Database Develop

NVflash stuck on 'waiting for bootloader to initialize'

Hi Team,
MY lg 2X is bricked as hell, doesnt respond to anything, no boot logo at all, doesn't seem NVflahable, when i follow PaulOBrien's guide i get a hang at waiting for bootloader to initialize.
Code:
C:\flash\2x\2x-v10b-1300166062-nvflash>.\nvflash.exe --bct E1108_Hynix_512MB_H8T
BR00U0MLR-0DM_300MHz_final_emmc_x8.bct --setbct --odmdata 0xC8000 --configfile a
ndroid_fastboot_emmc_full.cfg --create --bl fastboot.bin --go
Nvflash started
rcm version 0X20001
System Information:
chip name: unknown
chip id: 0x20 major: 1 minor: 3
chip sku: 0xf
chip uid: 0x0280408540c07457
macrovision: disabled
hdcp: enabled
sbk burned: false
dk burned: false
boot device: emmc
operating mode: 3
device config strap: 0
device config fuse: 17
sdram config strap: 0
sending file: E1108_Hynix_512MB_H8TBR00U0MLR-0DM_300MHz_final_emmc_x8.bct
- 4080/4080 bytes sent
E1108_Hynix_512MB_H8TBR00U0MLR-0DM_300MHz_final_emmc_x8.bct sent successfully
odm data: 0xc8000
downloading bootloader -- load address: 0x108000 entry point: 0x108000
sending file: fastboot.bin
/ 1024992/1024992 bytes sent
fastboot.bin sent successfully
waiting for bootloader to initialize
This is as far as i get, is there a physical error on the phone or am i doing something wrong?
Any help would be greatly appreciated.

Try maliacrete thread dated 6/5/11 title big mess up after update. I tried it and it surprisingly work. Inatruction was in german tho..but np..google chrome can solvr the language issue. But beware..you'll end up with a brand new fone..
Newbie on the block.

Sadly the LG is not recognized by smartflash whatsoever.
Plugging the phone in while holding voldown yields no results, nothing on screen and nothing smartflash can see.
is the phone irreversibly bricked?

Have you change/swap the usb port as well like robbie said in the instruction? What i did was..i change the port, it still didnt recognise, the only thing pop up was lg logo..then i kind of give up and stop holding the vol key.
(Make sure u r on the 'ROM copy D/L' smartflash tab)
Now try the step again untill you see the lg logo (make sure batt off), then let go vol down key, then re-press the key..by now..the S/W loading pict should be seen n smartflash must be able to detect ur 2x n will fill the blank. Now press start on the smartflash, sit back n let the rest done by smartflash. Once complete, unplug, batt in, and restart as normal. A new born 2X should be ready to see what lies ahead of him/her..
Im still trying to recover all my setting, data n app manually. Btw..dont forget to bckup after cwm.

xxsacra said:
Sadly the LG is not recognized by smartflash whatsoever.
Plugging the phone in while holding voldown yields no results, nothing on screen and nothing smartflash can see.
is the phone irreversibly bricked?
Click to expand...
Click to collapse
Hade the same problemen. I just installed the drivers in my laptop and then it worked. I cant do a nvflash with my desktop but works like a charm on my laptop. Try another pc.
Sent from my LG-P990 using XDA App

Did you figure it out?
xxsacra said:
Hi Team,
MY lg 2X is bricked as hell, doesnt respond to anything, no boot logo at all, doesn't seem NVflahable, when i follow PaulOBrien's guide i get a hang at waiting for bootloader to initialize.
Code:
C:\flash\2x\2x-v10b-1300166062-nvflash>.\nvflash.exe --bct E1108_Hynix_512MB_H8T
BR00U0MLR-0DM_300MHz_final_emmc_x8.bct --setbct --odmdata 0xC8000 --configfile a
ndroid_fastboot_emmc_full.cfg --create --bl fastboot.bin --go
Nvflash started
rcm version 0X20001
System Information:
chip name: unknown
chip id: 0x20 major: 1 minor: 3
chip sku: 0xf
chip uid: 0x0280408540c07457
macrovision: disabled
hdcp: enabled
sbk burned: false
dk burned: false
boot device: emmc
operating mode: 3
device config strap: 0
device config fuse: 17
sdram config strap: 0
sending file: E1108_Hynix_512MB_H8TBR00U0MLR-0DM_300MHz_final_emmc_x8.bct
- 4080/4080 bytes sent
E1108_Hynix_512MB_H8TBR00U0MLR-0DM_300MHz_final_emmc_x8.bct sent successfully
odm data: 0xc8000
downloading bootloader -- load address: 0x108000 entry point: 0x108000
sending file: fastboot.bin
/ 1024992/1024992 bytes sent
fastboot.bin sent successfully
waiting for bootloader to initialize
This is as far as i get, is there a physical error on the phone or am i doing something wrong?
Any help would be greatly appreciated.
Click to expand...
Click to collapse
I have the same problem. Where you able to get it going?

I have the same problem too. I did what he suggested ... I tried on another pc and it worked! Thanks K.D.M.! :good:

It's the nvflash driver...need to be installed manually

Optimus 2X Brick

Hello, i think my Optimus 2x is bricked. I flashed a wrong ROM and it would "freeze" at the LG logo. So I followed a guide that said would flash the phone to stock with NVflash. Anyway the guide said that I should go back to EXT3 FIRST before flashing but I forgot and now the phone won't even boot. Nothing happens when trying to turn it on. However my PC still sees APX/Nvidia recovery whatever when i plug it in.
Help.

If you download the nvflash kit from modaco by Paul, it will flash v10d on your phone. It creates the partitions and does not require ext3 or any specific format. It has always worked for me. I am not on my PC and hence cannot give you the link. Remember, remove battery and plug USB cable with both, I repeat both volume up and down pressed down to get into nvflash mode.

hackworks said:
If you download the nvflash kit from modaco by Paul, it will flash v10d on your phone. It creates the partitions and does not require ext3 or any specific format. It has always worked for me. I am not on my PC and hence cannot give you the link. Remember, remove battery and plug USB cable with both, I repeat both volume up and down pressed down to get into nvflash mode.
Click to expand...
Click to collapse
It doesn't work. The phone doesn't enter NVflash mode(the screen stays black). It's strange though that my PC still sees it.
I tried this http://forum.xda-developers.com/showthread.php?t=1229407 this is what i get:
Please pick a recovery, or exit [1,2,X]?1
Attempting to flash internal recovery...
Nvflash started
rcm version 0X20001
System Information:
chip name: unknown
chip id: 0x20 major: 1 minor: 3
chip sku: 0xf
chip uid: 0x033c2087415ff597
macrovision: disabled
hdcp: enabled
sbk burned: false
dk burned: false
boot device: emmc
operating mode: 3
device config strap: 0
device config fuse: 17
sdram config strap: 0
downloading bootloader -- load address: 0x108000 entry point: 0x108000
download command failed NvError 0x120002
command failure: bootloader download failed (bad data)
bootloader status: Bct file not found (code: 21) message: flags: 1073840124
I'll try to find that nvflash kit...
But if that doesn't work either... ??

Still stays black? If I remember rightly, with NVFlash.. you remove the battery, Hold down some buttons (MAKE SURE YOU ARE HOLDING DOWN THE RIGHT ONES as per pauls/rustys instructions) plug in the phone, then have to install the drivers. The screen will stay black.
You then run NVFlash itself.

Scougar said:
Still stays black? If I remember rightly, with NVFlash.. you remove the battery, Hold down some buttons (MAKE SURE YOU ARE HOLDING DOWN THE RIGHT ONES as per pauls/rustys instructions) plug in the phone, then have to install the drivers. The screen will stay black.
You then run NVFlash itself.
Click to expand...
Click to collapse
Do you have a link to pauls/rustys instructions and thread?

Have you tried smartflash tool? It have always solve my problems.
You can find instructions here http://forum.xda-developers.com/showthread.php?t=1008070
In dev section is a thread with firmawares to download to flash. If the links are dead, google for some, you will find it somewhere on the net.

Memhis said:
Have you tried smartflash tool? It have always solve my problems.
You can find instructions here http://forum.xda-developers.com/showthread.php?t=1008070
In dev section is a thread with firmawares to download to flash. If the links are dead, google for some, you will find it somewhere on the net.
Click to expand...
Click to collapse
It doesn't work. My phone seems to be stuck in APX mode. Doesn't matter what I do, if i plug it Windows says APX. There has to be a way! But the phone doesn't react to any buttons, whatever I hold, or do, it's still in APX mode and dead.

plig in your tel in nvflash mode and go to menage\device menager and unistal nvidia drivers for apx , reinstal lg usb driver with new and istall again nvidia usb driver (APX) and flash stock rom via nvflash method ....

Any luck?
xalix said:
plig in your tel in nvflash mode and go to menage\device menager and unistal nvidia drivers for apx , reinstal lg usb driver with new and istall again nvidia usb driver (APX) and flash stock rom via nvflash method ....
Click to expand...
Click to collapse
itsanden said:
Hello, i think my Optimus 2x is bricked. I flashed a wrong ROM and it would "freeze" at the LG logo. So I followed a guide that said would flash the phone to stock with NVflash. Anyway the guide said that I should go back to EXT3 FIRST before flashing but I forgot and now the phone won't even boot. Nothing happens when trying to turn it on. However my PC still sees APX/Nvidia recovery whatever when i plug it in.
Help.
Click to expand...
Click to collapse
Hi there,
Did you have any luck getting your p990 out of this state? same happened to mine and I don't know what else to do!?
Thanks!
EDIT:
This is what rusty's NVFlash gives me (which actually is the same problem as for itsanden's code.):
(I don't know how to copy the text from the NVFlash by modaco, since the window closes automaticaly)
"
-------------------------------
Russ' NVFlash Recovery Flasher
1. CWM 4.0.1.5 Internal
2. CWM 4.0.1.5 External
X. Exit
-------------------------------
Please pick a recovery, or exit [1,2,X]?2
Attempting to flash external recovery...
Nvflash started
rcm version 0X20001
System Information:
chip name: unknown
chip id: 0x20 major: 1 minor: 3
chip sku: 0xf
chip uid: 0x028841484180d657
macrovision: disabled
hdcp: enabled
sbk burned: false
dk burned: false
boot device: emmc
operating mode: 3
device config strap: 0
device config fuse: 17
sdram config strap: 0
downloading bootloader -- load address: 0x108000 entry point: 0x108000
download command failed NvError 0x120002
command failure: bootloader download failed (bad data)
bootloader status: Bct file not found (code: 21) message: flags: 1073840124
-------------------------------
Program will now exit
"

You need to access at least your cwm recovery to flash stock v20q then reset to factory reset or hard format
Sent from my Optimus 2X using xda premium

mdjpinto said:
Hi there,
Did you have any luck getting your p990 out of this state? same happened to mine and I don't know what else to do!?
Thanks!
EDIT:
This is what rusty's NVFlash gives me (which actually is the same problem as for itsanden's code.):
(I don't know how to copy the text from the NVFlash by modaco, since the window closes automaticaly)
"
-------------------------------
Russ' NVFlash Recovery Flasher
1. CWM 4.0.1.5 Internal
2. CWM 4.0.1.5 External
X. Exit
-------------------------------
Please pick a recovery, or exit [1,2,X]?2
Attempting to flash external recovery...
Nvflash started
rcm version 0X20001
System Information:
chip name: unknown
chip id: 0x20 major: 1 minor: 3
chip sku: 0xf
chip uid: 0x028841484180d657
macrovision: disabled
hdcp: enabled
sbk burned: false
dk burned: false
boot device: emmc
operating mode: 3
device config strap: 0
device config fuse: 17
sdram config strap: 0
downloading bootloader -- load address: 0x108000 entry point: 0x108000
download command failed NvError 0x120002
command failure: bootloader download failed (bad data)
bootloader status: Bct file not found (code: 21) message: flags: 1073840124
-------------------------------
Program will now exit
"
Click to expand...
Click to collapse
Firstly try to flash a baseband (I suggest 208 v10b, or the latest v20s' one), then go with nvflash..

grimmyrippy said:
You need to access at least your cwm recovery to flash stock v20q then reset to factory reset or hard format
Sent from my Optimus 2X using xda premium
Click to expand...
Click to collapse
That would b straight forward if I could turn on my phone. NVFlash Recovery doesn't fix as well, despite running and detecting the phone.
The only way it responds is the APX on windows. I've tried NVFlashing it to restore the rom to 2.2 but it gives me an error when transferring System.img
This it what i got from cmd:
C:\Users\Dinis\Desktop\desktop\android\Emergency>. \nvflash.exe --bct E1108_Hynix
_512MB_H8TBR00U0MLR-0DM_300MHz_final_emmc_x8.bct --setbct --odmdata 0xC8000 --co
nfigfile android_fastboot_emmc_full.cfg --create --bl fastboot.bin --go
Nvflash started
rcm version 0X20001
System Information:
chip name: unknown
chip id: 0x20 major: 1 minor: 3
chip sku: 0xf
chip uid: 0x028841484180d657
macrovision: disabled
hdcp: enabled
sbk burned: false
dk burned: false
boot device: emmc
operating mode: 3
device config strap: 0
device config fuse: 17
sdram config strap: 0
sending file: E1108_Hynix_512MB_H8TBR00U0MLR-0DM_300MHz_final_emmc_x8.bct
- 4080/4080 bytes sent
E1108_Hynix_512MB_H8TBR00U0MLR-0DM_300MHz_final_emmc_x8.bct sent successfully
odm data: 0xc8000
downloading bootloader -- load address: 0x108000 entry point: 0x108000
sending file: fastboot.bin
/ 1024992/1024992 bytes sent
fastboot.bin sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
setting device: 2 3
creating partition: BCT
creating partition: PT
creating partition: EBT
creating partition: MBR
creating partition: APP
creating partition: CAC
creating partition: MSC
creating partition: EB1
creating partition: LNX
creating partition: EB2
creating partition: DRM
creating partition: EB3
creating partition: SOS
creating partition: EB4
creating partition: UDA
creating partition: EB5
creating partition: UDB
Formatting partition 2 BCT please wait.. done!
Formatting partition 3 PT please wait.. done!
Formatting partition 4 EBT please wait.. done!
Formatting partition 5 MBR please wait.. done!
Formatting partition 6 APP please wait.. done!
Formatting partition 7 CAC please wait.. done!
Formatting partition 8 MSC please wait.. done!
Formatting partition 9 EB1 please wait.. done!
Formatting partition 10 LNX please wait.. done!
Formatting partition 11 EB2 please wait.. done!
Formatting partition 12 DRM please wait.. done!
Formatting partition 13 EB3 please wait.. done!
Formatting partition 14 SOS please wait.. done!
Formatting partition 15 EB4 please wait.. done!
Formatting partition 16 UDA please wait.. done!
Formatting partition 17 EB5 please wait.. done!
Formatting partition 18 UDB please wait.. done!
done!
sending file: fastboot.bin
/ 1024992/1024992 bytes sent
fastboot.bin sent successfully
sending file: system.img
- 851968/358400000 bytes sentdata send failed NvError 0x120002
command failure: create failed (bad data)
---------- Post added at 08:52 AM ---------- Previous post was at 08:47 AM ----------
markop90 said:
Firstly try to flash a baseband (I suggest 208 v10b, or the latest v20s' one), then go with nvflash..
Click to expand...
Click to collapse
Is there a way to do that without SmartFlashTool? because if my phone is stuck in APX smartflash won't detect! I have multiple bb ready to flash but i can't do it with smartflash.
Thanks though!

It could be an hw problem.. maybe nand is damaged..
Inviato dal mio Optimus 2X

Byteater said:
It could be an hw problem.. maybe nand is damaged..
Inviato dal mio Optimus 2X
Click to expand...
Click to collapse
(probably noob question) what is nand?

mdjpinto said:
(probably noob question) what is nand?
Click to expand...
Click to collapse
It includes the main partition ("/", where system files are located) and the internal storage
Inviato dal mio Optimus 2X

hELLO.
I bricked my phone 2 days ago.
only one thing worked for me
http://forum.xda-developers.com/showthread.php?t=1715272
NV Flash Homero Rom.
(If you got some problem to fdownload the roms concerned, even part 1 of the rom works by itself)
No battery in your phone. button Volume - and volume +. nothing appears on the phone when you plug it, but it is good to flash with nvflash.
Enjoy and thanks to Homero.

Aggree.
I got mine totally black, no sparks when I plugged the charger. Using google I found a similar case which lead me to use nvflash.
First thing I did was make sure that my win7 can recognize nvidia chip.
Next I downloaded some nvflash packages, which consist stock rom. ( some of packages provided w/ .bat file. Many of them can‘t be used on mine ).( watch out for antivirus responses )
Now I got froyo back on my 2x.
Sent from my LG-P990 using xda app-developers app

Hi, can you guys think of a reason why neither a Win7(64 bit) nor Vista(64 bit) PC wouldn't recognise the phone in NVfalsh mode as an APX device? I was able to do it a while ago but I think back then I was running XP(32 bit). I've read that (64 bit) machines struggle sometimes with the NVFlash process but I thought I'd be able to get my system to recognise the APX device. I really need to flash a clean rom as CM10 is going berserk on my phone. Keep getting BSODs and in general the device feels sluggish most of the time. Any advice?

bedevil99 said:
Hi, can you guys think of a reason why neither a Win7(64 bit) nor Vista(64 bit) PC wouldn't recognise the phone in NVfalsh mode as an APX device? I was able to do it a while ago but I think back then I was running XP(32 bit). I've read that (64 bit) machines struggle sometimes with the NVFlash process but I thought I'd be able to get my system to recognise the APX device. I really need to flash a clean rom as CM10 is going berserk on my phone. Keep getting BSODs and in general the device feels sluggish most of the time. Any advice?
Click to expand...
Click to collapse
try this method
http://forum.xda-developers.com/showthread.php?t=2007325
there is a problem in win7 x64 (or 8 x64) with driver signature sometimes... so try to add the apx drivers manually from device manager...

Thanks for your help mate, I'll give this a go
Sent from my LG-P990 using xda app-developers app

[Q] Unable to unbrick my bricked phone

Dear People,
I have a problem with my LG P990. It keep hanging on the LG logo with a blue bar under it. I searched the symptons and I found out it is bricked.
This happend after i hard resetted my rooted phone. I tried the following things:
1. I have tried to use Smartflash but my PC wasn't able to recognize my phone when I plugged it in while holding the Volume Down button. I installed different drivers. The ones that were provided by a website and the drivers from the LG Support website.
2. I tried to use AIO toolkit but I get the following error I couldn't find any solutions for on the internet:
======================================
The phone will display a S/W download.. screen,
while the command-window will inform you of the progress.
Nvflash started
rcm version 0X20001
System Information:
chip name: unknown
chip id: 0x20 major: 1 minor: 4
chip sku: 0xf
chip uid: 0x0a7c818341ff2117
macrovision: disabled
hdcp: enabled
sbk burned: false
dk burned: false
boot device: emmc
operating mode: 3
device config strap: 0
device config fuse: 17
sdram config strap: 0
downloading bootloader -- load address: 0x108000 entry point: 0x108000
sending file: fastboot.bin
/ 1027184/1027184 bytes sent
fastboot.bin sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
Succesfully updated partition table information to C:\Users\R...
\Temp\partitions.txt
Checking partition layout...Current Partition Layout could not be detected
Operation aborted
Press any key to return to main menu
I have Windows 8.1 but also tested these 2 methods on a Windows 7 PC.
I read about another method from one of the XDA members called ProgMaq but every download gives a 404 Not Found message or my browers warns me to not go to the website because it is not safe.
What can I do to unbrick my phone?

You should try to change bootloader and follow the instructions in aio

Change SD Card file system?

Maybe a working nvflash method

Maybe I am late by 3 years, but I got my hands on a zip file from LG called "P880 nvFlash tool(Recovery tool).zip".
It may can unbrick phones which happend to end up in APX (nvflash) mode.
There are two 2 type of bat files in it. 1 uses the regular nvlfash command like for optimus 2x and the other uses a blob file and also uses an encrypted bootloader and bct file.
My advice is to use the bat files from the "Final" folder if it's happen to work as it flashes the system.img boot.img and recovery.img too.
Here is the download link
And an image of the content
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

Hopeful signs
Never too late to post useful tools. I know I'd be a lot braver in experimenting if I knew I could recover from any possible screwup, and that is pretty much what this looks like.
I don't have windows and apparently didn't find the right nvflash executable for linux, but I came close. I am being very cautious and tried the minimal nvflash command I could think of, the --wait command, figuring it would be hard for THAT to hose me. Apparently it didn't but it also didn't quite work either.
Code:
# ./nvflash --blob blob.bin -w
Nvflash v1.13.87205 started
Using blob v1.1.57813
chip uid from BR is: 0x0000000000000000015d262e30281402
rcm version 0X30001
unknown bootrom version NvError 0x0
# ./nvflash -r --blob blob.bin --go
Nvflash v1.13.87205 started
[resume mode]
Using blob v1.1.57813
command failure: go failed
Considering that normally nvflash does absolutely nothing this tells me these files really do have the crypto 'mojo' for talking to the phone. So once I find a newer nvflash I'll play some more and report.
Update: That Chip uid matches the USB serial number so that proves beyond a doubt that nvflash is successfully communicating with the crypto enabled.

jmorris_42 said:
Never too late to post useful tools. I know I'd be a lot braver in experimenting if I knew I could recover from any possible screwup, and that is pretty much what this looks like.
I don't have windows and apparently didn't find the right nvflash executable for linux, but I came close. I am being very cautious and tried the minimal nvflash command I could think of, the --wait command, figuring it would be hard for THAT to hose me. Apparently it didn't but it also didn't quite work either.
Code:
# ./nvflash --blob blob.bin -w
Nvflash v1.13.87205 started
Using blob v1.1.57813
chip uid from BR is: 0x0000000000000000015d262e30281402
rcm version 0X30001
unknown bootrom version NvError 0x0
# ./nvflash -r --blob blob.bin --go
Nvflash v1.13.87205 started
[resume mode]
Using blob v1.1.57813
command failure: go failed
Considering that normally nvflash does absolutely nothing this tells me these files really do have the crypto 'mojo' for talking to the phone. So once I find a newer nvflash I'll play some more and report.
Update: That Chip uid matches the USB serial number so that proves beyond a doubt that nvflash is successfully communicating with the crypto enabled.
Click to expand...
Click to collapse
That sounds great.
Maybe you can try using the --getpartitiontable switch or read back a partition with the --read switch. Use the blob and the encrypted bootloader for that.
That two switch should not cause any problam to your device, normaly. But you may have heard that HTC One X gets stucked in APX mode if the user entered to that mode by accident. So anything can happen.
nvflash --blob blob.bin --bl bootloader.bin.encrypt --getpartitiontable partitions.txt --go
Or
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 8 SOS.img --go

bitdomo said:
nvflash --blob blob.bin --bl bootloader.bin.encrypt --getpartitiontable partitions.txt --go
Or
nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 8 SOS.img --go
Click to expand...
Click to collapse
Code:
# nvflash --blob blob.bin --bl bootloader.bin.encrypt --getpartitiontable partitions.txt --go
Nvflash v1.13.87205 started
Using blob v1.1.57813
chip uid from BR is: 0x0000000000000000015d262e30281402
rcm version 0X30001
unknown bootrom version NvError 0x0
Code:
# nvflash --blob blob.bin --bl bootloader.bin.encrypt --read 8 SOS.img --go
Nvflash v1.13.87205 started
Using blob v1.1.57813
chip uid from BR is: 0x0000000000000000015d262e30281402
rcm version 0X30001
unknown bootrom version NvError 0x0
Nope, it throws out that unknown bootrom version and stops right there. Even better is that the version of NvFlash I'm running is newer than the one in the zip file you provide, which is v1.7.75664. Looks like I have to go find a Windows PC and see what happens on that. Good grief but the horror show that I just that is going to be.... usb driver heck. Long term, gotta make it work here if it going to be very useful but need to know where the trouble is.
Not giving up here, too close.

Total extraction achieved
After a few hours of Windows Update grinding because I hadn't booted that side of that machine for months.....
Victory is achieved. All partitions successfully extracted, including those not normally visible. Now moving them back to the Linux box for examination and comparing to what was extracted via adb from the running phone for a sanity check, but the sizes all match, etc. and this IS supposed to be LG's own recovery method for a bare metal rebuild from a replaced CPU on a motherboard so the only question was really the provenance of the info and that was already shown to be good.
So unless I am misunderstanding, here is where things now stand on this phone.
Other than blowing fuses that would kill unlocking the bootloader again or other OTP fuse games, there is nothing that can be done on this handset that can't now be undone. This NvFlash thing is in mask ROM inside the CPU die and it runs before anything else. So unless somebody is overclocking and melts the hardware or something really dumb this is now one of the safest platforms for experimentation.
The phone's flash could even be repartitioned to recover the space wasted on things we do not care about.
The one remaining downside is that the SBK is still controlling the boot so the bootloader itself can't be replaced with one with a more complete fastboot. Editing the boot parameters the LG bootloader passes to the kernel doesn't look possible either.

is this nvflash is for moto g

nickbella2 said:
is this nvflash is for moto g
Click to expand...
Click to collapse
Why would it be for moto g if I posted on the optimus 4x forums? Not mention moto g does not have tegra soc, it has qualcomm soc.

Is this something? I think it just might be...
Looking at the dump some more and got curious at the manual explaining how to lock up a newly replaced CPU. Noticed it didn't say anything about obtaining the correct SBK, it just said to click the button to lock it down. Hmm....
Running strings on the utility turns up this most interesting sequence:
Code:
Enter Com Port
Error In OpenCommPort
Port Number : %d
at%nvsbk=8nGOWzuvGa/5u55X5kVj5IR3kLx2OlI0111GqsMe7WcgXVg4
%s%c
Error In WriteCommPort
Error In ReadCommPort
Success
Fail
at%nvsbchk
Fused
Not Fused
So it looks like AT modem like commands over a serial port but there is nvsbk as a command option right before nvsbkchk which pretty much has to be a check command that can return Fused or Not Fused. Problem is if that string is base64 encoded it yields 288 bits and not the 256 that one would expect... unless there is some sort of checksum to make sure you send the right key? 256 + a 32bit CRC would be just right.
So the jewels just might have leaked out. Stay tuned, will be experimenting more but had to post this as breaking news. Will need the patented Ace of Spades HQ flaming skull if it actually works.

Status update, no joy yet.
Update time. Yes that base64 blob does indeed appear to be a 256 bit key with a crc32 tacked on the end. The help text on the nvsbktool command is unclear, showing only an example of a 128bit key but if I just expand the four 32bit hex entries out to 64 bit the command runs and produces output. The blob.bin I get is not the same size as LG's and the encrypted data isn't the same either. Tried reversing the bytes for endianness issues and no joy either.
Here is what I have tried:
Code:
wine nvsbktool.exe --sbk 0xf2718e5b3baf19af f9bb9e57e64563e4 847790bc763a5234 d75d46aac31eed67 --chip 0x30 --blob /tmp/blob.bin --bct flash.bct /tmp/flash.bct.encrypted --bl bootloader.bin /tmp/bootloader.bin.encrypted
and
Code:
wine nvsbktool.exe --sbk 0xaf19af3b5b8e71f2 e46345e6579ebbf9 34523a76bc907784 67ed1ec3aa465dd7 --chip 0x30 --blob /tmp/blob.bin --bct flash.bct /tmp/flash.bct.encrypted --bl bootloader.bin /tmp/bootloader.bin.encrypted
If someone running on WIndows could repeat those commands (from inside Final/nvflash within whereever you unpacked the nvflash-recovery zip) and ensure you get these md5sum hashes to ensure something isn't whacky based on my using wine to run a Window executable I'd appreciate it:
af7ff5a63c343fc8c6cbaf7e2adb9234 /tmp/blob.bin
2971d586cf91b31d962b6d201c5238e0 /tmp/bootloader.bin.encrypted
211ae3430281fc3890809bc464b8d5e5 /tmp/flash.bct.encrypted

Still digging....
jmorris_42 said:
Update time. Yes that base64 blob does indeed appear to be a 256 bit key with a crc32 tacked on the end. The help text on the nvsbktool command is unclear, showing only an example of a 128bit key but if I just expand the four 32bit hex entries out to 64 bit the command runs and produces output. The blob.bin I get is not the same size as LG's and the encrypted data isn't the same either. Tried reversing the bytes for endianness issues and no joy either.
Click to expand...
Click to collapse
No, this is a dead end. That utility seems to be talking to the modem but with a name like nvsbk there was a chance they were stashing the key over in the modem. A newly born or rebuilt unit has to obtain the key material somehow, wouldn't be the first time obfuscation was used in place of a really secure method. But that theory is busted because the source for the Tegra3 clearly shows the SBK field as 128 bits and not the 256 this key yields after the CRC is removed. So perhaps this key locks down the firmware in the modem? If so it probably isn't too interesting.
But the same questions remain as to how a repaired handset gets locked down. They are telling techs to just flash away and not worry about it when replacing the applications processor. So what if fastboot locks itself? Nobody was apparently ever supposed to get a clear text copy of it so what if it just looks to see if an sbk is set and if it isn't sets one and rewrites itself into the flash? That would put a copy of the key somewhere in that binary blob. A glance does show what appears to be HDMI HDCP keys. While we have an unencrypted copy it is really big blob of ARM assembly language to wade through.
Wonder... any reason I couldn't write a perl script to take walk along 32bits at a time and feed every 128 bit value to the command and see what that key gets compared to the known good encrypted copy? Probably talking about days of runtime but not nearly as much grinding as figuring out the raw assembly.

So can this method be used to unbrick the phone in apx mode?

Restoring Bricked o4x wiht APX mode via NVFLASH
punit9779 said:
So can this method be used to unbrick the phone in apx mode?
Click to expand...
Click to collapse
Yes, it can be done with this tool. I did it on my o4x - the tool is restoring the ics version v10b. You can extract the DZ file of any ics and overwrite the files in downloaded package to get v10h
Q/A flashing extracted v20.
Yes it can be flashed with it and even boot. But after first boot rom just hangs in a few seconds. After reseting the phone you stuck at LG logo. I gues it's a due blob file. Its only for ics, and we dont have iit for JB.

ya5 said:
Yes, it can be done with this tool. I did it on my o4x - the tool is restoring the ics version v10b. You can extract the DZ file of any ics and overwrite the files in downloaded package to get v10h
Q/A flashing extracted v20.
Yes it can be flashed with it and even boot. But after first boot rom just hangs in a few seconds. After reseting the phone you stuck at LG logo. I gues it's a due blob file. Its only for ics, and we dont have iit for JB.
Click to expand...
Click to collapse
But in the given bat files it doesnt give any command for flashing the system.img, so how does it flash the ics version v10b?

Hy ! Can you help me?
Folder 1 : (Encrypt) : data send failed NvError 0x120002
command failure: bootloader download failed (bad data)
Folder 1 : (Non-Ecrypt) : rcm version 0X4
Command send failed (usb write failed)
Final : Encrypt : data send failed NvError 0x120002
command failure: bootloader download failed (bad data)
Final : Non-Ecrypt : rcm version 0X4
Command send failed (usb write failed)

How do you extract the dz of v10h to img files? i tried with lgextract and dzextract but get errors...

[TOOL] KDZ and TOT Extractor
tsimon40 said:
How do you extract the dz of v10h to img files? i tried with lgextract and dzextract but get errors...
Click to expand...
Click to collapse
Please use search, for me works.
http://forum.xda-developers.com/showthread.php?t=2600575
---------- Post added at 01:04 PM ---------- Previous post was at 12:45 PM ----------
nfs32100 said:
Hy ! Can you help me?
Folder 1 : (Encrypt) : data send failed NvError 0x120002
command failure: bootloader download failed (bad data)
Folder 1 : (Non-Ecrypt) : rcm version 0X4
Command send failed (usb write failed)
Final : Encrypt : data send failed NvError 0x120002
command failure: bootloader download failed (bad data)
Final : Non-Ecrypt : rcm version 0X4
Command send failed (usb write failed)
Click to expand...
Click to collapse
Inside final folder run cmd line, and run bat files. Try both.
After error feedback reconnect usb cable to your phone, then run again bat file.
---------- Post added at 01:08 PM ---------- Previous post was at 01:04 PM ----------
punit9779 said:
But in the given bat files it doesnt give any command for flashing the system.img, so how does it flash the ics version v10b?
Click to expand...
Click to collapse
Thats for sure command to flash sth. isnt it ? It doesnt need to say im flashing img file. The best of it ist it just does
iside the BAT file.
nvflash --blob blob.bin --bct flash.bct.encrypt --setbct --configfile flash_encrypt.cfg --create --bl bootloader.bin.encrypt --go
pause

iside the BAT file.
nvflash --blob blob.bin --bct flash.bct.encrypt --setbct --configfile flash_encrypt.cfg --create --bl bootloader.bin.encrypt --go
pause
Click to expand...
Click to collapse
Remember what this info dump was intended for and things make more sense. The two scripts were intended for a tech replacing the flash chip or the Tegra3. If you run the one intended for a flash replacement it assumes the processor is still locked down so it uses the blob.bin and flashes the encrypted BCT, Partition table and the bootloader. Assuming the flash is actually new, all other partitions are empty. In this condition we can assume the bootloader will come up in one of the two recovery modes and the tech is expected to use their normal procedure to flash a .kdz. You aren't in that situation, you have stuff on the other partitions and if they were not bootable before they are unchanged.
However the normal kernel, recovery and system images are present so you could manually use nvflash to restore those as well. You will of course get an ICS version but it will be a working phone again and you can upgrade back up.

im stuck in S7W Upgrade mode and cant install the usb driver. can somebody tell me if this method will work when im stuck in s/W upgrade mode??

oops

yunsen said:
im stuck in S7W Upgrade mode and cant install the usb driver. can somebody tell me if this method will work when im stuck in s/W upgrade mode??
Click to expand...
Click to collapse
If you can still get to SW Upgrade mode I'd suggest sorting out the Windows issues and using that since upgrade mode is known to be reliable.

TF701T NvFlash Unbrick Solution(tested)

TF701T NvFlash Unbrick Solution(tested)
(continue of the threadhttps://forum.xda-developers.com/showthread.php?t=2655888)
Charge tab before unbricking.
Connect tab to PC.
If your tab not started already in APX mode, then run APX mode by pressing button combination Vol+ and Power.
Insall drivers from "usb_drivers" if needed.
If there is a problem with the installation of drivers, use Google to search- how to install unsigned drivers.
When device installed correctly run "tf701t_flash.bat".
If flash process interrupts with error like ...read\write error..., then probably EMMC memory chip is damaged and need to replace.
If flash process complete, then we ready to next step.
Prepare fat32 formatted microSD card.
Download from ASUS site update package.
https://www.asus.com/us/Tablets/The_New_ASUS_Transformer_PadTF701T/HelpDesk_BIOS/
It _MUST_ be Version V10.14.1.47, SKU(region)- of your choice.
The downloaded file will look like **_epaduser_10_14_1_47_UpdateLauncher.zip
There will be another archive inside that archive.
Extract it, and rename it to t4_sdupdate.zip
Put t4_sdupdate.zip in root of microSD card.
Insert microSD card in tab, then start tab in recovery mode by pressing Vol- and Power key combination.
Follow onscreen instructions to complete recovery process.
After all you tab must be restored to factory state JB Android.
Now you may update firmware version using OTA or sdcard.
NvFlash TF701T Unbrick
http://mega.nz/#!mk8k0Y5S!TQJVfcQudH9HIMnapiGZWccV3VvygnTjDWYLxJte4lo
mirror
http://smartjtagbox.com/owncloud/index.php/s/T8DKqDuhSZzffSp

What is this? A covert ad campaign for Mega? How about hosting the file somewhere that does not force you to download an app, open an account and all that cr***? I'd be really curious to see the code, but not like this.....
Sent from my TF700T using Tapatalk

berndblb said:
What is this? A covert ad campaign for Mega? How about hosting the file somewhere that does not force you to download an app, open an account and all that cr***? I'd be really curious to see the code, but not like this.....
Click to expand...
Click to collapse
Where did you see the ad or need to register, or requirement of install the program for downloading?
Just checking in IE and FF.
I see a big red button- "download", no ads, and no requirements.
Ok, for those who have problems with mega.nz added a mirror for download.

TF701t - Hard Reset Fails ...
Dear Community,
I wanted to hard reset my TF701t to delete my data and give it to another one.
But now it stucks in "deleting data" ... that endures a minute then a dead android is on the screen.
When I want to reboot it, the hard reset comes again and want to delete everything, but the dead android is coming back :/
I can't go in Recovery Mode (Volume-down + Power)
Connection to APX works but, see pic below ...
I don't know what I could try anymore ...
Hope somebody have an idea.
Best greetings,
Symbic
Bild -> url: ibb.co/iFP5JH
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

Symbic said:
Dear Community,
I wanted to hard reset my TF701t to delete my data and give it to another one.
But now it stucks in "deleting data" ... that endures a minute then a dead android is on the screen.
When I want to reboot it, the hard reset comes again and want to delete everything, but the dead android is coming back :/
I can't go in Recovery Mode (Volume-down + Power)
Connection to APX works but, see pic below ...
I don't know what I could try anymore ...
Hope somebody have an idea.
Best greetings,
Symbic
Bild -> url: ibb.co/iFP5JH
Click to expand...
Click to collapse
Link to the picture is broken, so we cannot see what result you got...
What's your situation: Bootloader unlocked? Custom recovery? I guess not since you get the dead Android?

link to screenshot ok.
as i can see- problems begin after trying access to EMMC chip.
"Taking backup of EKS"
unfortunately with 90% certainty i can say that the EMMC chip damaged.

mr.bin said:
link to screenshot ok.
as i can see- problems begin after trying access to EMMC chip.
"Taking backup of EKS"
unfortunately with 90% certainty i can say that the EMMC chip damaged.
Click to expand...
Click to collapse
Can I do anything else to test the EMMC chip?

Symbic said:
Can I do anything else to test the EMMC chip?
Click to expand...
Click to collapse
In that state the EMMC chip can be tested with the special equipment like EasyJtag box.

Hello Mr Bin, registered an account just to say thank you...
You have no idea.. was helping a friend to update, but the guy who sold it(tf701) had bought it from different region and turned it to US, so we ended up hard bricking it.
Long story short, we hard bricked it.
Thank you for your hard work in making the fix, and a big THANK you for sharing it...
Perfect fix, its better than before because it got updated to .47 (we couldnt update, no OTA no manual, too old version for custom recoveries)
Again.. thanks :good::good:

Thanks.
But, after clicking to RCK, shows Android with blue procesing line and after few seconds android with open door and red triangle !. After few minutes bootloop....nothing more.
What can i doing again?

Wow! It's back!
Hi.
First of all: Thank you very much! I was sure my tablet was a goner... It is actually back. One tip I'd like to add: I had to try around a bit to get into APX mode. But essentially I just had to connect the tablet to my PC and then push "Volume up" and power at the same time - and ignore that the screen did not light up ...
Again: Thanks a lot!

Mr.Bin,
You have resurrected my TF701T! Thank you SOOOO MUCH! You are an actual genius! Thanks!

Help w installation
I have the same problems although i have not installed any custom OS but after few months of not using it didnt load up and ended in APX mode.
Tried this solution, installed the driver, started the .bat file and ended up here :
Nvflash 3.08.1704 started
Using blob 3.08.1704
chip uid from BR is: 0x600000015c3e10080c000000190301c0
rcm version 0X350001
Skipping BoardID read at miniloader level
System Information:
chip name: unknown
chip id: 0x35 major: 1 minor: 2
chip sku: 0x3
chip uid: 0x000000015c3e10080c000000190301c0
macrovision: disabled
hdcp: enabled
jtag: disabled
sbk burned: true
board id: 0
warranty fuse: 0
dk burned: true
boot device: emmc
operating mode: 6
device config strap: 0
device config fuse: 17
sdram config strap: 0
RCM communication completed
sending file: flash.bct
- 8192/8192 bytes sent
flash.bct sent successfully
BCT sent successfully
odm data: 0x82098000
downloading bootloader -- load address: 0x80108000 entry point: 0x80108000
sending file: bootloader.bin
data send failed NvError 0x120002
command failure/warning: bootloader download failed (bad data)
I would be very thankful for any information you could read from this. Just would like to know if i even have a chance of getting it back on.

So, I was running fine with CROMi-X KitKat, but wanted to upgrade to Marshmallow (to install sw not supported in KitKat), so decided to try KatKiss 6.0. It's been years since I've played with flashing ROMs, but I did a little reading to refresh my memory. Then I rebooted into recovery (ClockworkMod), backed everything up, then wiped everything, formatted /data, and tried flashing the KatKiss zip file. At that point, it just sat there forever at the ASUS logo screen:
I've tried several times to boot back into recovery by holding the Vol+ and Power buttons, but it either doesn't boot, or boots to the above screen. I've connected it to my Mac w/ the Android SDK Platform Tools, but adb doesn't see any device listed. [I've got an old Windows laptop (XP?)] I could use if it will do something the Mac can't.]
Any advice on how I can save this tablet?

This method can be apply to tft300t?

Hi! What a great thread! After lurking on this forum for many years, i've registered to expose my issue with an old tf701 that was given to me by a friend. He say me he installed esexplorer and deleted file to clean space. Next day he rebooted and never been able to boot system. Now tablet is in bootloop ending with blackscreen and backlight on. Im able to open in fastboot and talk with minimal adb and fastboot. RCK update ending with fallen robot, Wipe data/cache ending with fallen robot. APX mode also working and ive run mr.bin's Nvflash unbrick tool with this result:
Nvflash 3.08.1704 started
Using blob 3.08.1704
chip uid from BR is: 0x600000015c3e10060400000001058440
rcm version 0X350001
Skipping BoardID read at miniloader level
System Information:
chip name: unknown
chip id: 0x35 major: 1 minor: 2
chip sku: 0x3
chip uid: 0x000000015c3e10060400000001058440
macrovision: disabled
hdcp: enabled
jtag: disabled
sbk burned: true
board id: 0
warranty fuse: 0
dk burned: true
boot device: emmc
operating mode: 6
device config strap: 0
device config fuse: 17
sdram config strap: 1
RCM communication completed
sending file: flash.bct
- 8192/8192 bytes sent
flash.bct sent successfully
BCT sent successfully
odm data: 0x82098000
downloading bootloader -- load address: 0x80108000 entry point: 0x80108000
sending file: bootloader.bin
| 1463232/1463232 bytes sent
bootloader.bin sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
Taking backup of EKS
Receiving file: EKS_0400000001058440.bin, expected size: 4194304 bytes
/ 4194304/0 bytes received
file received successfully
Taking backup of PER
Receiving file: PER_0400000001058440.bin, expected size: 8388608 bytes
/ 8388608/0 bytes received
file received successfully
Taking backup of ABT
Receiving file: ABT_0400000001058440.bin, expected size: 4194304 bytes
/ 4194304/0 bytes received
file received successfully
Continuing create using flash.cfg
setting device: 2 3
deleting device partitions
creating partition: BCT
creating partition: PT
creating partition: EBT
creating partition: DFI
creating partition: BMP
creating partition: ABT
creating partition: GP1
creating partition: SOS
creating partition: DTB
creating partition: LNX
creating partition: APP
creating partition: CAC
creating partition: APD
creating partition: ADF
creating partition: MSC
creating partition: USP
creating partition: PER
creating partition: CRA
creating partition: MDA
creating partition: EKS
creating partition: UDA
creating partition: GPT
sending file: bootloader.bin
| 1463232/1463232 bytes sent
bootloader.bin sent successfully
sending file: xusb_sil_rel_fw
- 126464/126464 bytes sent
xusb_sil_rel_fw sent successfully
sending file: ABT_0400000001058440.bin
/ 4194304/4194304 bytes sent
ABT_0400000001058440.bin sent successfully
sending file: recovery.img
\ 7272704/7272704 bytes sent
recovery.img sent successfully
sending file: boot.img
- 6760704/6760704 bytes sent
boot.img sent successfully
sending file: PER_0400000001058440.bin
/ 8388608/8388608 bytes sent
PER_0400000001058440.bin sent successfully
sending file: EKS_0400000001058440.bin
/ 4194304/4194304 bytes sent
EKS_0400000001058440.bin sent successfully
failed executing command 26 NvError 0x120002
command failure/warning: sync failed (bad data)
bootloader status: Bct Write Failed (code: 22) message: nverror:0x40005 (0x14000
5) flags: 0
Click to expand...
Click to collapse
Advise would be great help. I dont know if mmc could be dead, it showing some successful tranfert but keep failing at same place. Thanks!

Hello. These commands for nvflash make a backup and installation of the system.
REED
@cls
@nvflash.exe --blob blob.bin --bl bootloader.bin --read 9 recovery.img --read 11 boot.img --read 12 system.img
@pause
WRITE
@cls
@nvflash.exe --blob blob.bin --bl bootloader.bin --download 9 recovery.img --download 11 boot.img --download 12 system.img
@pause
Thanks mr.bin for a great tool

Important information who uses nvflash!
3 files (ABTxxxxxxxxxxxxxxxx.bin, EKS_xxxxxxxxxxxxxxxx.bin, PER_xxxxxxxxxxxxxxxx.bin, which are created after running nvflash, must be flashed again. Otherwise, it will be impossible to unlock the tablet again and the serial number will be lost. Save in a safe place and then rename the files to EKS, ABT, PER.
To do this, create a second file with the bat extension. In a text editor, type these lines
Code:
nvflash --wait --blob blob.bin --bl bootloader.bin --download 7 ABT --download 21 EKS --download 18 PER --go
If these files are saved on the unlocked tablet, then after their firmware unlocking will be restored.
Also, using nvflash, you can resize partitions, flash a bootloader with file system markup, recovery.

There is no way to load an unlocked bootloader in this process ??