[Guide] Convert OnePlus 8T Cyberpunk Edition - OnePlus 8T Guides, News, & Discussion

OnePlus 8T Cyberpunk Edition use a flag in param partition to identify.
If the flag is 8, HydrogenOS will mount the cyberpunk oem partition and enable it.
OTA and 9008 will not lost it!
So we can dump the param partition, change the flag and flash it to enable.
I write a simple python decrypt script to read/write the params.
This operation is very dangerous, please make sure to back up your data just in case!
Get the script from here
https://github.com/xiofee/op8t_param
Convert to Cyberpunk Edition
1. dump param partition
Code:
➜ adb shell
OnePlus8T:/ $ su
OnePlus8T:/ #
OnePlus8T:/ # dd if=/dev/block/by-name/param of=/sdcard/param.bin
OnePlus8T:/ # exit
OnePlus8T:/ $ exit
➜ adb pull /sdcard/param.bin ./
2. Write Cyberpunk Edition flag
Code:
➜ python op8t_param.py write -f param.bin -o param2.bin 4 8
3. flash param partition
Code:
➜ adb push ./param2.bin /sdcard/
➜ adb shell
OnePlus8T:/ $ su
OnePlus8T:/ # dd if=/sdcard/param2.bin of=/dev/block/by-name/param
or you can use fastboot flash param partition
Code:
➜ adb reboot bootloader
➜ fastboot flash param param2.bin
3. reboot

reserve

nice job

Will the UX be changed from stock to Cyberpunk edition ?

So to revert the change, we'll have to make it to 4 again? or reflash the backed up param?
edit: so I tried it on my 8T Global AA variant.
theme UI works, has camera effects too
cyberpunk FOD logo and animation does not work (still on stock)
No cyberpunk sounds
will test horizon light

Abaddon said:
So to revert the change, we'll have to make it to 4 again? or reflash the backed up param?
edit: so I tried it on my 8T Global AA variant.
theme UI works, has camera effects too
cyberpunk FOD logo and animation does not work (still on stock)
No cyberpunk sounds
will test horizon light
Click to expand...
Click to collapse
I only tested on HydrogenOS, it has cyberpunk oem partition.
If you want restore, use your backup param or set the flag to 0 and reflash it.
Code:
python op8t_param.py write -f param.bin -o param2.bin 4 0
And the flag maybe 3 place
not prmec
prmec primary block
prmec backup block
The Cyberpunk flag now only use prmec primary block, if the prmec primary block is incorrect, system will use backup block restore the primary block.
If you have some problem, you can modify all place with follow step
modify not prmec block
Code:
python op8t_param.py write -f param.bin -o param2.bin 4 0 -ne
modify prmec primary block
Code:
python op8t_param.py write -f param.bin -o param2.bin 4 0
modify prmec backup block
Code:
python op8t_param.py write -f param.bin -o param2.bin 4 0 -np

I tried to do this on the Global rom I'm assuming it only works on hydrogen os? I got a syntax error on the python op8 code

work like a charm . i tried with 11.5.6 AA. But fod animation,ringtone,live wallpaper,icon pack,boot animation didnt change and for that reason i flashed boot animation via magisk and installed wallpaper and icon pack port.

Phreaker8 said:
work like a charm . i tried with 11.5.6 AA. But fod animation,ringtone,live wallpaper,icon pack,boot animation didnt change and for that reason i flashed boot animation via magisk and installed wallpaper and icon pack port.
Click to expand...
Click to collapse
About the phone shows 8T or Cyberpunked 8T ?
Your phone iw KB2000 that came with H2OS initially?
od animation,ringtone,live wallpaper,icon pack,boot animation didnt change because OEM cyberpunk comes only H2OS Rom.

Steve0007 said:
About the phone shows 8T or Cyberpunked 8T ?
Your phone iw KB2000 that came with H2OS initially?
od animation,ringtone,live wallpaper,icon pack,boot animation didnt change because OEM cyberpunk comes only H2OS Rom.
Click to expand...
Click to collapse
kb2001

The guide worked just some of the features doesn't stick

xiofee said:
I only tested on HydrogenOS, it has cyberpunk oem partition.
If you want restore, use your backup param or set the flag to 0 and reflash it.
Code:
python op8t_param.py write -f param.bin -o param2.bin 4 0
And the flag maybe 3 place
not prmec
prmec primary block
prmec backup block
The Cyberpunk flag now only use prmec primary block, if the prmec primary block is incorrect, system will use backup block restore the primary block.
If you have some problem, you can modify all place with follow step
modify not prmec block
Code:
python op8t_param.py write -f param.bin -o param2.bin 4 0 -ne
modify prmec primary block
Code:
python op8t_param.py write -f param.bin -o param2.bin 4 0
modify prmec backup block
Code:
python op8t_param.py write -f param.bin -o param2.bin 4 0 -np
Click to expand...
Click to collapse
With this i come complete back to a 8T EU what i have? i flash the param.bin from a 8T EU but msm download also a cyberpunk partition and i dont know why.

Hot-Proton said:
With this i come complete back to a 8T EU what i have? i flash the param.bin from a 8T EU but msm download also a cyberpunk partition and i dont know why.
Click to expand...
Click to collapse
It means your param still has the flag for cyberpunk. Revert it to 0 as mentioned at one of the previous posts on how to revert it.

Abaddon said:
It means your param still has the flag for cyberpunk. Revert it to 0 as mentioned at one of the previous posts on how to revert it.
Click to expand...
Click to collapse
No i get a param from a 8T EU without changes but msm download a cyberpunk partition.

Hot-Proton said:
No i get a param from a 8T EU without changes but msm download a cyberpunk partition.
Click to expand...
Click to collapse
I really feel bad for you bro

Keep in mind that if you need to MSN back to T-Mobile stock it wont work because the param.bin fiile has been edited should you ever need to go back to tmobile use this file first

Exathi said:
Keep in mind that if you need to MSN back to T-Mobile stock it wont work because the param.bin fiile has been edited should you ever need to go back to tmobile use this file first
Click to expand...
Click to collapse
I was just going to ask about that. Also, I wonder, if we have a T-Mobile branded device could we change the param.bin to be the standard North American Unlocked variant and such we could start using the MSM tool for that variant?

Working fine here Flashed the latest H2OS first, then flashed the modified param via fastboot. Had to go to "Customization" to enable the icon pack and accent color - It was already present, just needed to enable it. Same with wallpaper. But everything works

So, if i convert my normal 8T to cyberpunk then use MSM tool to restore, it has Cyberpunk addition in stock (no rooted, not modified) OxygenOS? I really like to mess with this :v

Well i did this and convert done full to Cyberpunk.
Lately i received 11.0.8.11 OTA and now cyberpunk addition is messed up. I need to install full OTA (not 300mb, full 2gb) to restore cyberpunk addition. I can't find any link, so returning back to older version. Also Thank you OP for posting this guide

Related

[Q] How to recover files from formatted partition, find Userdata block

I just downgraded my Verizon G2 from 12b to 11a with this guide: (because of the push email issue)
http://forum.xda-developers.com/showthread.php?t=2448960
What I didn't realize was it would erase the data partition and now all my pictures are gone (idiot, I know)
Recovery software wont work because the G2 is only listed as a MTP device and they software doesn't see it.
I tried using this guide here, http://forum.xda-developers.com/showthread.php?t=1994705, which has instructions for the Galaxy Nexus which has the same MTP only issue. It basically dumps the partition as a .raw file to the computer through adb and then you can recover from that. I'm having a problem with this command "/system/bin/busybox nc -l -p 5555 -e /system/bin/busybox dd if=/dev/block/mmcblk0p12" mmcblk0p12 is the block on the galaxy nexus where the userdata was stored. I thought I had found the G2's block at "/dev/block/platform/msmsdcc.1/by-name/userdata" but the command doesn't work
Does anyone have any idea what the block path really is or an alternative to recover my lost stuff? Thanks.
Also tried to flash TWRP and then mount from there so software will see it but mounting does nothing
indigoataxia said:
I just downgraded my Verizon G2 from 12b to 11a with this guide: (because of the push email issue)
http://forum.xda-developers.com/showthread.php?t=2448960
What I didn't realize was it would erase the data partition and now all my pictures are gone (idiot, I know)
Recovery software wont work because the G2 is only listed as a MTP device and they software doesn't see it.
I tried using this guide here, http://forum.xda-developers.com/showthread.php?t=1994705, which has instructions for the Galaxy Nexus which has the same MTP only issue. It basically dumps the partition as a .raw file to the computer through adb and then you can recover from that. I'm having a problem with this command "/system/bin/busybox nc -l -p 5555 -e /system/bin/busybox dd if=/dev/block/mmcblk0p12" mmcblk0p12 is the block on the galaxy nexus where the userdata was stored. I thought I had found the G2's block at "/dev/block/platform/msmsdcc.1/by-name/userdata" but the command doesn't work
Does anyone have any idea what the block path really is or an alternative to recover my lost stuff? Thanks.
Click to expand...
Click to collapse
Hi there,
You should identify which partition is your data partition (link in step 1 of the guide). I did it, it shows me mmcblk0p35 (i have D802). But I had another problem.
I have rooted stock rom (D80210f-EUR-XX) with stock recovery. After modyfying /system/build.prop i got bootloop. the only thing I could do was to enter stock recovery and "Reset to defaults", so I did, but I lost all my data, messages, settings etc.
I tried to recover data partition using the same guide, but i'm stuck at step 6. It shows me speed of 0 B/s and creates file of 0B nomatter how long I wait.
Can anybody help please?
indigoataxia said:
I just downgraded my Verizon G2 from 12b to 11a with this guide: (because of the push email issue)
http://forum.xda-developers.com/showthread.php?t=2448960
What I didn't realize was it would erase the data partition and now all my pictures are gone (idiot, I know)
Recovery software wont work because the G2 is only listed as a MTP device and they software doesn't see it.
I tried using this guide here, http://forum.xda-developers.com/showthread.php?t=1994705, which has instructions for the Galaxy Nexus which has the same MTP only issue. It basically dumps the partition as a .raw file to the computer through adb and then you can recover from that. I'm having a problem with this command "/system/bin/busybox nc -l -p 5555 -e /system/bin/busybox dd if=/dev/block/mmcblk0p12" mmcblk0p12 is the block on the galaxy nexus where the userdata was stored. I thought I had found the G2's block at "/dev/block/platform/msmsdcc.1/by-name/userdata" but the command doesn't work
Does anyone have any idea what the block path really is or an alternative to recover my lost stuff? Thanks.
Click to expand...
Click to collapse
I'have your same issue (LG G2 D802)
I tried with:
/system/xbin/busybox ncat -l -p 5555 -e /system/xbin/busybox dd if=/dev/block/platform/msm_sdcc.1/mmcblk0p35
/system/xbin/busybox nc -l -p 5555 -e /system/xbin/busybox dd if=/dev/block/platform/msm_sdcc.1/mmcblk0p35
/system/xbin/busybox ncat -l -p 5555 -e /system/xbin/busybox dd if=/dev/block/mmcblk0p35
/system/xbin/busybox nc -l -p 5555 -e /system/xbin/busybox dd if=/dev/block/mmcblk0p35
but nothing happen!
did you solve? if yes, how???
tetractius said:
did you solve? if yes, how???
Click to expand...
Click to collapse
No, never was able to recover.
Sorry for reviving a dead thread.
Has anyone been able to successfully recover their deep formatted drive? Like the guide mentioned does? I'm currently trying, but no success..

[Guide][Xiaomi][MSM8956] Port Redmi Note 3 ROMs To Mi Max

In my previous guide i explained How to port hydrogen ROMs to helium, and in this simple guide i'll show you guys How to port ROMs from kenzo as it's the same SoC like hydrogen (MSM8956) let's start !
You'll need some tools:
- ROM kitchen, i prefer superr's kitchen. :good:
- Boot image Extractor, you can use Android Image Kitchen
- Any text editor, Notepad++ is good choice for windows users.
Part 0: Preparing:
0- Get any Redmi Note 3 ROM (kenzo), you can find many in XDA or 4PDA
1- Open superr's kitchen and create new project, then copy kenzo ROM to project folder and Extract zip using kitchen (option 4). [when it asks for perm type choose sparse_dat]
2- Copy boot.img to Android Image Kitchen folder and run unpackimg.sh / unpackimg.bat (You can also drag and drop boot to unpackimg.bat if you're using windows).
Part 1: System files:
there's many differences between hydrogen and kenzo, like audio, camera and fingerprint, so you'll need to copy these files to "system" folder in kitchen.
File list
Then you have to edit build.prop replace kenzo with hydrogen and copy lines in hydrogen one like "fpc"
You can get this files from any working hydrogen ROM or from my Github Repo Here
Part 2: Editing Boot.img :
After unpacking kenzo boot.img using Android Image Kitchen You'll need to copy hydrogen zImage and edit somefiles:
* i prefer editing the following files even you can just copy it from hydrogen boot.img *
- Copy hydrogen zImage to "split_img" and make sure it's renamed as "boot.img-zImage"
- edit default.prop, change kenzo to hydrogen
- edit init.qcom.rc, you should use any compare program, like diff / meld / beyondcompare to check what code is in hydrogen and not in kenzo like
Line 204:216
Code:
# LED
chmod 0666 /sys/class/leds/led:torch_0/brightness
chmod 0666 /sys/class/leds/led:torch_1/brightness
chmod 0666 /sys/class/leds/led:switch/brightness
chown system system /sys/class/leds/red/blink
chown system system /sys/class/leds/green/blink
chown system system /sys/class/leds/blue/blink
chown system system /sys/class/leds/red/led_time
chown system system /sys/class/leds/green/led_time
chown system system /sys/class/leds/blue/led_time
on post-fs
start qseecomd
line 352:376
Code:
# Mark the copy complete flag to not completed
write /data/misc/radio/copy_complete 0
chown radio radio /data/misc/radio/copy_complete
chmod 0660 /data/misc/radio/copy_complete
# File flags for prebuilt ril db file
write /data/misc/radio/prebuilt_db_support 1
chown radio radio /data/misc/radio/prebuilt_db_support
chmod 0400 /data/misc/radio/prebuilt_db_support
write /data/misc/radio/db_check_done 0
chown radio radio /data/misc/radio/db_check_done
chmod 0660 /data/misc/radio/db_check_done
# Fingerprint
mkdir /data/fpc 0770 system system
mkdir /data/fpc/s 0770 system system
mkdir /data/tombstones 0771 system system
mkdir /tombstones/modem 0771 system system
mkdir /tombstones/lpass 0771 system system
mkdir /tombstones/wcnss 0771 system system
mkdir /tombstones/dsps 0771 system system
mkdir /persist/data/sfs 0700 system system
mkdir /persist/data/tz 0700 system system
mkdir /data/misc/dts 0770 media audio
mkdir /data/misc/audio_pp 0771 media audio
And
Code:
# Bring up all cores online
write /sys/devices/system/cpu/cpu1/online 1
write /sys/devices/system/cpu/cpu2/online 1
write /sys/devices/system/cpu/cpu3/online 1
write /sys/devices/system/cpu/cpu4/online 1
write /sys/devices/system/cpu/cpu5/online 1
To:
Code:
# Bring up all cores online
write /sys/devices/system/cpu/cpu1/online 1
write /sys/devices/system/cpu/cpu2/online 1
write /sys/devices/system/cpu/cpu3/online 1
write /sys/devices/system/cpu/cpu4/online 1
write /sys/devices/system/cpu/cpu5/online 1
write /sys/devices/system/cpu/cpu6/online 1
write /sys/devices/system/cpu/cpu7/online 1
Line 823:861
Code:
service fingerprintd /system/bin/fingerprintd
class late_start
user system
group drmrpc input system
socket fpce stream 0660 system system
writepid /dev/cpuset/system-background/tasks
service imsqmidaemon /system/bin/imsqmidaemon
class main
user system
socket ims_qmid stream 0660 system radio
group radio log diag
service imsdatadaemon /system/bin/imsdatadaemon
class main
user system
socket ims_datad stream 0660 system radio
group system wifi radio inet log diag
disabled
on property:sys.ims.QMI_DAEMON_STATUS=1
start imsdatadaemon
service ims_rtp_daemon /system/bin/ims_rtp_daemon
class main
user system
socket ims_rtpd stream 0660 system radio
group radio diag inet log
disabled
service imscmservice /system/bin/imscmservice
class main
user system
group radio diag inet log
disabled
on property:sys.ims.DATA_DAEMON_STATUS=1
start ims_rtp_daemon
start imscmservice
- Edit init.rc
Change
Code:
chown system system /sys/class/leds/green/brightness
chown system system /sys/class/leds/blue/brightness
chown system system /sys/class/leds/red/device/grpfreq
To
Code:
chown system system /sys/class/leds/green/brightness
chown system system /sys/class/leds/green/blink
chown system system /sys/class/leds/blue/brightness
chown system system /sys/class/leds/blue/blink
chown system system /sys/class/leds/red/device/grpfreq
chown system system /sys/class/leds/red/device/grppwm
- Edit init.qcom.sh
Add this line after start_sensors
Code:
start_copying_prebuilt_qcril_db
And this line at the end of file
Code:
chown radio:radio /data/misc/radio/copy_complete
- then Repack boot and copy image-new.img to superr's kitchen project folder then rename it to boot.img
You can get these files from any hydrogen boot.img
Part 3: Finalizing :
Now you've finished porting kenzo ROM to hydrogen, but you need to repack ROM into zip to be able to use it.
- Open superr's kitchen, choose 8) ROM Tools Menu then 7) Build Menu and finally 1) Build full ROM Zip
- Wait till it finishes (when it asks for sign zip press "y") then you'll have to edit META-INF/com/google/android/updater-script inside ROM Zip, so open ROM zip and head to META-INF/com/google/android/ to open updater-script file using text editor then change script to:
Code:
package_extract_dir("install", "/tmp/install");
set_metadata_recursive("/tmp/install", "uid", 0, "gid", 0, "dmode", 0755, "fmode", 0644);
set_metadata_recursive("/tmp/install/bin", "uid", 0, "gid", 0, "dmode", 0755, "fmode", 0755);
mount("ext4", "EMMC", "/dev/block/bootdevice/by-name/system", "/system", "");
run_program("/tmp/install/bin/backuptool.sh", "backup");
unmount("/system");
show_progress(0.750000, 0);
ui_print("Patching system image unconditionally...");
block_image_update("/dev/block/bootdevice/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat") ||
abort("E1001: Failed to update system image.");
show_progress(0.020000, 10);
mount("ext4", "EMMC", "/dev/block/bootdevice/by-name/system", "/system", "");
run_program("/tmp/install/bin/backuptool.sh", "restore");
unmount("/system");
show_progress(0.050000, 5);
package_extract_file("boot.img", "/dev/block/bootdevice/by-name/boot");
show_progress(0.200000, 10);
set_progress(1.000000);
And Congratulations You've finished porting kenzo ROM to your hydrogen
Special Thanks:
SuperR. for his great kitchen
osm0sis for amazing image tools script
iBotPeaches for apktool
@nijel8 for helium device tree
@Davehimself for helium vendor
@Ahmed Hady & @androidlover5842 my great friends & helpers
And me for typing this guide :good:
Reversed 1
Reversed 2
yshalsager said:
In my previous guide
Click to expand...
Click to collapse
Can u plz port sailfish os of kenzo for MiMAX hydrogen please?
https://forum.xda-developers.com/redmi-note-3/development/rom-sailfish-os-2-0-5-6-kenzo-t3571258/
afridi.shahriar said:
Can u plz port sailfish os of kenzo for MiMAX hydrogen please?
https://forum.xda-developers.com/redmi-note-3/development/rom-sailfish-os-2-0-5-6-kenzo-t3571258/
Click to expand...
Click to collapse
I think it can't be ported. Need to built from sources
yshalsager said:
I think it can't be ported. Need to built from sources
Click to expand...
Click to collapse
Then leave it
yshalsager said:
I think it can't be ported. Need to built from sources
Click to expand...
Click to collapse
Can u port nubia or funtouch os for kenzo or tell me name of device from which I can try to port these ui
Criston said:
Can u port nubia or funtouch os for kenzo or tell me name of device from which I can try to port these ui
Click to expand...
Click to collapse
I don't have kenzo, try with any MSM8956 device or MSM8976
What if rom does not contain some files in the system folder?
psbankar said:
What if rom does not contain some files in the system folder?
Click to expand...
Click to collapse
Forget it
yshalsager said:
I don't have kenzo, try with any MSM8956 device or MSM8976
Click to expand...
Click to collapse
Devices Based On MSM8976 Can Be used R U Sure though the difference is only core base
Criston said:
Devices Based On MSM8976 Can Be used R U Sure though the difference is only core base
Click to expand...
Click to collapse
Yes. As we can port from helium
can similarly kenzo roms can be ported to leeco le with sd652 ??
ankk98 said:
can similarly kenzo roms can be ported to leeco le with sd652 ??
Click to expand...
Click to collapse
yes
yshalsager said:
yes
Click to expand...
Click to collapse
i am a beginner
can u plz explain how this port can work? i mean both devices have different soc?
I want to try it by porting some oreo kenzo rom to leeco le 2 with msm8976
ankk98 said:
i am a beginner
can u plz explain how this port can work? i mean both devices have different soc?
I want to try it by porting some oreo kenzo rom to leeco le 2 with msm8976
Click to expand...
Click to collapse
Follow the guide and take files from your stock/working rom to kenzo rom
Part 3: Finalizing :
Now you've finished porting hydrogen ROM to helium, but you need to repack ROM into zip to be able to use it.
I dont get it, porting rom from hydrogen to helium?
raymondsanusi said:
Part 3: Finalizing :
Now you've finished porting hydrogen ROM to helium, but you need to repack ROM into zip to be able to use it.
I dont get it, porting rom from hydrogen to helium?
Click to expand...
Click to collapse
lol, sorry i was typo mistake
You can port from H2 to He but follow my another guide.
Is this guide can be used for porting Oreo roms?
Hello @yshalsager the file of hydrogen you have uploaded on GitHub are from which MIUI version?

Set Maximum CPU frequency on any Android ROM for the HP TOUCHPAD

The maximum and minimum cpu frequencies allow by the Kernel can be set to all the Android ROM ever made for the HP TOUCHPAD until now and forever!
This is apply as a native setting ( as shipped from the factory, we could say )
The ROM will not be modify, no need for ROOT access or install SuperSu or any Apps.
It can be done to an existing installed ROM, no need to re-flash, is safe and will not damage your installation or prevent you from using your TP. Even if you do not do it right, you will get your TP running as always.
This is only done in a Linux OS, I am using ubuntu, which it can also be run under a Virtual Machine in any other OS.
1. Get the boot.img from the zip ROM or the current uImage from the TP boot directory.
(The boot.img must be copy to the root/hpboot directory of the PC, not on the tablet)
2. Run each of this commands separately in terminal in the directory the boot.img is.
dumpimage -i boot.img kernel.uImage
dumpimage -i boot.img -p 1 ram
dd if=ram of=ramdisk.img.gz bs=64 skip=1
gunzip ramdisk.img.gz
mkdir ramdisk; cd ramdisk
cpio -i < ../ramdisk.img
3. Go to the ramdisk direcoty and open this file in a text editor:
init.tenderloin.power.rc
Copy and Paste under # CPU Scaling and # CPU boost the following:
Note: You can add different settings to each cpu0 or cpu1.
Different frequencies to each and also assigned different Governors to each cpu.
You have total and individual control.
# CPU Scaling
# Replace the numbers at the first two lines at the end with the frequencies your TP can handle.
# Replace the numbers at the last two lines at the end with the frequencies your TP can handle.
write /sys/devices/system/cpu/cpu0/cpufreq/scaling_min_freq 192000
write /sys/devices/system/cpu/cpu1/cpufreq/scaling_min_freq 192000
write /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq 1782000
write /sys/devices/system/cpu/cpu1/cpufreq/scaling_max_freq 1782000
# Configure Performance Governor
# This is optional, but it will speed boot time using both CPU at maximum frequencies.
write /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor "performance"
write /sys/devices/system/cpu/cpu1/cpufreq/scaling_governor "performance"
# CPU boost
# Set your desire speed can not be higher than your maximum frequencies.
write /sys/module/cpu_boost/parameters/boost_ms 20
write /sys/module/cpu_boost/parameters/sync_threshold 1782000
write /sys/module/cpu_boost/parameters/input_boost_freq 1782000
You can configure the type of governor after the system finished booting on this line. Is all up to the Kernel and your choice, but interactive is good.
# Configure Interactive
write /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor "interactive"
write /sys/devices/system/cpu/cpu1/cpufreq/scaling_governor "interactive"
4. Save the changes and repack the ramdisk with kernel.
Open Terminal in the ramdisk folder and paste:
find . | cpio --create --format='newc' | gzip > ../ramdisk_Pack.img
5. Go to the folder where the original boot.img file is and you should have a file ( ramdisk_Pack.img )
Paste the following two commands:
mkimage -A arm -O linux -T ramdisk -C none -a 0x00000000 -n "TENDERLOIN MAX CPU" -d ./ramdisk_Pack.img ./ramdisk.uImage
mkimage -A arm -T multi -C none -n "Tenderloin Android MAX CPU" -d kernel.uImage:ramdisk.uImage uImage.Android_MAX_CPU
6. There is a file name uImage.Android_MAX_CPU in the same folder as your original boot.img, copy it to your TP boot directory and reboot.
If you enter a wrong frequency and it did not finished then do a hard reset and select the other boot image and use it as always. If it finished booting then you are running faster than ever!
To take in consideration:
The Kernel in the ROM has the frequencies that supports, most of the ROM comes with a top frequencies of 1782000. The SKZ kernel allows for a maximum frequency of 1890000.
The HP Touchpad where made with different suppliers of components. Due to this differences not all supports the same maximum frequencies. Very few can work under 1890000 or 18360000. But you can get lucky and have one. You should know and test the maximum speed that it will take, you can do that with Kernels apps before making modifications to the Boot Image, also the minimum frequencies are important as well.
The advantages of creating your own personal Maximum Speed Boot Image:
1 You will get faster boot time as the CPUs are set to work after the system starts the booting process and do not have to wait until the GUI starts and the Kernel app applies the settings.
2. Keep your ROM secure, no ROOT and no Super User, use it as is.
3. Less apps to install to take space and waste of Memory. Kernel apps and Super User have background services that are all time running just to give you the extra speed. Other apps can get the extra Ram for more processing.
4. There is more benefits of running the device at a higher frequency with no extra processing power, than have multiple apps to fine tune your CPU and governors but use resources.
View attachment 4613960
I don't know how to do with this, please help.
[email protected]:/mnt/g/devices/tenderloin/12.5.1/ramdisk$ find . | cpio –create –format=’newc’ | gzip > ../rak_Pack.img
cpio: You must specify one of -oipt options.
Try `cpio --help' or `cpio --usage' for more information.
Try 'cpio --help' or 'cpio --usage' for more information.
In this post I did a detail explanation on how to unpack the boot image.
https://forum.xda-developers.com/hp-touchpad/development/make-root-permanet-read-write-to-t3846567
Create a directory on root ( hpboot ) copy and paste the command on terminal as is on the post and it should work.
View attachment 4614596
[email protected]:/mnt/g/devices/tenderloin$ cd ./hpboot/
[email protected]:/mnt/g/devices/tenderloin/hpboot$ ls
boot.img
[email protected]:/mnt/g/devices/tenderloin/hpboot$ dumpimage -i boot.img kernel.uImage
[email protected]:/mnt/g/devices/tenderloin/hpboot$ dumpimage -i boot.img -p 1 ram
[email protected]:/mnt/g/devices/tenderloin/hpboot$ dd if=ram of=ramdisk.img.gz bs=64 skip=1
28781+1 records in
28781+1 records out
1842017 bytes (1.8 MB, 1.8 MiB) copied, 0.431285 s, 4.3 MB/s
[email protected]:/mnt/g/devices/tenderloin/hpboot$ gunzip ramdisk.img.gz
[email protected]:/mnt/g/devices/tenderloin/hpboot$ mkdir ramdisk; cd ramdisk
[email protected]:/mnt/g/devices/tenderloin/hpboot/ramdisk$ cpio -i < ../ramdisk.img
6819 blocks
[email protected]:/mnt/g/devices/tenderloin/hpboot/ramdisk$ find . | cpio –create –format=’newc’ | gzip > ../rakRW.img
cpio: You must specify one of -oipt options.
Try `cpio --help' or `cpio --usage' for more information.
Try 'cpio --help' or 'cpio --usage' for more information.
[email protected]:/mnt/g/devices/tenderloin/hpboot/ramdisk$
I did it due to https://forum.xda-developers.com/hp-...te-to-t3846567 , but it stuck just like last time I did it.
What does this mean?
cpio: You must specify one of -oipt options.
I can not see the picture you attached and the link does not work.
Are you doing all the commands inside a Linux machine?
zcarrt said:
--SNIP--
[email protected]:/mnt/g/devices/tenderloin/hpboot/ramdisk$ find . | cpio –create –format=’newc’ | gzip > ../rakRW.img
cpio: You must specify one of -oipt options.
Try `cpio --help' or `cpio --usage' for more information.
--SNIP--
Click to expand...
Click to collapse
It may be copied wrong. It should be: cpio --create -–format=’newc’ (not one dash but two, i.e. not -create, -format, but --create, --format)
The working path shows: [email protected]:/mnt/g/devices/tenderloin/hpboot$
I am not a Linux guru, but it look the boot.img is on the root of the tablet and not the PC.
The commands will only work properly if the directory is created in the root of the PC no where else.
((correction))
Yes, you are correct, is something about pasting a double dash that it turns into a hyphen (single dash). When editing the post it shows as intended, double dash. When publish, shows as a single dash, unless the font size is change on here and type again.
How I did it:
Enter the command in ubuntu terminal ( worked ) then copy and paste into LibreOffice Writer.
Write the guide, then copy and paste into the forum, to avoid any mistakes.
Then surprise ! a double dash is change to a hyphen and I am not even aware of it..!
Thanks for correcting!
HP_TOUCHPAD said:
The working path shows: [email protected]:/mnt/g/devices/tenderloin/hpboot$
I am not a Linux guru, but it look the boot.img is on the root of the tablet and not the PC.
The commands will only work properly if the directory is created in the root of the PC no where else.
Click to expand...
Click to collapse
I thought that, too, but there wouldn't be enough room for the dd command to work, and the error message wouldn't have been a cpio error.
my path:
[email protected]:~/hpboot$
There should not be any mounted device anywhere.
HP_TOUCHPAD said:
I can not see the picture you attached and the link does not work.
Are you doing all the commands inside a Linux machine?
Click to expand...
Click to collapse
I did it in windows 10 Ubuntu bash last time , I will try it properly in a Linux machine again. Thanks.
zcarrt said:
I did it in windows 10 Ubuntu bash last time , I will try it properly in a Linux machine again. Thanks.
Click to expand...
Click to collapse
The problem was on the formatting on my post. When I paste the guide for some reason it shows as a hyphen instead of a double dash.
I corrected the error. This is how it should be, also should work in the windows10 linux subsystem.
find . | cpio --create --format='newc' | gzip > ../ramdisk_Pack.img
Stuck on step 5.
Not clear where to "paste" the 2 lines. I "pasted" them in terminal but get the following:
Usage: mkimage -l image
-l ==> list image header information
mkimage [-x] -A arch -O os -T type -C comp -a addr -e ep -n name -d data_file[:data_file...] image
-A ==> set architecture to 'arch'
-O ==> set operating system to 'os'
-T ==> set image type to 'type'
-C ==> set compression type 'comp'
-a ==> set load address to 'addr' (hex)
-e ==> set entry point to 'ep' (hex)
-n ==> set image name to 'name'
-d ==> use image data from 'datafile'
-x ==> set XIP (execute in place)
mkimage [-D dtc_options] [-f fit-image.its|-F] fit-image
-D => set all options for device tree compiler
-f => input filename for FIT source
Signing / verified boot not supported (CONFIG_FIT_SIGNATURE undefined)
mkimage -V ==> print version information and exit
Use -T to see a list of available image types
Any help please?
Thanks.
kojam said:
Stuck on step 5.
Not clear where to "paste" the 2 lines. I "pasted" them in terminal but get the following:
go to this post and run the script, if all work on your system then you have everything to build it.
https://forum.xda-developers.com/showpost.php?p=78028080&postcount=4
Click to expand...
Click to collapse
HP_TOUCHPAD said:
kojam said:
Stuck on step 5.
Not clear where to "paste" the 2 lines. I "pasted" them in terminal but get the following:
5. Go to the folder where the original boot.img file is and you should have a file ( ramdisk_Pack.img )
Paste the following two commands:
mkimage -A arm -O linux -T ramdisk -C none -a 0x00000000 -n “TENDERLOIN MAX CPU” -d ./ramdisk_Pack.img ./ramdisk.uImage
mkimage -A arm -T multi -C none -n “Tenderloin Android MAX CPU” -d kernel.uImage:ramdisk.uImage uImage.Android_MAX_CPU
go to this post and run the script, if all work on your system then you have everything to build it.
https://forum.xda-developers.com/showpost.php?p=78028080&postcount=4
Click to expand...
Click to collapse
Thanks for your reply.
I was in that folder (where ramdisk_Pack.img is) in terminal, then I entered/pasted those commands in terminal...
What am I doing wrong? Explain it to me like I'm 5yrs old please. LOL :laugh::silly:
Thanks a million!
Click to expand...
Click to collapse
kojam said:
HP_TOUCHPAD said:
Thanks for your reply.
I was in that folder (where ramdisk_Pack.img is) in terminal, then I entered/pasted those commands in terminal...
What am I doing wrong? Explain it to me like I'm 5yrs old please. LOL :laugh::silly:
Thanks a million!
Click to expand...
Click to collapse
My apologies, you did everything right. The error was in the command I posted which is now corrected.
This is how it happen:
I created the commands in ubuntu text editor, then wrote the instructions in LibreOffice Writer, then copy and paste everything to this forum. Then the apostrophe character got changed and that is why the command was not working.
I tested the commands one by one and I was able to finish the process, you should be able to do it also. This is a learning process and I thank you for trying it and finding out the errors.
Redo everything again as I also corrected the changes for the CPU speed.
Click to expand...
Click to collapse
HP_TOUCHPAD said:
kojam said:
My apologies, you did everything right. The error was in the command I posted which is now corrected.
This is how it happen:
I created the commands in ubuntu text editor, then wrote the instructions in LibreOffice Writer, then copy and paste everything to this forum. Then the apostrophe character got changed and that is why the command was not working.
I tested the commands one by one and I was able to finish the process, you should be able to do it also. This is a learning process and I thank you for trying it and finding out the errors.
Redo everything again as I also corrected the changes for the CPU speed.
Click to expand...
Click to collapse
Quite alright friend.
It is I who thanks you for this.
I was able to get create the file after following your update/corrected instructions.
Thanks again!
Click to expand...
Click to collapse
HP_TOUCHPAD said:
kojam said:
My apologies, you did everything right. The error was in the command I posted which is now corrected.
This is how it happen:
I created the commands in ubuntu text editor, then wrote the instructions in LibreOffice Writer, then copy and paste everything to this forum. Then the apostrophe character got changed and that is why the command was not working.
I tested the commands one by one and I was able to finish the process, you should be able to do it also. This is a learning process and I thank you for trying it and finding out the errors.
Redo everything again as I also corrected the changes for the CPU speed.
Click to expand...
Click to collapse
Thanks!
Worked!
Click to expand...
Click to collapse

Help Needed Modifying System Image

Hello XDA, I was attempting to do some experimentation with what I could do on the device via modifying init.rc files and the like. Rather than building and flashing a custom ROM for each run which is time consuming I thought I could just mess with the existing system images.
What I was hoping would work:
1. Download the October 007 (patch) stock binaries from Google
2. Extract the flame_xxxxx.zip image file
3. Convert the sparse system image file to a raw image file
- $ simg2img system.img system.raw
4. Mount the ext2 filesystem to a loopback device
- $ mount -o loop -t ext2 system.raw temp_dir
5. Edit the init file (e.g. init.rc) and save it
6. Unmount the ext2 filesystem
7. Create sparse system image
- Still don't quite know how to do this
8. Flash the sparse image from fastboot
- $ fastboot flash system system.img
So my question to the community at large is, is this track of work even logically correct. If so, how does one do it?
I have been trying to run these steps against image-flame-qd1a.190821.007.zip
My machine is running Ubuntu 19.10
For example Step 4 (mounting the ext2 system is failing for me)
Code:
$ losetup --list
....
/dev/loop8 0 0 1 1 /path/system.raw 0 512
....
$ sudo mount /dev/loop8 sys_mount
mount: /pathsys_mount: wrong fs type, bad option, bad superblock on /dev/loop8, missing codepage or helper program, or other error.
Also not working for Step 4
Code:
$ file system.raw
system.raw: Linux rev 1.0 ext2 filesystem data, UUID=4729639d-b5f2-5cc1-a120-9ac5f788683c (extents) (large files) (huge files)
$ sudo mount -o loop -t ext2 system.raw sys_mount
mount: /pathsys_mount: wrong fs type, bad option, bad superblock on /dev/loop8, missing codepage or helper program, or other error.
Thanks for the help.
I have since built my own AOSP build and have the same issue in that I can't mount the resulting system.img file from the AOSP build either.
Not sure if that matters or not, but I found it odd.

HELP!!! How to fix "Can’t load Android System your data may be corrupt" error without losing your data ?

Update 2 : I have managed to take a backup of all the eMMC partitions using QFIL but I don't know how to proceed further.
Update 1 : Successfully flashed Stock ROM both via using ADB Sideload and SD card in the recovery but I am still stuck on the same "Can’t load Android System.Your data may be corrupt.If you continue to get this message, you may need to perform a factory data reset and erase all user data stored on this device " screen.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
----------------------------------------------------------------------------------------------------------------------------------------------------------
Hello guys,I was uninstalling some apps and accidently Asus launcher,Google Play and Play services etc got selected as well.While apps were getting uninstalled and/or downgraded,phone restarted somehow and everything is screwed up now.I am stuck on a screen telling “Can’t load Android System.Your data may be corrupt.If you continue to get this message, you may need to perform a factory data reset and erase all user data stored on this device” with 2 options underneath, 1.Try again and 2.Factory data reset
When I select “Try again” it shows “ Dead android robot on his back and red triangle” for a split second and then goes to Asus logo screen for 5 seconds and then ask for encryption key, when I enter the key it goes to ASUS logo screen again for 30-40 seconds and again back to Error screen.
Here is the video of the problem (Keep reloading if it doesn't load in first attempt)
Asus Zenfone 3 Bootloop
Watch "Asus Zenfone 3 Bootloop" on Streamable.
streamable.com
Asus ZenFone 3 ZE552KL
ROM : Stock Oreo Version WW-15.0410.1807.75
Bootloader is Locked
Recovery : Stock Recovery
USB debugging : Disabled
Android device encryption is ON
Device is booting in Fastboot Mode and Recovery Mode.
It even boots to the Sideload Mode via recovery and running "adb devices" command shows it attached with it's serial number and sideload but other commands don't work.
Device is being shown /listed in Fastboot Mode.
I am unable to use adb as USB debugging is disabled.Running "adb devices " command shows device’s serial number and "recovery" written next to it ,in the command prompt.
Will flashing Version WW-15.0410.1807.75 again do the job without wiping user data ?
How about flashing only boot.img / system.img ? Can we resolve the issue by just flashing just system.img or boot.img instead of flashing complete stock ROM ?
I don't care about performance of the system or unpredicted issues later on,my entire focus is on preserving my data.I don’t wanna to lose my data coz there are some very important documents,projects reports, pictures and backups in it.
Any help would be greatly appreciated!
I extracted the Stock ROM zip and found it's updater script in "META-INF/com/google/android"
JavaScript:
ifelse( getprop("ro.build.id") == "OPR1.170623.026", ui_print("Android O device"), (
(greater_than_int(getprop("ro.build.date.utc"), 1514390400)) || abort("Can't install this package on device version less than 14.2020.1712.85 device build time (" + getprop("ro.build.date") + ").");
) );
ifelse( getprop("ro.product.name") == "OPEN_Phone", ui_print("OPEN SKU device"), (
getprop("ro.product.name") == "WW_Phone" || abort("This package is for \"WW_Phone\" devices; this is a \"" + getprop("ro.product.name") + "\".");
) );
ui_print("Target: asus/WW_Phone/ASUS_Z012D:8.0.0/OPR1.170623.026/15.0410.1807.75-0:user/release-keys");
show_progress(0.750000, 540);
ui_print("Patching system image unconditionally...");
block_image_update("/dev/block/bootdevice/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat") ||
abort("E1001: Failed to update system image.");
ui_print("Verifying the updated system image...");
if range_sha1("/dev/block/bootdevice/by-name/system", "136,0,32767,32768,32770,33009,33011,33516,65535,65536,65538,66043,98303,98304,98306,98545,98547,99052,131071,131072,131074,131579,163839,163840,163842,164081,164083,164588,196607,196608,196610,197115,229375,229376,229378,229617,229619,230124,262143,262144,262146,262651,294910,294912,294914,295153,295155,295660,327679,327680,327682,328187,335068,360448,360450,360955,393214,393216,393218,393723,393724,393725,425982,425984,425986,426491,458751,458752,458754,459259,491519,491520,491522,492027,524287,524288,524290,524795,557055,557056,557058,557563,589823,589824,589826,590331,622591,622592,622594,623099,655358,655360,655362,655867,688126,688128,688130,688635,720894,720896,720898,721403,753662,753664,753666,754171,786430,786432,786434,786939,819198,819200,819202,819441,819443,819948,851966,851968,851970,852475,884734,884736,884738,884977,884979,885484,917502,917504,917506,918011,950270,950272,950274,950779,967696,967697,983040") == "9a4740126249131da4ccd7e39fcf8d7302a3f818" then
if range_sha1("/dev/block/bootdevice/by-name/system", "136,32767,32768,32770,33009,33011,33516,65535,65536,65538,66043,98303,98304,98306,98545,98547,99052,131071,131072,131074,131579,163839,163840,163842,164081,164083,164588,196607,196608,196610,197115,229375,229376,229378,229617,229619,230124,262143,262144,262146,262651,294910,294912,294914,295153,295155,295660,327679,327680,327682,328187,335068,335580,359936,360448,360450,360955,393214,393216,393218,393723,393724,393725,425982,425984,425986,426491,458751,458752,458754,459259,491519,491520,491522,492027,524287,524288,524290,524795,557055,557056,557058,557563,589823,589824,589826,590331,622591,622592,622594,623099,655358,655360,655362,655867,688126,688128,688130,688635,720894,720896,720898,721403,753662,753664,753666,754171,786430,786432,786434,786939,819198,819200,819202,819441,819443,819948,851966,851968,851970,852475,884734,884736,884738,884977,884979,885484,917502,917504,917506,918011,950270,950272,950274,950779,967696,967697") == "6d1cea242bbacf2ea86f62fa6c06b6bde31ec430" then
ui_print("Verified the updated system image.");
else
abort("E1003: system partition has unexpected non-zero contents after OTA update");
endif;
else
abort("E1002: system partition has unexpected contents after OTA update");
endif;
show_progress(0.050000, 5);
package_extract_file("boot.img", "/dev/block/bootdevice/by-name/boot");
show_progress(0.200000, 10);
# ---- radio update tasks ----
ui_print("Patching firmware images...");
ifelse(msm.boot_update("main"), (
ui_print("installing cmnlib64");
package_extract_s_file("firmware-update/cmnlib64.mbn", "/dev/block/bootdevice/by-name/cmnlib64");
ui_print("installing sbl1");
package_extract_s_file("firmware-update/sbl1.mbn", "/dev/block/bootdevice/by-name/sbl1");
ui_print("installing cmnlib");
package_extract_s_file("firmware-update/cmnlib.mbn", "/dev/block/bootdevice/by-name/cmnlib");
ui_print("installing rpm");
package_extract_s_file("firmware-update/rpm.mbn", "/dev/block/bootdevice/by-name/rpm");
ui_print("installing tz");
package_extract_s_file("firmware-update/tz.mbn", "/dev/block/bootdevice/by-name/tz");
ui_print("installing devcfg");
package_extract_s_file("firmware-update/devcfg.mbn", "/dev/block/bootdevice/by-name/devcfg");
ui_print("installing aboot");
package_extract_s_file("firmware-update/emmc_appsboot.mbn", "/dev/block/bootdevice/by-name/aboot");
ui_print("installing lksecapp");
package_extract_s_file("firmware-update/lksecapp.mbn", "/dev/block/bootdevice/by-name/lksecapp");
ui_print("installing keymaster");
package_extract_s_file("firmware-update/keymaster.mbn", "/dev/block/bootdevice/by-name/keymaster");
), "");
ifelse(msm.boot_update("backup"), (
ui_print("installing cmnlib64bak");
package_extract_s_file("firmware-update/cmnlib64.mbn", "/dev/block/bootdevice/by-name/cmnlib64bak");
ui_print("installing sbl1bak");
package_extract_s_file("firmware-update/sbl1.mbn", "/dev/block/bootdevice/by-name/sbl1bak");
ui_print("installing cmnlibbak");
package_extract_s_file("firmware-update/cmnlib.mbn", "/dev/block/bootdevice/by-name/cmnlibbak");
ui_print("installing rpmbak");
package_extract_s_file("firmware-update/rpm.mbn", "/dev/block/bootdevice/by-name/rpmbak");
ui_print("installing tzbak");
package_extract_s_file("firmware-update/tz.mbn", "/dev/block/bootdevice/by-name/tzbak");
ui_print("installing devcfgbak");
package_extract_s_file("firmware-update/devcfg.mbn", "/dev/block/bootdevice/by-name/devcfgbak");
ui_print("installing abootbak");
package_extract_s_file("firmware-update/emmc_appsboot.mbn", "/dev/block/bootdevice/by-name/abootbak");
ui_print("installing lksecappbak");
package_extract_s_file("firmware-update/lksecapp.mbn", "/dev/block/bootdevice/by-name/lksecappbak");
ui_print("installing keymasterbak");
package_extract_s_file("firmware-update/keymaster.mbn", "/dev/block/bootdevice/by-name/keymasterbak");
),"no backup partition");
msm.boot_update("finalize");
ui_print("installing modem");
package_extract_s_file("firmware-update/NON-HLOS.bin", "/dev/block/bootdevice/by-name/modem");
ui_print("installing dsp");
package_extract_s_file("firmware-update/adspso.bin", "/dev/block/bootdevice/by-name/dsp");
ui_print("installing asusfw");
package_extract_file("firmware-update/asusfw.img", "/dev/block/bootdevice/by-name/asusfw");
set_progress(1.000000);
It's been a long time since I've used an Android phone.
I believe it was possible to flash a stock ROM and gaaps using fastboot commands without erasing user data.
audit13 said:
It's been a long time since I've used an Android phone.
I believe it was possible to flash a stock ROM and gaaps using fastboot commands without erasing user data.
Click to expand...
Click to collapse
Nope,I haven't tried that yet coz before doing anything I want to be absolutely sure that it's not gonna wipe my data. Again,flashing the complete stock ROM is required or flashing a specific image like boot.img / system.img would resolve the issue ?
Please take a look at this thread.I didn't get "-w flag" thing.
hello, what you are trying to achieve is possible but we need to make solution specific to your android version which is android 8.
secondly explain what happened in detail like was your phone rooted or not, like if not then how on earth you uninstall system apps, if not uninstalled just degraded using uninstall updates button tell me.
xda is only in my laptop so i am unable to reply instantly, you can use telegram to talk to me @Bhd82
[email protected] said:
secondly explain what happened in detail like was your phone rooted or not, like if not then how on earth you uninstall system apps, if not uninstalled just degraded using uninstall updates button tell me.
Click to expand...
Click to collapse
My device is not rooted.Yes,I selected multiple apps to uninstall and Asus launcher,Play Store,Google Play Services also got selected accidenlty and when Uninstall button was clicked, I suppose were downgraded in the process.
[email protected] said:
hello, what you are trying to achieve is possible but we need to make solution specific to your android version which is android 8.
secondly explain what happened in detail like was your phone rooted or not, like if not then how on earth you uninstall system apps, if not uninstalled just degraded using uninstall updates button tell me.
xda is only in my laptop so i am unable to reply instantly, you can use telegram to talk to me @Bhd82
Click to expand...
Click to collapse
Hello buddy,here is the video of the bootloop.
encryption is downgrade protected so you probably broke it. so first you should dump cache partition and search kernel logs for QSEECOM. if your bootloader is unlocked, boot custom recovery from fastboot boot command and dump partitions from adb pull, otherwise dump from edl.py.
loaders can be found here
https://forum.xda-developers.com/showthread.php?t=3603643&page=4
https://forum.xda-developers.com/showthread.php?t=3759473
https://romprovider.com/download-prog_emmc_firehose-qcom-phone-cpus
https://www.firmware27.com/2017/06/collectionprog-emmc-firehose-prog-ufs.html
https://www.leakite.com/collection-qualcomm-emmc-programmer-files
https://github.com/programmer-collection
https://github.com/bkerler/Loaders
https://github.com/thantoeaungat/firehose
https://www.tuserhp.com/2018/02/prog-emmc-firehose-ufs-firehose.html
https://firmwarego.com/index.php?a=downloads&b=folder&id=2288
edit: or try to get logcat during boot-loop
Code:
fastboot oem adb_enable
fastboot continue
adb logcat > logcat.log
aIecxs said:
encryption is downgrade protected so you probably broke it
Click to expand...
Click to collapse
Hello buddy,thank you for your valuable input! It means a lot! Well ,device was running without any glitch even after disabling and downgrading several pre installed apps and bloatwares.Several times ,I downgraded Playstore and Google play services to fix some issues.And everything went hand in hand with encryption enabled.I guess ,in this particular case, device got restarted during downgrading process and that corrupted some files.
aIecxs said:
if your bootloader is unlocked, boot custom recovery from fastboot boot command and dump partitions from adb pull, otherwise dump from edl.py.
Click to expand...
Click to collapse
My bootloader is locked and USB debugging is disabled.Yes, I have been digging threads regarding QSEECOM and QPST for past few days.
aIecxs said:
edit: or try to get logcat during boot-loop
Code:
fastboot oem adb_enable
fastboot continue
adb logcat > logcat.log
Click to expand...
Click to collapse
Unfortunately,unlocking bootloader would wipe out all the data which I want to preserve.Is there any way to get logcat with bootloader locked and usb debugging disabled ?
Thank you!
sorry I didn't know that fastboot oem adb_enable requires unlocked bootloader.
yes there is maybe. you can flash adb enabled AVBv1 signed modified boot.img from Qualcomm HS-USB QDLoader 9008 EDL mode if you have deep flash cable or figure out test point
first backup all partitions to PC
(replace ./ with proper path on disk or cd into directory. home directory ~ might run out of disk space)
Bash:
mkdir ~/tmp
cp -v ./prog_emmc_firehose_8953_ddr.mbn ~/tmp
cd edl
python3 ./Loaders/fhloaderparse.py ~/tmp Loaders
python3 ./edl.py printgpt
python3 ./edl.py r boot boot.img
python3 ./edl.py r system system.img
python3 ./edl.py r cache cache.img
python3 ./edl.py r metadata metadata.bin
python3 ./edl.py r devinfo devinfo.bin
python3 ./edl.py r userdata userdata.img
python3 ./edl.py r ...
second modify default.prop in boot.img ramdisk with AIK
Code:
ro.debuggable=1
ro.adb.secure=0
ro.secure=0
persist.sys.usb.config=mtp,adb
third flash image-new.img (which is hopefully AVBv1-signed) back to device and try get logcat while booting android (might brick your device)
Bash:
python3 ./edl.py w boot image-new.img
python3 ./edl.py reset
adb logcat '*:W' -b all | tee ~/logcat.txt
In case you bricked just restore backup boot.img and go for logs in cache partition. loop mount the partition image
Bash:
mkdir ~/cache
sudo -H mount -t ext4 -o loop,ro,noexec,noload,noatime ./cache.img ~/cache
sudo -H thunar ~/cache
edit: optional patch avb/dm-verity with Magisk
(attachments removed)
aIecxs said:
so first you should dump cache partition and search kernel logs for QSEECOM.dump from edl.py.
Click to expand...
Click to collapse
Hello,after a lot of research and experiments,I finally managed to build an EDL flash cable and figured out device's key combination to get the device in QDLoader 9008 EDL mode.
While I am a tech enthusiast,I am incognizant of Linux / Python so kindly bear with me.Even after spending hours I couldn't find any tutorial / video regarding how to use edl.py / bkerler/edl. Instructions here are unclear and complicated.Looks developer have a notion that everybody on this planet have an understanding of coding or python.It's full of jargons.A video tutorial of the whole process could be quite informative but unfortunatley it's missing.
This "loader" thing is also utterly confusing, some people are referring prog_emmc_firehose files as loader while bkerler/Loaders are entirely different phenomenon and I am unable to comprehend it.
I had downloaded xubuntu.iso to boot it via USB on Windows 11 machine only to find it later that bkerler/edl is first asking to use 3.9GB large Re LiveDVD and then later want us to install python + git and loads of other things.I don't understand what's the point of doing all this when one can run Linux commands in Windows using Windows Subsystem for Linux (WSL).
aIecxs said:
you can flash adb enabled AVBv1 signed modified boot.img from Qualcomm HS-USB QDLoader 9008 EDL mode if you have deep flash cable or figure out test point
first backup all partitions to PC
(replace ./ with proper path on disk or cd into directory. home directory ~ might run out of disk space)
Bash:
mkdir ~/tmp
cp -v ./prog_emmc_firehose_8953_ddr.mbn ~/tmp
cd edl
python3 ./Loaders/fhloaderparse.py ~/tmp Loaders
python3 ./edl.py printgpt
python3 ./edl.py r boot boot.img
python3 ./edl.py r system system.img
python3 ./edl.py r cache cache.img
python3 ./edl.py r metadata metadata.bin
python3 ./edl.py r devinfo devinfo.bin
python3 ./edl.py r userdata userdata.img
python3 ./edl.py r ...
second modify default.prop in boot.img ramdisk with AIK
Code:
ro.debuggable=1
ro.adb.secure=0
ro.secure=0
persist.sys.usb.config=mtp,adb
third flash image-new.img (which is hopefully AVBv1-signed) back to device and try get logcat while booting android (might brick your device)
Bash:
python3 ./edl.py w boot image-new.img
python3 ./edl.py reset
adb logcat '*:W' -b all | tee ~/logcat.txt
In case you bricked just restore backup boot.img and go for logs in cache partition. loop mount the partition image
Bash:
mkdir ~/cache
sudo -H mount -t ext4 -o loop,ro,noexec,noload,noatime ./cache.img ~/cache
sudo -H thunar ~/cache
edit: optional patch avb/dm-verity with Magisk
(have attached patched boot.img for both)
Click to expand...
Click to collapse
I am sorry but this post went completely over my head. Can you please recommend some step by step tutorial ? Thank you!
no worry, just follow the install instructions, then follow above steps. you can also do it on windows. but when it comes to loop-mount partition images it's far more easier to do it in linux (viewing logs in cache partition). another reason is you don't have to struggle with Qualcomm HS-USB QDLoader 9008 Drivers as linux fully handle all usb drivers automatically.
Prerequisites Step 1 (linux)
open terminal with CTRL + ALT + T and navigate to any directory on your hard disk with cd
Code:
cd /media/xubuntu/*
Prerequisites Step 2
install dependencies
Code:
# Debian/(X)ubuntu/Mint/etc
sudo apt update
sudo apt install adb fastboot python3-dev python3-pip liblzma-dev git
(optional) disable mobile broadband communication (skip this)
Code:
sudo apt purge modemmanager
sudo systemctl stop ModemManager
sudo systemctl disable ModemManager
sudo apt purge ModemManager
Prerequisites Step 3
download build and install edl.py
Code:
# edl.py (required)
git clone -b 3.52.1 https://github.com/bkerler/edl.git
cd edl
# common firehose programmer collection = factory loaders (optional)
git submodule update --init --recursive
# build + install
python3 setup.py build
sudo python3 setup.py install
(optional) set usb permissions so edl.py can run without sudo
Code:
sudo cp Drivers/51-edl.rules /etc/udev/rules.d
sudo cp Drivers/50-android.rules /etc/udev/rules.d
Prerequisites Step 4
connect device in EDL mode and check if linux can see it
Code:
lsusb
now ready for installing own loader and backup everything!
(see above)
- fhloaderparse.py
- edl.py
next step can be skipped because I already did it for you (see attachments)
- download and extract AIK-Linux-v3.8-ALL.tar.gz
- copy boot.img into AIK directory
- execute unpackimg.sh shell script
- modify default.prop
- execute repackimg.sh shell script
once you have backup proceed with flashing modified boot, reboot phone and get a logcat.txt
(see above)
aIecxs said:
no worry, just follow the install instructions, then follow above steps.
Click to expand...
Click to collapse
Install instructions of what ? Linux or edl.py ? Should I boot into xubuntu via a bootable USB flash drive ? Thank you!
- boot into xubuntu via a bootable USB pendrive
- goto - settings - keyboard - add your language and remove english layout
- open your prefered directory on windows hard disk
- right mouse click - open terminal here
- proceed with prerequisites (post #11)
- get a working firehose programmer (trial and error)
- proceed with backup (post #9)
aIecxs said:
Prerequisites Step 4
connect device in EDL mode and check if linux can see it
Code:
lsusb
now ready for installing own loader and backup everything!
(see above)
- fhloaderparse.py
- edl.py
Click to expand...
Click to collapse
Hello friend,after days of trial and error I managed to take a backup of all the partitions using QFIL.
As I want to do it via edl.py ,I have also set up a persistent Xubuntu USB and completed the Step 4.It looks like Linux has recognized the device in EDL mode ?
If I am correct,in the next step, I need to put "prog_emmc_firehose_8953_ddr.mbn" inside "edl" folder (
[email protected]:/media/xubuntu/New Volume/XB/edl) and open Terminal there and run the following commands one by one which will make backups inside "edl" folder.Correct me if I am wrong.
Bash:
mkdir ~/tmp
cp -v ./prog_emmc_firehose_8953_ddr.mbn ~/tmp
cd edl
python3 /media/xubuntu/New Volume/XB/edl/Loaders/fhloaderparse.py ~/tmp Loaders
python3 /media/xubuntu/New Volume/XB/edl/edl.py printgpt
python3 /media/xubuntu/New Volume/XB/edl/edl.py r boot boot.img
python3 /media/xubuntu/New Volume/XB/edl/edl.py r system system.img
python3 /media/xubuntu/New Volume/XB/edl/edl.py r cache cache.img
python3 /media/xubuntu/New Volume/XB/edl/edl.py r metadata metadata.bin
python3 /media/xubuntu/New Volume/XB/edl/edl.py r devinfo devinfo.bin
python3 /media/xubuntu/New Volume/XB/edl/edl.py r userdata userdata.img
python3 /media/xubuntu/New Volume/XB/edl/edl.py r ...
Again,there are 67 emmc partitions ( these are the partitions backed up by QFIL) out there.Nothing like "metadata".How do we find the names of the partition on LInux ? And do we need to do it manually one by one or is there any command to dump all the partitions ?
Thank you!
yes QDL means EDL...
(paths with whitespaces must be quoted "/media/xubuntu/New Volume/XB/edl" but no need to type the whole path at all, just dot ./ is fine if you already cd'd into directory)
yes you can place prog_emmc_firehose_8953_ddr.mbn inside edl directory, just parse the proper file path as first argument to fhloaderparse.py (like tmp/ in example)
./edl.py printgpt is the initial command it will print you all partition names and some device info. if it fails, maybe EDL got timeout and phone needs to reboot into EDL mode again
yes there is command to dump all partitions at once. you don't need it as you already have done this step from QFIL which is great, it means you found working firehose programmer
Code:
python3 edl.py printgpt
python3 edl.py rl dumps
your device obviously don't have metadata partition that was just example code
But you already have cache.bin you should loop-mount file and zip the logs from inside recovery directory. I will have a look into it maybe there is something useful inside. it should not contain anything that violates your privacy, however if you are paranoid about wifi/mac address or IMEI you can password protect zip
yes you can place prog_emmc_firehose_8953_ddr.mbn inside edl directory, just parse the proper file path/name as first argument to fhloaderparse.py (like tmp/ in example)
Complete file path is
/media/xubuntu/New Volume/XB/edl/prog_emmc_firehose_8953_ddr.mbn
Click to expand...
Click to collapse
and I am running terminal inside "edl folder" but despite several attempts I am getting following error.
Am I doing it the wrong way ? Can you please tell me the exact commands to run ?
aIecxs said:
But you already have cache.bin you should loop-mount file and zip the logs from inside recovery directory.
Click to expand...
Click to collapse
How do you do that ? By executing Step 4 of Post #9 ?
Bash:
mkdir ~/cache
sudo -H mount -t ext4 -o loop,ro,noexec,noload,noatime ./cache.img ~/cache
sudo -H thunar ~/cache
Thanks a lot!
one of your paths doesn't exist, either edl/Loaders/fhloaderparse.py is missing or it's because whitespaces in path
"/media/xubuntu/New Volume/XB/edl"
Code:
cd edl
python3 Loaders/fhloaderparse.py . Loaders
or if the above doesn't work
Code:
mkdir ~/tmp
cd edl
cp -v ./prog_emmc_firehose_8953_ddr.mbn ~/tmp
python3 ./Loaders/fhloaderparse.py ~/tmp Loaders
please also double check fhloaderparse.py exist and is spelled correctly and typed case sensitive
aIecxs said:
one of your paths doesn't exist, either edl/Loaders/fhloaderparse.py is missing.
Please also double check fhloaderparse.py exist and is spelled correctly and typed case sensitive
Click to expand...
Click to collapse
Yes,it's missing.There is no file called "fhloaderparse.py" inside "Loaders" folder.
It's also missing in bkerler/Loaders.
it is somehow removed from github
this commit is the last including it
https://github.com/bkerler/Loaders/tree/9b90b81
edit: lol it's still there in edlclient/Tools but without .py suffix
that's why the setup.py is needed, it will install the scripts right in environment so fhloaderparse is in $PATH already
this is new usage
Code:
mkdir ~/tmp
cd edl
cp -v prog_emmc_firehose_8953_ddr.mbn ~/tmp
fhloaderparse ~/tmp Loaders
_____________________________________________________________________delete___________________________________________________________________________

Categories

Resources