Related
Thread closed...
Thread closed...
Thread closed...
Looks good.
mAYBE AN init.FILE
heX79 said:
Current road-block, custom CWM built with recovery builder using stock 4.1.1 recovery (insecure & fstab)
-Can't mount /system even though adb shell returns #.
Something is changing the blocks:
Code:
/dev/block # ls -l
ls -l
[COLOR="Red"]brw------- 1 root root 7, 0 Jan 1 00:00 loop0
brw------- 1 root root 7, 1 Jan 1 00:00 loop1
brw------- 1 root root 7, 2 Jan 1 00:00 loop2
brw------- 1 root root 7, 3 Jan 1 00:00 loop3
brw------- 1 root root 7, 4 Jan 1 00:00 loop4
brw------- 1 root root 7, 5 Jan 1 00:00 loop5
brw------- 1 root root 7, 6 Jan 1 00:00 loop6
brw------- 1 root root 7, 7 Jan 1 00:00 loop7[/COLOR]
brw------- 1 root root 179, 0 Jan 1 00:00 mmcblk0
brw------- 1 root root 179, 1 Jan 1 00:00 mmcblk0p1
-rw-rw-rw- 1 root root 1088 Jan 1 00:00 mmcblk0p8
drwxr-xr-x 3 root root 60 Jan 1 00:00 platform
/dev/block #
Click to expand...
Click to collapse
wouldnt that be an init file be renaming them?
---------- Post added at 03:34 PM ---------- Previous post was at 03:31 PM ----------
FriedBacon said:
wouldnt that be an init file be renaming them?
Click to expand...
Click to collapse
Code:
fastboot boot boot.img
copies file onto device but then fastboot hangs.
How long did you let I load for? I found it took about 45-60 seconds for it to start booting after running fastboot boot boot.IMG.
Sent from my A110 using xda app-developers app
HAHAHA
fringle said:
How long did you let I load for? I found it took about 45-60 seconds for it to start booting after running fastboot boot boot.IMG.
Sent from my A110 using xda app-developers app
Click to expand...
Click to collapse
I flashed it onto my device so i wait a few minute and see if it loads. otherwise im stuck in "softbrick" or w/e lol
I can also confirm this, any attempts to boot the 4.1.1 kernel on 4.1.2, have not been successful. I tried the stock one and the insecure one. Maybe the bootloader is checking the kernel? Just a wild guess at this point. I'm sure we'll figure more out, once Skellums is ready with another recovery to test.
Still hoping some devs pop in to help guide us a bit. I know there are devs here that can probably crack this wide open, trouble is they most likely don't own the device.
Just messaged Paul O'Brien of Modaco fame. Hopefully he can give us some tips if he's not too busy.
heX79 said:
I can also confirm this, any attempts to boot the 4.1.1 kernel on 4.1.2, have not been successful. I tried the stock one and the insecure one. Maybe the bootloader is checking the kernel? Just a wild guess at this point. I'm sure we'll figure more out, once Skellums is ready with another recovery to test.
Still hoping some devs pop in to help guide us a bit. I know there are devs here that can probably crack this wide open, trouble is they most likely don't own the device.
Click to expand...
Click to collapse
I've been busy over the last few days so I haven't had a lot of time to look at this further.. I'm wondering if the system backup from the CWM backup that fringle posted could be flashed with fastboot? The system portion isn't an img file, but I'm looking to see how it can be converted. Of course I wouldn't suggest doing this as it would overwrite everything in your /system (that's if it even worked!)
Skellums said:
I've been busy over the last few days so I haven't had a lot of time to look at this further.. I'm wondering if the system backup from the CWM backup that fringle posted could be flashed with fastboot? The system portion isn't an img file, but I'm looking to see how it can be converted. Of course I wouldn't suggest doing this as it would overwrite everything in your /system (that's if it even worked!)
Click to expand...
Click to collapse
Isn't this the update.zip I asked for earlier? I just can't figure out how to make one from a cwm backup.
Just posted a possible 4.1.2 boot.img file http://forum.xda-developers.com/showpost.php?p=36510887&postcount=414 if someone wants to give it a try. It did boot on 4.1.1 so I'm not sure if it will work but always worth a shot.
Edit:
We have at least one report of this working, just waiting to see if they still get mount errors in cwm.
Looks like it's booting but not allowing changes, insecure one posted here:
http://forum.xda-developers.com/showpost.php?p=36515118&postcount=425
Hopefully it will be working
So none of them returned root prompt but at least we now have a working boot.img file for 4.1.2.
fringle said:
Just posted a possible 4.1.2 boot.img file http://forum.xda-developers.com/showpost.php?p=36510887&postcount=414 if someone wants to give it a try. It did boot on 4.1.1 so I'm not sure if it will work but always worth a shot.
Edit:
We have at least one report of this working, just waiting to see if they still get mount errors in cwm.
Looks like it's booting but not allowing changes, insecure one posted here:
http://forum.xda-developers.com/showpost.php?p=36515118&postcount=425
Hopefully it will be working
So none of them returned root prompt but at least we now have a working boot.img file for 4.1.2.
Click to expand...
Click to collapse
So I built CWM from source using the 4.1.2 boot.img posted by fringle... No idea if it works or not or makes any difference.
Usual disclaimers, I'm not responsible for any damage caused by using this. I hold no responsibility for loss of data or the inability to boot your device.
Edit: Helps if I attach the file...
We've got Root
Looks like we finially beat it.
http://forum.xda-developers.com/showpost.php?p=36562865&postcount=469
Yup. And there's a 4.1.2 root guide made by me.
Of course, you're all in the thanks section.
Great job guys. Great work.
Sent from my Acer Iconia Tab A110 using XDA Premium HD app
Hi!
This post was intended to the [DEV] thread but it seems I do not have enough priviledges yet
I have GT-I8730 running Android 4.1.2, rooted with Framaroot, my recovery is CWM 6.0.3.5. The rest is standard as shipped.
I've read through & followed the process the thread below, however my device is vibrating then rebooting after 'Samsung I8730' appears on the screen.
I am unable to resolve this and would like to fix it rather than flash it back to standard.
This is the process i followed:
http://forum.xda-developers.com/show....php?t=2285898
i am very grateful for all the effort put in by KINGbabasula, aureljared, arclac, jjchico & others who have done all the heavy lifting.
Any suggestions would be much appreciated.
Am currently attempting advice recieved from ROM Dev Kingbabasula: http://forum.xda-developers.com/showthread.php?t=2285898&page=30
He has to get su permissions in adb giving adb root command. Maybe you may try to replace cm ramdisk with the stock one and see if it works. If not the problem is the zImage so you may try to switch zimage with the stock one in cm boot.img. If you have time please try.
confirmed root in ADB
cache init.recovery.qcom.rc
charger initlogo.rle
custom initramfs.cpio.gz
data internal_sd
default.prop lpm.rc
default.prop~ preload
dev proc
efs res
etc root
external_sd sbin
fstab.qcom sd-ext
init sdcard
init.qcom.class_core.sh sdcard1
init.qcom.class_main.sh sys
init.qcom.early_boot.sh system
init.qcom.lpm_boot.sh tmp
init.qcom.sh ueventd.goldfish.rc
init.qcom.syspart_fixup.sh ueventd.qcom.rc
init.qcom.usb.sh ueventd.rc
init.rc
~ #
Reflash stock ROM with Odin.
Sent from my Galaxy Express using Tapatalk.
TL;DR ... please skip to the bottom for a step-by-step how-to.
It is still a bit of a mystery on how easy it is for someone to lose their EFS data (including baseband/IMEI). It has happened a few times (judging by the forum activity). Even for more reason, especially since this data cannot be replaced without warranty work, it is always best to protect yourself.
So I took the task of backing up all my partitions (some through TWRP, others through shell/dd), and then pulling the dd'd partitions to my PC. Best practice is to back up everything...there may be something else lost that you may need in the future.
My old theory (based on grep'ping the images) targeted p16 and p18. According to /dev/block/by-name, mmcblk0p16 translates to the APD partition (which is related to the demo program), and mmcblk0p18 the system partition ...
Code:
lrwxrwxrwx root root 2015-07-07 16:40 ADF -> /dev/block/mmcblk0p17
lrwxrwxrwx root root 2015-07-07 16:40 APD -> /dev/block/mmcblk0p16
lrwxrwxrwx root root 2015-07-07 16:40 boot -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 2015-07-07 16:40 boot-one-shot -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 2015-07-07 16:40 cache -> /dev/block/mmcblk0p15
lrwxrwxrwx root root 2015-07-07 16:40 config -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 2015-07-07 16:40 data -> /dev/block/mmcblk0p19
lrwxrwxrwx root root 2015-07-07 16:40 factory -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 2015-07-07 16:40 fastboot -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 2015-07-07 16:40 misc -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 2015-07-07 16:40 panic -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 2015-07-07 16:40 persistent -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 2015-07-07 16:40 ramdump -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 2015-07-07 16:40 recovery -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 2015-07-07 16:40 reserved -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 2015-07-07 16:40 silentlake -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 2015-07-07 16:40 splashscreen -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 2015-07-07 16:40 system -> /dev/block/mmcblk0p18
lrwxrwxrwx root root 2015-07-07 16:40 userkeystore -> /dev/block/mmcblk0p8
...however, the location within system is elusive (no common files between the search terms, except "/system/usr/srec/en-US/hmm_symbols", which doesn't seem to count)...
...please note, I have redacted my IMEI segments for protection.
Code:
[email protected]:~/Build/ArchiKitchen-master/PROJECT_070815_181336$ grep -c -r -a abcd * | grep -v :0
system/lib/arm/libcrypto.so:1
system/lib/libstagefright.so:1
system/lib/libcrypto.so:1
system/tts/lang_pico/en-GB_kh0_sg.bin:1
system/tts/lang_pico/es-ES_zl0_sg.bin:1
system/app/ASUSBrowser/ASUSBrowser.apk:2
system/app/LiveWallpapers/LiveWallpapers.apk:1
system/priv-app/GmsCore/lib/x86/libsslwrapper_jni.so:1
system/priv-app/FileManager2/x86/FileManager2.odex:1
system/priv-app/AsusZenUIServices/x86/AsusZenUIServices.odex:1
system/usr/icu/icudt53l.dat:1
system/usr/srec/en-US/hmm_symbols:1
system/usr/xt9/databases/ldb/ZHsbUNps_GB18030_xt9_big.ldb:1
system/bin/wpa_supplicant:1
system/bin/hostapd:1
[email protected]:~/Build/ArchiKitchen-master/PROJECT_070815_181336$ grep -c -r -a efgh * | grep -v :0
system/etc/security/cacerts/ccc52f49.0:1
system/etc/catalog/V1_7260/audiocomms_config/parameter-framework/Settings/Audio/AudioConfigurableDomains.xml:35
system/etc/catalog/V1_DSDA/audiocomms_config/parameter-framework/Settings/Audio/AudioConfigurableDomains.xml:29
system/framework/x86/boot.oat:1
system/usr/srec/en-US/hmm_symbols:1
system/usr/xt9/databases/ldb/ENubUN_xt9.ldb:1
system/usr/xt9/databases/ldb/ESusUN_xt9.ldb:1
system/vendor/lib/libWVStreamControlAPI_L1.so:1
[email protected]:~/Build/ArchiKitchen-master/PROJECT_070815_181336$ grep -c -r -a ijkl * | grep -v :0
system/etc/security/cacerts/d16a5865.0:2
system/tts/lang_pico/en-GB_kh0_sg.bin:1
system/app/MYuppyHK_Medium/MYuppyHK_Medium.apk:6
system/app/YouTube/YouTube.apk:1
system/app/Newsstand/x86/Newsstand.odex:1
system/usr/srec/en-US/hmm_symbols:1
system/usr/xt9/databases/ldb/ITusUN_xt9.ldb:1
[email protected]:~/Build/ArchiKitchen-master/PROJECT_070815_181336$
Just recently, user noviardi did a real world test with two devices...one with a working baseband, the other with a borked EFS. Noviardi managed to get device number two working by cloning p14 (also known as the config partition). Please note there are consequences, that with this solution, only one device can be "online" at a time, or the functioning IMEI will get blacklisted (then neither devices will have cell access). Which is the least of the problems. Hence, why I do not share my EFS data (neither should anyone else), or even snippets.
So, if you want to back up your EFS for personal resuce, your best shot is to back up the mmcblk0p14 / Config partition. But if you are paranoid (like me ), might as well back up everything.
Here's how to do it:
Connect the device to your PC
Turn on USB debugging (if not already)
From your PC, fire up a terminal/command prompt
Type "adb shell" (without the quotes - may need to add "sudo" to the front depending on your situation)
Run these commands:
Code:
su
dd if=/dev/block/mmcblk0p14 of=/storage/MicroSD/mmcblk0p14.img
Repeat the last line for any other partitions to back up (changing both numbers)
Type "exit", press enter (and repeat to close adb shell)
Run the following command:
Code:
adb pull /storage/MicroSD/mmcblk0p14.img .
Repeat for any other partitions to copy to your PC
Close out terminal, unplug USB cable.
Also, there is at least one version of TWRP (TheSSJ's release) that will back up your Config partition for you, as Config is also responsible for connectivity issues (not related to IMEI) switching between ROM's.
Hope this helps on how to protect your IMEI, with a big thanks to noviardi.
Mines showing that too..emei of abcdefgh........and not number sometimes...its weird.
pato2015 said:
Mines showing that too..emei of abcdefgh........and not number sometimes...its weird.
Click to expand...
Click to collapse
I clarified my text above.
I masked my IMEI (with abcd...) in the code boxes as I did not want even part of my IMEI known (for personal security reasons). My actual terminal I used the numbers in groups of four obtained from dialing *#06#.
If you are getting letters after dialing *#06#, I must ask - can you dial out? Did you do any modifications to the phone since you got it (e.g. root, unlock bootloader, etc)?
joel.maxuel said:
I clarified my text above.
I masked my IMEI (with abcd...) in the code boxes as I did not want even part of my IMEI known (for personal security reasons). My actual terminal I used the numbers in groups of four obtained from dialing *#06#.
If you are getting letters after dialing *#06#, I must ask - can you dial out? Did you do any modifications to the phone since you got it (e.g. root, unlock bootloader, etc)?
Click to expand...
Click to collapse
Im still on stock due , i join the asus beta program on going ....change imei only appears abcd change imei only appears during when im on recovery mode...when pound number sign asterisk it imei appears the original imei on my side.
pato2015 said:
Im still on stock due , i join the asus beta program on going ....change imei only appears abcd change imei only appears during when im on recovery mode...when pound number sign asterisk it imei appears the original imei on my side.
Click to expand...
Click to collapse
Doesn't sound corrupted then, just boatloader is being protective.
Or at worst, bug in boatloader.
Sent from my ASUS ZenFone 2
I haven't heard of any easier way or any potential issues, but as always, better safe than sorry with this stuff .
Hi,
I tried to copy the blocks from a terminal emulator on the device itself, and it took a long time and I cancelled it. How big are the blocks, and how long should the copy take?
BobboVilla said:
Hi,
I tried to copy the blocks from a terminal emulator on the device itself, and it took a long time and I cancelled it. How big are the blocks, and how long should the copy take?
Click to expand...
Click to collapse
mmcblk0p16 is about 300MB, so will take a couple minutes (one to dd it, the other to adb pull it). mmcblk0p18 (which I don't think carries EFS as I was able to grep the individual files in the system partition and no common files came up) is ~2.3GB and will (probably) take over 10 minutes.
Also, my procedure above assumes you have a MicroSD card inserted. Don't know the outcome if one ran the commands without one (probably an out of space error).
joel.maxuel said:
mmcblk0p16 is about 300MB, so will take a couple minutes (one to dd it, the other to adb pull it). mmcblk0p18 (which I don't think carries EFS as I was able to grep the individual files in the system partition and no common files came up) is ~2.3GB and will (probably) take over 10 minutes.
Also, my procedure above assumes you have a MicroSD card inserted. Don't know the outcome if one ran the commands without one (probably an out of space error).
Click to expand...
Click to collapse
Thanks. Although I'm not an android developer, I am a programmer, so I can understand code/scripting, and I realized that the command assumed I had an SD card .
I'll do it again and this time let it finish .
mmmm i tried this procedure (also used for oneplus one) and works well.
Type "adb shell" (without the quotes - may need to add "sudo" to the front depending on your situation)
Run these commands for backup efs:
su
dd if=/dev/block/mmcblk0p10 of=/sdcard/modemst1.bin bs=512
dd if=/dev/block/mmcblk0p11 of=/sdcard/modemst2.bin bs=512
Modemst1.bin and Modemst2.bin are saved in internal storage
for restore use fastboot
fastboot flash modemst1 modemst1.bin
fastboot flash modemst2 modemst2.bin
Bye.
fosseperme said:
mmmm i tried this procedure (also used for oneplus one) and works well.
Type "adb shell" (without the quotes - may need to add "sudo" to the front depending on your situation)
Run these commands for backup efs:
su
dd if=/dev/block/mmcblk0p10 of=/sdcard/modemst1.bin bs=512
dd if=/dev/block/mmcblk0p11 of=/sdcard/modemst2.bin bs=512
Modemst1.bin and Modemst2.bin are saved in internal storage
for restore use fastboot
fastboot flash modemst1 modemst1.bin
fastboot flash modemst2 modemst2.bin
Bye.
Click to expand...
Click to collapse
Keep in mind that procedure backs up "reserved" and "panic" for this device, as this one does not have modemst1/2 partitions.
It is still a hunting match.
Sent from my ASUS_Z00AD
if I could get a copy of mmcblk0p16 ? whether it is contained individual device's IMEI number ?
omgwtf19924 said:
if I could get a copy of mmcblk0p16 ? whether it is contained individual device's IMEI number ?
Click to expand...
Click to collapse
I wouldn't recommend that. Because it is the phone's unique identity like someone's fingerprints, services like cell providers will have difficulty distinguishing one from the other, and I think the policy in that case is to shut both devices down (blacklist the IMEI). So now, you would have two unusable devices.
I got your PM also, reconstructing that partition (that is your EFS) is a taboo topic, mostly because it is illegal in many countries. I wouldn't recommend that either.
Best course of action is servicing. Even if you voided your warranty, ASUS won't say no, it's just be prepared to pay (more). Of course, in this case you could pretend the warranty is still good, go back to unrooted stock, and play unaware...
Just curious, how did you hurt your IMEI? Just to see if there is a pattern of events that can cause that (and ultimately be prevented for someone else).
This happened so that, for some time I could not enter into a standard recovery, update your phone through the built-in program ended in failure, and at the entrance to recovery tried to update the phone and soon jumped mistake. Restore factory settings did not help, full unroot nothing distance, upload the new system did not help ... at the end I installed a temporary CWM used for root and reformatted /factory , /config, /cache, /ADP, /ADF and probably in one of them sat a match for IMEI ... oh well, I contacted ASUS service center and wait for a response. Currently, it is not detected SIM1 and SIM2 work and logs on to the network, both have the same IMEI and should have separate.
EDIT: Phone service reported to ASUS, after returning once the makings copies of files on the future ...
efs problem....help
i lost my asus zenfone 2 ze550ml's efs file so its showing only one dummy imei number,
But i have system backup which i took using temporary recovery
tell me if there is a way to recover efs from system backup?
thanks.
i havnt unlocked bootloader yet!
psurve01 said:
i lost my asus zenfone 2 ze550ml's efs file so its showing only one dummy imei number,
But i have system backup which i took using temporary recovery
tell me if there is a way to recover efs from system backup?
thanks.
i havnt unlocked bootloader yet!
Click to expand...
Click to collapse
I'm pretty sure it's the APD (mmcblk0p16) partition at this point.
You can try to restore system, I just don't think it would be fruitful.
Always curious with this sort of thing, what (do you think) happened that you lost your EFS?
The actual partition that keep imei is on mmcblk0p14 named Config
i got 2 phone with one dead baseband chip to tried out.
the mmcblk0p16 that you mention doesn't contain imei at all..
best luck
noviardi said:
The actual partition that keep imei is on mmcblk0p14 named Config
i got 2 phone with one dead baseband chip to tried out.
the mmcblk0p16 that you mention doesn't contain imei at all..
best luck
Click to expand...
Click to collapse
I was considering this one a while back. There was just no search matches to back that theory up.
If you have successfully revived one EFS with the partition (#14) from the other device, that not only makes sense with the problems I have had with config in the past, also means we have something more solid to go by than just block searches.
Will update in a little bit, with attribution. Thanks!
OfficerJimLahey said:
I was considering this one a while back. There was just no search matches to back that theory up.
If you have successfully revived one EFS with the partition (#14) from the other device, that not only makes sense with the problems I have had with config in the past, also means we have something more solid to go by than just block searches.
Will update in a little bit, with attribution. Thanks!
Click to expand...
Click to collapse
yes sir.
as we now confirmed that the imei is containing in the #14..
let hope some expert will extract the importance imei from that 64mb partition..
the backup command should be
adb shell
su
dd if=/dev/block/mmcblk0p14 of=/storage/MicroSD/mmcblk0p14.img
and restore whole 14 partition from the adb shell
with this command
adb shell
su
dd if=/storage/MicroSD/mmcblk0p14.img of=/dev/block/mmcblk0p14
Recently I tried to root the phone and successfully did it via CWM Temporary Recovery.
I used Exposed Framework, Intelli3G module, greenify etc. My phone was running well except I needed to turn flight mode on and off each time after booting or restarting my phone to get network on sim 1. But it was going well until one day when there was a new OTA update available. I just had forgotten the issue of OTA update on a rooted device.
After updating my rooted device it went into bootlops. I am not so geeky so I was looking for a solution. Then I restored a previous NANDROID backup via CWM but the it was showing error after restoration when the device rebooted.
So then again I went to CWM recovery mode and FORMATTED ALL THE PARTITIONS INCLUDING EFSthen I flashed some downgraded recovery.img, droidboot.img etc and updated my phone with the lattest official stock firmware via CWM
I was lucky to unbrick my phone as it started well
But then the real problem started
THERE'S NO NETWORK ON SIM 1
I reflashed my phone but it was same then I took it to a servicing store they said I have IMEI problem in my phone, the phone is now in the servicing shop,
Isn't there any way to restore my imei???
How about Zenfone Rescue tool kit(by Aztech)??
Hello,
I managed to break my fingerprint reader. I don't think the problem is my /persist because all sensors work fine. But unfortunately, I had never backed up the rest of the sensitive partitions: vbmeta, vbmeta_system, keystore, keymaster, odm, core_nhlos, secdata, abl, cmnlib, cmnlib64, devcfg, dsp, hyp, xbl, xbl_config, tz, rpm, aging, aging_mod.
Could someone on a TMO 7t Pro 5G McLaren (with a working fingerprint reader preferably running the latest 10.0.35 software, please pull and post these partition img files? If you don't know how, it's very simple, please ask.
I point to this because my previous phone, Essential PH1, had similar issues, but at least Essential had posted all of the firmware images on their website every month, and flashing the above partitions would fix it. 1+ doesn't provide anything and even the MSM doesn't restore all of these partitions.
Thanks so very very much in advance!
Edit: If possible, could one extract all partition img files from 10.0.35 in addition to those requested above?
EDIT2: ODM partition has 1st priority for anyone who can help.
Edit3: odm is fine. After looking through some logs,
I need keystore, keymaster (_a or _b, whichever is your current slot), vbmeta (a or b), and vbmeta_system (a or b). None are very large I think.
You're making me want a backup. I thought MSM was supposed to be that for us. Irritating.
A couple of those look like they could have sensitive data. Anyone know of a reason not to post them? Looks like they are all available via /dev/block..
ttabbal said:
You're making me want a backup. I thought MSM was supposed to be that for us. Irritating.
A couple of those look like they could have sensitive data. Anyone know of a reason not to post them? Looks like they are all available via /dev/block..
Click to expand...
Click to collapse
If you don't already have a backup of every partition, please please please do so urgently. Or an RMA will most likely be in your future. That should be in huge bold print with a link to instructions at the very top of the root and bootloader unlock threads.
I've never had a device with these issues before. It's starting to get ridiculous.
Edit: If you didn't take backups before unlocking the bootloader, Widevine L1 support (being able to watch Netflix in HD instead of 480p crap on our giant beautiful screens) is lost forever (except for RMA). And just flashing a "bad" canary version of magisk was enough to kill the fingerprint sensor. Of course I didn't learn any of this until it was too late.
MSM will get your phone back to life but not fully heal it. Basically all the MSM is guaranteed to do is get the phone to boot. No sensors, no fingerprint, no Widevine L1, no IMEI and wifi Mac address fix (if one is really screwed). And 1+ didn't take any measures to protect the sensitive partitions once bootloader is unlocked. It's all just a clusterf**k
Same issues on 7T and 8 and 8pro if that makes you feel any better ¯\_(ツ)_/¯
Well, that's irritating. WTF wouldn't you have a recovery tool for all those? Interestingly, I don't seem to have odm in there at all. Ah, scratch that, it's in /dev/block/mapper and there are 3. _a, _b, -verity.
It's rpm I don't seem to have. 10.0.35.
ttabbal said:
Well, that's irritating. WTF wouldn't you have a recovery tool for all those? Interestingly, I don't seem to have odm in there at all. Ah, scratch that, it's in /dev/block/mapper and there are 3. _a, _b, -verity.
It's rpm I don't seem to have. 10.0.35.
Click to expand...
Click to collapse
Yeah, system, vendor, product, and odm are stored in super.img on Android 10. But u found it. Find out what slot you are on, running 10.0.35, and you'd want the _a or _b files that match your current slot.
ttabbal said:
Well, that's irritating. WTF wouldn't you have a recovery tool for all those? Interestingly, I don't seem to have odm in there at all. Ah, scratch that, it's in /dev/block/mapper and there are 3. _a, _b, -verity.
It's rpm I don't seem to have. 10.0.35.
Click to expand...
Click to collapse
I think you are right. Rpm doesn't exist possibly on this phone. Don't have time to research right now.
But I noticed in /dev/block/mapper, I only have _a and _b. No -verity file. For system, vendor, odm, nor product. Could you post the -verity file(s)?
What files/file sizes do you have in /odm/ ?
starcms said:
I think you are right. Rpm doesn't exist possibly on this phone. Don't have time to research right now.
But I noticed in /dev/block/mapper, I only have _a and _b. No -verity file. For system, vendor, odm, nor product. Could you post the -verity file(s)?
What files/file sizes do you have in /odm/ ?
Click to expand...
Click to collapse
Doesn't look really interesting to me, but here's the ls output.
Code:
OnePlus7TProNR:/sdcard/img # ls -l /odm
total 20
drwxr-xr-x 4 root root 4096 2008-12-31 17:00 etc
drwx------ 2 root root 16384 2008-12-31 17:00 lost+found
OnePlus7TProNR:/sdcard/img # ls -l /odm/etc
total 12
-rw------- 1 root root 2735 2008-12-31 17:00 build.prop
-r--r--r-- 1 root root 0 2008-12-31 17:00 fs_config_dirs
-r--r--r-- 1 root root 0 2008-12-31 17:00 fs_config_files
drwxr-xr-x 2 root root 4096 2008-12-31 17:00 selinux
drwxr-xr-x 2 root root 4096 2008-12-31 17:00 vintf
OnePlus7TProNR:/sdcard/img # ls -l /odm/etc/selinux/
total 728
-rw-r--r-- 1 root root 733547 2008-12-31 17:00 precompiled_sepolicy
-rw-r--r-- 1 root root 65 2008-12-31 17:00 precompiled_sepolicy.plat_sepolicy_and_mapping.sha256
-rw-r--r-- 1 root root 65 2008-12-31 17:00 precompiled_sepolicy.product_sepolicy_and_mapping.sha256
OnePlus7TProNR:/sdcard/img # ls -l /odm/etc/vintf/
total 16
-rw-r--r-- 1 root root 5300 2008-12-31 17:00 manifest.xml
-rw-r--r-- 1 root root 1369 2008-12-31 17:00 manifest_ese.xml
-rw-r--r-- 1 root root 622 2008-12-31 17:00 manifest_noese.xml
I can try, but my upstream sucks. It might be faster for someone else to grab them.
-rw-r--r-- 1 travis travis 816K Jun 4 15:40 img/odm-verity.img
-rw-r--r-- 1 travis travis 1.3G Jun 4 15:41 img/product-verity.img
-rw-r--r-- 1 travis travis 2.2G Jun 4 15:40 img/system_root-verity.img
-rw-r--r-- 1 travis travis 884M Jun 4 15:43 img/vendor-verity.img
After looking through some logs, you can ignore most of that.
I need keystore, keymaster (_a or _b, whichever is your current slot), vbmeta (a or b), and vbmeta_system (a or b). None are very large I think.
Thanks for all of your time @ttabbal. Sorry if I'm driving you crazy Been driving myself crazy trying to fix this for 2 weeks now lol
My /odm seems to be fine. Matches yours. I was mainly concerned about those 2 files with 0 size. But I don't have any of the -verity.imgs from /dev/block/mapper. I'm pretty sure they are supposed to be created and mounted at boot (from super.img and by verity/vbmeta). I'm hoping those 2 vbmeta partitions will fix things up. If not, then I'll try keystore and keymaster. And then I'll have to send it in...
Edit:. Just curious, I'm assuming you are bootloader unlocked and running Magisk? Just confirming since you have those -verity.imgs
ok.. Hope it helps.
https://drive.google.com/file/d/1a9FTbvdEM2n12wjc4SL7kNMu3SAtfuAY/view?usp=sharing
https://drive.google.com/file/d/15Ssumik6iMY7kWgldHfFajsbyNdh9aTz/view?usp=sharing
Yes, I am unlocked and rooted with Magisk.
ttabbal said:
ok.. Hope it helps.
https://drive.google.com/file/d/1a9FTbvdEM2n12wjc4SL7kNMu3SAtfuAY/view?usp=sharing
https://drive.google.com/file/d/15Ssumik6iMY7kWgldHfFajsbyNdh9aTz/view?usp=sharing
Yes, I am unlocked and rooted with Magisk.
Click to expand...
Click to collapse
Well, not exactly lol.
Flashed your two images via fastboot, still broken fingerprint and still missing -verity files from /dev/block/mapper/ , went to flash my backups of vbmeta and vbmeta_system via fastboot, got into a bootloop, and after a couple hours of screwing with it, finally got back where I started from...except using your images.
I don't understand. vbmeta and vbmeta_system are NOT device specific. One from my phone, one from your phone, one from anyone's phone running 10.0.35 should be exactly the same.
What exact method did you use to pull the images? dd to a tmp dir on device and then adb pull img? dd directly to computer? or adb pull the partitions themselves direct to computer? Shouldn't all 3 methods return the same results?
I swear, after the RMA I really don't know if I am going to risk unlocking the bootloader again (this is coming from someone who has had s-off/bootloader unlock/root/su/Magisk on every single android device ever owned over the past 10 years...without ever having any problem I couldn't fix by myself)
It should all be the same img, but I did "dd bs=1M if=/dev/<partition> of=/sdcard/img/" and adb pull them to the computer. Pretty much the same dd command I use for most image work. I am on 10.0.35.
One of the biggest reasons I gave this device a shot was the ability to reflash back to stock. Now I hear that doesn't work. That's really annoying. This is something Oneplus should just provide as a backup. They don't even have to keep it up to date. We can OTA our way to the latest. They have to have something like that to flash the phones before shipping them out. I guess they could flash to storage chips before installing them on the PCBs.
I was also hoping to see some development, I didn't realize that the A/B thing or A10 was going to cause so many problems. Not the devs fault, just one more thing to shake my head at. Sadly, I think root stuff is going to start phasing out. I don't mind no support for modified software, but I hate that I don't own my devices.
ttabbal said:
It should all be the same img, but I did "dd bs=1M if=/dev/<partition> of=/sdcard/img/" and adb pull them to the computer. Pretty much the same dd command I use for most image work. I am on 10.0.35.
One of the biggest reasons I gave this device a shot was the ability to reflash back to stock. Now I hear that doesn't work. That's really annoying. This is something Oneplus should just provide as a backup. They don't even have to keep it up to date. We can OTA our way to the latest. They have to have something like that to flash the phones before shipping them out. I guess they could flash to storage chips before installing them on the PCBs.
I was also hoping to see some development, I didn't realize that the A/B thing or A10 was going to cause so many problems. Not the devs fault, just one more thing to shake my head at. Sadly, I think root stuff is going to start phasing out. I don't mind no support for modified software, but I hate that I don't own my devices.
Click to expand...
Click to collapse
What is the need or result of the "bs=1M" in the command? I've never seen that before in other threads. I'm assuming it means block size equal to 1MB. Is that definitely required to get a good pull? Same bs for any/all partitions?
If you have persist and both EFS images backed up, you should be okay. The MSM tool can restore I think everything else. I'd keep a backup especially of any partitions that don't end in _a or _b. The MSM tool definitely takes care of the rest (those ending in _a and _b). I just hate using it because there's no way to make it not wipe userdata. And without being able to make a nandroid backup due to no fully working twrp due to A10, it's just a giant pain.
And unfortunately we can't just OTA our way to the latest, at least not by manually downloading an OTA from 1+. Only way to update is with a real OTA update from T-Mobile.
The A/B partitioning isn't the problem with development. That's been around since Android 7 or 8. It's the new dynamic partitioning format that all phones that launch with Android 10 (or newer) have. Even the Pixel 4 doesn't have fully working twrp yet. It's coming soon though...
Edit: Also, for the dd commands, did you use /dev/block/actual_partition or /dev/block/by-name/friendly_name_of_partition? Again, should it really make a difference?
Edit2: All of these issues have a root cause from Android 10. The new required partitioning system for any phones that launch with it. That's why unlocking the bootloader wipes reserve.img. Because it's in userdata (cause of A10) and 1+ forgot about that and didn't rewrite the algorithm used when the bootloader is unlocked. It's also their negligence (combined with A10) which causes persist (and other key partitions) to become so easily corrupted. Virtually all devices launched since Android 7 use "fastboot flashing unlock" and then "fastboot flashing unlock_critical" to allow changes to device specific partitions. For some reason 1+ still is using the antiquated "fastboot oem unlock" command which unlocks literally everything, even some stuff that unlock_critical doesn't, and which in the old days, didn't matter. A10 especially should not ever be used with fastboot oem unlock. Google says so lol.
If it makes you feel better, this isn't unique to this phone. It's a problem on every device 1+ has launched with A10 and still is (OP7T/TPro/OP8/Pro). Because of A10 partitioning combined with the use of an antiquated bootloader that only supports "fastboot oem unlock"
The block size doesn't matter for the pull and doesn't change the image at all. It just reads in chunks, making it faster.
Yes, I used by-name and it shouldn't matter if you use that or the sd# names.
It's your persist and it's unique. The rest of your sensors won't care. If you didn't back it up, you're screwed. An MSM restore doesn't fix this.
LLStarks said:
It's your persist and it's unique. The rest of your sensors won't care. If you didn't back it up, you're screwed. An MSM restore doesn't fix this.
Click to expand...
Click to collapse
The issue is I had a backup of my unique persist. And restoring it doesn't fix the dang fingerprint. That's why I was thinking the issue had to be elsewhere
Good evening everyone!
I recently bought a Junsun V1 head unit for my Golf 7. I specifically chose it because of the AC8227L SOC, which is a renamed MT8127. It includes a few more peripherals that are useful in car infotainment systems, but the core is identical.
I'm in the process of creating a new firmware from scratch, to replace the chinglish, buggy stock one. However, I have not succeeded yet.
What I have done so far is create a TWRP image for it, completely from source, using the prebuilt kernel. It's available here (any mirrors will be appreciated and linked in this post):
https://mega.nz/file/1Gp2gJ5S#gAxcP1WK8nwXivYTpAlyEsWNoWwNZBZ8VTs3fm57gEc
I have also dumped the firmware from the 2GB + 32GB version: https://mega.nz/file/hXhEjTab#AowvrX36nn9rXIkeu_zgnGmLyDxtiSUSWswwmXcN46k
To install install TWRP simply put it on the "RECOVERY" section in SP Flash Tool using the scatter and preloader provided in the firmware dump. Uncheck everything else and press flash.
You'll need a type-a to type-a USB cable connected to the 4-pin USB connector (not the 6-pin), and then give power to the unit.
Any other information about the device, serial communication between android and the MCU, decompiled apps, modified apps, etc are also welcome!
I hope this is useful for somebody.
UPDATE 07-01-2021:
I've been reverse engineering the MainUI apk for a week now. I've extracted the MCU communication protocol, now I'm trying to extract the DSP protocol, and CAN will be next.
The touch buttons on the left side of the unit is managed by this .apk as well, and that has already been reverse engineered, only the implementation has to be done with the available API I wrote.
All help is welcome. You can find the source code in github. The important work is being done in native libraries, the java stuff is useless right now. https://github.com/Iscle/MainUI
root
hi, i think i have a HU similar to yours ( se e attached pucture ). Btw did you manage to root the original fw? what about your development, it sounds interesting...
root
......see attachment
maxou2 said:
hi, i think i have a HU similar to yours ( se e attached pucture ). Btw did you manage to root the original fw? what about your development, it sounds interesting...
Click to expand...
Click to collapse
maxou2 said:
......see attachment
Click to expand...
Click to collapse
If you can install TWRP then you will be able to root.
iceblue1980 said:
If you can install TWRP then you will be able to root.
Click to expand...
Click to collapse
magisk?
maxou2 said:
magisk?
Click to expand...
Click to collapse
Anything you want but I would really recommend SuperSU as Magisk doesn't work as intended on these units. Also make sure you run SuperSU v2.79 and no higher. As for TWRP, only version 3.0.2 is stable in my experience.
I'm stuck unlocking the bootloader, the command "fastboot oem unlock" works and the unit ask to confirm by pressing vol+, unfortunately the touch on the panel does not work... tried to put a wireless keyboard dongle on the other USb but it doesn't work....
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Magisk works just fine, I actually recommend it over SuperSU, as SuperSU is practically obsolete nowadays.
Also, no need to unlock the bootloader, just flash the recovery image as I explained on the first post.
Just made a deep study and tests on this unit, here my results, thoughts, mods and other considerations hoping this will help.
Being scared to brick the unit I used a conservative approach by making step by step mods rather than flash the firmware at the first post.
Here's my changment pattern:
Firmware : Before rooting I updated to the last version of the firmware the vendor gave me ( the latest OEM firmware ).
It's an OTA update ( use the "five fingers screen touch & move" method ) after putting the the files .bin and .upd in a USB key connected to a USB port when you powerup the unit.
I enclose a link to download it.
OTA update
I've made a DUMP of the partitions ( by using the SP tool Readback feature, you can find a lot of tutos on the internet how to use it ) and with the WwR tools i managed to have a full flashable original FW backup.
Another interesting method is to retrieve the partition content on a "live" system by use a shell and the dd unix command :
Enable the developer option on the system and connect the 4 wire USB port to a PC ( by using a 4 wire male to male USB cable ).
If you have an ADB command environment installed on your PC you can just fire a "adb shell" command,
followed by an "su @#zxcvbnmasdfghjklqwertyuiop1234567890,." to have a shell with superuser rights.
Now you can navigate trought your file system as root.
Anyway here's the partions table :
/dev/block/platform/soc/11230000.mmc/by-name # ls -l
lrwxrwxrwx 1 root root 21 Dec 3 14:26 ANDROID -> /dev/block/mmcblk0p24
lrwxrwxrwx 1 root root 20 Dec 3 14:26 ARM2 -> /dev/block/mmcblk0p9
lrwxrwxrwx 1 root root 21 Dec 3 14:26 BOOTIMG -> /dev/block/mmcblk0p10
lrwxrwxrwx 1 root root 21 Dec 3 14:26 CACHE -> /dev/block/mmcblk0p25
lrwxrwxrwx 1 root root 21 Dec 3 14:26 DKB -> /dev/block/mmcblk0p22
lrwxrwxrwx 1 root root 21 Dec 3 14:26 EXPDB -> /dev/block/mmcblk0p20
lrwxrwxrwx 1 root root 21 Dec 3 14:26 FRP -> /dev/block/mmcblk0p23
lrwxrwxrwx 1 root root 21 Dec 3 14:26 KB -> /dev/block/mmcblk0p21
lrwxrwxrwx 1 root root 20 Dec 3 14:26 LK -> /dev/block/mmcblk0p6
lrwxrwxrwx 1 root root 21 Dec 3 14:26 LOGO -> /dev/block/mmcblk0p14
lrwxrwxrwx 1 root root 21 Dec 3 14:26 METAZONE -> /dev/block/mmcblk0p17
lrwxrwxrwx 1 root root 21 Dec 3 14:26 MISC -> /dev/block/mmcblk0p13
lrwxrwxrwx 1 root root 20 Dec 3 14:26 NVRAM -> /dev/block/mmcblk0p2
lrwxrwxrwx 1 root root 21 Dec 3 14:26 ODMDTBO -> /dev/block/mmcblk0p18
lrwxrwxrwx 1 root root 20 Dec 3 14:26 PROTECT_F -> /dev/block/mmcblk0p3
lrwxrwxrwx 1 root root 20 Dec 3 14:26 PROTECT_S -> /dev/block/mmcblk0p4
lrwxrwxrwx 1 root root 20 Dec 3 14:26 PRO_INFO -> /dev/block/mmcblk0p1
lrwxrwxrwx 1 root root 21 Dec 3 14:26 RECOVERY -> /dev/block/mmcblk0p11
lrwxrwxrwx 1 root root 20 Dec 3 14:26 SECCFG -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root root 21 Dec 3 14:26 SEC_RO -> /dev/block/mmcblk0p12
lrwxrwxrwx 1 root root 20 Dec 3 14:26 TEE1 -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root root 20 Dec 3 14:26 TEE2 -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root root 21 Dec 3 14:26 VENDOR -> /dev/block/mmcblk0p19
lrwxrwxrwx 1 root root 21 Dec 3 14:26 forfanzone -> /dev/block/mmcblk0p15
lrwxrwxrwx 1 root root 21 Dec 3 14:26 tszone -> /dev/block/mmcblk0p16
lrwxrwxrwx 1 root root 21 Dec 3 14:26 userdata -> /dev/block/mmcblk0p26
Just use the dd unix command to dump every partitions content to a /sdcard directory where you can easily copy to an external USB stick or PC via adb pull.
E.g: dd if=/dev/block/mmcblk0p10 of=/sdcard/TWRP/boot_from_dd.img
Luckily I didn't have to use these datas to unbrick my system...
TWRP : I used another version ,it's a v3.3.1, works well. Flashed with SP Flash tool and the scatter contained in the .zip firmware at first post. I enclosed it so someone can tell what's the best option amongst these.
ROOT : Flashing magisk zip from TWRP worked flawlessy, but in my case i experienced an additional delay at boot ( let's say between 20-30 sec ), now a cold boot takes about 1 minute whereas with no root it was about 35 secs. I suspect this is due to the magisk modification to the boot process .
HW mods, temp controls and other infos will follow.
Any questions, just ask.
I have v1 1ram 16rom with ac8227l, but when I tried to update my radio I was only able to with an update-ty.zip with a manual process like this:
What I can do????
this is the last firmware that junsun send to me https://drive.google.com/file/d/1OjZcB0yqVQsu8O63l58VrMneZBmr25p5/view?usp=sharing
jabatillo_2001 said:
this is the last firmware that junsun send to me https://drive.google.com/file/d/1OjZcB0yqVQsu8O63l58VrMneZBmr25p5/view?usp=sharing
Click to expand...
Click to collapse
jabatillo_2001 said:
I have v1 1ram 16rom with ac8227l, but when I tried to update my radio I was only able to with an update-ty.zip with a manual process like this:
What I can do????
Click to expand...
Click to collapse
Your update process is very different from mine, probably you should tick every checkbox ( the most dangerous could be the MCU IMHO ) and start the update process. You should check first with the vendor, but it seems the correct procedure if the files he sent you match your Head Unit.
BTW take some picture of the MCu version, FW revision etc... of your unit.
Actually the compressed file they sent you contains BOOT, SYSTEM, TEE AND VENDOR updated partitions, and .bin update file ( usually the mcu update are .bin file but in my experience are really smaller then the one contained in the zip so it's diffucult to know what is for ).
So probably you should tick the "Sistema - > update_ty.zip" ONLY and start the update process....
The update only works with this name of file update-ty.zip, others don't work. My problem is bluetooth, It Connects and disconnects all the time. I'm crazy with this, I think the problem is bttool.apk or MTK but I'm not sure.I'm not allow to call or answer calls, either I can't dial by numbers.
I need to try some other firmware to resolve the problem.
Perhaps you can give me one idea or some trick to help me.
Thanks a lot.
My Android mobile XDA app don't work properly, after I'll attach you photos of my radio characteristics.
maxou2 said:
Actually the compressed file they sent you contains BOOT, SYSTEM, TEE AND VENDOR updated partitions, and .bin update file ( usually the mcu update are .bin file but in my experience are really smaller then the one contained in the zip so it's diffucult to know what is for ).
So probably you should tick the "Sistema - > update_ty.zip" ONLY and start the update process....
Click to expand...
Click to collapse
jabatillo_2001 said:
The update only works with this name of file update-ty.zip, others don't work. My problem is bluetooth, It Connects and disconnects all the time. I'm crazy with this, I think the problem is bttool.apk or MTK but I'm not sure.I'm not allow to call or answer calls, either I can't dial by numbers.
I need to try some other firmware to resolve the problem.
Perhaps you can give me one idea or some trick to help me.
Thanks a lot.
My Android mobile XDA app don't work properly, after I'll attach you photos of my radio characteristics.
Click to expand...
Click to collapse
Need to be sure that the firmware in this thread match your unit first, take pictures of your system infos. BTW your unit is only 1 GB RAM right?
Can you post the link where you bought it? ( Probably aliexpress... )
Keep in mind that generally on these chinese HU the BT is not managed by the android system as with cellphones, it's the MCU and dedicated apk that usually do that ( you do not have any BT option in the android system settings ).
So:
1) Did you try with a system reset?
2) Can you reach an advanced system option menu ( a little bit tricky in my unit ) where you can interact deeply ( BE VERY CAREFUL ) with several options, here you can set some BT systemwide parameters.
3) Maybe an MCU update could also help
1) yes
2)Wells, only development options of Android, the firmware not contains BT options. If you turn off BT, It turns off automatically. BT music only works if you play by mobile, neither by radio.
3) Perhaps, but it's the same problem, to update MCU I need a file named m51_update. You can see in image.
I have a A2 Lite of Xiaomi, but I try in a note 6 pro and the same problem.
What can I do?
I don't know what I can modify native MCU, but I like to probe another compatible ROM.
All my test, without rooting, are around Android 8.1 BT problems..
Bttool.apk don't work properly, disconnects for example, when I try to syncronize the contacts.
I'm afraid to brick It installing by flashing.
maxou2 said:
Keep in mind that generally on these chinese HU the BT is not managed by the android system as with cellphones, it's the MCU and dedicated apk that usually do that ( you do not have any BT option in the android system settings ).
So:
1) Did you try with a system reset?
2) Can you reach an advanced system option menu ( a little bit tricky in my unit ) where you can interact deeply ( BE VERY CAREFUL ) with several options, here you can set some BT systemwide parameters.
3) Maybe an MCU update could also help
Click to expand...
Click to collapse
maxou2 said:
Need to be sure that the firmware in this thread match your unit first, take pictures of your system infos. BTW your unit is only 1 GB RAM right?
Can you post the link where you bought it? ( Probably aliexpress... )
Click to expand...
Click to collapse
The firmware I posted on the first post was also extracted with SP Flash Tools + WwR tools. I sent it to a friend who uploaded a dump made with dumpyara here: https://git.rip/dumps/ffkj/ff-5000
This way we can navigate the filesystem easily, and grab anything we need.
I'm in the process of creating a kernel source for this SoC, I don't know if it will work, but if it does, the first thing I'll do is overclock it haha
jabatillo_2001 said:
1) yes
2)Wells, only development options of Android, the firmware not contains BT options. If you turn off BT, It turns off automatically. BT music only works if you play by mobile, neither by radio.
3) Perhaps, but it's the same problem, to update MCU I need a file named m51_update. You can see in image.
I have a A2 Lite of Xiaomi, but I try in a note 6 pro and the same problem.
What can I do?
I don't know what I can modify native MCU, but I like to probe another compatible ROM.
All my test, without rooting, are around Android 8.1 BT problems..
Bttool.apk don't work properly, disconnects for example, when I try to syncronize the contacts.
I'm afraid to brick It installing by flashing.
Click to expand...
Click to collapse
You should check your HU Hardware parameters, so you can figure is this thread is for you.
System "About device" - see picture.. Take a picture of the values on the screen.
After that touch the Gear icon on the top right of the screen a popup menu will appear, digit 8888 and ok.
An advanced system setting menu will appear, choose "others", scroll down and you'll see some BT options ( see picture ), try to change them.
Save and reboot.
If your system doesn't have such as menus I strongly recommend you to check elsewhere because probably your HU is different from mine.