Hello everyone,
I recently bought an amazon echo dot 2nd generation ( smart home, voice control device from amazon which runs with their voice recognition service Alexa ) after struggling with open-source voice recognition projects (jasper, raspberry pi).
Long story short, this device is running on android 5.1, with a mediatek cpu (MT8163) and i'm trying to gain access to it via usb.
When plugged via usb to a computer, a MT65XX preloader is first briefly detected, then it boots normally. I have no access through adb (and no screen to change settings). I found the way to boot into fastboot (hold action button on boot for those interested), but most of the useful commands (flash, boot,...) end with a "remote: the command you input is restricted on locked hw".
I got an answer for getvar all thought:
Code:
(bootloader) lk_build_desc: 0e1d0d9-20161018_220224
(bootloader) prod: 1
(bootloader) unlock_status: false
(bootloader) unlock_code: 0x627cf130f18b078f
(bootloader) serialno: G090LF09646208F0
(bootloader) max-download-size: 0x6d00000
(bootloader) warranty: no
(bootloader) secure: yes
(bootloader) kernel: lk
(bootloader) product: BISCUIT
(bootloader) version-preloader: 0.1.00
(bootloader) version: 0.5
all: Done!!
finished. total time: 0.004s
Does the "locked hw" bit means there is a lock on the NAND memory which can only be removed on the hw, or is this something to do with the bootloader? And possibly, is there some way to go around this restriction to gain root access of this device?
If i'm not clear enough (I'm not an expert in android dev), feel free to ask.
kekepremier said:
Hello everyone,
I recently bought an amazon echo dot 2nd generation ( smart home, voice control device from amazon which runs with their voice recognition service Alexa ) after struggling with open-source voice recognition projects (jasper, raspberry pi).
Long story short, this device is running on android 5.1, with a mediatek cpu (MT8163) and i'm trying to gain access to it via usb.
When plugged via usb to a computer, a MT65XX preloader is first briefly detected, then it boots normally. I have no access through adb (and no screen to change settings). I found the way to boot into fastboot (hold action button on boot for those interested), but most of the useful commands (flash, boot,...) end with a "remote: the command you input is restricted on locked hw".
I got an answer for getvar all thought:
Code:
(bootloader) lk_build_desc: 0e1d0d9-20161018_220224
(bootloader) prod: 1
(bootloader) unlock_status: false
(bootloader) unlock_code: 0x627cf130f18b078f
(bootloader) serialno: G090LF09646208F0
(bootloader) max-download-size: 0x6d00000
(bootloader) warranty: no
(bootloader) secure: yes
(bootloader) kernel: lk
(bootloader) product: BISCUIT
(bootloader) version-preloader: 0.1.00
(bootloader) version: 0.5
all: Done!!
finished. total time: 0.004s
Does the "locked hw" bit means there is a lock on the NAND memory which can only be removed on the hw, or is this something to do with the bootloader? And possibly, is there some way to go around this restriction to gain root access of this device?
If i'm not clear enough (I'm not an expert in android dev), feel free to ask.
Click to expand...
Click to collapse
Most likely this means a locked bootloader, same story as FireTV stick2.
I think that without any screen it'll be hard to even get into ADB. I wonder if ADB is turned on by default. Try ADB over network using the IP address, see if it's going to let you in. If ADB is working, you can try the DirtyCow exploit.
Observe that on FireTV2 I could use a combination of things and actually now I have ADB working over the USB cable :
http://forum.xda-developers.com/fire-tv/general/firetv-stick2-tank-dirtycow-exercises-t3511871
Kingroot has not succeeded yet, but perhaps future versions might work.
Thanks for the information. Unfortunately, I wasn't able to access adb, either by usb or wifi.
They seemed to have done a good job locking this device up. I will try to open it to see what I can get from it's board.
adb
i think i read something about having to push the dot button on it for 5+ secs to turn on adb for a short period and im not sure wether thats adb by wire or by wifi
EDIT: ok so i went back and found the article its fastboot over wire but it is a locked bootloader
It would be awesome if we could exploit this and get some kind of Linux or Android going on it, so we could turn it into a Google Assistant SDK device
+1 for loading the Google Assistant SDK onto an echo dot. That's currently what I'm trying to do. I have a rpi3 that I could use, but this hardware is perfectly suited for this...and cheaper than buying the rpi hardware!
regarding informations on vanderport.com blog, there are some research done about rooting amazon echo devices. One of them mentions a jtag method / emmc extender root boot that may could work...
..interesting.
SoulInferno said:
regarding informations on vanderport.com blog, there are some research done about rooting amazon echo devices. One of them mentions a jtag method / emmc extender root boot that may could work...
..interesting.
Click to expand...
Click to collapse
That's only for the 1st generation Echo and Echo Dot. The 2nd Gen Echo Dot is missing the testpoints on the board for that, and runs Android instead of a Linux distribution.
Maybe you guys could try using my old AFTV2 tools to see if you can get the preloader to read/write the flash (assuming they didn't disable the commands you need like they eventually did on the AFTV2).
https://gitlab.com/zeroepoch/aftv2-tools
---------- Post added at 05:49 PM ---------- Previous post was at 05:16 PM ----------
zeroepoch said:
Maybe you guys could try using my old AFTV2 tools to see if you can get the preloader to read/write the flash (assuming they didn't disable the commands you need like they eventually did on the AFTV2).
https://gitlab.com/zeroepoch/aftv2-tools
Click to expand...
Click to collapse
Nope I just tired them on my Amazon Echo Dot 2 just because I became curious. It handshakes fine with the preloader but as soon as you send the 32-bit read command, and address + size, it never sends back the expected ok status bytes (or any bytes) and just hangs.
Guys, did anyone see any meaningful progress towards getting "root" access on Echo Dot 2?
Amazon Echo Tech Support
For any kind of Amazon Echo assistance, you can contact @ +1-888-293-1413.
If anyone's feeling adventurous, here's the eMMC pinout for the device.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Note, I did not find this out myself, I got it from this set of slides.
And if you do decide to try to solder an adapter to those, make note: those capacitors/resistors are super tiny, and be careful.
r3pwn said:
If anyone's feeling adventurous, here's the eMMC pinout for the device.
Click to expand...
Click to collapse
That's really useful information, thanks!
With how cheap these devices are nowadays, I don't see why it's not worth the risk of bricking the device to get back to hacking on it. I wonder if the eMMC is encrypted or not?
I find no small amusement in the fact that its product name is "Biscuit."
Related
Hey mates,
today my friend gave me his HTC Magic, he doesnt know what happened to it, see the pictures:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
As you can see, the phone shows various stripes.
What I figured out:
- The phone can be charged
- If I connect it via USB, it gets detected normally:
- I guess I'm also able to get into bootloader via vol. down and power, because the LCD stays on all the time (with stripes) and it doesn't charge any further.
Based on my knowledge I would guess that the LCD is defective (or maybe the LCD flex cable is broken) - what do you think?
I'd say I'm quite knowledged about taking apart such devices, so I think I could proceed a LCD change.
Thanks for your help in advance
DN41
Install Fastboot Commander: http://forum.xda-developers.com/showthread.php?t=824435
Turn phone off, then turn on by pressing Back + Power (fastboot-mode)
Connect to PC
Post device info from utility
Thanks a lot, already doing it
DN41
Edit:
STARTING PRINT OF DEVICE INFO.
-----------------------------------.
Radio version: 2.22.28.25.
SPL/hboot version: 1.33.0013.
product: sapphire.
mid: sapp10000.
security: on.
build-mode: ship.
-----------------------------------.
Print of device info SUCCESSFUL.
This device does not have s-off nor eng hboot.
ARE YOU SURE THAT THIS IS THE RIGHT TOOL FOR YOU?.
Info seems right... but go to screen with "Custom command" and post output for commands
Code:
fastboot getvar version-main
fastboot getvar cid
fastboot getvar cidnum
It will identify what rom and customerid (equals country) phone has...
HTC Magic 32a [Airtel India] had same issue
I had a same issue in my device.. My screen turned to this after it fell from my pocket. Luckily i was having the phone on already and USB debugging was enabled.
I used [email protected] from here to see my phone and give commands like backup..
http://blog.ribomation.com/2010/01/droidscreen/
Then gave the phone to airtel and got a replacement for free.. Still was in warranty..
@anoopch:
I guess that something similar happened to this one
Badly, Debugging is not enabled because ADB doesnt find any device.
@5[Strogino]:
Thanks a lot sir, here's the information:
Version-main: 1.91.162.1
cid: VODAP102
cid-num: VODAP102∟■§U
But why do you need those informations? I think the LCD needs to be replaced and fine?
DN41
DN41 said:
But why do you need those informations? I think the LCD needs to be replaced and fine?
Click to expand...
Click to collapse
This info needs to exclude software incompatibility. Info seems ok and you have to replace lcd screen...
Thanks
Thought of that regarding that my friend is a noob concerning software, flashing, etc
DN41
LCD replaced, Magic working fine
Was a bit difficult to seperate digitizer and LCD but I handled it
DN41
Flashing Factory 8.1 - After ADB Reboot Bootloader: Error "Connect USB Data Cable"
GOAL: flash factory stock 8.1 image on phone purchased from Swappa. Why? To eliminate any possibility of any lingering software (e.g. Cerberus) that might have been installed by the previous owner.
PROBLEM: after issuing command ADB Reboot Bootloader at Windows terminal, the phone boots in to bootloader mode, but says, Connect USB Data Cable despite the fact that it is, in fact connected to my Win10 computer via a USB cable (the very same one that forced the phone to reboot into bootloader mode).
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Of course, I do notice that the above screen says, device is LOCKED, but my belief is that the bootloader on this phone is UNlocked. Why? Two reasons. (1) Because that's the way it was described in the Swappa listing. (2) the Developer Options \ OEM unlocking is set to "allow the bootloader to be unlocked."
By the way, if (while the phone is in bootloader mode) I run the flash-all.bat script, I get these errors:
C:\Users\me>"C:\BIN\angler-opm1.171019.011-factory-39448337\angler-opm1.171019.011\flash-all.bat"
error: cannot load 'bootloader-angler-angler-03.78.img': No such file or directory
rebooting into bootloader...
OKAY [ 0.022s]
finished. total time: 0.023s
error: cannot load 'radio-angler-angler-03.85.img': No such file or directory
rebooting into bootloader...
OKAY [ 0.022s]
finished. total time: 0.023s
W/ziparchive( 6844): Unable to open 'image-angler-opm1.171019.011.zip': No such file or directory
error: failed to open zip file 'image-angler-opm1.171019.011.zip': I/O error
Press any key to exit...
Click to expand...
Click to collapse
With the phone in normal mode (booted up normally), and then run ADB devices the system returns
List of devices attached
myserialnumber device
Click to expand...
Click to collapse
so I know that the computer and phone are talking. Immediately after that, if I try to run the same (flash-all.bat) command when the phone is not in bootloader mode, I get back waiting for any device as though computer and phone cannot communicate.
I am so confused. :cyclops:
What am I doing wrong?
UPDATE:
I just realized that I needed to issue the command fastboot flashing unlock at a Windows terminal prompt, then select (on the phone) to unlock the bootloader.
Furthermore.... I just noticed that in the Windows Termminal, I needed to navigate to the folder containing the IMG file to be flashed before running the flash-all.bat script. Since that location wasn't in my Windows 10 computer's PATH command, the script couldn't "see" the IMG file, which explains the errors above.
UPDATE # 2 - Solved
1. At windows terminal, issue command "adb devices" (to verify that computer and phone are connected).
2. At windows terminal, issue command "fastboot flashing unlock" then on phone choose the option to unlock bootloader.
3. At windows terminal, issue command adb reboot bootloader or on phone, with phone off, press power and volume-down simultaneously.
4. At windows terminal, with prompt located at the same drive and folder where the IMG you want to flash is located, run the flash-all.bat script.
5. After new OS is installed and phone reboots, then at Windows Terminal, , issue command "fastboot flashing lock" then on phone choose the option to re-lock bootloader. This will wipe the phone, reinstall the OS and reboot the phone.
There may be (probably are) smarter and better ways to skin this cat. If so, I hope that someone smarter than me will add that in the comments to help anyone who reads this thread.
I want to unlock the bootloader on my Mi Mix 3 5G, but I'm not able to... getting really frustrated with this.
I've done all the steps required prior to unlocking the Bootloader:
Enabled OEM Unlocking
Enabled USB Debugging
Added my Mi Account successfully in the Mi Unlock status setting
Downloaded the Mi Unlock tool and updated to the latest version + updated USB drivers
I logged in with the same Mi account on my PC
Plugged my phone into an USB 2.0 port
Entered Fastboot on my phone
Here's a screenshot with the error:
https://imgur.com/QEKdEBr
Here's the log for the error:
Code:
DEBUG <12:43:16.016,T:20112> : User click unlock button!
DEBUG <12:43:27.040,T:19924> : -s *** oem device-info
DEBUG <12:43:27.097,T:19924> : (bootloader) Verity mode: true
(bootloader) Device unlocked: false
(bootloader) Device critical unlocked: false
(bootloader) Charger screen enabled: false
OKAY [ 0.006s]
Finished. Total time: 0.006s
DEBUG <12:43:32.045,T:19924> : VerifyDeviceInfo
INFO <12:43:32.045,T:19924> : product:andromeda
DEBUG <12:43:32.045,T:19924> : getvar tokenversion -s ***
DEBUG <12:43:32.097,T:19924> : getvar:tokenversion FAILED (remote: 'GetVar Variable Not found')
Finished. Total time: 0.004s
INFO <12:43:32.097,T:19924> : getvar:tokenversion FAILED (remote: 'GetVar Variable Not found')
Finished. Total time: 0.004s
INFO <12:43:32.097,T:19924> : tokenversion=0
DEBUG <12:43:32.141,T:19924> : FAILED (remote: 'unknown command')
fastboot: error: Command failed
INFO <12:43:32.141,T:19924> : FAILED (remote: 'unknown command')
fastboot: error: Command failed
Finished. Total time: 0.003s
DEBUG <12:43:32.186,T:19924> : to sign token with key for device:andromeda
DEBUG <12:43:34.791,T:19924> : sign result:{
"code" : 20056,
"descCN" : "请重新绑定后再次尝试解锁",
"descEN" : "Please rebind and try again.",
"description" : "请重新绑定后再次尝试解锁"
}
DEBUG <12:43:34.791,T:19924> : unlock return:11111 msg:please rebind and try again.
I want to flash a new ROM on my device, but I'm getting pretty annoyed right now.
Thanks for the help in advance!
I would like to confirm the problem. In addition to the steps described above I also enabled the "find lost device" functionality and updated the device location via Xiaomi cloud before trying to unlock.
I am trying to unlock a POCO X3 Pro using Mi unlock tool version 6.5.406.31.
Unlock procedure stage one worked. I was told to wait for another 16 hours. After that time period I only get the aforementioned error message.
Having the exact same problem. I think the problem is, that mi binds the device wrongly to your account. When I check my Mi Account online and look under "Manage devices", it shows the phone, but without the real model
and name.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Having the same problem tried rebinding the account didn't work I think it's a new problem on xiaomi's end tried new versions of unlock tool and old versions. All didn't work and I've unlocked xiaomi phones without a problem in the past.
DeadRabbit62 said:
Having the exact same problem. I think the problem is, that mi binds the device wrongly to your account. When I check my Mi Account online and look under "Manage devices", it shows the phone, but without the real model
and name.
View attachment 5613441
Click to expand...
Click to collapse
In my case, "model" is also empty and "name" is shown correctly as "POCO X3 Pro".
Same problem on poco f3
Model and name are correct
Yeah, similar issue on my end... weirdly the photo of the device is correct and the name is displayed correctly in the devices list, but not the popup.
Same here on my Poco X3 Pro 8/256, tried both the official Xiaomi Unlock Tool and the XiaoMiTool V2, installed drivers again, rebooted and my device doesnt get recognized at first but after the doing the MiAssistent step in XMT2 it does get the device data
It does show my device name and model correctly tho
Might be something going on with the servers? I ain't no expert but it's odd how everyone with the same problem started popping up only today.
I am experiencing the same issue with a Redmi Note 10 Pro..
MoonBoomLT said:
Might be something going on with the servers? I ain't no expert but it's odd how everyone with the same problem started popping up only today.
Click to expand...
Click to collapse
yea, I am pretty sure it is either xiaomi being rude or their crappy servers sucking rn
TheRealRandomGuy said:
yea, I am pretty sure it is either xiaomi being rude or their crappy servers sucking rn
Click to expand...
Click to collapse
It sucks lmao, I'm saying goodbye to my old Mi 9T some time this weekend and I really wanted to try some custom roms. Oh well, guess it wasn't meant to be.
am I really that unlucky that Xiaomi's servers are malfunctioning when I want to unlock my bootloader
( btw, for me my model and name are shown correctly under "My devices" at https://us.i.mi.com/#/setting )
Same problem with Mi8
FurriousFox said:
am I really that unlucky that Xiaomi's servers are malfunctioning when I want to unlock my bootloader
( btw, for me my model and name are shown correctly under "My devices" at https://us.i.mi.com/#/setting )
Click to expand...
Click to collapse
not only you bro, I now waited this frickin week and pulled down all my data for nothing
Same problem with Mi 10T.
Waited patiently 168 hours to unlock it, just to get this error. Frustrated. Anyone solved it?
same happening to me my model and product no is correct but having same problem.
xiaomi 11i 5g PISSARRO 12.5.6.0 RKTINFK
damjan778899 said:
Same problem with Mi 10T.
Waited patiently 168 hours to unlock it, just to get this error. Frustrated. Anyone solved it?
Click to expand...
Click to collapse
As mentioned above it's probably a server issue, best way to solve it now is just to wait it out.
EDIT: If I'm incorrect and someone actually found a solution feel free to add it to the forum.
I googled this error. This thread shows up as the first result. Without OP posting about this today I wouldn't post here. I created my account just to confirm this problem.
I'm saying we might be the outliers that have this specific problem. Perhaps many people can unlock and will not post here about their success.
Having the same issue on Xiaomi 11T Pro since 11 AM
Hello i have a Motorola Moto G31 (W) XT273-3
OEM Locked - Android 11
FRP Locked
AP fastboot Flash Mode (Secure)
BL: MBM-2.1-Cofud_g-3e4f6a263-22075
Baseband: <not found>
Product/Variant: Cofud XT2173-3 64GB PVT
Serial Number: ZY22DXWR2G
CPU: MT6769V/CZ
eMMC: 64GB MICRON G1J9R8 RV=08 PV=00
FV=0000000000000204
DRAM = 4GB MICRON LP2 DIE=4GB M5=FF M6=06 M7=00 M8=18
CONSOLE=[NULL]: null
TOOLS MODE CONFIG: DISABLED
BATTERY OK
TRANSFER MODE: USB CONNECTED
Access - Summary of within RECOVERY MODE: NO COMMAND (DROID IMAGE with Error Sign) - can though with Vol up get into inside the recovery mode.
IMEI1: 3564200662778950
IMEI2: 3564200662778968
Within normal operational mode, it can access to wifi
the wifi address is 192.168.1.75
MAC Address to WI-FI card is 4a: 5e: 8f: 58: da: oc
FRP: 0X2F08000 - 0X100000
Pattern: 0X30B0000000 - 0XC0000000
i read another article https://firmwarespro.com/frp/motorola-moto-g31-detail where they describe a potential method to bypass FRP (Without having EMAIL and password information) i have not been able to sucess with that yet though, that's why i ask professionals here for advice and guidance how / if i can write the EEeProm chipset or someway reinstall custom ROM to the phone internal storage - and from that point bypass / get rid of previous stored Google FRP data.
Thanks in advice
Best regards
Richiie
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
https://mirrors.lolinet.com/firmware/motorola/cofud/official/ i found this foreign archive including ROM files for various phones. Could this perhaps be something that can be used in order to succeed properly?
https://custom-rom.org/download-custom-rom-for-moto-g31-android-12/ found this aswell but i don't know it's integrity if its a trusted source?
Here below is the link i mentioned previously found the unofficial method to bypass FRP.
Motorola Moto G31 FRP Bypass Android 11 Google Account Unlock Without PC & APK Free
In this post, I share the latest step-by-step tutorial to Motorola Moto G31 FRP Bypass Android 11 Google Account Unlock Without PC & APK Free
www.bypassfrpfiles.com
best regards
Hello every one, I have same phone, maybe some make custom system for this device, or pls how I can do it myself for share, maybe some linageos avaliable for this device?
pls some help me about assembling custom of for this phone how I can do it?
Also I have all needed for compile, but I cant know how make custom firmware from sources, pls help some one
overtube said:
Hello every one, I have same phone, maybe some make custom system for this device, or pls how I can do it myself for share, maybe some linageos avaliable for this device?
pls some help me about assembling custom of for this phone how I can do it?
Also I have all needed for compile, but I cant know how make custom firmware from sources, pls help some one
Click to expand...
Click to collapse
Anybody got anything, any information or advice what to do or how to proceed?
Best regards
Richiie89 said:
Anybody got anything, any information or advice what to do or how to proceed?
I want make custom os for phone but I can't find blobs on github for this model
Click to expand...
Click to collapse
I would buy this phone if it had custom rom and unlockable bootloader.
veseihaty said:
I would buy this phone if it had custom rom and unlockable bootloader.
Click to expand...
Click to collapse
I wish there would be more guides and how-to's how to proceed / reinstall the bootloader for this phone and make it work properly again.
Hello,
i have here a Xiaomi M1903F10G from a good friend, which stuck in a boot loop: phone seems to boot normal, home screen is visible for roundabout 1 second and the phone reboot immediately. Do we have a chance to get the user data (family photos etc.) ?
With Vol+ + Power button i get a "main menu mi-recovery 3.0" with the following options:
Reboot
Wipe Data
Connect with MIAssistant
With Vol- and Power button i can enter Fastboot mode, here are some info:
Bash:
[email protected]$ fastboot oem device-info
(bootloader) Verity mode: true
(bootloader) Device unlocked: false
(bootloader) Device critical unlocked: false
(bootloader) Charger screen enabled: false
OKAY [ 0.001s]
Finished. Total time: 0.001s
I can successful enter the EDL mode (i think) via shorting the pins on the main pcb, then phone shows up as "Qualcomm HS-USB QDLoader 9008 (COM6)". According to [GUIDE] How to dump and write back the storage on most of Qualcomm devices i should then use the right firehose file and try to open the partition manager. I tried many different firehose files(see attachments)/storage settings/2 computers(win10x64)/cables(usb-a 2.0/usb-a 3.0/usb-c), i can never successfully open the partition manager.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Now the question:what i can do to recover the user data for my friend ? I know i could oem unlock and try to boot into twrp, but as far as i know unlock would wipe all user data. (My friend has also the bill from when he bought the device if that helps).
there is not much you can do on locked bootloader. you can dump raw partitions, that's it. it isn't of any use because of encryption. all you could try is check file system for possible errors (if not metadata encrypted)
have you found loader that worked? try this python script in linux
https://github.com/bkerler/edl
Hello Alecxs,
thanks for your reply. Unfortunately, in the meantime i had to give the phone back to my friend. She told me, she want to try her luck with a commercial data recovery store. Hopefully they are lucky and are able to recover the photos.
Best,
Marcel
Recover photos? Aren't photos synchronised with Google?
Nope.
Then, all data should be backuped. No way to retrieve as data is encrypted anyway
yaro666 said:
Then, all data should be backuped. No way to retrieve as data is encrypted anyway
Click to expand...
Click to collapse
That is not correct, but thanks anyway.