UPDATE
It is clear from many users now that the 2.3.4 / 4.5.91 OTA burns a fuse, specifically in ReservedOdm[1], which switched from:
Code:
old: 0000 0000 0000 0001 0000 0000 0000 00[B]0[/B]1
new: 0000 0000 0000 0001 0000 0000 0000 00[B]1[/B]1
So, if you see something in /sys/firmware/fuse/ReservedOdm like:
Code:
10000000000010001000[B][U]3[/U][/B]00004000
You *should not* SBF to anything except PUDDING or an SBF with PUDDING, or AT&T 4.5.91.
Any official motorola .sbf, EXCEPT 4.5.91, will leave you in hard-brick nvflash land...
(I will make a new post and call for more data for Chinese 0x1000 errors)
Here is an AT&T specific putative explination for their 0x1000 issues:
Our phones have a fuse, a set of one-time-programmable bits, called 'ReservedOdm' (reserved for the original design manufacturer, Motorola.) Using a fuse in this set, the unreleased 2.3.3 bootloader implemented 'fastboot oem unlock' which burns a bit in ReservedOdm[0] and sets these 32 bits (represented as 8 hex values) to 0x00004000. There are 8 ReservedOdm[] 32bit values, or 8x32 (256) fuses. Once one is burned (set to 1) it cannot be un-burned. Hence, a 'fuse'.
You can view the state of your ReservedOdm by looking at /sys/firmware/fuse/ReservedOdm, if you are root. Mine looks like this:
10000000000010001000100004000
(before unlock:
10000000000010001000100000000)
Broken down (Odm as short for ReservedOdm):
Code:
Odm[3] | Odm[2] | Odm[1] | Odm[0]
00010000 | 00000001 | 00010001 | 00004000
We don't really understand Odm[3], but it likely gets burned by flashing an .sbf or some other process, not everyone has a 1 there. You don't see Odm[7] through [4] because leading zeros are dropped from the printf output. Also, some people (pre-first-sbf?) seem to have 00000001 not 00010001 in Odm[1].
Why discuss unlocking? Because although downgrade bricking is not directly related to unlocking, in the end it is caused by another fuse, in ReservedOdm[1].
Talented dev nothize has disassembled bootloaders and determined that AT&T 1.8.3 and earlier, and most chinese bootloaders, expect that only the last bit of Odm[1] is 1. By burning the next-to-last bit, Moto broke ability to downgrade.
Basically, SVF:105:1:2 means, at lower word (16bits) of Odm[1], (called "105" dunno why) we expect the first '1' to be in position '1' but we found it at position '2', barf. Ie, for AT&T bricking case, we wanted Odm[1] should have been 0x????0001 (binary 0001 for last 4 bits) but we got 0x????0003 (last 4 bits, binary 0011) instead. By barf I mean drop to nvflash mode which only motorola service can use, since only they have our 'secure boot key' which nvflash requires. Thus, the hard brick when certain (older and/or chinese) bootloaders find this unexpected fuse burned.
Now although 4.5.91 OTA & sbf burn a fuse, you only brick if you run a bootloader that expects it not to be burned (ie, stock 1.8.3 or below.) Similarly, you can burn the Odm[0] fuse to get 0x00004000, but it won't do you any good unless your bootloader cares. So far there is one bootloader which cares, from 2.3.3, 4.5.47 (unreleased build) and lets you 'oem unlock', burning that Odm[0] fuse, and if it's burned, lets you fastboot, skips signature checks, etc.
If you run any other bootloader besides 'Pudding', it doesn't matter if your fuse is burned, you're 'effectively' locked (other BLs don't care to give you permissions.) But since fuse burning is irreversible, once you go back to the unlockable bootloader, it will notice you burned that fuse, and print 'Unlocked' in the corner. So although your fuse is burned, you don't get the benefits of it, unless you flash 'Pudding' (4.5.47) or an sbf with 'Pudding' in it.
Pudding/4.5.47-BL is also a special for another reason. Although it also does not like Odm[1] to be 0x00010003 (like 1.8.3/pre) and displays error 0x1000, it lets you escape. It gives you a really nice menu of options so you can flash something higher (only 4.5.91 right now) if you want to stay locked, or it lets you enter fastboot and 'oem unlock.' Then, in the future, even if it notices this 'bad' fuse is burned in Odm[1], because you have the Unlocked fuse burned in Odm[0] it gives you a pass, and boots anyway. So flashing Pudding or something+Pudding after 4.5.91 might give you a little heart attack, but in the end it should be harmless.
Preserved for posterity below (if you have a Chinese/Korean/Hong Kong Atrix please continue to post your ReservedOdm plus model, location, carrier, current build/sbf please, until I start a new thread.)
ATTENTION
The purpose of this thread is to assist currently 'hard' bricked users seeing 0x1000 on boot, and to understand why this happens. People who have un-bricked please skip to the end of the post. Talented dev nothize has disassembled some bootloaders and thinks perhaps this is a fuse check failure. Also, he has been able to glean some info from the chinese-language threads about this same error some weeks ago. It has been very hard to try to make sense of this issue after being away by combing through hundreds of posts. Let's keep this thread uncluttered.
HOW TO HELP
Everyone who has seen 0x1000:
Post a short description of how you got there, what you see (ie, do you boot loop?) For example, ATT users: Did you OTA from 1.8.3 to 4.5.40 or 4.5.91? Had you flashed 'Pudding' before OTA? Were you locked or unlocked? Did you see any messages about 'BP' during any RSD flash or OTA upgrades? If you recovered, exactly how (full Pudding+1.8.3 or just Pudding. If you were locked, did you have to unlock? etc.) INCLUDE SVF STRING (if any.) Be concise and specific.
If you managed to un-brick:
0. (Root your phone, see: here)
1. As root, cd to /sys/firmware/fuse
2. Run: "for i in * ; do echo $i `cat $i`; done"
3. Post output here, especially of "ReservedOdm" fuse
(Include: carrier, previous .sbfs & bootloaders used, if unlocked, current BL)
(The following is depreciated, probably not worth doing... 0x1000 on 1.8.3 bootloader [or older] is different to the Hong Kong/China 0x1000, and also different for users lucky enough to flash 2.3.3/Pudding after OTA)
If you are currently bricked:
[Note, this is not a fix, but we'd like to know if you can 'see' your device on your PC's USB. If you have, or can make, a factory cable this test will be more conclusive, especially if you see any sort of 'Nvflash' message]
0. (Be sure your battery is charged!!)
1. Unplug phone, remove battery, leave disconnected for at least 10s
2. Hold down the volume-up before and during battery insertion
3. Continue to hold down volume-up (never release it!) and connect to PC
(If you've held volume-up more that 30s after inserting battery, you can release)
4. Try to see your device in RSD
5. If Step #4 fails, try to see your device in linux 'lsusb' (like: "watch -n .1 lsusb" before connecting phone to PC)
6. Post your results in this thread!
(PM me if you use windows freeware lsusb or usbview. I don't run windows and can't test, but would gladly post instructions)
Good thread for our bricked friends. Nice one!
Ronaldo_9 said:
Good thread for our bricked friends. Nice one!
Click to expand...
Click to collapse
This is exactly the kind of spam I do not want on this thread. If this starts to happen I will close this thread.
Please respect the big red underlined request in the first post and do not post in this thread unless you have experienced 0x1000 yourself, and have something useful to contribute.
Thanks in advance for valuing our time.
Six step plan is a no go for me. I tried it quite a few times with two different batteries.
One battery is low-ish on charge and it reads the following under the traditional error:
Code:
Entering NVFlash recovery mode
Battery is too low to flash
The other battery is full. It reads the error for about three seconds and then quickly flashes the "NVFlash recovery mode" line before it turns blank. The screen just goes dark. Still, the device must be on, because it won't let me reboot without battery pull.
@kenneth that's exactly what happened with me.
I have already gotten a new atrix and dumped the busted one back to AT&T (on the pretense of a battery dying while doing an OTA update.) So unfortunately I cannot help figure this out.
But for my two cents, im still a firm believer that using a factory cable to connect the phone w/o a battery to a PC holds the solution we seek.
I attempted to make my own, but at 7am after going all day at work (im in the US Marine Corps Infantry ) I was falling asleep while soldering. Im going to work on it again this weekend though.
Sent from my MB860 using XDA App
I had the 0x1000 error yesterday morning by flashing pudding. I don't think was a hard brick due too the fact that I was able to recover.
Sent from my MB860 using XDA Premium App
Same issue as jakew02, how ever I still have my bricked atrix. I will get a fully charged battery and try to get some results but I have the same symptoms as Kenneth as well as in phone starts for about 3 seconds and immediatley needs a battery pull. I'm off work in a few hours and will post results then.
Sent from my MB860 using XDA App
Sthony said:
I had the 0x1000 error yesterday morning by flashing pudding. I don't think was a hard brick due too the fact that I was able to recover.
Sent from my MB860 using XDA Premium App
Click to expand...
Click to collapse
Please guys... the more descriptive the better.
Sthony, you OTAd to 4.5.91 from 1.8.3 by putting the .zip in /sdcard and fastboot menu into Recovery? Then, you flashed Pudding and soft-bricked. How did you recover? Were you unlocked before OTA? Or you only unlocked after flashing pudding?
Can those of you who recovered please cat /sys/firmware/fuse/ReservedOdm ? (as root)
We would like to determine what prevents you all from downgrading (and maybe, possibly, get the still-bricked out of nvflash mode, but this will probably require cable + SBK). So it will help knowing exactly what versions you went FROM and TO (with OTA inbetween) and the type of 0x1000 you got (bootloop with RSD option using battery during volume-up method, VS. nvflash, VS. fastboot menu) including the SVF (usually 105:1:2) message if possible.
kennethpenn said:
Six step plan is a no go for me. I tried it quite a few times with two different batteries.
One battery is low-ish on charge and it reads the following under the traditional error:
Code:
Entering NVFlash recovery mode
Battery is too low to flash
The other battery is full. It reads the error for about three seconds and then quickly flashes the "NVFlash recovery mode" line before it turns blank. The screen just goes dark. Still, the device must be on, because it won't let me reboot without battery pull.
Click to expand...
Click to collapse
Kenneth, same here.
the 6-step thing is a no go for me. It flashes the NV thing very quickly, then goes dark. At least I know what I did wrong, and quite stupidly so
- On 2.3.4 stock
- tried to push a de-odexed services.jar , deleting the services.odex (stupid in hindsight)
- pushed kenneth's boot.img and system.img (without reading that the system needs to be UNLOCKED)
- since the only thing left was RSD, tried to flash 1.2.6, which failed. BOOM. hard brick.
I only hope my stupidity helps people not make the same mistakes.
Will try to give it to a moto service center tomorrow, see if they can fix it.
*EDIT* doing the steps in the first posts without battery but plugged into wall outlet leaves the phone in "starting nvflash... battery too low to flash." If you push in the battery, and then pull out the cable, the screen stays on. Not sure if that helps anything, since I don't know how to do nvflash, and don't have the right tools to begin with.
Please fill out and use the following template when posting to this thread:
1. Before the 2.3.4 (4.5.91) OTA upgrade, did you flash a fresh install of 1.8.3 .sbf from RSD?
2. If the answer to #1 was no, what mods (if any) did you have installed at the time of your 2.3.4 (4.5.91) OTA flash (cwm, pudding, root, et cetera...), also what version of software were you on if not 1.8.3?
3. After flashing the 2.3.4 (4.5.91) OTA by putting the update.zip in the root of your /sdcard-ext/ and booting into the stock recovery, did you install any mods (cwm, pudding, root, et cetera...)?
NOTE: If you did not flash the 2.3.4 (4.5.91) OTA by putting the update.zip in the root of your /sdcard-ext/ and booting into a stock recovery, please detail what method you used to get to the 2.3.4 (4.5.91) OTA. This thread is only for users who flashed with this method.
4. Did you use RSD to flash anything else while on the 2.3.4 (4.5.91) OTA, such as pudding?
5. Did you use fastboot to flash anything else while on the 2.3.4 (4.5.91) OTA, such as cwm or preinstall root?
6. Did you then try to flash back to the stock 1.8.3 .sbf via RSD? If so, what version of RSD Lite did you use?
7. If the answer to #6 was no, what version of .sbf did you flash via RSD, also what version of RSD Lite did you use?
8. Did you encounter the 0x1000 error after trying to downgrade to a lower version .sbf?
9. Have you been able to recover from the 0x1000 error and resume normal functionality? If so, what software version are you currently on?
10. Please detail below exactly what had occurred during and after the downgrade to a lower version .sbf via from the 2.3.4 (4.5.91) OTA. If you were able to recover, please detail the steps that led up to your recovery. Also what type of 0x1000 you got (bootloop with RSD option using battery during volume-up method, VS. nvflash, VS. fastboot menu) including the SVF (usually 105:1:2) message if possible.
Also include everything required from the first post of this thread. This is very important.
If you can also provide filenames for the files you've flashed, that would be optimal.
=>
Well, I had this issue some days ago following the Pudding stickied topic.
I had 4.1.8.3 with old Tenfar's CWM so following the steps in that topic flashed 4.1.8.3 again with RSD Lite. It was a service SBF.
Then I booted in Android recovery mode and flashed the OTA. Everything went fine, I had 4.5.9.1 with all my data and apps.
Then I flashed Pudding.
Instantly after RSD rebooted my phone, I had this 0x1000 error. I didn't know what to do, I followed the guide step by step and I was confused. So I tought "Maybe I need to unlock my bootloader". So I booted the phone in fastboot mode and unlocked my bootloader through fastboot.
Then I did a fastboot reboot and voila, the phone booted again in 4.5.9.1.
I notice I have a "Unlocked" text in the Motorola boot screen.
Well, I hope this info helps someone.
Let me know how it went.
Failed to boot 0x1000
I have the same issue that you guys have...
I did the update to Gingerbread 2.3.4 and then I tried to roll back to froyo so I used RDSlite 5.3.1 and this .sbf: OLYFR_U4_1.2.6_SIGNED_OLPSATTSPE_P012_HWolympus_1g_1FF.sbf and the phone got hard bricked...
I left it with the battery inside yesterday and today the phone drain the battery completely... I took it off, charge it for 2 or 3 minutes and put it back, connect it to my pc and it displays:
SVF: 105: 1:2
Failed to boot 0x1000
Entering nvflash recovery mode
Battery is to low to flash
But if i take the battery from my other atrix, fully charged it just turn on, display the error and for a second "Entering in nvflash recovery mode" and then Black Screen.
Just going to point this out in a new post for everyone to see on unbricking transformer: http://forum.xda-developers.com/showthread.php?t=1123429
I am wondering if sth like this could work (with the right .cfg and .sbf). I am going to take a look at the nvflash package in any case.
bl0wf1sh said:
Just going to point this out in a new post for everyone to see on unbricking transformer: http://forum.xda-developers.com/showthread.php?t=1123429
I am wondering if sth like this could work (with the right .cfg and .sbf). I am going to take a look at the nvflash package in any case.
Click to expand...
Click to collapse
You would need your SBK which is why the NVFlash issue is a 'hard' brick in the first place.
First i would like to apologize if this post is not of much use to you guys as I have not hard bricked my device. However I have flashed the 4.5.91 OTA and I noticed something intersting.
1 I unlocked my bl the night pudding was released.
2 I flashed a fresh 1.83 sbf
4 OTAd form android recovery to 4.5.91
5 on the very first reboot after OTA I entered into RSD protocol and once I connected to RSD lite 5.3.1 I noticed RSD identified my device as SE-Olympus insted of the normal NF-Olympus.
6. I flashed zomgunlock-lite.sbf. After it completed SE-Olympus changed back to NF-Olympus.
I may be wrong but i dont ever recall RSD seeing my device as SE-Olympus.
Anyways I hope this may useful and good luck!
kennethpenn said:
Six step plan is a no go for me. I tried it quite a few times with two different batteries.
One battery is low-ish on charge and it reads the following under the traditional error:
Code:
Entering NVFlash recovery mode
Battery is too low to flash
The other battery is full. It reads the error for about three seconds and then quickly flashes the "NVFlash recovery mode" line before it turns blank. The screen just goes dark. Still, the device must be on, because it won't let me reboot without battery pull.
Click to expand...
Click to collapse
On my bricked Atrix, it just shows the error, and stays there until a battery pull (no other text shows up)
When you see the LOW battery warning, it's a false warning. On Olympus, NvFlash can only be accessed with external power from the factory cable (without ANY battery inserted). That's why your devices are "flashing" and powering themselves down. It's a "protection" implemented by Moto (as factory cable should be only built by Moto for repairing bricked devices).
Anyway, why are you hardbricking your devices flashing an old bootloader?
...At least, do you know why your device isn't relockable?
The new bootloader writes a bit into a fuse (in the ODM Reserved set) that isn't already blown. When it reads it back, if it's set to 1, it shows the "Unlocked" message and disables security checks.
Still, why can't I relock the device?
As you might know, when a fuse is blown, its programming power ramp is literally blown, so, you can't reprogram a fuse that has been burned.
And still, so, after so many hours of boring reading of your post, can you tell me why the **** my device is bricking with an old bootloader?
...The bootloader reads the entire ODM Reserved fuse set. When it reads it, it won't read fuse 1,2,3,4.... but the ENTIRE set.
If another fuse is blown, the old bootloader can't recognize why the damn there's an 1. It doesn't know what it is.... so boot fails, MotoBoot stops its execution and passes it to the Emergency NV3p Server (Emergency NvFlash Mode, from nVidia MicroBoot).
I think those infos should clear some doubts in your mind.
Cheers!
very nice of you I offered to possibly fix some bricks but with out knowing actual facts as to what is going on with their devices it would be hard . have you talked to any of them ? you know they dont talk to me , do they actually have access granted to NV3p server or nvflash or are they still locked out?
as per the first post, the OTA DOES CHANGE YOUR BP, THIS IS NOT A ?, as i was graceful enough to enter irc under another handle and post earlier in the week.
on a side note the irony of this entire situation is that i was booted from #moto-atrix after arguing the subject of blindly flashing back to older versions with a sbf, true at the time i was concerned with 1.84 - 1.29 , but now just a short time later ...
Regardless a fix maybe possible but need to know exactly what access you have once powering on device
*edit* for the sake of giving you what you asked here is my output , I am unlocked, rooted, I did use OTA I never bricked , I am now running my own stuff after flashing a CWM and building
Code:
DeviceKey FFFFFFFF
JtagDisable 0
KeyProgrammed 1
OdmProduction 1
ReservedOdm 10000000000010001000300004000
SecBootDeviceConfig 0
SecBootDeviceSelect 7
SecBootDeviceSelectRaw 0
SecureBootKey
SkipDevSelStraps 0
SpareBits
SwReserved 0
kfuse_raw ��j�s��Q��'��[email protected]�C��%57�ܠ� ��.����fm���vp��^����D}�G������K�*^V��w�+�����6:��YяmTq���;bH9�٩$M��nT&�7� ���4.�ŷX{�J ������[�;N{�,(Ay���V��K=tTD���!$�{%�f��y;v��~�\�C:L-|��w���)�g #�!mv���+W�T�����(����|�3 LNP�HV�J��|q��b�Wfa��/
�.���^df�6�6�e�n��U�Sj��j}�_g��i��c�i�h��0$ bz)�ߋ�Cd|ge-G���oU�GF��w���YLn2E,�rU����5�V��3.�V��NjY�m�v*Bt�����2�[email protected]�?��ؘ��#w��&6�+rdb;TK_r��� �,�F_�� � vQ�NJ
�2��}(�8mg�ȯ#nv� �����M$�Oǹ=E��I�v��E�9tP"�[`�'�a#X�E��S+�4 �u/�ö4�B|y�1bd��*��N��/"U� �p� ��� F���%4>X�0H�xx�����
sku F
So here is my basic info now that I am home.
I was on stock att 1.83, flashed 2.3.4 via zip through sd card. Tried to install pudding, phone went into bootloop then flashed the red led. upon reboot showed error and message of "no os available cannot boot."
After panicking a bit, I loaded the 1.26 sbf, got to the moto boot screen and the phone shut off, no led, no message, nothing. I pulled the battery and restarted, then all I got was the 0x1000 message for 3 seconds, then the NVflash message and immediately a blank screen.
Now that I am home I have tried the steps provided and haven't been able to see the phone through rsd lite, and it still has the same symptoms. If you need any other info, or if i have forgot anything please let me know I will help where I can since I now have a paperweight and a brand new functioning atrix, thank god my mother-in-law was due for an upgrade.
They're still locked out. No SBK no party.
"No OS to boot" implies that you need to repartition/reflash without absolutely touching the MotoBoot. So, someone make a recovery SBF that won't flash the bootloader or you'll see plenty of bricked devices.
They can't recover with NvFlash.
--> From Motorola, but do at your own risk, as always! <---
Lenovo Motorola Smart Assistant - "lmsa"
I've played with, and done some more research on lmsa.
I am wondering if this would help some folks here.
Please report back success or failure and your particular symptom so others will know.
NOTE: my phone is bootloader unlocked XT1900-1 One fi which OTA'ed itself up from 8.1 to 9 Oct 1 '19 security.
If you are able to back anything up, do so before you do this - if successful, it will flash your phone.
go here
https://www.motorola.com/us/lenovo-motorola-smart-assistant
and download it.
Watch the video for software issues(lower left of that page).
Install it.
Start it up.
You want flash/ rescue.
follow the instructions and put your phone into fastboot mode and connect to PC via USB.
If it offers you something(takes a minute), click the little download arrow and when it's downloaded, click rescue.
This is what it looks like for me before I would click the download arrow.
I believe this tool is for people who have a locked bootloader, never unlocked? LMSA won't recognize my device. RSD lite won't either.
Persistent memory has some value that is not overwritten by Wipe All twrp? Of course I will never relock.... just a heads up to others.
I am one of the few.... 1900-1 Fi working fine on Aug Pie factory and wanted to try ionOS. Flashed fine and working good. Now 3 carriers in my area only US Cellular has service. T-Mob--, Sprin- coverage area 10 - 0% Found as I have before No ROM other than stock for ME can get Data services to work on all three carriers in my area. So for data services trying to reflash back to stock. NO factory image successfully flashed will have modems working. For me. Tried many forms of flash modems only via fastboot, nope.
Different flavors of ADB don't help. Now I haven't tried "Hardware tools loader" style because if wrong will brick it. Unless some one has? Various forms of flashing modems, flash all scripts, ADB versions, Hardware only flash from two ROMs (which is why I am here I think) the Wipe All needed for those two roms some how did it? No blame, just for some reason can't flash back to stock. Others have but....I can't. So hoping a forward update by Motorola Factory Image will do a complete modem working Flash.
kkjb said:
I believe this tool is for people who have a locked bootloader, never unlocked? LMSA won't recognize my device. RSD lite won't either....
Click to expand...
Click to collapse
My phone IS bootloader unlocked - I bought it used(ebay) and it came to me that way with a fresh 8.1 It gives the usual bootloader unlocked error message on boot. It has OTA updated itself to 9 Oct 1 '19 security. I have not tried to modify it because that would prevent me from getting future OTAs.
RSDlite latest (6.2.4) does not recognize my phone. That is RSDlite's fault. I don't think it is yet capable of an A/B phone, let alone a full Treble (ours, on 9, are not full Treble, only partial but DO have A/B sets of partitions).
From the attached pic you can see it was ready to flash my phone with the latest stock ROM appropriate for my device which is a 1900-1 One fi, even though it was unlocked.
I am guessing that Motorola invented lmsa to stem the flow of trashed phones to Moto factory repair. It wouldn't surprise me if it would auto blankflash if necessary.
Try it - it only takes a minute or 2 to test! The worst it can say is "no"!
Understand, tried all the options and LMSA needs I think a stock recovery, boot, fastboot flash mode. The various options show "phone not recognized" no mode available with twrp installed to goto Factory Flash as LMSA appears to wait for in Bootloader Mode. So the drop down box screen will not appear since not recognized.
This post was just a update as you had asked for others to give their results. So going to do hand flash of factory images again, see if try many times... and some how one works
kkjb said:
Understand, tried all the options and LMSA needs I think a stock recovery, boot, fastboot flash mode. The various options show "phone not recognized" no mode available with twrp installed to goto Factory Flash as LMSA appears to wait for in Bootloader Mode. So the drop down box screen will not appear since not recognized.
This post was just a update as you had asked for others to give their results. So going to do hand flash of factory images again, see if try many times... and some how one works
Click to expand...
Click to collapse
Thanks.
Bummer this didn't work for you.
Yeah phone definitely needs to be in fastboot mode.
Hopefully it will help others.
Yeah, back when RSDlite worked you could "sledge hammer" just about anything if it would boot to fastboot! Hopefully they will upgrade it...
No Thank You, you gave me some ideas about the a/b devices thoughts. We have the odd ball not 9.0 at release device so the a/b script is different than some devices. So with the newest ROMs using fastboot "flash all zip scripts" for a/b boot slots I think the problem is factory images want something else for the modems. Oddly the factory images flash fine with no errors just that no modems...imei, wifi, blutooth. 8.0,8.1,9.0 all. Its a weird problem.
kkjb said:
No Thank You, you gave me some ideas about the a/b devices thoughts. We have the odd ball not 9.0 at release device so the a/b script is different than some devices. So with the newest ROMs using fastboot "flash all zip scripts" for a/b boot slots I think the problem is factory images want something else for the modems. Oddly the factory images flash fine with no errors just that no modems...imei, wifi, blutooth. 8.0,8.1,9.0 all. Its a weird problem.
Click to expand...
Click to collapse
Yeah I was thinking a-/b prob
If you ran the "flash all fi bat" to install ionOS it would have worked well since, with Aug 9, you were in a 2 file system phone. so i am guessing
a) you would only have success flashing a 9 stock (fi or not)
b) you would probably have to do a preliminary flash with just the stock 9 bootloader etc (the stuff before the ping. as well as maybe the 2 modem erases later in the command stack - some playing needed there...) tons of guesswork and luck needed here!
c) I found it humorous that ionOS script made b active but I hope the dev knew what he/she were doing.
edit d) so what partitions set is active after you flash your tests? ie you flash something, but what are you then booting to - unless you set something active... I don't believe there is a default - just last successful - though I assume if one fails it will try the other. Perhaps endlessly.
But, yeah, I can see why that flash went well. But of course you are then stuck with the modems they flashed and how that particular opsys planed to use them. US cellular is apparently known to be iffy on the X4 since I saw that caveat on a number of ebay x4 sales - "not guaranteed for...". And Sprint, of course is cdma but is supposedly accessible as LTE by fi??? I have zero knowledge there!!!
WARNING WHEN DEALING WITH ME - I TEND TO MAKE A POST AND THEN KEEP EDITING IT ENDLESSLY>>> SORRY!
Hi All.
I trust you well. I was wondering if I could request your assistance with updating my TF701T to a new version of android. I have tried many methods and none has worked. I am actually more confused now as to where to start and what to download and install. :silly:
If possible maybe direct me where I could get a step by step guide with the links to the correct downloads/procedure.
I imported the pad from USA to South Africa and barely used it.
Kind Regards
Rob
(h-tee-tee-pee-s) androidbiits.com/root-asus-transformer-pad-tf701t-easily/
probably use the versions of magisk + twrp that are linked at the site, as they are tested with that hardware -- the latest versions may not work. i do not own that particular device and am not a programmer -- just trying to help you out. search the web for info if anything is confusing in the instructions -- i can't really walk you through it, but the person at that site may be able to help you out if you get stuck.
you'll need to connect the asus pad to a computer, so you'll need the usb data cable & adb installed on the computer.
you will likely also need open gapps to get the play store + apps working. select processor type, android version, then variant. you can find it here ==> (h-tee-tee-pee-s) opengapps.org <== but i'm not sure how long that will be functional, as hosting is apparently migrating to sourceforge.
please note that there are no w's in either address mentioned previously.
here's an explanation of gapps ==> (h-tee-tee-pee-s + w's) androidfreeapks.com/apk/download-gapps-for-android/
...and there are also download links for various variations at that last address too. cheers!
you will not be able to install *the latest* version of android (it's just plain not out there as a mod for a device this old) but you *can* get something a bit newer than the stock version on it.
best of luck!
one last thing (pertaining to the very first thing you have to do) is unlock the bootloader.
(h...s + w's) asus.com/us/Tablets/The_New_ASUS_Transformer_PadTF701T/HelpDesk_Download/
you will find the utility to do so at the above site. select Android, then under "Utilities"
click "See All Downloads" - therein, the 2nd thing from the bottom in that section is the unlock tool,
which says: Unlock Device App. V1.o (there's only one thing with that name. size is 448.82 kb)
and it will only work from the stock Android version, which i assume is still functional on your device.
Magisk is apparently a newer replacement for SuperSU, which doesn't flag the system as altered...
therefore you *may not* need to install Gapps if using Magisk - that seems logical to me, but i am not certain.
thanks for the assistance Dorkus.........this is killing me....but I will keep the faith and try again
I am trying myself and cannot get the unlock tool to work, performed wipe data reset without google account and still "network error occurred" . Android version 4.4.2
bobwho said:
I am trying myself and cannot get the unlock tool to work, performed wipe data reset without google account and still "network error occurred" . Android version 4.4.2
Click to expand...
Click to collapse
Same here. I tried to contact Asus but no hope... We're completely blocked unless they do something? No other way to unlock?
greetings all, it is i, dorkus, of the house of mallorcus. haha. my name is actually reni.
xda keeps locking me out for some reason. i've now created 2 accounts (3 including the one from which this comment is posted) one even with a dedicated e-mail address just for this, but if i try to log in with either one, i get some "invalid" whatever message. admins: what have i said that was grossly incorrect? those links may not be presented in absolutely the most coherent way, but they're the best reasonable explanations of the procedure involved that i could find with about an hour or 2 of research, which i did because of intending to get one of these devices myself (which has now occurred! yay). besides that, who else with greater experience has chimed in on this thread? yes, i've reset my password, on both accounts. after i do so, both times: same "invalid" message. it's wasted over an hour of my time, when i'm just trying to help these people. it's highly annoying & if it continues, well, they'll just have to go it on their own.
to the point:
as luck would have it,
i was able to acquire one of these devices, still in superb condition, for a great deal from ebay. i have been in contact with Asus support & the word is: it's an EOL product, so the unlock servers have been shut down & there is currently no recourse end users have for unlocking their devices. i feel it's doubtful that they'll fire up a server again, but maybe we can pester them enough to develop a fastboot unlock tool? it sure would have been nice if it worked like that in the first place, but oh well, like the song says:
you can't always get what you want.
i will surely let you all know if am able to make any progress on unlocking my TF701T.
footnote: i also have a TF700 model which is in fact unlocked, has TWRP installed, and is running Android 5.1.1 {zombie-pop} which works a bit better than the Cyanogen mod flavor that it came to me with: somewhat improved user experience, maybe a little snappier too, but speed improvement is fairly minimal. most importantly, almost all of my apps work on it - a few don't even have an installer for Android 4 at the Play Store. the 701 is noticeably more responsive than the 700 model, even running 4.2.2 - the main issue with it for me is not being able to run all of my apps, some of which are purchased. i'd probably sell the 700 if i could get everything on the 701. oh well. it's an excellent reader + portable video viewing device even at stock. it's definitely worth what i paid in the condition received, but it'd be even better if i could unlock the bootloader & get a newer version of Android on it! i could possibly even be so happy that i'd float a couple bux Tim Duru's way, the guy primarily responsible for porting Android 6+7 (the latter of which apparently does not have a working camera) to this device.
footnote #2: the first day i got the 701, i tried to do a firmware update (proper region, latest available. full battery charge. the battery in the one i picked up is in fantastic condition, the thing is practically brand new + functions nicely... but now Asus won't let me unlock it, even though it's well out of warranty! grrrrr) which crashed mid-way & then it proceeded to get into an update / crash boot loop. i was pretty sad for a while, but did not give up & found a way to restore the original firmware (which turned out to be a very minor upgrade) from the SD card, thanks to information in a post here in the xda forums. that post is the link which follows. my thing would still go into fastboot (albeit slightly corrupted) + recovery mode, which enabled an SD card firmware flash to happen {...and lo, my little slab of Jelly Bean was resurrected...} so i did not require the NvFlash tool at all... but it's still there at the provided links in that thread.
to summarize the procedure:
1) format an SD card to fat32
2) download the appropriate firmware from Asus [**please note the region: if you flash the firmware from a wrong region onto your device, you will -hard- brick it + will then be required to use the NvFlash tool**]
3) un-zip the firmware (not completely, just remove nesting - so you have only one zip file)
4) rename the one remaining zip file: t4_sdupdate.zip
5) put that file on the root directory of SD card, then into the tablet (while turned off)
6) invoke recovery mode (power + vol down) & choose the recover [RCK] box (hit volume up, while it's the selected of the 3 choices) and from there the firmware update happens automatically. you can apparently upgrade to any official firmware by this method, but **cannot** downgrade... so i'd suggest leaving it at 4.2.2 until we are 100% sure that there are zero bootloader unlock options, because apparently the unlock tool, from what i understand, only works from the original 4.2.2
without further ado:
https://forum.xda-developers.com/transformer-tf701/tf701t-nvflash-unbrick-solutiontested-t3742848
it's now a few hours later from my original post, near bedtime for me, and the xda gods let me log into this account to make this edit... and it's even allowing URLs now! will wonders never cease? not sure what the problem was earlier, but it was quite annoying. anyway, if it lets me log into the account with the dedicated xda e-mail address, that's the one i'll use in future. username is renigade.
fly a kite said:
...
Click to expand...
Click to collapse
Hello @fly a kite @dorkus mallorcus @renigade
Please consult the inbox of your private messages. Thanks for your cooperation!
Stay safe and stay healthy!
Regards
Oswald Boelcke
I need help too. So, I own a Moto G5s plus sanders. I unlocked its bootloader the day I got it. Didn't keep any backup and rooted it. I Also installed dot os based on android 11. But my 4G Volte connection was finicky. So, I decided to use a Volte zip patch. But, anyways I flashed the zip via TWRP and tried to reboot. But the phone didn't turn on after that. After a few minutes to my shock I understood that I hardbricked my mobile. No button combos, nothing worked. Anyways in my desperation I found a YouTube video showing the use of blankflash to revive a phone and lo and behold I used the procedure to again restore my device. It booted to the fastboot interface. But my happiness was short lived. My baseband was unknown at this point and the bootloader was I dunno downgraded to 0.5 inplace of 2.12. But, more importantly the unlock status was lost. I unlocked it again and all went well. I could even flashed TWRP. but then I realised I couldn't upgrade my bootloader. I couldn’t do anything. It's always gives a "security downgrade", "preflash validation failed" and "permission denied" error. I even tried RSA official rescue tool from Lenovo but even it was unsuccessful. It was never unsuccessful before that. Not even with a unlocked bootloader. I researched for days and tried custom ROMs. I flashed stock images. Nothing brought back my baseband and IMEI. When I type "fastboot oem unlock critical" it gives me permission denied error with a message. "Need OEM signed bootloader." I think the blankflash bootloader is the root of all evil. I need to change it and therefore I need to enter the edl mode. I have tried all adb commands and fastboot commands. The phone reboots okay after those commands but never goes into edl mode whatsoever. I am also ready to do a controlled hardbrick of my device to go into the edl mode so that I can use my device again with a proper bootloader and a properly working fastboot. Please help
i think this vid will help
Greetings everyone. Sorry if I posted this in the wrong forum. Please move this in appropriate forum if I made a mistake. Believe me, for the last 7 days I have searched all of xda and internet, followed innumerable guides, FAQs and workarounds and none worked. So, as a last resort I am starting this thread
Device: Motorola Moto G5s Plus XT1804 ......4GB _64GB variant
Problem: 1) Baseband not found (unknown) Original Baseband: M8953_52.61.07.98R SANDERS_INDIADSDS_CUST
2) IMEI 0 (Sim cards are not detected).
I bought this refurbished phone about an week ago after my last LG went kaput. I was happy by the build quality of the phone. But it only ran Android 8.1 Oreo. So, I decided to put a custom ROM in it. I am not exactly a newbie to the world of CyanogenMods, Lineage OSes and Pixel Experiences. Or, so I thought. Anyways, after a lot of searching I finally decided on Dot OS 5.2 Official Android 11 version. The ROM looked very pleasing and the reviews looked positive. So, I got the unlock key from Motorola website, unlocked the bootloader, put in official TWRP recovery in it. Everything went like a breeze and in all that excitement I forgot to take a backup of the persist, efs and other partitions. A very costly mistake it seems. DotOS booted fine and looked really fresh till I found that there is a small cross near the SIM card network signal triangle up righthand side corner and the signal is only LTE and not VOLTE. I was using a Vodafone Sim card at the time. Although VOLTE option was enabled in SIM settings. To confirm my doubts regarding VOLTE I switched to a JIO Simcard and alas I was not able to make a call without redirecting through the horrid JIO calling app. VOLTE was indeed not working. So, I looked up for a fix and I found a Volte ZIP file from here https://www.google.com/url?sa=t&sou...0QFnoECBAQAQ&usg=AOvVaw0YgJvCjQWXXV8WQSJkxBOK . This was the starting of my troubles. I flashed the universal VOLTE fix zip from TWRP and it flashed fine. On rebooting, I found to my shock that my phone was not turning on. I pressed and held the power key and there was no sign of life. I couldn’t go to the fastboot bootloader or recovery. Only the white led blinked at the top when connected to the charger. My phone was apparently hard bricked. I searched frantically for a solution in this forum and YouTube wherein I found that one can bring it back to life by doing a blankflash. Found the blankflash file here https://www.google.com/url?sa=t&sou...wQFnoECAsQAQ&usg=AOvVaw1eVdBWGVFr8aiqLdP-ZkeT followed the instructions and it flashed my bricked device back to fastboot. I was relieved for a moment but the next I found that the Bootloader version has downgraded from BL C2 07 to BL C0 05. I knew something was wrong as bootloader downgrade shouldn't be possible. Also the unlock and rooted status were also lost and the baseband was unknown at this point. Anyways the device was recognised as a fastboot device and I tried to flash the stock ROM latest version using the fastboot. But, only then I realised there was something wrong with the bootloader. It gave errors like security downgrade, permission denied, preflash validation failed, remote command failed. At this point I was truly confused and worried. Why would it think the latest bootloader to be a security downgrade to a supposedly old bootloader and prevent me from flashing it. However it did flash the other files like gpt.bin for partition, oem.img, boot.img, system.img sparsechunks and everything else. I booted back to Android 8.1 Oreo and everything seemed working except my IMEI now read zero and my Simcard was not recognised by the device. After that I again unlocked my bootloader. Somehow the original unlock key worked and the bootloader screen said flashing unlocked but the bootloader didn't behave like an unlocked bootloader. The TWRP installed fine but couldn’t install the latest Pixel Experience. The flash screen said PE 11 was for Sanders and my device is (blank no name). I tried both the normal and plus and both behaved similarly. Lineage OS unofficial builds behaved similarly. I again tried Dot OS and Arrow OS and both installed fine except there was no signal. For a moment I tried to forget about the bootloader but concentrated on recovering my IMEI and Baseband but I couldn’t. For nearly 5 days I tried different guides including a detailed guide using Validus Sanders ROM but none worked. My EFS folder has files around 12 megabytes but my Persist seems deleted at zero bytes. The IMEI keeps changing between null, zero and unknown depending on the 20 something ROMs I tasted on this device. At this point, I am at a loss. This was to be my main phone and I am financially crunched. I can't buy another phone right now. I think that blankflash bootloader is corrupted and it is giving me permission denied errors. Even Magisk won't work properly. I even tried using the official rescue and smart assistant tool by Lenovo and it failed at 47 percent. I tried in different computers and Win7 to Win 11 OSes but it was of no use. I also tried getting a QCN file but I couldn’t get one for the device to recover the IMEI. Please suggest something if anyone of you can save this poor device of mine. Thanks in advance
Raghaov said:
i think this vid will help
Click to expand...
Click to collapse
Thanks for the quick reply but my phone is soft bricked now. It was hardbricked and I uses a faulty blankflash bootloader to bring it back to life. My device is softbricked now. I have lost my baseband and I have no IMEI. I cannot take calls and no mobile data. Can you show me a way to go to edl mode in my device. Thanks again.
can your phone turn on if yes can you root it with magisk
if yes then pls tell me i will tell you
I can do everything except calling and mobile data. Yes, I have rooted with Magisk and have root access. But my baseband is unknown and my IMEI is showing zero. I can't call or access mobile data. Although I can use wifi
I have tried what is shown in this video already. Didn't work
I think the blank flash bootloader was corrupt or of a different region.
so go to magisk manager and on top-right corner you will see setting click the button right next to it and click on reboot to edl
I didn't even knew that. Trying asap. Will update
Doesn’t work. Reboots back to system.
Updated Magisk to latest and tried both edl and download mode like you said brother. Everytime boots back to system. Am I missing something. The phone was not connected to the PC at the time
I am on stock Oreo now. Rooted and twrp installed
An interesting observation while installing Xposed, it gave an error that the device is not rooted properly
I have an untouched dump file for my model. The whole thing. Could you please guide me how I can restore my smartphone from that.
can you flash it through adb sideload fastboot twrp etc
I don't know but I sold the device. I bought a new one. Thanks @Raggaov for the help.
you're welcome