot. I'm gathering all the info I can and I'll be posting my progress here.
If you're looking for a root, just download mobogenie on PC, than KingRoot app on your phone. You'll be able to have SU in ROM Toolbox.
Here are some pictures, and what got my attention:
Is there any chance of unbricking my phone? I can't get any info on this, just a lot of people with the similar problems as me

Main problem we have here is that SP flash tool won't download. It reads back, but download is impossible, cause device disconnects when you try downloading. I tried without a battery, with a battery, with volume key down, with volume key up, and all possible hardkey combiations. I think that by soldering some of these soldering points together I can get it to work. I'll try measuring pins with multimeter for safety, so i don't burn something on my motherboard, I'll also try finding jtag pins that are in use. But I'll have to buy a "smarter" multimeter, so i dont get parallel port burnt, or phone mobo again. I have few multimeters, but all of them are cheap crappy chinese ones, and they don't read correctly.
According to MT6582 datasheet, there are 4 jtag pins, so there is just one unused pin. Hopefully I'll be able to write a program in C that will allow me to listen to the parallel port data so i can indentify which pins do what.

blazeaster said:
Main problem we have here is that SP flash tool won't download. It reads back, but download is impossible, cause device disconnects when you try downloading. I tried without a battery, with a battery, with volume key down, with volume key up, and all possible hardkey combiations. I think that by soldering some of these soldering points together I can get it to work. I'll try measuring pins with multimeter for safety, so i don't burn something on my motherboard, I'll also try finding jtag pins that are in use. But I'll have to buy a "smarter" multimeter, so i dont get parallel port burnt, or phone mobo again. I have few multimeters, but all of them are cheap crappy chinese ones, and they don't read correctly.
According to MT6582 datasheet, there are 4 jtag pins, so there is just one unused pin. Hopefully I'll be able to write a program in C that will allow me to listen to the parallel port data so i can indentify which pins do what.
Click to expand...
Click to collapse
Hello, i have one small question. How did you flash the boot img through fastboot. I want the extact command. Also if you have adb then you isn't hard bricked because the adb-daemon boots with the kernel(bootimg).
Generally the jtag is for unbricking hard-bricked devices. You know with damaged bootloaders (IBL, SBL etc). And usually the points are close to the battery connector or behind the battery connector. And think these are your jtag point. There should be some GND points that's why you have 7 pins. You can identify which pins are GND with a multimeter.
And maybe is easy to unbrick your phone vio recovery mode. Have you tried to flash a full rom or a boot img?

root-expert said:
Hello, i have one small question. How did you flash the boot img through fastboot. I want the extact command. Also if you have adb then you isn't hard bricked because the adb-daemon boots with the kernel(bootimg).
Generally the jtag is for unbricking hard-bricked devices. You know with damaged bootloaders (IBL, SBL etc). And usually the points are close to the battery connector or behind the battery connector. And think these are your jtag point. There should be some GND points that's why you have 7 pins. You can identify which pins are GND with a multimeter.
And maybe is easy to unbrick your phone vio recovery mode. Have you tried to flash a full rom or a boot img?
Click to expand...
Click to collapse
I tried, but I don't have factory update, and my phone is running factory recovery. I know my phone isn't hardbricked, but I can't unbrick it, so JTAG is an option. I flashed bootimg with "fastboot flash boot boot.img"

OK... So I didnt miss being a idiot today again. Now I dont have ADB and recovery anymore. I flashed recovery with MTK droid tools generated image. But I did realize that it may be possible to unbrick this phone with SPFlash tool. This is the error I get:
Code:
06/07/2015 20:43:22.043 FlashTool[4772][2988][DEBUG]: NandLayoutParameter::CompareIsNandLayoutMatched(): NOT MATCH: load item key(RSV_OTP), value(0xffff0200), target item key(OTP), value(0xffff0200).(.\NandLayoutParameter.cpp,139)

blazeaster said:
I tried, but I don't have factory update, and my phone is running factory recovery. I know my phone isn't hardbricked, but I can't unbrick it, so JTAG is an option. I flashed bootimg with "fastboot flash boot boot.img"
Click to expand...
Click to collapse
First of all, jtag generally it's an expesive and a more difficult way to unbrick your phone. Also with jtag you don't flash the whole firmware. You only upload to the memory a bootloader which handles the update through sp flash tool let's say. And you flash your firmware.
Also if you find a factory pdate you can flash it through recovery. Was the boot.img faulty?

Boot image I used for flashing was for 5038D i think, there's not much of a difference between these two phones, but still it was enough to f*ck up my phone. I managed to get SP flash tools to the next level (luckily I have valid scatter file), but now I'm getting an error :
Anyway I want to find out where and what are the exact pins for JTAG, so I can help people who got hard bricked. It's not expensive if its possible to do it without extra tools. I hope i can do something by listening to paralell :/ I mentioned multimeter, I want to check if there's an power pin on jtag, so i dont get phone or parallel port burned.
Also there is no stock rom available for download, but there is source code on alcatel site.

blazeaster said:
Boot image I used for flashing was for 5038D i think, there's not much of a difference between these two phones, but still it was enough to f*ck up my phone. I managed to get SP flash tools to the next level (luckily I have valid scatter file), but now I'm getting an error :
Anyway I want to find out where and what are the exact pins for JTAG, so I can help people who got hard bricked. It's not expensive if its possible to do it without extra tools. I hope i can do something by listening to paralell :/ I mentioned multimeter, I want to check if there's an power pin on jtag, so i dont get phone or parallel port burned.
Also there is no stock rom available for download, but there is source code on alcatel site.
Click to expand...
Click to collapse
I have done some research for jtag recently and usually you want a dev board to access the cpu of the phone. Maybe you can do it with the parallel but I'm not sure. With a dev board it's easier. Also we can make our dev board for jtaging and we can load on it openocd. It's a very good software fordebugging and jtaging.
Also there are many cheap boards in the web for example bus pirate (35$).
And there no Vcc pins or power pins in jtag. You power your phone from battery or from external power. There only TDI, TDO, TMS, TCK, TRST(optional).

root-expert said:
I have done some research for jtag recently and usually you want a dev board to access the cpu of the phone. Maybe you can do it with the parallel but I'm not sure. With a dev board it's easier. Also we can make our dev board for jtaging and we can load on it openocd. It's a very good software fordebugging and jtaging.
Also there are many cheap boards in the web for example bus pirate (35$).
And there no Vcc pins or power pins in jtag. You power your phone from battery or from external power. There only TDI, TDO, TMS, TCK, TRST(optional).
Click to expand...
Click to collapse
Bus pirate seems like a great solution for me. Thanks for the info on JTAG. To be honest i didn't do any jtaging on "modern" phones. I did however jtaged xperia x1, and as i can remember there were VCC and GND, regardless of port you choose. Im also absolutely sure that one router i jtaged had power pins.
Anyway I managed to find POP D5 with stock firmware, so as soon as i get my hands on it Ill be writing a tutorial for soft bricked phones.

blazeaster said:
Bus pirate seems like a great solution for me. Thanks for the info on JTAG. To be honest i didn't do any jtaging on "modern" phones. I did however jtaged xperia x1, and as i can remember there were VCC and GND, regardless of port you choose. Im also absolutely sure that one router i jtaged had power pins.
Anyway I managed to find POP D5 with stock firmware, so as soon as i get my hands on it Ill be writing a tutorial for soft bricked phones.
Click to expand...
Click to collapse
I'm happy to hear that you can unbrick your phone. But it would be nice to do some research how to jtag different phones. I know that it is difficult but as I understood your a hardware guy and you can solder wires to phones etc. So if you want I can help you to start a R&D thread with information...

Thanks for all the info. I'll order a bus pirate, regardless of this method I'll try with the parallel port. I definitely need one, cause I mess around with hardware a lot. I'm also willing to learn, so message me if you will with some interesting material. We can start a thread, why not. But let me do something concrete first.

blazeaster said:
Bus pirate seems like a great solution for me. Thanks for the info on JTAG. To be honest i didn't do any jtaging on "modern" phones. I did however jtaged xperia x1, and as i can remember there were VCC and GND, regardless of port you choose. Im also absolutely sure that one router i jtaged had power pins.
Anyway I managed to find POP D5 with stock firmware, so as soon as i get my hands on it Ill be writing a tutorial for soft bricked phones.
Click to expand...
Click to collapse
progress on this?? Have you tried to back it up??? can you upload the back up to help others.

[email protected] said:
progress on this?? Have you tried to back it up??? can you upload the back up to help others.
Click to expand...
Click to collapse
I would like to know also if there has been a solution.

Pop d5 5038a no stock frimware in the web
Alcatel4037N said:
I would like to know also if there has been a solution.
Click to expand...
Click to collapse
you cannot find the stock firmware of this phone anywhere. if you bricked this phone you cannot unbricked it. none has ever unbrick this damn phone..... mine is just sitting in my cabinet still bricked untill now

[email protected] said:
you cannot find the stock firmware of this phone anywhere. if you bricked this phone you cannot unbricked it. none has ever unbrick this damn phone..... mine is just sitting in my cabinet still bricked untill now
Click to expand...
Click to collapse
What about Furious Gold? h t t p : // w w w .furiousgold . com /en/ module/ mtk-code-reader
The phone is not hardware-brick, but is lock by software. There got to be a way to bypass or pause the software for locking the USB port. I do not know if it could be possible but connecting the on-board memory to a USB adapter reader with the phone completely off. I am sure there is a way!

Related

Desire Z bricked

So I've now got a bricked Desire Z and have had to go back to my reliable and fairly beaten up old G1 again.
The ROM it was running was Virtuous Unity 2.39.0 with a particular kernal that allowed me to record phone calls.
What was I attempting before it became a massive paperweight? A ROM backup via ClockworkMod Touch.
What does it do now? Absolutely nothing! When I plug it into an AC charger or the USB cable it gives absolutely no sign of life, trying a different battery makes no difference as the two I've tried, work in a dusty old faulty Desire Z.
I can no longer reach the bootloader.
Any ideas would be appreciated.
Plug it in with the phone off and turn the phone on while holding the volume down button it will go into fastboot mode.
From there you will have fastboot access and select recovery if it does not work then flash a new recovery by doing the following
1) Download the correct clockwork mod recovery image (should be something like recovery.img) I believe there is one on the first page of the development section which supports touch.
2) while on fastboot (first sentence of this post), type the following
fastboot flash recovery c:\recovery.img
where recovery.img is the location of your recovery, you will need to be inside of the android sdk tools directory where adb and fastboot commands are located.
A_Elizondo said:
Plug it in with the phone off and turn the phone on while holding the volume down button it will go into fastboot mode.
Click to expand...
Click to collapse
There's a massive problem with your solution. It won't turn on AT ALL thus making said solution useless.
When plugged into either an AC adapter or a USB cable connected to the PC it gives zero sign of life.
As useless as the solution itself was in this instance, I've never actually used ADB to flash a recovery image before so it was still a little helpful.
Any other ideas?
Bricked - sounds like it may be only revived by flashing it via JTAG hardware interface. See if you find one around that is capable of this..
Mike
MIkeRD03 said:
Bricked - sounds like it may be only revived by flashing it via JTAG hardware interface. See if you find one around that is capable of this..
Mike
Click to expand...
Click to collapse
I'll leave the JTAG flashing up to the boys and girls at HTC since I'm not confident enough with a solder gun to attack it myself, even if no solder gun is necessary I still may have difficulty remembering what screws went where whilst re-assembling it.

LG G2 D802 No Display, Bricked, Recovered

Hello,
This is my first post on this forum so hello everyone! This forum has helped me numerous times with various devices, it is a valuable source of information and the people here seem very helpful. I have searched but cant find a thread relating to my current issue so I decided to start a thread and hopefully get some answers.
Ill try to keep this short while still providing enough information, first things first my device is a D802T 32GB model. Timeline of steps ive taken are as follows.
-Running Ressurection Remix ROM
-Downloaded ROM update and flashed with TWRP
-Device would get to "Upgrading Apps" step then restart half way through, back to upgrading app, restart again and so on
-Flashed stock ROM with LG Flash tool 2014, Froze at 49%
-Tried again to flash Stock ROM, this time it froze at 10%
-This caused the phone to loose Download mode & Recovery.... HARD BRICKED
-Phone would show as Qualcomm HS-USB 9006 in device manager
-Used Ubuntu to flash Partitions
-Must have flashed wrong partitions, after I flashed them the phone seemed to be 100% bricked with no signs of life at all
-Managed to jump pins on chip inside phone to get it into Qualcomm HS-USB 9008 mode
-Downloaded BIN_LGD802AT-00-V10b-SEA-XX-SEP-04-2013-32G+0 TOT File and extracted partitons
-Used BoardDiag to re flash Partitions I extracted from TOT file above
-Phone now seems 100% fixed except for one issue NO DISPLAY!
The phone boots, I hear the boot sound, the touch screen works as it should but I have no display whatsoever not even a black screen. My question is can flashing partitions cause you to loose display but the phone still boot and retain digitizer function?
I repair phones for a bit of extra money on the side so I know what im doing but I wanted another opinion or two before I go ordering parts. Does this sound like I may have damaged something while jumping the pins or could it be the partitions I flashed? Also if I have damaged something how can I tell if its the screen or if I damaged the charge port flex as this carry's the display signal. Keep in mind everything else works on that lower board such as the USB port etc. It seems a massive coincidence I loose display after flashing partitions but then again I was fiddling with the insides but I have done that many many times before so what are peoples thoughts on this?
I appreciate anyone who takes the time to help
42 views and no one has any ideas at all?
Sorry m8.....the last time i had 9006 brick i flashed correct partitions and got my phone working through TOT.......
You could try a new flex cable or even a new screen to diagnose whether its a hardware problem, black screen usually indicates damaged LCD connector pins on LCD panel or flex cable.
Also having "white tv noise" indicates a damaged flex cable.
Next time you have 9006, use this! https://www.youtube.com/watch?v=_d5b_osUTug
You don't need Ubuntu and you have less chance of super bricking.
Hey mate thanks for replying,
I did try that method but kept getting an error (something about cannot find file specified) so I just went the Ubuntu method. I did plan on just ordering a new screen but wanted to be a bit more certain of the issue first. I wish I had of kept my old damaged screens so I could fit one to determine if the screen really is the issue.
I didn't need to touch the bottom part where the LCD flex cables plug onto the board but stranger things have happened, unfortunately the G2 doesn't seem to be very popular in my area as I dont know anyone else that has one that I could possibly put my motherboard in to know for sure its the screen.
I might completely disassemble it and inspect it under a magnifier to make sure I haven't knocked any resistors or anything off the board, ill probably end up just ordering a screen as it seems the only way to know.
Thanks for your help

SM-950F Hard bricked, JTAG?

Hey
So I was flashing android 7.0 to an S8 and it completely died, this is how completely:
- No screen/LED/vibration motor
- No safety/recovery/download mode (and don't ask about button combos, I've tried them all)
- No USB recognition from device manager (not even as exynos in other devices, just nothing)
- USB jig does nothing
- It is however recognised by wireless chargers (but I doubt that has any real significance)
At this point my question is would a JTAG even work on it? Or is my only hope a complete motherboard replacement?
S8 Hard bricked
A_Bad_Marksman said:
Hey
So I was flashing android 7.0 to an S8 and it completely died, this is how completely:
- No screen/LED/vibration motor
- No safety/recovery/download mode (and don't ask about button combos, I've tried them all)
- No USB recognition from device manager (not even as exynos in other devices, just nothing)
- USB jig does nothing
- It is however recognised by wireless chargers (but I doubt that has any real significance)
At this point my question is would a JTAG even work on it? Or is my only hope a complete motherboard replacement?
Click to expand...
Click to collapse
hello!
same happened to me ......dont worry i will help u....
i think u flashed aosp rom
phone is not hard bricked its still not turned off believe me........
do the following:
donot charge phone for atlesat 24 hours .......
after 24 hours try to boot into download mode press button for like a minute it will work in multiple tries,,
immediately flash twrp and when flashed successfully suddenly press vol down + bixby + power it will boot into recovery
charge for 1 -2 hours , clear system and every thing if you have backup thats good other wise flash firmware......donot turn in till flashing the system and data in recovery mood......boot into download mood from recovery and there you go....if still a problem inbox me
Thanks, I'll give it a shot
ok let me know then
Jtag dead phone to life and rewrite IMEI
I had the same thing, sent it to Fonefunshop in England, they said they could fix it, the didn't even open it as discovered by the guys who fixed it and is necessary to use jtag.
Fonefunshop said eMMC chip was bad, which is not true, but that led me to search for someone to replace the chip. I found A2Z cellular in Ottawa, Canada. They got the phone to boot up, but IMMEI was null( I did this trying to flash back to stock after TWRP screwed up). They rewrote original IMEI , now phone works like new. These guys are amazing.
http://a2zcellular.com/
Thank you all for the advice.
But I have now managed to unbrick and reflash the firmware. khawarjaved's advice turned out to be what fixed it in the end.
That was close, nearly lost £30
A_Bad_Marksman said:
Thank you all for the advice.
But I have now managed to unbrick and reflash the firmware. khawarjaved's advice turned out to be what fixed it in the end.
That was close, nearly lost £30
Click to expand...
Click to collapse
I have been through that situation man.... So always ready to help, ??
Hi pros
I'm in kind of a similar situation....I think I flashed MY 950U PIE with wrong BL
This phone is dead....Doesn't boot...no download mode....No recovery mode....
When connected to pc....device manager Recognises device as QUALCOMM HS USB 9008
Any way to brig it back to life...?
Your phone is connected in edl download mod. It will accept special files which will allow it to boot to download mode and let you flash stock firmware
The tool used for this is emmcdl.exe
It has to come with phone specific files
No idea where to get it. Ask people here, those who root phones. They know.

Help!! I accidentally soft-bricked (or hard-bricked) my PX6 Rk3399 Android 10 HU!

First of all, thank you so much all for any help!! It's my first time posting in the forum which I think speaks to my desperation state right now:crying:, so anything is greatly appreciated!
I bought an Android 10 unit with the PX6 Rk3399 processor, but it had some bloatware that I wanted to get rid of (mainly a knock-off android auto that started when I plugged my phone in even after disabling the app and it got pretty annoying). I decided to root the unit, but it wouldn't stay rooted after restart. I then decided to let SuperSU update the SU binaries despite knowing that something could go wrong, and of course the unit went straight into bootloop!
I then accessed Recovery mode by long pressing the power button (waiting for the unit to flash 5 times) then releasing and pressing again (don't ask me how I found this out). It had an option to flash updates, so I tried flashing the Kal9k Android 9 ROM, with no luck (kept getting error 1001). Then I found a firmware in update.zip form for a similar radio, with my processor and ram and etc from sygav, so I decided to flash that one using the update option on recovery. No luck though, as it was still stuck on boolook with a ford logo (as if the original system partition wasn't flashed and was still there). I couldn't access adb from recovery to see if I could delete the SU folder (if I plugged a USB cable on recovery, the computer didn't seem to see anything), so I booted into bootloader from recovery. Which by the way, was a black screen but did get picked up through USB by windows.
After tinkering with drivers for hours, I don't know how, but my unit got connected and recognized by fastboot. But in trying to erase the system partition, there was no way for system to be found. Every other partition (i.e. cache) could be erased but not system. I also couldn't flash the firmware I found because it being an update.zip, it didn't have a system.img (but it did have an image for everything else, such as boot, recovery, etc).
So I decided to flash a firmware from a guy on the internet that had a soft brick, and I flashall'd it. Now I'm starting to think this guy's firmware was for another completely different system (oh and by the way, System.img failed to flash as it couldn't find the partition, but it really was the only firmware I could find that had a system.img, so since I was completely desperate I stupidly went for it).
Now I can no longer boot into recovery, and I might be booting straight into bootloader mode, but I am not that sure. After I do the trick with the lights flashing and all, the device gets picked up by my computer, but as an unknown device:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I manually update it's drivers with the downloaded bootloader drivers from the android sdk (google USB drivers) and it gets detected as a Kedacom USB device, not an Android Device, so no fastboot:
Then if I disconnect it and connect it again, it shows up as an unrecognizable USB device or something like that.
It seems like the same problem I had when I first connected to bootloader, but I don't even know what I did to fix that . I think I might have rebooted into recovery, and then from there booted into bootloader, and somehow my computer then had Android drivers available for install and I manually installed them and it worked? Maybe? I really have no idea, but I can't try that because I can't get to recovery.
I have an update.zip with what I think is the closest firmware to what my radio had originally, an Android 10 PX6 firmware, from which I was planning to install the boot, bootloader and recovery if I had access to fastboot (which I really don't know how to make windows see that it might be a bootloader device), however, since I don't have a system.img to flash and bootloader doesn't even find the system partition, I don't even know where I would go from there.
What do you guys think I should do? What are my options? Did I just hard brick my unit? I wouldn't think so because windows detects "something" even if it can't assign it the driver. But if it is hard bricked, I am not scared to open it up and to do whatever I have to do, if just am really unsure on what to do and how to do it!
Again, any help is highly appreciated! And thank you so much in advance!:fingers-crossed:
SOLUTION:
Alright, this was a ride! It took me about two weeks to find the solution. No matter what I flashed from the recovery, the unit would still be on bootloop, but the last thing I flashed was an update.zip I found on the internet from some guy, and that made my unit completely hard bricked and irrecoverable (no access to recovery). So here's what I did.
Apparently, reading around Rocketchips (PX3,PX5,PX6) have like a "if everything else fails" kind of mode, for stupid people like me, called MASKROM Mode. It's the last resort mode that lets you flash something on the unit when everything fails. That mode is not flashable (you can't mess it up). It's kind of like if a computer had an integrated last resort in case you mess up and break the BIOS.
To get to it though, it is kind of complicated. You need to get to the PX6/5/3 board, which is basically the heart of your radio. So start unscrewing!
The board will look something like this one:
https://sc01.alicdn.com/kf/HTB1f6tCE.R1BeNjy0Fmq6z0wVXaC.jpg
Where the top part is a heatsink that you might also have to remove. PX5s and PX3s may not look exactly like so, but look for something of more or less the same characteristics and form factor, you'll know when you see it.
Go ahead and remove the board from the unit VERY CAREFULLY (the female pin sockets break VERY VERY EASILY from what I've heard, so be very careful).
Next, we will need to connect the PX6/5/3 to the computer through USB. For that, we will have to make a custom cable. Here's the link to the forum where they explain how to make that cable in detail: https://forum.xda-developers.com/an...px3-5-headunit-mod-recover-flash-som-t3766892
Shoutout to @marchnz , he's a genius and without his help I certainly would have wasted my $400 I spent on the headunit.
So long story short, take a USB to something cable (the ones for your phone, for instance), strip it, and solder some resistances to it in the EXACT SAME WAY as in the pictures in the first post of the forum.
Now, connect the cable in the same way as the pictures if you have a PX5 or PX3.
IF YOU HAVE A PX6 find out which pins to connect in PAGE 2 of https://forum.xda-developers.com/an...s-development/px6-maskrom-mode-t3989407/page2 , in the pictures of a post by @oton .
Now download Androidtool here: https://github.com/rockchip-linux/tools/blob/rk3399/windows/AndroidTool_Release_v2.52.zip . This is the software that is going to let us access the mode I was talking about earlier.
Once you have it install, restart and plug in your USB end of the cable. Open the device manager on windows. If you see an Unrecognized device pop up, or a malfunctioning USB, you will need to install the drivers. Here's the link to where you can find an autoinstaller: https://github.com/rockchip-linux/tools .
If, after all, you still are having issues with the drivers, you'll need to install them manually. So right-click on the unrecognized device, update driver, browse my computer, let me pick, Have Disk, and then you find the drivers that we just downloaded (unzip them, of course). Choose the driver, and close and re-open Androidtool.
If you see Maskrom device detected on the bottom, you're all set! If you see recovery device detected, you'll have to put it on Maskrom, for good measure. It might work on recovery, but I'd put it in maskrom mode anyway. To do that, you'll have to disconnect the usb from the computer (while the other end with the cables is still hooked to the board), short two pins on the other side of the board (where the heatsink was) (for a PX6, you can find out which ones here https://forum.xda-developers.com/showpost.php?p=80641439&postcount=435) (for a PX5, I belive it will be on the thumbnails of the first post here: https://forum.xda-developers.com/an...px3-5-headunit-mod-recover-flash-som-t3766892) (if you can't figure out which ones, google search for pins to put your unit in maskrom). While you are shorting those pins (maybe with some metallic tweezers), plug in the usb, stop shorting the pins, and the unit should show up in maskrom.
Now dowload an update.img from the following repository: https://yadi.sk/d/umCvHqCDzHccr/RockChip PX5 Android 9/YB . If it tells you to download something, just click on the file until you get to the .rar screen and click on the download arrow on the top right of the screen.
Important: FOR MY UNIT, I HAD TO DOWNLOAD MANY UPDATE.IMG BEFORE 1 WORKED. ONLY ANDROID 8.1 WORKED FOR ME, SO KEEP TRYING! YOU'RE ALMOST THERE!
ALSO, DO NOT DOWNLOAD ANY OTGs (update.zip), ONLY DOWNLOAD IMAGES (update.img).
Now go to upgrade firmware on Androidtool, click on firmware, choose the update.img you downloaded, and start flashing it!
You'll get a progress readout on the right side, and you'll know when its done. Now it's time to put everything back together and hook up the unit and see if it worked. If it didn't or if it's in bootlooop, download another image from the repository and try again. The only one that worked for me was android 8.1.
Okay, so now everything worked and you got your Head Unit back! But what if you had to downgrade android for it?
Here's how to bring it back to its former glory:
From where I stood (android 8.1), the android 8.1 recovery wouldn't allow for android 9 or android 10 flashing. And I found some info on how to flash PX5s recoveries, but nothing on PX6, so I went to Hal9k's website and purchased his modinstaller 2 and followed instructions. Through there, you'll have the chance to update to android 9 or 10 (up to you), by running his apk that will install a new recovery on your machine, and then flashing any update.zip you want. In my case, I decided to also go for his ROM, because of the features it offered. The whole process was 10 bucks but I think it was completely worth it (honest opinion, not sponsored). You can also opt for installing and Android 10 ROM, as I had at the beginning, but I've heard they're pretty unstable.
So that's all! Not an easy project, but at the end you'll have your unit back and running!
I'm guessing you've seen this rom thread? There's a link to the stock stm firmware in the thread, if that's what you have.
https://forum.xda-developers.com/an...rom-malaysk-rom-px6-mcu-stm32-rk3399-t4111653
When mine was stuck on the black screen, I had to short 2 pins out on the board which entered recovery mode. I then managed to get it working from there. I can post a photo of which pins if it's any use to you?
skipraider said:
I'm guessing you've seen this rom thread? There's a link to the stock stm firmware in the thread, if that's what you have.
https://forum.xda-developers.com/an...rom-malaysk-rom-px6-mcu-stm32-rk3399-t4111653
When mine was stuck on the black screen, I had to short 2 pins out on the board which entered recovery mode. I then managed to get it working from there. I can post a photo of which pins if it's any use to you?
Click to expand...
Click to collapse
Hi! I saw that ROM, but when I went to download it it still gives me an update.zip file with all the recovery.img, boot.img bootloader.img but no system.img. I guess I could boot it to recovery and apply the update there, but I think my recovery is also gone :/
Regarding what you said though, are you talking about the maskrom mode? or something like that? Or do those pins just take you into recovery? I could try it but I don't know if Recovery will even work :/
And if they put the radio in maskrom, where do you go from there?? And sure! A picture would be more than greatly appreciated!!
Thank you so much for all your help!!!
To be honest with I'm not sure if it is the maskrom mode, I'm no expert with these things.
All I was getting out of mine was a black screen, but shorting these pins out and powering it up entered a recovery mode each time. Might be worth a try.
skipraider said:
To be honest with I'm not sure if it is the maskrom mode, I'm no expert with these things.
All I was getting out of mine was a black screen, but shorting these pins out and powering it up entered a recovery mode each time. Might be worth a try.
Click to expand...
Click to collapse
My board looks different from that one and I can't seem to find any pins that look like could be shorted :/
I'm at the point where I can flash update.img into the board with my computer (through connecting pins to some USB cable), but I cannot find any full OTG flash for my PX6!
Any ideas? This might be too much to ask but is there any chance you could provide me with a full otg backup of yours to flash on mine maybe?
alfondehesa said:
My board looks different from that one and I can't seem to find any pins that look like could be shorted :/
I'm at the point where I can flash update.img into the board with my computer (through connecting pins to some USB cable), but I cannot find any full OTG flash for my PX6!
Any ideas? This might be too much to ask but is there any chance you could provide me with a full otg backup of yours to flash on mine maybe?
Click to expand...
Click to collapse
Hi,
I have no idea how to do that, and the unit is back in the car now. I ended up keeping the stock rom to be on the safe side! Sorry.
I'm stuck in bootloop on Android 10 PX6 MTCE, headset has no HW buttons only a reset button, can't seem to access recovery.
What step should I try first? I am a total noob and don't own a soldering iron.
Paperclip and recovery?
Update.zip won't flash before rom boot will it.
If all else fails can someone post me a USB OTG?
I only started messing as Malaysk rom had no software volume change for me. Xposed install then reboot looks like a bootloop. Was my Christmas present as well
Hello My Threecar device crashed.
I could not connect to the port in the picture.
The computer does not see the device at all. Does not detect.
Red square. I shorted the feet and the computer never detected it
How can I do PC device detection
Hi, What kind of connector are you using ? can you send a link for that connector or give the connector name ?

			
				
radskin said:
Hi, What kind of connector are you using ? can you send a link for that connector or give the connector name ?
Click to expand...
Click to collapse
Hi.
JST-SH 1.0 mm 4 pin Connector
bicer79 said:
Hi.
JST-SH 1.0 mm 4 pin Connector
Click to expand...
Click to collapse
I have bought the JST-SH 1.0 mm 4 pin connector and the connector is to small.
Sorry mate.
I confused it with another device
jst 1.25 connector 4p female
if you want i can pay you
radskin said:
I have bought the JST-SH 1.0 mm 4 pin connector and the connector is to small.
Click to expand...
Click to collapse
radskin said:
I have bought the JST-SH 1.0 mm 4 pin connector and the connector is to small.
Click to expand...
Click to collapse
bicer79 said:
if you want i can pay you
Click to expand...
Click to collapse
Tanks for the offer, but I work at a company that sells this type of material. I ill look for the right type of connector.
radskin said:
Tanks for the offer, but I work at a company that sells this type of material. I ill look for the right type of connector.
Click to expand...
Click to collapse
This is the correct connector
JST 1.25 mm connector 4 pin female
Hi,
I have same board like skipraider, when I short these two pins there is no results. Should I connect board to PC by USB cable. My radio is freezing on black screen after car logo. It happend after updating software and it was take very long time on erasing part so then I restarted radio and it never woke up If I should connect to PC by USB using 4 pin connector has someone pinout description of this connector. Where is Ground, 5V+ , DP+ and DP-?
welcome
Sorry, I don't know English, but I translate from Google. I have a problem. I updated the screen and an error occurred. And because a black screen appears after the logo appears. I can not enter the recovery recovery. The computer refuses to recognize the screen. There is someone who said it must be a 6pin. How do I get the cable that holds the 6 pin. Or is there a way to revive?
[ROM][PX6][STM32][9.0] Malaysk ROM for PX6 MCU STM32 RK3399 with Android 9
Only for devices processor Rockchip PX6, MCU - STM32. Mod Pie 9.0 Android PX6 STM32 RK3399 Not suitable for those who have a real 10 android installed. Install the Device Info HW application in Google Market and look at the API level. 28 API - 9...
forum.xda-developers.com
Examine this topic. Here is how to recover bricked device.
jst 1.25 connector 4p required

Lenovo Tab M10 FHD Plus (X606f) won't power on after flashing older ROM

I'm flashing my new Lenovo tablet with Android 9 (so I can flash it later with Ubuntu Touch) and after SP Flash tool finished flashing
tablet won't power on. The power button does nothing and holding volume down + power button does nothing either.
The battery isn't dead so I'm trying to figure out why the tablet won't come on if older ROM is on it.
I had no error outputs during the flash.
This is the ROM I flashed https://mirrors.lolinet.com/firmwar..._Gen/TB-X606F/TB-X606F_S300007_200923_BMP.zip
Any suggestion as to how to get it to work again ?
I don't think you can downgrade these. You may need to completely wipe and reinstall the ROM.
ldeveraux said:
I don't think you can downgrade these. You may need to completely wipe and reinstall the ROM.
Click to expand...
Click to collapse
I'm using the official Lenovo's Rescue Tool but it's not helping. The tool isn't detecting the device after holding volume up + connecting.
python_rocks said:
I'm using the official Lenovo's Rescue Tool but it's not helping. The tool isn't detecting the device after holding volume up + connecting.
Click to expand...
Click to collapse
assuming windows, check that your drivers are detecting the recovery module
ldeveraux said:
assuming windows, check that your drivers are detecting the recovery module
Click to expand...
Click to collapse
Yes I'm using W10. adb is working and I've got Lenovo USB drivers installed too. What do you mean by "recovery module" ? Recovery partition inside the tablet ?
python_rocks said:
I'm flashing my new Lenovo tablet with Android 9 (so I can flash it later with Ubuntu Touch)...
Click to expand...
Click to collapse
Cool. Are you doing a Halium port for this device?
Yahoo Mike said:
Cool. Are you doing a Halium port for this device?
Click to expand...
Click to collapse
I'm not a Halium dev but I'm trying to flash the device. Me and another member of the community have our tablets dead after flushing it with supposedly Android 9 ROM. Not even Lenovo's Rescue Tool is helping now.
python_rocks said:
Yes I'm using W10. adb is working and I've got Lenovo USB drivers installed too. What do you mean by "recovery module" ? Recovery partition inside the tablet ?
Click to expand...
Click to collapse
No i mean when you connect the tablet to the pc in recovery, open Device Manager and ensure the tablet is connected with the correct driver. I'm sorry i don't know what that is offhand, but it should be different than when you connect it if the tablet was working. Sorry if it makes no sense, but i think this is what's going on.
ldeveraux said:
No i mean when you connect the tablet to the pc in recovery, open Device Manager and ensure the tablet is connected with the correct driver. I'm sorry i don't know what that is offhand, but it should be different than when you connect it if the tablet was working. Sorry if it makes no sense, but i think this is what's going on.
Click to expand...
Click to collapse
In my case there's no "connect the tablet to the PC in recovery". The tablet won't power on at all. Can't invoke fastboot nor recovery. The tablet doesn't react to any presses. Or press and holds. No nothing. The only thing I can confirm is the red LED on when the tablet is on charger.
Window's device manager is recognizing MediaTek USB driver when plugged in but that's it.
I've ran out of ideas about how to restore it hence I'm posting here.
python_rocks said:
In my case there's no "connect the tablet to the PC in recovery". The tablet won't power on at all. Can't invoke fastboot nor recovery. The tablet doesn't react to any presses. Or press and holds. No nothing. The only thing I can confirm is the red LED on when the tablet is on charger.
Window's device manager is recognizing MediaTek USB driver when plugged in but that's it.
I've ran out of ideas about how to restore it hence I'm posting here.
Click to expand...
Click to collapse
Oh i misunderstood completely! That is worse, i have no clue how to fix it...
python_rocks said:
The tablet won't power on at all.
Click to expand...
Click to collapse
If it's that dead, then it sounds like the preloader.bin is trashed.
Try this method.
There is also an older thread for older SOCs that might have some hints.
Otherwise, you might have to open up the tablet.
You could research and try the "test point" method. It involves shorting two points on the motherboard. I did something similar for the X605F (which has a QCom SOC).
I'm not sure where the test points on this tablet are. Some MTK devices don't have test points. Google "mediatek test point" for starters. If you can't find them, then maybe ask Lenovo where they are. If you find out, post a photo of the test points on here.
If you're not confident doing any of this, then send the tablet to Lenovo for repair.
Yahoo Mike said:
If it's that dead, then it sounds like the preloader.bin is trashed.
Try this method.
There is also an older thread for older SOCs that might have some hints.
Otherwise, you might have to open up the tablet.
You could research and try the "test point" method. It involves shorting two points on the motherboard. I did something similar for the X605F (which has a QCom SOC).
I'm not sure where the test points on this tablet are. Some MTK devices don't have test points. Google "mediatek test point" for starters. If you can't find them, then maybe ask Lenovo where they are. If you find out, post a photo of the test points on here.
If you're not confident doing any of this, then send the tablet to Lenovo for repair.
Click to expand...
Click to collapse
Yeah, I've ordered opening kit. I'm going in. Quite a few people got their devices working by disconnecting the battery and connecting it back. I've noticed that no matter how long the
tablet is on charger the LED stays red, it doesn't change to orange or green.
This same problem has happen to two more members of the community. Same tablet.
We had to flag that ROM as it bricks the tablet.
python_rocks said:
We had to flag that ROM as it bricks the tablet.
Click to expand...
Click to collapse
I don't have a lot of experience with the SPF tool, but could the root-cause of your problem be that you need to use a different dropdown option? See the description of the options in the unbrick guide - specifically the firmware upgrade option.
It makes sense that you want to force a full flash of low-level firmware when changing Android versions. That option seems to do exactly that.
Android 9 OS is not going to play nice with low-level firmware written for Android 10.
There might be nothing wrong with the ROM ??? ...just an idle thought.
Yahoo Mike said:
I don't have a lot of experience with the SPF tool, but could the root-cause of your problem be that you need to use a different dropdown option? See the description of the options in the unbrick guide - specifically the firmware upgrade option.
It makes sense that you want to force a full flash of low-level firmware when changing Android versions. That option seems to do exactly that.
Android 9 OS is not going to play nice with low-level firmware written for Android 10.
There might be nothing wrong with the ROM ??? ...just an idle thought.
Click to expand...
Click to collapse
Thank you for trying to help.
The flash tool doesn't do anything when I click Download and plugging in the tablet while holding the volume down button. Dropdown option was set to "firmware upgrade" as advised.
The guide suggests that it's for people who can at least power on the device. It says "switch off the phone ..." which I don't need to do since I can't even switch it on
python_rocks said:
I'm flashing my new Lenovo tablet with Android 9 (so I can flash it later with Ubuntu Touch) and after SP Flash tool finished flashing
tablet won't power on. The power button does nothing and holding volume down + power button does nothing either.
The battery isn't dead so I'm trying to figure out why the tablet won't come on if older ROM is on it.
I had no error outputs during the flash.
This is the ROM I flashed https://mirrors.lolinet.com/firmwar..._Gen/TB-X606F/TB-X606F_S300007_200923_BMP.zip
Any suggestion as to how to get it to work again
Click to expand...
Click to collapse
Did you mange to fix it?
A. Alaska said:
Did you mange to fix it?
Click to expand...
Click to collapse
You need to use a rework station heat gun or maybe a hair blow dryer might work to heat the sides of the screen to remove it.
I recommend cutting a water bottle in a square or rectangle shape then using the corner to slowly pry the screen off. After that remove the battery ribbon and hold the power bottom for 20-60 seconds to fully drain the charge.
Then recconect it and turn it on 100 percent works.
Just remember you must have the flash tool app and firmware ready in upgrade or download mode while holding down vol. It will reflash the tablet and bam will unbrick.
Just to note down my experiences here as well. I now also got into the same trouble. I tried
TB-X606F_S100015_191127_BMP.zip and also TB-X606F_S300091_201215_BMP.zip
It turns out that with these two you cannot start up the device anymore. Just as the thread-creator described. In my case pluging out and in again seems to give the SP FalshTool the chance to flash again (put it in "Download"-Mode before). So the latest firmware by today - TB-X606F_S300429_21110_BMP.zip - helped me to revive it again.
For me this is nice, but I also wanted to put Ubuntu touch on it just as described here: https://gitlab.com/ubports/community-ports/android9/lenovo-tab-m10-fhd-plus/lenovo-x606 ... unfortunately I am blocked now due to not being able to bring Android 9 on it. btw: There is no proposal on the site which firmware-version is even Android 9. I just guessed from the date.

Categories

Resources