Related
Hi,
i know there are a lot of threads about all this stuff already and i also know that the hero is not the latest gadget anymore.
Anyway, a few days ago i started investigating on the bluetooth sub-system running on my HTC Hero. I tried to find out how things work out on latest stock ROM 3.32.405.2 compared to some of latest nightly ROM builds based on cyanogen.
I just wanted to post what i found out in the meantime and what might be worth discussing. Here we go
The chipset:
Th Hero in fact uses a BRF6350 from Texas Intruments which is a successor of the BRF6300. This chip definitely has FM capabilites, but there's no access to this function per default.
It is yet unknown if the hardware connections would basically support this option, if set up correctly.
Again, there is some basic information at TI's website:
http://focus.ti.com/general/docs/wt...ateId=6123&navigationId=12659&contentId=14646
I also found a very interesting document in the web, that gives a more detailed block diagram of the BRF6350 chipset (see attachment).
The firmware:
In stock ROM there's only a BRF6300 firmware file, though a BRF6350 is used one the mainboard.
On the latest cyanogen nightly builds there's also a BRF6350 firmware file.
See this thread for more: http://forum.xda-developers.com/showthread.php?t=704976
I could not find out what is the origin of this file, maybe it was extracted form a WM-ROM...
Who ever knows more about it please post it here!
Anyway the firmware get's loaded during boot up, using a service call in init.hero.rc. This one is common in stock and AOSP ROM's:
Code:
service hciattach /system/bin/hciattach \
-n -s 115200 /dev/ttyHS0 texasalt 4000000 flow
user bluetooth
group bluetooth net_bt_admin
disabled
On stock ROM there's an additonal service started in init.hero.rc:
Code:
#btips - 2.22
service btips /system/bin/btipsd --logfile /data/btips/btips_log.txt -no_android_log
socket bluetooth stream 660 bluetooth bluetooth
socket dbus_bluetooth stream 660 bluetooth bluetooth
group bluetooth net_bt_admin misc
disabled # the MCP monitor service is responsible for bringing up the daemon
oneshot
AFAIK, this service is needed to start the TI bluetooth stack and does a more specific setup of the chipset.
Also it might be possible, that on stock ROMs hciattach is obsolete and btipsd in fact loads the BRF6300 firmware to the BRF6350 chipset. Some further investigation is required here...
There'd also been some discussions early this year in the IRC channel about btipsd.
By stepping through the binary, i found out that btipsd also includes some hard coded start-up scripts (*.bts).
These are similar to the scripts located in /etc/firmware.
The scripts:
After the firmware has been transferred to the chipset, a basic setup has to be made. So that's what these scripts are doing.
The firmware uses some binary command mode to communicate at this point.
Also some tweaks might be injected to match the current API.
These are the basic scripts located in /etc/firmware (stock ROM and AOSP):
avpr.bts (Description: BRF6450 AVPR FW Initialization Script, Compatibility: BRF6450 PG1 ROM)
fm_rx_init_1273.2.bts (Description: This script could be used to put the FM IP in RCV mode)
fmc_init_1273.2.bts (Description : FM Firmware Patch - v2.140, Compatibility : BL6450 2.1, BL6450 3.0, WL127x 2.0, NL55xx 2.0 ROM)
tiinit_5.3.53.bts (Description : BRF6350 2.11 ROM Initialization Script, Compatibility: BRF6350 2.11 ROM)
It seems that these scripts are generic and are used on other platforms as well. By extracting the debug messages of these scripts, if found out, that on stock ROM none of them is matching to the given firmware (BRF6300.bin).
In other words they seem to be useless!
By integrating BRF6350.bin into the AOSP ROMs, there's only one that maybe used: tiinit_5.3.53.bts
Some cross referals....
E.g. the Xperia X1 (also uses BRF6350 chipset) got a couple init scripts to match different firmware versions:
TIInit_5_3_53.bts (Description : BRF6350 2.11 ROM Initialization Script, Compatibility: BRF6350 2.11 ROM)
TIInit_5_2_34.bts (Description : BRF6350 2.34 ROM Initialization Script, Compatibility: BRF6350 2.34 ROM)
TIInit_4_2_38.bts (Description : BRF6300 1.31 ROM Initialization Script, Compatibility: BRF6300 1.31 ROM)
Inside Xperia X1 ROMs there are also some scripts to activate FM radio on a BRF6530 chipset
Fm_on_2_0.bts
Fm_on_2_1.bts (Description : BRF6350 2.11 FM Initialization, Compatibility: BRF6350 2.11 ROM)
FMInit_2.bts (Description : BRF6350 2.0 FW 2.34 FM Initialization, Compatibility: BRF6350 2.0 ROM w/ 2.0.34 Firmware)
There's also a package called HTC tools for the WM phones (HTC Diamond, HTC Raphel, etc) including similar scripts for FM.
So maybe it will be possible some day to tweak Hero ROMs and make use of these scripts. This would probably solve this issue: http://forum.xda-developers.com/showthread.php?t=533780
The stack:
HTC Hero stock ROM's use TI proprietary bluetooth stack.
The HCI communication to the chipset is mainly done through btipsd, which is also closed source.
There's also some nice command line interface (btipsd_cli) to gather some low level information.
Some proprietary libraries might be in use for the stack as well...
The firmware file is BRF6300.bin.
On the AOSP ROMs the bluetooth framework is little more open.
AFAIK the BlueZ stack is used on these ROMs.
The HCI communication seems to rely entirely on hci toolset (e.g. hciattach, hciconfig, hcitool...)
The latest cyanogen nightly ROMs make use of BRF6350.bin.
As already stated, i just started to investigate a few days ago...
... still many secrets and still little confusing, but i just wanted to start collecting some information and give it out to the community.
Another nice thread at G1 sub-forum: http://forum.xda-developers.com/showthread.php?t=527027
Please post your knowledge here or correct me, if i pointed out something wrong!
TBC....
Best regards,
scholbert
extended info about *.bts files
Init files from HTC Hero...
Debug strings in fm_rx_init_1273.2.bts:
Code:
0x24 0x4F # +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
0x78 0x1B # RCV Power On - v0.8
0x9E 0x4A # Description: This script could be used to put the FM IP in RCV mode
0xED 0x19 # Author: Manav
0x010B 0x17 # Date: Dec 29, 2007
0x0127 0x14 # Changes:
0x0147 0x20 # 0] Dec'29 2007 - Initial Edits
0x016C 0x43 # 1] Jan'31 2008 - Clean up - Moved register settings to code patch
0x01B4 0x1C # 2] Mar'15 2008 - No Change
0x01DB 0x2E # Notes: Use this script after running FM Init
0x020E 0x50 # ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
0x026D 0x22 # Putting the Synth in Closed Loop
0x02BD 0x57 # Select if RDS is needed (Make fm_rcv_mode =3 for RDS and FM and =1 for only FM Audio)
0x0319 0x10 #fm_rcv_mode = 3
0x033C 0x52 # RCV POWER ON API (Arg = 3 for both FM Audio and RDS / Arg = 1 for only FM Audio)
0x03B8 0x0E #Audio Enable.
0x03CB 0x31 #Send_HCI_VS_I2C_Write_to_FM 0xFD35, 0x1D, 0x0002
0x0401 0x4C #Wait_HCI_Command_Complete_VS_I2C_Write_to_FM_Event 5000, 0x00, 0xfd35, 0x00
Debug Strings in fmc_init_1273.2.bts:
Code:
0x29 0x53 #--------------------------------------------------------------------------------
0x81 0x2D # Description : FM Firmware Patch - v2.140
0xBA 0x21 # Author : Sumeer Bhatara
0xE8 0x46 # Compatibility : BL6450 2.1, BL6450 3.0, WL127x 2.0, NL55xx 2.0 ROM
0x013B 0x1D # Last Updated : 02/06/2009
0x0165 0x3C # Notes : Please refer to the SP2.22 RN for details
0x01A6 0x53 #--------------------------------------------------------------------------------
0x020D 0x39 # FM ON Command - This would activate the I2C co-relator
0x0250 0x29 #Send_HCI_VS_I2C_FM_POWER_MODE 0xFD37, 1
0x027E 0x60 #Wait_HCI_Command_Complete_VS_I2C_FM_POWER_MODE_Event 5000, any, HCI_VS_I2C_FM_POWER_MODE, 0x00
0x02E8 0x1F #time needed for APLL to lock
0x030C 0x0A #sleep 30
0x0345 0x0D #Data patch
0x035C 0x1B # PA VOLTAGE TABLE CHANGE
0x08A1 0x35 #Program the g_tCapAdjTable[5] = {-2, -1 ,0 ,2 ,4 }
0x08DB 0x32 # g_tCapAdjTable[1] = -1 , g_tCapAdjTable[0] = -2
0x093B 0x30 # g_tCapAdjTable[3] =2 , g_tCapAdjTable[2] = 0
0x0999 0x28 # g_tgLow[0] =2 , g_tCapAdjTable[4] =4
0x09EF 0x1F # g_tCapValTable TABLE CHANGE
0x0A13 0x20 # Program the g_tCapValTable[0]
0x0A61 0x20 # Program the g_tCapValTable[1]
0x0AAF 0x20 # Program the g_tCapValTable[2]
0x0AFD 0x20 # Program the g_tCapValTable[3]
0x0B4B 0x20 # Program the g_tCapValTable[4]
0x0B99 0x20 # Program the g_tCapValTable[5]
0x0BE7 0x20 # Program the g_tCapValTable[6]
0x0C35 0x20 # Program the g_tCapValTable[7]
0x0C8D 0x0C #Code Patch
0x4BD7 0x4F # +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
0x4C2B 0x1B # RCV Power On - v0.8
0x4C51 0x4A # Description: This script could be used to put the FM IP in RCV mode
0x4CA0 0x19 # Author: Manav
0x4CBE 0x17 # Date: Dec 29, 2007
0x4CDA 0x14 # Changes:
0x4CFA 0x20 # 0] Dec'29 2007 - Initial Edits
0x4D1F 0x43 # 1] Jan'31 2008 - Clean up - Moved register settings to code patch
0x4D67 0x1C # 2] Mar'15 2008 - No Change
0x4D8E 0x2E # Notes: Use this script after running FM Init
0x4DC1 0x50 # ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
0x4E20 0x22 # Putting the Synth in Closed Loop
0x4E70 0x57 # Select if RDS is needed (Make fm_rcv_mode =3 for RDS and FM and =1 for only FM Audio)
0x4ECC 0x10 #fm_rcv_mode = 3
0x4EEF 0x52 # RCV POWER ON API (Arg = 3 for both FM Audio and RDS / Arg = 1 for only FM Audio)
0x4F6B 0x0E #Audio Enable.
0x4F7E 0x31 #Send_HCI_VS_I2C_Write_to_FM 0xFD35, 0x1D, 0x0002
0x4FB4 0x4C #Wait_HCI_Command_Complete_VS_I2C_Write_to_FM_Event 5000, 0x00, 0xfd35, 0x00
In fact these inits are for WiLink 6.0 mobile platform WL1271/WL1273 (WLAN 802.11 a/b/g/, Bluetooth v2.1 + EDR, FM)
Debug strings in tiinit_5.3.53.bts:
Code:
0x24 0x52 #--------------------------------------------------------------------------------
0x7B 0x37 # Description : BRF6350 2.11 ROM Initialization Script
0xBE 0x22 # Compatibility: BRF6350 2.11 ROM
0xEC 0x29 # Last Updated: 14-Dec-2009 15:39:50.51
0x0121 0x1D # Version : TI_P2_11.158
0x014A 0x4D # Notes : Use this script on BRF6350 2.11 ROM device only (FW v3.0.53)
0x019C 0x52 #--------------------------------------------------------------------------------
0x36C6 0x65 #####################################################################################################
0x3730 0x65 ############## BEGIN POWER TABLE SECTION ##########################################################
0x379A 0x65 #####################################################################################################
0x3D07 0x65 #####################################################################################################
0x3D71 0x65 ############## END POWER TABLE SECTION ############################################################
0x3DDB 0x65 #####################################################################################################
0x3F63 0x3E ##############################################################
0x3FA6 0x3E #### This portion of the Init Script is for custom use. #####
0x3FE9 0x3E #### Enable/Disable as required for the actual platform. #####
0x402C 0x3E ##############################################################
0x4074 0x5C ############ Fast Clock Configuration - Disable Crystal ##############################
0x40DB 0x35 # When Crystal in use - please remove this command.
0x4115 0x4C # Please refer to BT-SW-0030 Vendor Specific document for more information.
0x419A 0x42 #-----------------------------------------------------------------
0x41EB 0x18 # Enable Protocol Viewer
0x4208 0x42 #-----------------------------------------------------------------
0x4270 0x42 #-----------------------------------------------------------------
0x42C1 0x1B # Initialize voice settings
0x42E1 0x42 #-----------------------------------------------------------------
0x436A 0x51 #Send_HCI_VS_Write_CODEC_Configuration 0xFF08, 0x01, 0x00, 0x19, 0x19, 0x19, 0x01
0x43C0 0x56 #Wait_HCI_Command_Complete_VS_Write_CODEC_Configuration_Event 5000, 0x00, 0xff08, 0x00
0x4420 0x4D # Set inactivity timer to 320 frames - 400 msec (recommended for most hosts)
0x4472 0x6A # value may be reduced in accordance to host limitations for power saving (default: 80 frames - 100msec).
0x4506 0x2D # Accept PA_SD signaling from WLAN during TX
0x456F 0x15 # Enable co-existence
0x4589 0x42 #-----------------------------------------------------------------
0x45D0 0xAB #Send_HCI_VS_Write_Wlan_Configuration 0xFD1D, 0x04, 0x01, 0x05e9, 0x0000, 0x00, 0x00, "FF:FF:FF:FF:FF:FF:FF:FF:FF:FF", 0x04, 0x01, 0x00, 0x01, 0x02, 0x01, 0x00, 0xff, 0x00
0x4680 0x55 #Wait_HCI_Command_Complete_VS_Write_Wlan_Configuration_Event 5000, 0x00, 0xfd1d, 0x00
0x46DA 0x26 #set IO17 to be the BT RF-Activity pin
0x473B 0x22 # 0x5e8 - remove SCO from Priority
0x4762 0xAB #Send_HCI_VS_Write_Wlan_Configuration 0xFD1D, 0x04, 0x01, 0x05e8, 0x0000, 0x00, 0x00, "FF:FF:FF:FF:FF:FF:FF:FF:FF:FF", 0x05, 0x01, 0x00, 0x01, 0x02, 0x01, 0x00, 0xff, 0x00
0x4812 0x55 #Wait_HCI_Command_Complete_VS_Write_Wlan_Configuration_Event 5000, 0x00, 0xfd1d, 0x00
0x4876 0x18 # HCI_VS_Set_DDIP_Params
0x48BE 0x18 # Enable deep sleep mode
It seems this init could be used after brf6350.bin has been loaded on HTC Hero.
Debug Strings in avpr.bts:
Code:
0x24 0x52 #--------------------------------------------------------------------------------
0x7B 0x37 # Description: BRF6450 AVPR FW Initialization Script
0xBE 0x21 # Compatibility: BRF6450 PG1 ROM
0xEB 0x2A # Last Updated: 30-Jun-2008 19:06:31.35
0x0121 0x15 # Version: 1.1
0x0142 0x52 #--------------------------------------------------------------------------------
0x019E 0x11 #Mask All domains
0x01DA 0x39 #Issue Switch On command (all domains - including wibree)
0x023E 0x29 #turn on COREX clock (should read 0xnnn9)
0x0292 0x31 # Cortex Reset (hold in reset while loading IMEM)
0x8FB4 0x15 #release Cortex Reset
This init is used for newer chipset BRF6450.
HTC Tools for WM (capable HTC Diamond, HTC Raphael, etc. to test FM radio) includes some FM init scripts.
Debug Strings in FMInit_2.bts:
Code:
0x24 0x52 #--------------------------------------------------------------------------------
0x7B 0x35 # Description : BRF6350 2.0 FW 2.34 FM Initialization
0xBC 0x33 # Compatibility: BRF6350 2.0 ROM w/ 2.0.34 Firmware
0xFB 0x1C # Last Updated: 14-Feb-2007
0x0123 0x13 # Version : 2.2
0x0142 0x43 # Notes : Required after runnung BRF6350 Bluetooth Initscript
0x018A 0x52 #--------------------------------------------------------------------------------
0x01E6 0x07 # FM ON
Debug Strings in FM_on_2_0.bts:
Code:
0x24 0x1C #log "FM_ON" (default 32KHz)
0x66 0x1C #log "FM_ON" (Optional FREF)
0x87 0x28 #Send_HCI_VS_I2C_FM_POWER_MODE 0xFD37, 1
0xB4 0x5F #Wait_HCI_Command_Complete_VS_I2C_FM_POWER_MODE_Event 5000, any, HCI_VS_I2C_FM_POWER_MODE, 0x00
0x0122 0x09 #SW patch
0x0130 0x20 # No FW patch defined for D2_11
0x015F 0x2D # Changes recommended by the AFE team - V0.1
0x01DF 0x0D #ADC settings
0x0297 0x15 #power on: FM and RDS
Debug Strings in FM_on_2_1.bts:
Code:
0x24 0x52 #--------------------------------------------------------------------------------
0x7B 0x2E # Description : BRF6350 2.11 FM Initialization
0xB5 0x21 # Compatibility: BRF6350 2.11 ROM
0xE2 0x1C # Last Updated: Oct 10, 2007
0x010A 0x13 # Version : 3.7
0x0129 0x15 # Author : Manav
0x0149 0x45 # Notes : Required after runnung BRF6350 Bluetooth Initscript.
0x0193 0x2F # Includes FM Register Patch v0.5
0x01C7 0x52 #--------------------------------------------------------------------------------
0x0223 0x44 # ------------------------------------------------------------------
0x026C 0x07 # FM ON
0x0278 0x44 # ------------------------------------------------------------------
0x02E7 0x44 # ------------------------------------------------------------------
0x0330 0x3A # Note: Delay of 20ms is required in after FM Power ON API
0x036F 0x40 # Checksum command has been used to create required delay.
0x03B4 0x44 # ------------------------------------------------------------------
0x03FD 0x09 #sleep 20
0x3839 0x06 x *yx
0x3F61 0x44 # ------------------------------------------------------------------
0x3FAA 0x39 # Note: Delay of ~4ms is required in after RESET command.
0x3FE8 0x40 # Checksum command has been used to create required delay.
0x402D 0x44 # ------------------------------------------------------------------
0x4076 0x09 #sleep 40
0x4586 0x44 # ------------------------------------------------------------------
0x45CF 0x42 # Un-mark SWITCH2FREF command below when working with FREF for FM
0x4616 0x2E # Default : FM on 32K (command below remarked)
0x4649 0x44 # ------------------------------------------------------------------
0x4692 0x2B # Send_HCI_VS_I2C_Write_to_FM 0xFD35, 36, 1
0x46C2 0x5C # Wait_HCI_Command_Complete_VS_I2C_Write_to_FM_Event 5000, any, HCI_VS_I2C_Write_to_FM, 0x00
0x4728 0x44 # ------------------------------------------------------------------
0x4771 0x18 # FM Register Patch v0.5
0x478E 0x44 # ------------------------------------------------------------------
0x4872 0x44 # ------------------------------------------------------------------
0x48BB 0x1E # FM Register Patch v0.5 (End)
0x48DE 0x44 # ------------------------------------------------------------------
0x4954 0x15 # Power on FM and RDS
0x4993 0x44 # ------------------------------------------------------------------
0x49DC 0x42 # Note: Delay of 30ms is required in after FM POWER ON RCV command
0x4A23 0x40 # Checksum command has been used to create required delay.
0x4A68 0x44 # ------------------------------------------------------------------
0x4AB1 0x0A # sleep 30
0x4AE2 0x20 # Enable Dynamic LNA mode switch
Stolen from Xperia X1 ROM this init is basically the same as on HTC Hero (tiinit_5.3.53.bts).
Debug strings in TIInit_5_3_53.bts (Xperia X1):
Code:
0x24 0x52 #--------------------------------------------------------------------------------
0x7B 0x37 # Description : BRF6350 2.11 ROM Initialization Script
0xBE 0x22 # Compatibility: BRF6350 2.11 ROM
0xEC 0x29 # Last Updated: 04-Mar-2008 1:32:43.58
0x0121 0x1C # Version : TI_P2_11.34
0x0149 0x4D # Notes : Use this script on BRF6350 2.11 ROM device only (FW v3.0.53)
0x019B 0x52 #--------------------------------------------------------------------------------
0x01F7 0x51 #--------------------------------------------------------------------------------
0x0257 0x24 # Update the Baudrate to 4000000 bps
0x0280 0x51 #--------------------------------------------------------------------------------
0x0301 0x51 #--------------------------------------------------------------------------------
0x2A99 0x65 #####################################################################################################
0x2B03 0x65 ############## BEGIN POWER TABLE SECTION ##########################################################
0x2B6D 0x65 #####################################################################################################
0x3191 0x65 #####################################################################################################
0x31FB 0x65 ############## END POWER TABLE SECTION ############################################################
0x3265 0x65 #####################################################################################################
0x335E 0x5A # SW bypass for spikes on IOs - Leave HCI TX, RX, CTS, RTS and BT_Wakeup during deep sleep
0x3408 0x3E ##############################################################
0x344B 0x3E #### This portion of the Init Script is for custom use. #####
0x348E 0x3E #### Enable/Disable as required for the actual platform. #####
0x34D1 0x3E ##############################################################
0x3519 0x57 ############ Enable Protocol Viewer ###############################################
0x3596 0x54 ############ Change baudrate example ###############################################
0x35F5 0x3D # Example below changes baudrate to 921k (16mHz system clock)
0x3637 0x58 # For other baudrates and system frequencies please contact your support representative.
0x3694 0x49 # Please note that the VS_Set_Uart_HCI_Baudrate_Island3 has replaced the
0x36E2 0x3A # HCI_VS_Update_Uart_HCI_Baudrate vendor specific command.
0x372C 0x3E #Send_HCI_VS_Set_Uart_HCI_Baudrate_Island3 0xFD38, 2, 17, 0, 7
0x376F 0x77 #Wait_HCI_Command_Complete_VS_Set_Uart_HCI_Baudrate_Island3_Event 5000, any, HCI_VS_Set_Uart_HCI_Baudrate_Island3, 0x00
0x37F0 0x42 #-----------------------------------------------------------------
0x3841 0x1B # Initialize voice settings
0x3861 0x42 #-----------------------------------------------------------------
0x38EA 0x42 #-----------------------------------------------------------------
0x393B 0x15 # Enable co-existence
0x3955 0x42 #-----------------------------------------------------------------
0x39D7 0x56 ############ Sleep Mode Setup ##################################################
0x3A32 0x4D # Set inactivity timer to 320 frames - 400 msec (recommended for most hosts)
0x3A84 0x6A # value may be reduced in accordance to host limitations for power saving (default: 80 frames - 100msec).
0x3AF3 0x3A #Send_HCI_VS_hcill_parameters 0xFD2B, 0x0640, 0xffff, 0xff
0x3B32 0x4D #Wait_HCI_Command_Complete_VS_hcill_parameters_Event 5000, 0x00, 0xfd2b, 0x00
0x3B89 0x0F #deep sleep: 2s
0x3BC7 0x63 # Default Settling time of 15ms may be reduced in accordance to design requirments for power saving
0x3C2F 0x2C #Send_HCI_VS_Set_Settling_Time 0xFF79, 15000
0x3C60 0x5F #Wait_HCI_Command_Complete_VS_Set_Settling_Time_Event 5000, any, HCI_VS_Set_Settling_Time, 0x00
0x3CC9 0x2B # Enable deep sleep with default parameters
Debug strings in TIInit_5_2_34.bts (Xperia X1):
Code:
0x24 0x52 #--------------------------------------------------------------------------------
0x7B 0x37 # Description : BRF6350 2.34 ROM Initialization Script
0xBE 0x22 # Compatibility: BRF6350 2.34 ROM
0xEC 0x29 # Last Updated: 08-Mar-2007 20:15:32.73
0x0121 0x17 # Version : P11.11
0x0144 0x2F # RAM consumption : 2892B used, 328B available
0x017F 0x25 # Patch entries : used 14 out of 24
0x01B0 0x4D # Notes : Use this script on BRF6350 2.34 ROM device only (FW v2.0.34)
0x0202 0x52 #--------------------------------------------------------------------------------
0x025E 0x51 #--------------------------------------------------------------------------------
0x02BE 0x24 # Update the Baudrate to 4000000 bps
0x02E7 0x51 #--------------------------------------------------------------------------------
0x0368 0x51 #--------------------------------------------------------------------------------
0x3511 0x57 ############ Enable Protocol Viewer ###############################################
0x356D 0x30 #Send_HCI_VS_Enable_Protocol_Viewer 0xFF68, 0x01
0x35A2 0x53 #Wait_HCI_Command_Complete_VS_Enable_Protocol_Viewer_Event 5000, 0x01, 0xff68, 0x00
0x35FF 0x42 #-----------------------------------------------------------------
0x3650 0x1B # Initialize voice settings
0x3670 0x42 #-----------------------------------------------------------------
0x36F9 0x42 #-----------------------------------------------------------------
0x374A 0x15 # Enable co-existence
0x3764 0x42 #-----------------------------------------------------------------
0x37E6 0x56 ############ Sleep Mode Setup ##################################################
0x3841 0x42 #-----------------------------------------------------------------
0x3892 0x18 # Enable Deep Sleep Mode
0x38AF 0x4D # Set inactivity timer to 320 frames - 400 msec (recommended for most hosts)
0x3901 0x6A # value may be reduced in accordance to host limitations for power saving (default: 80 frames - 100msec).
0x3970 0x42 #-----------------------------------------------------------------
0x39B7 0x3A #Send_HCI_VS_hcill_parameters 0xFD2B, 0x0140, 0xffff, 0xff
This is also included in Xperia stock ROM but used with a firmware for BRF6300 chipset. This chipset got no FM support.
Debug strings in TIInit_4_2_38.bts (Xperia X1):
Code:
0x24 0x52 #--------------------------------------------------------------------------------
0x7B 0x37 # Description : BRF6300 1.31 ROM Initialization Script
0xBE 0x22 # Compatibility: BRF6300 1.31 ROM
0xEC 0x29 # Last Updated: 30-Sep-2007 18:14:28.93
0x0121 0x21 # Version : DVM_BOOST_P13.48
0x014E 0x4D # Notes : Use this script on BRF6300 1.31 ROM device only (FW v2.0.38)
0x01A0 0x52 #--------------------------------------------------------------------------------
0x01FC 0x51 #--------------------------------------------------------------------------------
0x025C 0x24 # Update the Baudrate to 4000000 bps
0x0285 0x51 #--------------------------------------------------------------------------------
0x2921 0x5C ############# DEVM output power threshold. Please see release note for further information.
0x2A19 0x08 €€€€€€€€
0x2A4B 0x08 €€€€€€€€
0x2A7D 0x08 €€€€€€€€
0x2AAF 0x08 €€€€€€€€
0x2B0E 0x09 €€€€€€€€€
0x4745 0x65 #####################################################################################################
0x47AF 0x65 ############## BEGIN POWER TABLE SECTION ##########################################################
0x4819 0x65 #####################################################################################################
0x50C4 0x65 #####################################################################################################
0x512E 0x65 ############## END POWER TABLE SECTION ############################################################
0x5198 0x65 #####################################################################################################
0x532C 0x3E ##############################################################
0x536F 0x3E #### This portion of the Init Script is for custom use. #####
0x53B2 0x3E #### Enable/Disable as required for the actual platform. #####
0x53F5 0x3E ##############################################################
0x543D 0x5C ############ Fast Clock Configuration - Disable Crystal ##############################
0x54A4 0x35 # When Crystal in use - please remove this command.
0x54DE 0x4C # Please refer to BT-SW-0030 Vendor Specific document for more information.
0x5563 0x57 ############ Enable Protocol Viewer ###############################################
0x55E0 0x54 ############ Change baudrate example ###############################################
0x563F 0x3D # Example below changes baudrate to 921k (16mHz system clock)
0x5681 0x41 # For other baudrates and system frequencies please use the UART
0x56C7 0x51 # Baudrate Calculator tool. Please note that the VS_Set_Uart_HCI_Baudrate_Island3
0x571D 0x4B # has replaced the HCI_VS_Update_Uart_HCI_Baudrate vendor specific command.
0x5778 0x3E #Send_HCI_VS_Set_Uart_HCI_Baudrate_Island3 0xFD38, 2, 17, 0, 7
0x57BB 0x77 #Wait_HCI_Command_Complete_VS_Set_Uart_HCI_Baudrate_Island3_Event 5000, any, HCI_VS_Set_Uart_HCI_Baudrate_Island3, 0x00
0x583C 0x56 ############ Sleep Mode Setup ##################################################
0x589C 0x4D # Set inactivity timer to 320 frames - 400 msec (recommended for most hosts)
0x58EE 0x6A # value may be reduced in accordance to host limitations for power saving (default: 80 frames - 100msec).
0x595D 0x3A #Send_HCI_VS_hcill_parameters 0xFD2B, 0x0140, 0xffff, 0xff
0x599C 0x4D #Wait_HCI_Command_Complete_VS_hcill_parameters_Event 5000, 0x00, 0xfd2b, 0x00
0x59F3 0x63 # Default Settling time of 15ms may be reduced in accordance to design requirments for power saving
0x5A5B 0x2C #Send_HCI_VS_Set_Settling_Time 0xFF79, 15000
0x5A8C 0x5F #Wait_HCI_Command_Complete_VS_Set_Settling_Time_Event 5000, any, HCI_VS_Set_Settling_Time, 0x00
0x5AF5 0x2B # Enable deep sleep with default parameters
0x5B25 0x53 #Send_HCI_VS_Sleep_Mode_Configurations 0xFD0C, 1, 1, 0xFF, 0xFF, 0xFF, 0xFF, 0, 100
0x5B7D 0x6F #Wait_HCI_Command_Complete_VS_Sleep_Mode_Configurations_Event 5000, any, HCI_VS_Sleep_Mode_Configurations, 0x00
0x5BF6 0x42 #-----------------------------------------------------------------
0x5C47 0x28 # Initialize voice settings for 7500 PCM
0x5C74 0x42 #-----------------------------------------------------------------
0x5CFD 0x42 #-----------------------------------------------------------------
0x5D4E 0x15 # Enable co-existence
0x5D68 0x42 #-----------------------------------------------------------------
0x5E68 0x42 #-----------------------------------------------------------------
0x5EB9 0x18 # Enable Deep Sleep Mode
0x5ED6 0x4D # Set inactivity timer to 320 frames - 400 msec (recommended for most hosts)
0x5F28 0x6A # value may be reduced in accordance to host limitations for power saving (default: 80 frames - 100msec).
0x5F97 0x42 #-----------------------------------------------------------------
0x5FDE 0x3A #Send_HCI_VS_hcill_parameters 0xFD2B, 0x0140, 0xffff, 0xff
0x601D 0x3A #Send_HCI_VS_hcill_parameters 0xFD2B, 0x1f40, 0xffff, 0xff
0x605C 0x4D #Wait_HCI_Command_Complete_VS_hcill_parameters_Event 5000, 0x00, 0xfd2b, 0x00
Sorry for this extensive post, but i wanted to put it down here for completeness
Regards,
scholbert
So guys I've managed to brick my optimus (tried to flash 2.1 via kdz over 2.2)
It broke half way doing flashing. Now that same thing happens evry time I try flashing it (something about missing dlls)
Any help?
here is kdz log:
[09:33:57:583] : Start Web Downloading
[09:33:57:583] : Get Usb Port
[09:33:57:591] : rsi.strFriendlyName=Communications Port (COM1)
[09:33:57:591] : Remove Communications Port (COM1)
[09:33:57:591] : rsi.strFriendlyName=LGE Bluetooth TransPort (COM23)
[09:33:57:591] : Remove LGE Bluetooth TransPort (COM23)
[09:33:57:591] : rsi.strFriendlyName=LGE Android Platform USB Serial Port (COM24)
[09:33:57:592] : FriendlyNameList[iii].szFriendlyName=LGE Android Platform USB Serial Port
[09:33:57:592] : WM_COPYDATA ¸Ţ˝ĂÁö ş¸łż 1 - COM24
[09:33:57:592] : Port = COM24
[09:33:57:593] : Clear
[09:33:57:593] : Clear
[09:33:57:594] : UNKNOWN : Req(12) -> Rsp(13)
[09:33:57:594] : Clear
[09:33:57:595] : UNKNOWN : Req(12) -> Rsp(13)
[09:33:57:595] : Clear
[09:33:57:596] : UNKNOWN : Req(12) -> Rsp(13)
[09:33:57:596] : >> DIAG_STATUS_F FAILED
[09:33:57:601] : >>Get Model Name [DIAG_VERNO_F]
[09:33:57:601] : Clear
[09:33:57:602] : BAD CONN MODE : Req(0) -> Rsp(3)
[09:33:57:602] : Clear
[09:33:57:603] : BAD CONN MODE : Req(0) -> Rsp(3)
[09:33:57:603] : Clear
[09:33:57:604] : BAD CONN MODE : Req(0) -> Rsp(3)
[09:33:57:604] : Clear
[09:33:57:605] : BAD CONN MODE : Req(0) -> Rsp(3)
[09:33:57:605] : Clear
[09:33:57:606] : BAD CONN MODE : Req(0) -> Rsp(3)
[09:33:57:606] : Clear
[09:33:57:607] : BAD CONN MODE : Req(0) -> Rsp(3)
[09:33:57:607] : FAIL (No Phone)
[09:33:57:607] : GetModelName() Operation Failed Check Diag CMD
[09:33:57:607] : EMERGENCY Booting Mode
[09:33:57:607] : >>Get Model Name in Emergency Mode [DLOAD_VERREQ_F]
[09:33:57:607] : Clear
[09:33:57:607] : Clear
[09:33:57:608] : BS/GT540/7Dp0501#1#{86e0d1e0-8089-11d0-
[09:33:57:608] : WM_COPYDATA ¸Ţ˝ĂÁö ş¸łż 0 - GT540
[09:33:57:608] : >>Get Mobile SW [DIAG_EXT_BUILD_ID_F]
[09:33:57:608] : Clear
[09:33:57:608] : Clear
[09:33:57:609] : DLOAD_NAK_F reason_msb = 6, reason_lsb = 6
[09:33:57:609] : [ DLOAD ERROR ] : NAK_INVALID_CMD
[09:33:57:609] : Clear
[09:33:57:610] : DLOAD_NAK_F reason_msb = 6, reason_lsb = 6
[09:33:57:610] : [ DLOAD ERROR ] : NAK_INVALID_CMD
[09:33:57:610] : Clear
[09:33:57:611] : DLOAD_NAK_F reason_msb = 6, reason_lsb = 6
[09:33:57:611] : [ DLOAD ERROR ] : NAK_INVALID_CMD
[09:33:57:611] : FAIL
[09:33:57:611] : Clear
[09:33:57:611] : Clear
[09:33:57:622] : DLOAD_NAK_F reason_msb = 3, reason_lsb = 3
[09:33:57:622] : [ DLOAD ERROR ] : NAK_INVALID_LEN
[09:33:57:622] : Clear
[09:33:57:623] : DLOAD_NAK_F reason_msb = 3, reason_lsb = 3
[09:33:57:623] : [ DLOAD ERROR ] : NAK_INVALID_LEN
[09:33:57:623] : Clear
[09:33:57:624] : DLOAD_NAK_F reason_msb = 3, reason_lsb = 3
[09:33:57:624] : [ DLOAD ERROR ] : NAK_INVALID_LEN
[09:33:57:624] : NV Write Fail : NV ITEM 9028(9028)
[09:33:57:724] : m_pPhoneCtrl->m_pDload->Dl_GetCommMode(&m_pPhoneCtrl->m_pDload->m_nCommMode)
[09:33:57:724] : >> GET DLOAD COMM MODE
[09:33:57:724] : Clear
[09:33:57:724] : Clear
[09:33:57:725] : [GetCommMode] Communication mode : 2
[09:33:57:725] : Pre Nand Download
[09:33:57:725] : >>Set Trusted Mode [DLOAD_NAND_SEC_MODE] sec_mode = 1 (1=trusted 0=NonTrusted)
[09:33:57:725] : WM_COPYDATA ¸Ţ˝ĂÁö ş¸łż 3 - TRUSTED MODE
[09:33:57:725] : Clear
[09:33:57:725] : Clear
[09:33:57:726] : [COM24] >>NandFlashInitWithFile(PARTITION TBL), BinType =8
[09:33:57:726] : WM_COPYDATA ¸Ţ˝ĂÁö ş¸łż 3 - INIT PARTITION TBL
[09:33:57:726] : Clear
[09:33:57:726] : Clear
[09:33:57:737] : Clear
[09:33:57:737] : Clear
[09:33:57:738] : ¸Ţ˝ĂÁö ş¸łż TYPE_WPARAM_WRITE_TO_SDRAM 3
[09:33:57:738] : [COM24] Check BCPL Status ...
[09:33:57:740] : WM_COPYDATA ¸Ţ˝ĂÁö ş¸łż 3 - Check BCPL
[09:33:57:741] : WaitRsp_1
[09:33:57:841] : Error Read in WaitRsp
[09:33:57:841] : [COM24] >> BCPL Off ...
[09:33:57:841] : m_nSelectedImages= 70787108
[09:33:57:841] : m_nSelectedImages= 70787108,Type= 13
[09:33:57:841] : [COM14] ¸Ţ˝ĂÁö ş¸łż TYPE_WPARAM_WRITE_OEMSBL 18
[09:33:57:841] : [COM24] >>NandFlashInitWithFile(OEMSBL HEADER), BinType =12
[09:33:57:841] : WM_COPYDATA ¸Ţ˝ĂÁö ş¸łż 3 - INIT OEMSBL HEADER
[09:33:57:841] : Clear
[09:33:57:841] : @@ Cable Disconnected - Writing : 5
[09:33:57:841] : Clear
[09:33:57:841] : WM_COPYDATA ¸Ţ˝ĂÁö ş¸łż 3 - Close Port
[09:33:57:841] : Close Port<<
[09:33:57:841] : Clear
[09:33:57:841] : [COM24] FAIL
[09:33:57:841] : >>NandFlashWrite OEMSBL
[09:33:57:841] : WM_COPYDATA ¸Ţ˝ĂÁö ş¸łż 3 - FLASHING OEMSBL
[09:33:57:844] : ¸Ţ˝ĂÁö ş¸łż ProgreassiveBar Init wParam TYPE_WPARAM_PROGRESSIVE_POS=5 lParam(pos)=0 nResult=0
[09:33:57:844] : FAIL
[09:33:57:844] : Debug Log Start ======================================
[09:33:57:844] : Ram Writing
[09:33:57:844] : NandAddr : 0x00000001, Size : 0
[09:33:57:844] : TargetAddr : 0x00000000
[09:33:57:844] : Debug Log End ========================================
[09:33:57:844] : >> RETRY(1)
[09:33:58:344] : FAIL
[09:33:58:344] : Debug Log Start ======================================
[09:33:58:344] : Ram Writing
[09:33:58:344] : NandAddr : 0x00000001, Size : 0
[09:33:58:344] : TargetAddr : 0x00000000
[09:33:58:344] : Debug Log End ========================================
[09:33:58:344] : >> RETRY(2)
[09:33:58:844] : FAIL
[09:33:58:844] : Debug Log Start ======================================
[09:33:58:844] : Ram Writing
[09:33:58:844] : NandAddr : 0x00000001, Size : 0
[09:33:58:844] : TargetAddr : 0x00000000
[09:33:58:844] : Debug Log End ========================================
[09:33:58:844] : ERROR : NandFlashWrite(OEMSBL)
[09:33:58:844] : TYPE_WPARAM_UPGRADE_ERROR
[09:33:58:844] : ¸Ţ˝ĂÁö ş¸łż - TYPE_WPARAM_UPGRADE_ERROR Error Code = 1010
[09:33:58:904] : Log finished
Click to expand...
Click to collapse
Flash a rom with fastboot and type 'fastboot -w'.
Joost
Boot in download mode and try again
While trying to root my zenfone 6 it bricked.
Now cannot go to recovery mode at all and it stays at USB logo when connected to laptop.
Tried the steps from the following link but stuck half way as it says "windriver error" and so on, even though all drivers were updated.
http://www.asus-zenfone.com/2014/11/how-to-unbrick-zenfone-5-and-zenfone-6_8.html
Please refer to this log file:
xfstklog_Fri_5._Jun_20-14-07_2015.txt
20:13:42 - XFSTK Downloader API 1.5.1 Copyright (c) 2013 Intel Corporation
20:13:42 - fwdnx -- C:/Users/Manivannan/Desktop/Unbrick/dnx.bin
20:13:42 - fwimage -- C:/Users/Manivannan/Desktop/Unbrick/ifwi.bin
20:13:42 - osdnx -- C:/Users/Manivannan/Desktop/Unbrick/dnx_osr.bin
20:13:42 - osimage -- C:/Users/Manivannan/Desktop/Unbrick/fastboot-2.19.img.pos.bin
20:13:42 - gpflags -- 0x80000001
20:13:42 - XFSTK-LOG--USBSN:--virtual bool CloverviewPlusDownloader::SetDevice(IGenericDevice*)
20:13:42 - Initiating download...
20:13:42 - XFSTK-LOG--USBSN:--virtual bool CloverviewPlusDownloader::UpdateTarget()
20:13:42 - XFSTK-LOG--USBSN:--FWDnxPath -- C:/Users/Manivannan/Desktop/Unbrick/dnx.bin
20:13:42 - XFSTK-LOG--USBSN:--FWImagePath -- C:/Users/Manivannan/Desktop/Unbrick/ifwi.bin
20:13:42 - XFSTK-LOG--USBSN:--SoftfusesPath -- BLANK.bin
20:13:42 - XFSTK-LOG--USBSN:--OSDnxPath -- C:/Users/Manivannan/Desktop/Unbrick/dnx_osr.bin
20:13:42 - XFSTK-LOG--USBSN:--OSImagePath -- C:/Users/Manivannan/Desktop/Unbrick/fastboot-2.19.img.pos.bin
20:13:42 - XFSTK-LOG--USBSN:--MiscDnxPath --
20:13:42 - XFSTK-LOG--USBSN:--Gpflags -- 80000001
20:13:42 - XFSTK-LOG--USBSN:--DebugLevel -- ffffffff
20:13:42 - XFSTK-LOG--USBSN:--UsbDelay ms -- 0
20:13:42 - XFSTK-LOG--USBSN:--TransferType -- USB
20:13:42 - XFSTK-LOG--USBSN:--WipeIFWI -- False
20:13:42 - XFSTK-LOG--USBSN:--Idrq -- False
20:13:42 - XFSTK-LOG--USBSN:--Verbose -- True
20:13:42 - XFSTK-LOG--USBSN:--void CloverviewPlusDownloader::Init()
20:13:42 - XFSTK-LOG--USBSN:--Open
20:13:42 - XFSTK-LOG--USBSN:--void CloverviewPlusUtils::SetUsbsn(char*)
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--USB Device found - USBSN: 5B1051DA385AEED4 Address:6
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--void CloverviewPlusDownloader::do_update(CloverviewPlusOptions*)
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Start
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Sending DnER...
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--WriteOutPipe DnER
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--WriteOutPipe 0
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Write --->DnER
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetOpCode
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--ReadInAck
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetAck
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetAck - DORM(0x4)
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--OS: Handle OS download...
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetOpCode
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Changing to DLDR_STATE_OS_NORMAL ...
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--CheckFile
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--CheckFile
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--_num OS Images : 1
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--_temp_data : 67c9
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--OSII: 0 Data Size: 13603328
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--_Temp Data is: 67c9 h
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--InitOsipHdr
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Init OSIP header ...
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--_After fread osip_hdr
20:13:42 - XFSTK-STATUS--USBSN:5B1051DA385AEED4--POS download is in progress ...
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--StartOs
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--sending 6 DWORDS of DnxOS size and checksum...
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetOsDnXHdr
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--C:/Users/Manivannan/Desktop/Unbrick/dnx_osr.bin size:99296 bytes
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--WriteOutPipe à?
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--WriteOutPipe 0
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Write --->à?
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--End of StHandleOsNormal
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetOpCode
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--ReadInAck
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetAck
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetAck - DXBL(0x4)
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--OS: Sending DnX ...
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--OsDXBL
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetOsDnX
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--C:/Users/Manivannan/Desktop/Unbrick/dnx_osr.bin size:99296 bytes
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--WriteOutPipe __BINARY__
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--WriteOutPipe 0
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Write --->__BINARY__
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--LogProgress
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetOpCode
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--ReadInAck
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetAck
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetAck - ROSIP$$$(0x8)
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetOsipHdr
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Get OSIP header + Partion Table...
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--sending OSIP...
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--sending OSIP header + Partion Table...
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--WriteOutPipe __BINARY__
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--WriteOutPipe 0
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Write --->__BINARY__
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetOpCode
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--ReadInAck
20:13:42 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetAck
20:13:47 - XFSTK-LOG--USBSN:5B1051DA385AEED4--usb_bulk_read() fails
20:13:47 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Windriver Error: 0x20000015, Timeout expired
20:13:52 - XFSTK-LOG--USBSN:5B1051DA385AEED4--usb_bulk_read() fails
20:13:52 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Windriver Error: 0x20000015, Timeout expired
20:13:57 - XFSTK-LOG--USBSN:5B1051DA385AEED4--usb_bulk_read() fails
20:13:57 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Windriver Error: 0x20000015, Timeout expired
20:14:02 - XFSTK-LOG--USBSN:5B1051DA385AEED4--usb_bulk_read() fails
20:14:02 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Windriver Error: 0x20000015, Timeout expired
20:14:07 - XFSTK-LOG--USBSN:5B1051DA385AEED4--usb_bulk_read() fails
20:14:07 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Windriver Error: 0x20000015, Timeout expired
20:14:07 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Device is not responding...
20:14:07 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetAck - (0xBAADF00D)
20:14:07 - XFSTK-STATUS--USBSN:5B1051DA385AEED4--Unknown Ack code:baadf00d, aborting ...
20:14:07 - XFSTK-LOG--USBSN:5B1051DA385AEED4--void CloverviewPlusDownloader::do_abort()
20:14:07 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Abort
20:14:07 - XFSTK-STATUS--USBSN:5B1051DA385AEED4--FAIL
20:14:07 - XFSTK-STATUS--USBSN:5B1051DA385AEED4--Errors encounter during OS download. Aborting ...
Please help.
this is better way to do it : http://www.asus.com/zentalk/forum.php?mod=viewthread&tid=3045
---------- Post added at 05:33 PM ---------- Previous post was at 05:31 PM ----------
all need adb , asus zenphone rom
---------- Post added at 05:34 PM ---------- Previous post was at 05:33 PM ----------
also intel usb drive for android
I am stuck at no.5 from the instruction.
From the USB logo I am unable to go to droidboot or recovery when pressing power + vol up.
Going to droidboot is the main issue.
Is there a way to boot the phone usind a SD card or any other means?
press lower volume button at the time of usb logo . ... reply quickly ...!
---------- Post added at 09:25 PM ---------- Previous post was at 09:22 PM ----------
to do all above things you have mentioned you have to enter into bootloader .....!
Regardless of whichever combinations of pressing the vol up/down with power, it is not going to the droidboot.
just connect it with pc and tell me it got detected by pc or not ....! a pop up notification will show that windows is installing device driver .
---------- Post added at 10:52 PM ---------- Previous post was at 10:48 PM ----------
http://www.afterdawn.com/software/desktop/misc_desktop_tools/droid_explorer_64-bit.cfm
try the above sofware
---------- Post added at 10:53 PM ---------- Previous post was at 10:52 PM ----------
its droid explorer
device driver is already installed.
when run xfstk downloader, it detects.
The droid explorer cannot be installed as it is asking to specify path for SDK even though I have specified the right path.
it took me more than 3 hours to research your subject:
following method you should follow : put all those file as according .
https://www.youtube.com/watch?v=jh89aiepcjQ&list=WL&index=20
all drivers and files are associated with video description .
here is link for your xml and other file which you required in making the setup folder :
http://www.mediafire.com/download/3oda9d3la0cqbc5/zenfone6.zip
---------- Post added at 02:32 AM ---------- Previous post was at 02:28 AM ----------
i think your doridboot got corrupted ... go to asus care if its not solving.......!
i am still on my way to find solution for this problem .......! sooner or later i will definitely find it ......!
---------- Post added at 02:45 AM ---------- Previous post was at 02:32 AM ----------
Another method :
https://www.youtube.com/watch?v=acKiTWg77XA
Appreciate your help very much that you are trying your best to help me. Thanks a lot bro.
I have downloaded the exact file shown in the youtube video and did according to the flow.
It is asking for the file recovery.img. I don't know where to get this file from.
see below.
=======================
06/07/15 14:00:06.506 INFO : Manufacturing Flash Tool V 6.0.2 (build on Fri Feb 15 12:04:32 MST 2013)
06/07/15 14:00:06.510 INFO : Loading settings from C:/ProgramData/INTEL/Manufacturing Flash Tool.ini
06/07/15 14:00:06.518 INFO : Using Qt version: 4.8.1
06/07/15 14:00:06.518 INFO : Using XFSTK version: 1.3.6
06/07/15 14:00:06.526 WARNING: Please select a flash file...
06/07/15 14:00:14.138 INFO : Loading Flash file (C:/Users/Manivannan/Desktop/ZenFone 6 Latest 2/ASUS_T00I_WW_4_3_11_UpdateLauncher/UL-ASUS_T00I-WW-4.3.11.0-user/zenfone.xml)
06/07/15 14:00:14.142 ERROR : File C:/Users/Manivannan/Desktop/ZenFone 6 Latest 2/ASUS_T00I_WW_4_3_11_UpdateLauncher/UL-ASUS_T00I-WW-4.3.11.0-user\recovery.img not found
06/07/15 14:00:14.142 ERROR : Error in parsing zenfone.xml file please check the contents of zenfone.xml file!
=======================================
Work around getting interesting. Managed to get something out of nothing but stucked at ifwi flashing. It start flashing until 7% and stopped because ifwi is wrong.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Update: Don't know how to insert the image of flash tool.
Also the log:
==============================================
# Manufacturing Phone Flash Tool Logs generated on 2015-06-07T15:28:04
######################################
#### Flash tries 2 ####
#### Flash failure 2 ####
#### Flash success 0 ####
#### ####
#### Fail IFWI 2 ####
#### Fail ENUM 0 ####
#### Fail Modem 0 ####
#### Fail OS 0 ####
######################################
06/07/15 15:15:47.035 INFO : Manufacturing Flash Tool V 6.0.2 (build on Fri Feb 15 12:04:32 MST 2013)
06/07/15 15:15:47.035 INFO : Loading settings from C:/ProgramData/INTEL/Manufacturing Flash Tool.ini
06/07/15 15:15:47.050 INFO : Using Qt version: 4.8.1
06/07/15 15:15:47.050 INFO : Using XFSTK version: 1.3.6
06/07/15 15:15:47.058 WARNING: Please select a flash file...
06/07/15 15:15:57.764 INFO : Loading Flash file (C:/Users/Manivannan/Desktop/Test ZenFone/zenfone.xml)
06/07/15 15:15:57.764 WARNING: Fail to parse fastboot sequence xml file, now fastboot sequence is restored to default!
06/07/15 15:15:57.764 INFO : Ready to flash!
06/07/15 15:16:11.335 INFO : Port 0/0/6 #0: IFW flash started - SN : 5B1051DA385AEED4
06/07/15 15:16:11.335 INFO : Disabling xFSTK wipe out ifwi option
06/07/15 15:16:11.335 INFO : Disabling xFSTK Misc DnX
06/07/15 15:16:12.355 INFO : Port 0/0/6 #0: XFSTK-STATUS SN: 5B1051DA385AEED4 Unknown Ack code:baadf00d, aborting ...
06/07/15 15:16:12.355 INFO : Port 0/0/6 #0: XFSTK-STATUS SN: 5B1051DA385AEED4 FAIL
06/07/15 15:16:12.355 INFO : Port 0/0/6 #0: XFSTK-STATUS SN: 5B1051DA385AEED4 Errors encounter during download. Aborting...
06/07/15 15:16:12.356 WARNING: Port 0/0/6 #0: Retry IFW Flashing - Serial: 5B1051DA385AEED4
06/07/15 15:16:13.364 WARNING: Port 0/0/6 #0: Retry IFW Flashing - Serial: 5B1051DA385AEED4
06/07/15 15:16:14.380 ERROR : Port 0/0/6 #0: IFW flash failed - SN : 5B1051DA385AEED4
06/07/15 15:16:17.425 INFO : Port 0/0/6 #0: IFW flash started - SN : 5B1051DA385AEED4
06/07/15 15:16:17.425 INFO : Disabling xFSTK wipe out ifwi option
06/07/15 15:16:17.425 INFO : Disabling xFSTK Misc DnX
06/07/15 15:16:17.675 INFO : Port 0/0/6 #0: XFSTK-STATUS SN: 5B1051DA385AEED4 POS download is in progress ...
06/07/15 15:16:17.721 INFO : Port 0/0/6 #0: XFSTK-PROGRESS SN: 5B1051DA385AEED4 4
06/07/15 15:16:42.891 INFO : Port 0/0/6 #0: XFSTK-STATUS SN: 5B1051DA385AEED4 Unknown Ack code:baadf00d, aborting ...
06/07/15 15:16:42.891 INFO : Port 0/0/6 #0: XFSTK-STATUS SN: 5B1051DA385AEED4 FAIL
06/07/15 15:16:42.891 INFO : Port 0/0/6 #0: XFSTK-STATUS SN: 5B1051DA385AEED4 Errors encounter during OS download. Aborting ...
06/07/15 15:16:42.891 WARNING: Port 0/0/6 #0: Retry IFW Flashing - Serial: 5B1051DA385AEED4
06/07/15 15:16:43.906 WARNING: Port 0/0/6 #0: Retry IFW Flashing - Serial: 5B1051DA385AEED4
06/07/15 15:16:44.919 ERROR : Port 0/0/6 #0: IFW flash failed - SN : 5B1051DA385AEED4
==========================================
What I understand from this is need to get the right firmware ifwi etc, etc..it then should be able to flash 100%.
I am going to try all those and will update you accordingly.
whats your firmware sku ...its ww or tw ...!
---------- Post added at 02:23 PM ---------- Previous post was at 02:21 PM ----------
get a fresh jellybean /kitkat firm ware from this site : https://www.asus.com/gr/Phones/ZenFone_6_A601CG/helpdesk_download/
keep in mind that you have to download the proprer sku .......if its tw then try tw or if its ww then try ww
---------- Post added at 02:24 PM ---------- Previous post was at 02:23 PM ----------
you will also get raw firmware from here
---------- Post added at 02:35 PM ---------- Previous post was at 02:24 PM ----------
open the zip of your firmware you will got recovery.img. also a ifwi zip file ....!
I have no luck to proceed beyond 7% from the manuf. flash tool. I have also wrote to the youtube author asking him for help.
My sensing is that the phone can be revived with proper files.
It's TW
The ifwi file name is different (ifwi_ctp_a600cg.bin), where as the author's one is just ifwi.bin. I tried to rename it but that also don't work. Recovery.img is not found in this firmware.
UL-ASUS_T00F-TW-6.3.3.3-user.zip
download V1.18.40.11 for TW SKU from asus site ...its jelly bean ...you will get all the flies required for it.......!
you will found it at firmware section ...!
Author is also working on jellybean firmware ..! so try it .!
Confusion:
Should I add those 5 files, namely, FwDnx, ifwi, osdnx etc.. from the authour or rename those found in the firmware. Either way it can't proceed beyond 7%, meaning ifwi failure.
In addition it is now asking for fastboot.bin when using this firmware. In those latest version it is not asking for fastboot.bin, but fastboot.img.
I can't figure out why this failure occurs.
my examination is tomorrow , so i will unavailable for single day ... !
All the best for your exam!
The youtube author Ashraf's video is showing Zenfone 4 flashing. Since I have problem with all other firmwares, I decided to give a try for the same firmware even though I know it may not work.
To my surprise the ifwi.bin flashing was successful(15%) and asked to reboot. But it did not go to next step because mine is Zenfone 6 with TW SKU while he is using Zenfone 4 with WW SKU.
What I understand from this is my phone hardware is ok but the required files are NOT working working with the right firmware. The important files are:
fwdnx.bin
ifwi.bin
osdnx.bin
recovery.img
splash.bin
cloverview.tlv
signded soft key clak.bin
fastboot.img
zenfone.xml
I don't have knowledge on these files but do know that they are required for bricked zenfone 6 successful flashing. You may want to get in touch with Ashraf also to see how it can be cooked to work on zenfone 6. I have seen lot of them having difficulties with those files uploaded by him in the mediafire. In fact all of them are not working on Manufacturing Flash Tool 6.0.2.
here is solution :
please follow instruction :
download : http://www.mediafire.com/download/daq7x1j5zski7bc/xfstk-downloader-setup-1.5.1.exe
zenfone 6 download this also : https://www.mediafire.com/folder/tk0z4dmhxjfdv/ZenFone6
install xfstk setup ........its around 13 mb .
note: dont try to replace any file on zenfone 6 .
launch xtfstk downloader 1.5.1 .
you have to go : red marked section .
[/url][/IMG]
select files from zenphone 6 section ........
like this :
[/url][/IMG]
fw : dxn.bin
ifwi: ifwi.bin
os dnx : dnx_osr.bin
os image : fastboot-2.19.img.pos.bin
connect phone >> begin download
after the thing is done you can enter into fastboot then follow the first post step i had mentioned.
you must have isoc usb driver : http://www.mediafire.com/download/4gv78qp8hbblhvb/iSocUSB-Driver-Setup-1.0.4.exe
---------- Post added at 01:04 PM ---------- Previous post was at 12:39 PM ----------
if mediafire is not giving permission to download bulk file the download it individually and put them into same namefolder
all the best ......!
I am getting error from 15:43:14 onwards.
Here's the log:
xfstklog_Tue_9._Jun_15-43-34_2015.txt
15:43:09 - XFSTK Downloader API 1.5.1 Copyright (c) 2013 Intel Corporation
15:43:09 - fwdnx -- C:/Users/Manivannan/Desktop/Zen 9/dnx.bin
15:43:09 - fwimage -- C:/Users/Manivannan/Desktop/Zen 9/ifwi.bin
15:43:09 - osdnx -- C:/Users/Manivannan/Desktop/Zen 9/dnx_osr.bin
15:43:09 - osimage -- C:/Users/Manivannan/Desktop/Zen 9/fastboot-2.19.img.pos.bin
15:43:09 - gpflags -- 0x80000001
15:43:09 - XFSTK-LOG--USBSN:--virtual bool CloverviewPlusDownloader::SetDevice(IGenericDevice*)
15:43:09 - Initiating download...
15:43:09 - XFSTK-LOG--USBSN:--virtual bool CloverviewPlusDownloader::UpdateTarget()
15:43:09 - XFSTK-LOG--USBSN:--FWDnxPath -- C:/Users/Manivannan/Desktop/Zen 9/dnx.bin
15:43:09 - XFSTK-LOG--USBSN:--FWImagePath -- C:/Users/Manivannan/Desktop/Zen 9/ifwi.bin
15:43:09 - XFSTK-LOG--USBSN:--SoftfusesPath -- BLANK.bin
15:43:09 - XFSTK-LOG--USBSN:--OSDnxPath -- C:/Users/Manivannan/Desktop/Zen 9/dnx_osr.bin
15:43:09 - XFSTK-LOG--USBSN:--OSImagePath -- C:/Users/Manivannan/Desktop/Zen 9/fastboot-2.19.img.pos.bin
15:43:09 - XFSTK-LOG--USBSN:--MiscDnxPath --
15:43:09 - XFSTK-LOG--USBSN:--Gpflags -- 80000001
15:43:09 - XFSTK-LOG--USBSN:--DebugLevel -- ffffffff
15:43:09 - XFSTK-LOG--USBSN:--UsbDelay ms -- 0
15:43:09 - XFSTK-LOG--USBSN:--TransferType -- USB
15:43:09 - XFSTK-LOG--USBSN:--WipeIFWI -- False
15:43:09 - XFSTK-LOG--USBSN:--Idrq -- False
15:43:09 - XFSTK-LOG--USBSN:--Verbose -- True
15:43:09 - XFSTK-LOG--USBSN:--void CloverviewPlusDownloader::Init()
15:43:09 - XFSTK-LOG--USBSN:--Open
15:43:09 - XFSTK-LOG--USBSN:--void CloverviewPlusUtils::SetUsbsn(char*)
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--USB Device found - USBSN: 5B1051DA385AEED4 Address:6
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--void CloverviewPlusDownloader::do_update(CloverviewPlusOptions*)
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Start
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Sending DnER...
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--WriteOutPipe DnER
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--WriteOutPipe 0
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Write --->DnER
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetOpCode
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--ReadInAck
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetAck
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetAck - DORM(0x4)
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--OS: Handle OS download...
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetOpCode
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Changing to DLDR_STATE_OS_NORMAL ...
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--CheckFile
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--CheckFile
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--_num OS Images : 1
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--_temp_data : 67c9
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--OSII: 0 Data Size: 13603328
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--_Temp Data is: 67c9 h
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--InitOsipHdr
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Init OSIP header ...
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--_After fread osip_hdr
15:43:09 - XFSTK-STATUS--USBSN:5B1051DA385AEED4--POS download is in progress ...
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--StartOs
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--sending 6 DWORDS of DnxOS size and checksum...
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetOsDnXHdr
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--C:/Users/Manivannan/Desktop/Zen 9/dnx_osr.bin size:99296 bytes
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--WriteOutPipe à?
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--WriteOutPipe 0
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Write --->à?
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--End of StHandleOsNormal
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetOpCode
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--ReadInAck
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetAck
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetAck - DXBL(0x4)
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--OS: Sending DnX ...
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--OsDXBL
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetOsDnX
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--C:/Users/Manivannan/Desktop/Zen 9/dnx_osr.bin size:99296 bytes
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--WriteOutPipe __BINARY__
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--WriteOutPipe 0
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Write --->__BINARY__
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--LogProgress
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetOpCode
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--ReadInAck
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetAck
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetAck - ROSIP$$$(0x8)
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetOsipHdr
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Get OSIP header + Partion Table...
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--sending OSIP...
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--sending OSIP header + Partion Table...
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--WriteOutPipe __BINARY__
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--WriteOutPipe 0
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Write --->__BINARY__
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetOpCode
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--ReadInAck
15:43:09 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetAck
15:43:14 - XFSTK-LOG--USBSN:5B1051DA385AEED4--usb_bulk_read() fails
15:43:14 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Windriver Error: 0x20000015, Timeout expired
15:43:19 - XFSTK-LOG--USBSN:5B1051DA385AEED4--usb_bulk_read() fails
15:43:19 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Windriver Error: 0x20000015, Timeout expired
15:43:24 - XFSTK-LOG--USBSN:5B1051DA385AEED4--usb_bulk_read() fails
15:43:24 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Windriver Error: 0x20000015, Timeout expired
15:43:29 - XFSTK-LOG--USBSN:5B1051DA385AEED4--usb_bulk_read() fails
15:43:29 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Windriver Error: 0x20000015, Timeout expired
15:43:34 - XFSTK-LOG--USBSN:5B1051DA385AEED4--usb_bulk_read() fails
15:43:34 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Windriver Error: 0x20000015, Timeout expired
15:43:34 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Device is not responding...
15:43:34 - XFSTK-LOG--USBSN:5B1051DA385AEED4--GetAck - (0xBAADF00D)
15:43:34 - XFSTK-STATUS--USBSN:5B1051DA385AEED4--Unknown Ack code:baadf00d, aborting ...
15:43:34 - XFSTK-LOG--USBSN:5B1051DA385AEED4--void CloverviewPlusDownloader::do_abort()
15:43:34 - XFSTK-LOG--USBSN:5B1051DA385AEED4--Abort
15:43:34 - XFSTK-STATUS--USBSN:5B1051DA385AEED4--FAIL
15:43:34 - XFSTK-STATUS--USBSN:5B1051DA385AEED4--Errors encounter during OS download. Aborting ...
Hello all,
I'm trying to debrick my dead device that has no power/no charging and can't access to the recovery mode.
When I connect the device, windows can detect it as CloverView so I followed some articles here on the forum to debrick it using xfstk. The software starts doing its job then stops at 5% with "Battery power is too low, charging up" message as indicated in the logs
Code:
16:10:27 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--Write --->__BINARY__
16:10:27 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--LogProgress
16:10:27 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--GetOpCode
16:10:27 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--ReadInAck
16:10:27 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--GetAck
16:10:27 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--GetAck - RTBD(0x4)
16:10:27 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--WriteOutPipe DBDS
16:10:27 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--WriteOutPipe 0
16:10:27 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--Write --->DBDS
16:10:27 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--ReadInPipe
16:10:29 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--Read - (4)
16:10:29 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--WriteOutPipe RRBD
16:10:29 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--WriteOutPipe 0
16:10:29 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--Write --->RRBD
16:10:29 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--ReadInPipe
16:10:29 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--Read - BATI(12)
16:10:29 - XFSTK-STATUS--USBSN:DA96A7501C2BDB94--BATI: Battery power is too low, charging up ...
16:10:29 - XFSTK-STATUS--USBSN:DA96A7501C2BDB94--BATI:42415449: Battery voltage: 0x8(0.150785V) The threshold: 0xbf(3.600000V)
16:10:29 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--GetOpCode
16:10:29 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--ReadInAck
16:10:29 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--GetAck
16:10:29 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--GetAck - RTBD(0x4)
16:10:29 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--WriteOutPipe DBDS
16:10:29 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--WriteOutPipe 0
16:10:29 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--Write --->DBDS
16:10:29 - XFSTK-LOG--USBSN:DA96A7501C2BDB94--ReadInPipe
So my question is: is there a way to force xFSTK to ignore the voltage in my battery and force it to continue or is there another solution to this problem
Thanks for your help
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
PixelOS is an AOSP based ROM, with Google apps included and all Pixel goodies (launcher, wallpapers, themed icons, google sans fonts, Monet color based system wide theming, boot animation), a fork of OG Pixel Experience with improvements on the top of it. Huge respect to Pixel Experience team for their work, thanks to them for making this ROM possible.
In short a fully functional Pixel Experience with just the right amount of essentials.
Code:
/* Your warranty is now void.
*
* I am not responsible for bricked devices, dead SD cards,
* thermonuclear war, or you getting fired because the alarm app failed. Please
* do some research if you have any concerns about features included in this ROM
* before flashing it! YOU are choosing to make these modifications, and if
* you point the finger at me for messing up your device, I will laugh at you.
*/
Improvements over PixelExperience
General Enhancements:
Performance improvements from ProtonAOSP
Reduced log spam verbosity
Under the hood optimizations
Optimized UI responsiveness
Flattened apexes for faster access
Pixel Goodies:
System-wide Google Sans font integration
Spoofed Google Photos as Pixel 1XL for unlimited Photos backup in original quality
Pixel spoofing for various pixel exclusives
Smartspace on lockscreen (weather)
UX Improvements:
Material You boot animation
Material You colors on fingerprint authentication ripple animation
Bluetooth battery icon in status bar
Material style 4G/LTE icons
Themed icons for a lot of 3rd party apps
Extended Material You theming to more UI elements
Add/remove Quick Settings tiles with one click
More font size options in 5% steps from 80% to 130%
Additional features:
Various additional Quick Settings tiles (Caffeine, Heads up, Sync, Adaptive Brightness, Ambient display, Always on display, USB tether, Live display, Data Switch)
Optional separate Quick Settings tiles for WiFi and Mobile data
Optional Quick unlock
Pin Scramble layout
Allow removing the screenshots and screenrecords limits for all applications (excluding DRM content)
Allow disabling combined signal icon
Status bar icon manager
Allow hiding gesture navigation bar
Allow toggling screen off FoD for supported devices
Unlinked ring and media notification volumes
In-call vibration customizations
Optional inverted layout for 3-button navigation
Three-fingers-swipe to screenshot
Double-tap/long-press power button to toggle torch
Double-tap to sleep on lockscreen
Double-tap to sleep on statusbar
Double tap to trigger doze
Volume button long-press media controls
Allow disabling screenshot shutter sound
First-class implementation of Repainter app to allow for rootless theming
Device-Specific Issues:
You tell me
Requirements
MIUI V13.0.2.0 Firmware base
Downloads
Get the latest PixelOS Build for Mi Note 10 Lite Download
Firmware https://xiaomifirmwareupdater.com/firmware/toco/stable/V13.0.2.0.SFNMIXM/
TWRP Recovery TWRP for Android 13
OrangeFox Recovery OrangeFox for Android 13
Note: GApps are included, don't flash separately.
Notes
• Encryption is enabled by default
• SELinux is enforcing
• VantomKernel v4.14.295 included
Flashing Instructions
Clean flash (coming from a different ROM):
• Reboot to recovery
• Flash MIUI 13.0.2.0 global stable firmware (link above)
• Flash ROM zip
• Format data (if encrypted)
• Reboot and voila!
Updating to a newer build (dirty flash):
• Flash ROM zip
• Wipe cache and dalvik (optional, recommended)
• Reboot and voila!
Join our Telegram Group https://t.me/PixelOSChat
Buy me a Coffee https://paypal.me/ahq254
Source Code
PixelOS: http://github.com/PixelOS-Pixelish
Device Tree and Vendor Tree: https://github.com/PixelOS-Devices
Kernel Tree: https://github.com/vantoman/kernel_xiaomi_sm6150
ROM OS Version: Android 13.0
ROM Kernel: Linux 4.14.x
Stable Release Date: 20 October 2022
Latest Release Date: 20 October 2022
Source Changelog
Merged August Security Patch
Introduced Quick unlock
Added an option to scramble pin layout when unlocking
Added an option to hide power menu on secure lockscreen
Allow user configurable fingerprint wake and unlock
Fixed an issue where vibration intensity would reset on some devices
Fixed volume panel background color in light mode
Restored default Pixel font behavior
Enable strict standby policy
Rework screen off FOD
AppLock improvements
Updated translations
hello dear,
can double tap to wake and double tap to sleep be implemented like in the MIUI?
Hi, cant make a phonecall with any dailer. no crash reports, its just shuts down. Had the same problem after a updated the Elixir rom. Then flashed the stock 13.0.2 rom and tried this rom, same problem.
Sigge2099 said:
Hi, cant make a phonecall with any dailer. no crash reports, its just shuts down. Had the same problem after a updated the Elixir rom. Then flashed the stock 13.0.2 rom and tried this rom, same problem.
Click to expand...
Click to collapse
Same for me. Is there Any Solution? Incoming Calls are also not possible. I have followed the Update Instructions on the First Page.
DarkEmotions said:
Same for me. Is there Any Solution? Incoming Calls are also not possible. I have followed the Update Instructions on the First Page.
Click to expand...
Click to collapse
I turned off VOLTE and now the calls are working
Sigge2099 said:
Hi, cant make a phonecall with any dailer. no crash reports, its just shuts down. Had the same problem after a updated the Elixir rom. Then flashed the stock 13.0.2 rom and tried this rom, same problem.
Click to expand...
Click to collapse
Could solve the Problem. Switch Off Volte for the SIM. After that it worked in my Case.
merhaba
öncelikle romlar için teşekkür ederim oğlu yayınlamış romu yüklüyorum ama çift hatta internet aktif oluyorken yapılıyor ve arayanada meşgül uyarısı veriyor
teşekkürler
Perfect ROM, stable and fast ! Thx, AndroidHQ254
Of the rom problems:
- automatic adjustment of the screen backlight: in low light it will change several times in 10 seconds
Awesome thanks a lot!!!
Partizanos said:
Perfect ROM, stable and fast ! Thx, AndroidHQ254
Of the rom problems:
- automatic adjustment of the screen backlight: in low light it will change several times in 10 seconds
Click to expand...
Click to collapse
See the solution from this thread:
> Adaptive brightness fix (Updated on 09/07/2020) @AndroidHQ254 - copy to /system/overlay/ folder and set rw-r-r permisions
devnoname120 said:
See the solution from this thread:
> Adaptive brightness fix (Updated on 09/07/2020) @AndroidHQ254 - copy to /system/overlay/ folder and set rw-r-r permisions
Click to expand...
Click to collapse
I didn't find such path (/system/overlay/) in android 13, twrp filemanager
Partizanos said:
I didn't find such path (/system/overlay/) in android 13, twrp filemanager
Click to expand...
Click to collapse
Maybe /system/product/overlay or /system/vendor/overlay?
Not that I haven't tried this and I have no idea what's the difference in the paths
Can I install with miui 13 eu
How is the battery life like compared to AOSP?
Can someone tell me how to solve the problem with non-working VoLTE - the call is disconnected when trying to establish a connection. Below is the call log ("adb logcat -d") with VoLTE enabled.
The phone is registered on sip server :
Code:
11-01 23:51:21.223 14477 14503 I QImsService: ImsSenderRxr : [0009]< REQUEST_IMS_REGISTRATION_STATE ImsRegistrationInfo state: 1 errorCode: 0 errorMessage: radioTech: 14 pAssociatedUrissip:+37529*******@@ims.mnc002.mcc257.3gppnetwork.org|sip:+37529*******@ims.mnc002.mcc257.3gppnetwork.org;user=phone[SUB1]
11-01 23:51:21.223 14477 14477 I QImsService: ImsRegistrationController : Message received: what = 4
11-01 23:51:21.223 14477 14477 I QImsService: ImsRegistrationController : handleImsStateChanged
11-01 23:51:21.223 1075 14554 D C2Store : Using ION
11-01 23:51:21.223 14477 14532 D ImsFeature: ImsFeature notifyCapabilitiesStatusChanged Capabilities = 11
11-01 23:51:21.223 14477 14532 D ImsFeature: ImsFeature notifyCapabilitiesStatusChanged Capabilities = 11
11-01 23:51:21.224 14477 14477 I QImsService: ImsServiceSub : [1] VOLTE ims registered, WFC change to Not registered
Next comes a series of errors in QImsService:
Code:
11-01 23:51:21.227 14477 14503 I QImsService: IFRequest : [0008]< REQUEST_SET_IMS_CONFIG error: 2
11-01 23:51:21.228 14477 14477 I QImsService: ImsServiceSub : [1] sendBroadcastForDisconnected
11-01 23:51:21.229 14477 14503 I QImsService: ImsRadioResponseHidl : Got setUiTTYModeResponse from ImsRadio error 0
11-01 23:51:21.229 14477 14503 I QImsService: ImsSenderRxr : [0010]< REQUEST_SEND_UI_TTY_MODE [SUB1]
11-01 23:51:21.230 14477 14477 I QImsService: ImsSenderRxr : [0011]> REQUEST_QUERY_SERVICE_STATUS [SUB1]
11-01 23:51:21.230 14477 14477 I QImsService: ImsRegistrationController : updateSelfIdentityUriCache :: new self-identity host URI=[b127144240284c5f924d931c11d5c46241c3b85c]
11-01 23:51:21.231 14477 14477 I QImsService: ImsRegistrationController : updateSelfIdentityUriCache :: new self-identity host URI=[04f813fc17b136c456050a5b6da89a5d3298c9ef]
11-01 23:51:21.231 14477 14477 I QImsService: ImsServiceSubHandler : Message received: what = 39
11-01 23:51:21.231 14477 14477 E QImsService: ImsServiceSub : [1] IMS Service auto reject update failed!org.codeaurora.ims.ImsRilException: E_GENERIC_FAILURE
11-01 23:51:21.231 14477 14477 I QImsService: ImsServiceSubHandler : Message received: what = 40
11-01 23:51:21.231 14477 14477 E QImsService: ImsServiceSub : [1] Failed to send result java.lang.NullPointerException: Attempt to read from field 'android.os.Messenger android.os.Message.replyTo' on a null object reference in method 'void org.codeaurora.ims.ImsServiceSub$ImsServiceSubHandler.handleMessage(android.os.Message)'
11-01 23:51:21.234 1115 14559 D SimpleC2Component: Using output block pool with poolID 36 => got 36 - 0
11-01 23:51:21.239 14477 14503 I QImsService: ImsRadioResponseHidl : queryServiceStatusResponse_1_6()
11-01 23:51:21.239 14477 14503 I QImsService: Class : Num of SrvUpdates = 6
11-01 23:51:21.239 14477 14503 I QImsService: Class : networkMode = 14 status = 2 restrictCause = 0 registered = 1
11-01 23:51:21.239 14477 14503 I QImsService: Class : Partially Enabled Status due to Restrict Cause
REQUEST_QUERY_SERVICE_STATUS error: 2
And call it turns off by timeout.
In attachment full logcat call log.
Thx.
Partizanos said:
I turned off VOLTE and now the calls are working
Click to expand...
Click to collapse
A fix will come in the next update without the need to turn off volte
Partizanos said:
Can someone tell me how to solve the problem with non-working VoLTE - the call is disconnected when trying to establish a connection. Below is the call log ("adb logcat -d") with VoLTE enabled.
The phone is registered on sip server :
View attachment 5749797
Code:
11-01 23:51:21.223 14477 14503 I QImsService: ImsSenderRxr : [0009]< REQUEST_IMS_REGISTRATION_STATE ImsRegistrationInfo state: 1 errorCode: 0 errorMessage: radioTech: 14 pAssociatedUrissip:+37529*******@@ims.mnc002.mcc257.3gppnetwork.org|sip:+37529*******@ims.mnc002.mcc257.3gppnetwork.org;user=phone[SUB1]
11-01 23:51:21.223 14477 14477 I QImsService: ImsRegistrationController : Message received: what = 4
11-01 23:51:21.223 14477 14477 I QImsService: ImsRegistrationController : handleImsStateChanged
11-01 23:51:21.223 1075 14554 D C2Store : Using ION
11-01 23:51:21.223 14477 14532 D ImsFeature: ImsFeature notifyCapabilitiesStatusChanged Capabilities = 11
11-01 23:51:21.223 14477 14532 D ImsFeature: ImsFeature notifyCapabilitiesStatusChanged Capabilities = 11
11-01 23:51:21.224 14477 14477 I QImsService: ImsServiceSub : [1] VOLTE ims registered, WFC change to Not registered
Next comes a series of errors in QImsService:
Code:
11-01 23:51:21.227 14477 14503 I QImsService: IFRequest : [0008]< REQUEST_SET_IMS_CONFIG error: 2
11-01 23:51:21.228 14477 14477 I QImsService: ImsServiceSub : [1] sendBroadcastForDisconnected
11-01 23:51:21.229 14477 14503 I QImsService: ImsRadioResponseHidl : Got setUiTTYModeResponse from ImsRadio error 0
11-01 23:51:21.229 14477 14503 I QImsService: ImsSenderRxr : [0010]< REQUEST_SEND_UI_TTY_MODE [SUB1]
11-01 23:51:21.230 14477 14477 I QImsService: ImsSenderRxr : [0011]> REQUEST_QUERY_SERVICE_STATUS [SUB1]
11-01 23:51:21.230 14477 14477 I QImsService: ImsRegistrationController : updateSelfIdentityUriCache :: new self-identity host URI=[b127144240284c5f924d931c11d5c46241c3b85c]
11-01 23:51:21.231 14477 14477 I QImsService: ImsRegistrationController : updateSelfIdentityUriCache :: new self-identity host URI=[04f813fc17b136c456050a5b6da89a5d3298c9ef]
11-01 23:51:21.231 14477 14477 I QImsService: ImsServiceSubHandler : Message received: what = 39
11-01 23:51:21.231 14477 14477 E QImsService: ImsServiceSub : [1] IMS Service auto reject update failed!org.codeaurora.ims.ImsRilException: E_GENERIC_FAILURE
11-01 23:51:21.231 14477 14477 I QImsService: ImsServiceSubHandler : Message received: what = 40
11-01 23:51:21.231 14477 14477 E QImsService: ImsServiceSub : [1] Failed to send result java.lang.NullPointerException: Attempt to read from field 'android.os.Messenger android.os.Message.replyTo' on a null object reference in method 'void org.codeaurora.ims.ImsServiceSub$ImsServiceSubHandler.handleMessage(android.os.Message)'
11-01 23:51:21.234 1115 14559 D SimpleC2Component: Using output block pool with poolID 36 => got 36 - 0
11-01 23:51:21.239 14477 14503 I QImsService: ImsRadioResponseHidl : queryServiceStatusResponse_1_6()
11-01 23:51:21.239 14477 14503 I QImsService: Class : Num of SrvUpdates = 6
11-01 23:51:21.239 14477 14503 I QImsService: Class : networkMode = 14 status = 2 restrictCause = 0 registered = 1
11-01 23:51:21.239 14477 14503 I QImsService: Class : Partially Enabled Status due to Restrict Cause
REQUEST_QUERY_SERVICE_STATUS error: 2
And call it turns off by timeout.
In attachment full logcat call log.
Thx.
Click to expand...
Click to collapse
Fixed in the next build release. Just be patient
If the solution to the problem with VoLTE is fixed in git repo, I will be glad if you add a link to the commit to this topic - it's interesting to know what the changes will be. Thx
Partizanos said:
If the solution to the problem with VoLTE is fixed in git repo, I will be glad if you add a link to the commit to this topic - it's interesting to know what the changes will be. Thx
Click to expand...
Click to collapse
The fix involves using the latest codeaurora telephony stuff since our vendor blobs are updated to be at per with lineageos one. The one from PixelOS has not merged the latest QSSI tag