Related
This is my own completely Off Topic Discussion thread.
A place where I will bring HW related discussions, that do not fit into
specific threads or discussions.
Please, do not post here with general questions or other junk that I have not initiated myself.
Also do not ask where to find files/programs mentioned in this thread, because if I have not linked to them, I don't know!
They will be removed. (Thanks for understanding.)
See you.
<< Better reserve for more dragons >>
Didn't see that anyone mentioned it and I'm not sure if the S4 modems are as well, but the initial container that the modems are in on the HTC used S3 chips is a fat16 format. I saw that with a simple hex editor showed it and I was able to see the modem file structure as well. I'll snag a few S4 modems later today and take a look. Couldn't unpack and repackaged though, which is probably the EFS formatting with it.
Off topic goes in off topic
Sorry it took so long
I had intended to do this at least a week ago, but had not the chance. Both the S3 HTC Radios and the S4 HTC Radios are fat 16 imgs.
As you see in the Rezound screenshot, in the first few lines of the HEX table in the bottom left mentions no volume label and a fat 16 label on the type. in addition when I use IMG viewers it shows the same with both the MDM9K image and the main IMG. This should theoretically enable us to possibly use amss imgs or other parts of the radios with other devices or even cross the modem over to other Samsung devices with the same modem chips.
In addition as per the Ville screenshot, this is the One S modem for one of the European basebands. Again the HEX shows Fat 16 as the file type, but the file structure and amount of files are much more plentiful. If this can become of any use, great. If not, oh well... but it is good food for thought either way.
On other notes, I did try to copy files from the LTE baseband (MDM9k) from the Vivid and move them to the MDM9k IMG for the rezound, but the IMG bloated. I haven't had enough time to try and mount the images in my Ubuntu environment, but doing it in Winblows caused the IMG to bloat up too much and caused radio issues and IMEI unknown blanks.
Happy perusing and happy hunting!
Very nice, but I doubt you'll be able to mix modem files (between different devices) unless you're absolutely sure that the device modem and AP HW is the same. Apparently from another recent conversation, it seem that HTC and Qualcomm are both moving to unified source code for their devices. So it can still be true that many of those files are the same across devices.
Could you write a few lines on how you go about this extraction and do it for the HTC One X (LTE)?
Also don't forget that US HTC One X (or S, or whatever) is not the same hardware and the European one!
On second thought, I think this is what you got..right?
Pretty much. Seems like another situation where I should have spoke up when I first saw it with Qualcomm S3 modems in May. On moving files though, I was planning to stay in family. S3 w/ S3 ect.
^^ BTW. Could you tell if there are any structural differences (content wise) between files of same prefix, but sequential postfix? What is strange is that they are all very different sizes, which indicate they probably have very different content...
If it was just one solid piece of firmware, it would just have been chopped up into equal sized pieces...
I'll look closer on that. I do remember that most of the sequential pieces were the same size minus either the first or the last, holding with your theory.
Maybe not the right place, but have you looked at the pit files?
COM_TAR2MSM8960
MODEM non-tlos.bin
sbl1.mbm
sbl2.mbm
sbl3.mbm
aboot.mbm
rpm.mbm
BOOT boot.img
TZ
PAD
PARAM
EFS efs.img (ext4)
MODEMST1 nvrebuild1.bin
MODEMST2 nvrebuild2.bin
system.img (ext4)
userdata.img (ext4)
persist.img (ext4)
cache.img (ext4)
recovery.img (ext4)
FOTA
BACKUP
FSG
SSD
GROW
PGPT pgpt.img
PIT MSM8960.pit
MD5 md5.img
SGPT sgpt.img
I know it is not really new, but I hadn't seen the img names.
The ones I took screenshots of were for 3rd and 4th Gen Snapdragon processors, radio.imgs for HTC devices. The Samsung pit files may give good cross references though. I'll re-unbox my Amaze this evening and check the mounts to see any information on the single file broken into pieces theory.
"eMMC Partition tools usage for msm7x30/msm8x60"
(A repost from Anyclub...)
In the eMMC boot, there are some changes in eMMC partitioning.
Code:
[SIZE=2]partition.xml - Everything begins with this file, which describes the number of
partitions desired, and how many sectors each one should be.
PartitioningTool.py - translates partition.xml into binary partitions
msp.exe - writes binary partitions to SD/eMMC cards using card reader
mjsdload.cmm - writes binary partitions to SD/eMMC cards using Trace32
msp.py - writes binary partitions to a single image file
QPST - writes binary partitions to SD/eMMC cards on Target
[/SIZE]
Helper /Debug Tools:
Code:
[SIZE=2]parseBinaryPartitionFile.pl - Decodes MBR partition tables. Run:
"Perl parseBinaryPartitionFile.pl partition.bin"
to generate the partition information
parseGPT.pl - Decodes GPT partition tables
[/SIZE]
partition.xml
These are the property entries that can be added in new partiton.xml to specify the configuration.
Code:
[SIZE=2]<parser_instructions>
WRITE_PROTECT_BOUNDARY_IN_KB = 0
GROW_LAST_PARTITION_TO_FILL_DISK = false
ALIGN_ALL_LOGICAL_PARTITIONS_TO_WP_BOUNDARY = false
</parser_instructions>[/SIZE]
WRITE_PROTECT_BOUNDARY_IN_KB: Typical boundaries are 64MB, i.e. 65536 KB. This
means that a 256MB eMMC card has 4 write protect boundaries. Any or all of
them can be marked as read-only. Different vendors allow for different sized
boundaries.
GROW_LAST_PARTITION_TO_FILL_DISK: In partition.xml the size of each partition
is specified. If this field is TRUE, then the last partition size is ignored
and set to 0. Then during patching this size is updated such that the last
partition extends to use all remaining space.
ALIGN_ALL_LOGICAL_PARTITIONS_TO_WP_BOUNDARY: To allow total flexibility, it
could be that a partition that is currently writeable might need to be marked
as read-only. This can only happen *if* that partition begins on a write
protect boundary (i.e. 64MB). Thus if this field is TRUE, then all logical
partitions are positioned such that they begin on a write protect boundary.
PartitioningTool.py
Is a new tool used to generate the the partition.xml
When run, it will output following 5 files:
1. emmc_lock_regions.xml
This hold the sector ranges that need to be marked as read-only by the
operating system (this is from readonly="true" in partition.xml) i.e. modem
code and boot images are typically on read-only partitions Typical
Write-Protect boundary is 64MB = 131072 sectors = 0x20000 sectors. The file
below is protecting the very first 64MB region of the card,
Boundary #0
Starting at sector 0
Ending at sector 131071 (for a total of 131072 sectors)
Code:
[SIZE=2]<?xml version="1.0" ?>
<protect>
<!-- NOTE: This is an ** Autogenerated file ** -->
<!-- NOTE: Sector size is 512bytes, WRITE_PROTECT_BOUNDARY_IN_KB=0, WRITE_PROTECT_BOUNDARY_IN_SECTORS=0 -->
<!-- NOTE: "num_sectors" in HEX "start_sector" in HEX, i.e. 10 really equals 16 !! -->
<program boundary_num="0" num_boundaries_covered="1"
num_sectors="20000" num_sectors_dec="131072" physical_partition_number="0"
start_sector="0" start_sector_dec="0"/>
<information WRITE_PROTECT_BOUNDARY_IN_KB="0"/>
</protect>
[/SIZE]
2. partition0.bin
This holds the partition tables, i.e. MBR followed by all EBRs. This is the
partition table in binary format. It is copied over to the storage device in a
1 to 1 manner. I.e. how it looks in partition0.bin is exactly how the
partition table will look on the storage device. partition0.bin is a "generic"
file meant to fit on *any* size SD/eMMC card, as a result, there are 0's that
need to be patched,such as EXT partition and last partition size.
3. patch0.xml
Contain the patching instructions to tailor each partition table
"partition0.bin" to a specific SD/eMMC card. I.e. the partition0.bin
partition tables can be applied to any size storage device As a result,
there are empty values (zeros) in the partition tables that must be filled
in with a specific cards sector size
There are two ways to apply this patch:
a) (patch before) When you patch the "zeros" in the partition tables held in the file partition0.bin, and then write it to the card
b) (patch after) When you write partition0.bin to the card (which still has "zeros" in it), and then patch the cards partition tables directly
4. rawprogram0.xml
precise sector details of all partitions and what files (if any) need to
be placed there. In addition to writing partition tables onto a device,
often times it is desired to write one or more files into the partition
area as well, The File has partition name (i.e. label), where it begins
(start_sector) and how big it is (num_partition_sectors). It also
describes what file(s) to write to this partition, as well as any
offsets.
Example:
Code:
[SIZE=2]<program file_sector_offset="0" filename="partition0.bin" label="MBR"
num_partition_sectors="1" physical_partition_number="0"
size_in_KB="0.5" start_sector="0"/>
<program file_sector_offset="1" filename="partition0.bin " label="EXT"
num_partition_sectors="2" physical_partition_number="0"
size_in_KB="1.0" start_sector="779"/>
[/SIZE]
The 1st line describes taking the 1st sector from partition0.bin, and writing it to sector 0 of the card.
The 2nd line describes taking the 2nd and 3rd sector from partition0.bin and writing it to sector 779 of the card.
I.e. file_sector_offset = 2 and num_partition_sectors=2
5. loadpt.cmm
This is used by the mjsdload.cmm to flash the image.
msp.exe
This is used to apply the patches
This program will program a memory card (SD/eMMC) attached to the PC as USB mass storage device
Use -d to detect the path of the memory card if you are unsure what to do first
Commands list:
Code:
[SIZE=2]-h (Print this help message) Ex. msp -h
-d (Detect which storage device ID is active) Ex. msp -d
-p (Print partition information) Ex. msp -p /dev/sdb
-pp (Print partition information - DETAILED) Ex. msp -pp /dev/sdb
-x (Write files as outlined in rawprogram.xml) Ex. msp -x rawprogram.xml /dev/sdb
-xx (Write files as outlined in rawprogram.xml - DETAILED) Ex. msp -xx rawprogram.xml /dev/sdb
-s (Write SINGLE IMAGE "singleimage.bin" as outlined in rawprogram.xml) Ex. msp -s rawprogram.xml 8192
-v (Verify file written correctly as outlined in rawprogram.xml) Ex. msp -v rawprogram.xml boot.img /dev/sdb
-f (Program single file as outlined in rawprogram.xml) Ex. msp -f rawprogram.xml boot.img /dev/sdb
[/SIZE]
To program the SD/eMMC with msp.exe in mass storage mode:
Code:
[SIZE=2]STEPS Complete example (patch after)
-------------------------------------------------------------
parse partition.xml python PartitioningTool.py partition.xml
Detect your device msp -d
Program your device msp -x rawprogram0.xml /dev/sdb
Patch your device msp -xx patch0.xml /dev/sdb
STEPS Complete example (patch before)
-------------------------------------------------------------
parse partition.xml python PartitioningTool.py partition.xml
Detect your device msp -d
Patch your files msp xx patch0.xml 15758336 (patch the 8GB card offline,this will change the partition0.bin)
Program your device msp x rawprogram0.xml /dev/sdb
[/SIZE]
The msp.py program can also used to patch the files.
For example:
python msp.py patch0.xml 15758336
This will patch the 8GB card offline, and change the partition0.bin.
Qualcomm DBL format (source Anyclub)
DBL is combined by three images.
dbl.bin - the raw DBL image
dbl.hd - the dbl header image
dbl_preamble.mbn - the preamble image with following format:
Code:
[SIZE=2]+------------+
|Dbl-preamble|
+------------+
|Dbl-header |
+------------+
|Dbl.bin |
+------------+
[/SIZE]
PBL is using the dbl_preamble to detect the NAND page size. The NAND controller
can detect 512 byte and 2 Kbyte page size automatically, but for NAND page size
more than 2K, PBL needs preamble to determine the page size, so for 512/2K
NAND,eMMC,eSD,oneNAND , the preamble is optional.
For the dbl_preamable, the first two words are same as dbl header, they are
codeword and magic,
ref image_header.c
Code:
data_ptr = autodetectpage;
*data_ptr = sbl_header.codeword;
data_ptr++;
*data_ptr = sbl_header.magic;
data_ptr++;
*data_ptr = AUTODETECT_PAGE_SIZE_MAGIC_NUM;
the third one is auto page size detection magic number.
The usage of the auto detection magic number is as below description To
understand this more clearly, for example ,if the dbl_preamble is 8KB. When we
detect the NAND page size > 2KB, we will set the default page size as 2K, then
try to read the preamble image from NAND flash, in case the page size is 4KB,
when read, can get 2 magic number in 8K size because page size will increase
with 4K byte steps, so page size is detected and that is 8K/2 = 4. For the 8K
page NAND, 1 magic number is read from the 8K size preamble image, so the page
size will be 8K/1 = 8K.
Dbl_preamble layout:
Code:
[SIZE=2]+-------------------------------------------------+
| codeword|magic|autodetection_ magic|............|
2K------------------------------------------------|
| codeword|magic|autodetection_ magic|............|
4K------------------------------------------------|
| codeword|magic|autodetection_ magic|............|
6K------------------------------------------------|
| codeword|magic|autodetection_ magic|............|
8K------------------------------------------------|
| codeword|magic|autodetection_ magic|............|
+-------------------------------------------------+
[/SIZE]
E:V:A said:
parse partition.xml python PartitioningTool.py partition.xml
Detect your device msp -d
Program your device msp -x rawprogram0.xml /dev/sdb
Patch your device msp -xx patch0.xml /dev/sdb
Click to expand...
Click to collapse
Hello, where i can find these files, i have qpst but there are no such files.
So does this explain why the pit references: pgpt.img, md5.img, sgpt.img but they aren't on any partition, (they should be after GROW blk0p23)
dviguha said:
Hello, where i can find these files, i have qpst but there are no such files.
Click to expand...
Click to collapse
I think it could be part of the Qualcomm Development Acceleration Resource Toolkit (QDART), as it supersedes QPST. But I'm not sure...
joederp said:
So does this explain why the pit references: pgpt.img, md5.img, sgpt.img but they aren't on any partition, (they should be after GROW blk0p23)
Click to expand...
Click to collapse
Where do you find these references?
I don't know, so if you find out let us know.
http://forum.xda-developers.com/showthread.php?t=1848267
If you dump the pit file you can see the references if you open in hex editor. Since it defines partition locations it appears they are either after last partition.. I haven't looked into technical pit stuff.
Sent from my SGH-T999 using xda app-developers app
Photo Place Holder Post
All images that I have not yet posted goes here...
Where can i find parseBinaryPartitionFile.pl or parseGPT.pl ?
vache said:
Where can i find parseBinaryPartitionFile.pl or parseGPT.pl ?
Click to expand...
Click to collapse
You tell me!
Code:
<Disclaimer>
[FONT=Verdana]All the information and tools mentioned in this post are not my work.
I still need to add a proper credits section to this post, which will take a while,
since the tools and documentation came from many different sources.
As with any experimental tool, proceed with caution.
</Disclaimer>
[/FONT]
Hi Everyone,
I've managed to get myself in a bit of a pickle by hard bricking my Nexus 4 (By accidentally running mkfs on all the block devices, DOH).
This has led me to take a serious look into how the Nexus 4 can be unbricked using the Qualcomm High Speed USB Device (QHSUSB_DLOAD).
The Nexus 4 has a Qualcomm APQ8064 SoC,
As far as I can tell, we will be able to unbrick hard bricked Nexus 4 devices using QPST if we manage to get a couple of files:
1. A working copy of MPRG8064.hex - This is a set of instructions (specific to the APQ8064)
that are sent to the flash programmer on the phone that tells it how to download a copy of the boot image package.
2. A boot image generated for the Nexus 4. This file is typically named 8064_msimage.mbn, which is generated from a couple of other Nexus 4 mbn images.
This file is generated using a Qualcomm utility called emmcswdownload.exe and an XML describing the mbn images and the partition layout of the final 8064_msimage.mbn image.
I have found a couple of examples of these XML files on http://www.anyclub.org/2012/05/how-to-generate-8660msimagembn.html:
Code:
[COLOR=#000000] <?xml version="1.0"?>[/COLOR]
[COLOR=#000000] <image>[/COLOR]
[COLOR=#000000] <physical_partition number="0">[/COLOR]
[COLOR=#000000] <primary order="1" type="4d" bootable="true" label="SBL1" size="1000" readonly="false">[/COLOR]
[COLOR=#000000] <file name="sbl1.mbn" offset="0"/>[/COLOR]
[COLOR=#000000] </primary>[/COLOR]
[COLOR=#000000] <primary order="2" type="51" bootable="false" label="SBL2" size="3000" readonly="false">[/COLOR]
[COLOR=#000000] <file name="sbl2.mbn" offset="0"/>[/COLOR]
[COLOR=#000000] </primary>[/COLOR]
[COLOR=#000000] <primary order="3" type="45" bootable="false" label="SBL3" size="1500" readonly="false">[/COLOR]
[COLOR=#000000] <file name="sbl3.mbn" offset="0"/>[/COLOR]
[COLOR=#000000] </primary>[/COLOR]
[COLOR=#000000] <primary order="4" type="5" bootable="false" label="EXT" size="1000000">[/COLOR]
[COLOR=#000000] <extended order="1" type="47" label="RPM" size="1000" readonly="false">[/COLOR]
[COLOR=#000000] <file name="rpm.mbn" offset="0"/>[/COLOR]
[COLOR=#000000] </extended>[/COLOR]
[COLOR=#000000] <extended order="2" type="46" label="TZ" size="1000" readonly="false">[/COLOR]
[COLOR=#000000] <file name="tz.mbn" offset="0"/>[/COLOR]
[COLOR=#000000] </extended>[/COLOR]
[COLOR=#000000] </primary>[/COLOR]
[COLOR=#000000] </physical_partition>[/COLOR]
[COLOR=#000000] </image>[/COLOR]
and
Code:
<? Xml version = "1.0"?>
<data>
<! - NOTE: Sector size is 512bytes ->
<program file_sector_offset = "0" filename = "" label = "MODEM" num_partition_sectors = "65536" physical_partition_number = " 0 "size_in_KB =" 32768.0 "start_sector =" 1 "/>
<program file_sector_offset =" 0 "filename =" sbl1.mbn "label =" SBL1 "num_partition_sectors =" 1000 "physical_partition_number =" 0 "size_in_KB =" 500.0 "start_sector = "65537" />
<program file_sector_offset="0" filename="sbl2.mbn" label="SBL2" num_partition_sectors="3000" physical_partition_number="0" size_in_KB="1500.0" start_sector="66537"/>
<program file_sector_offset = "0" filename = "rpm.mbn" label = "RPM" num_partition_sectors = "1000" physical_partition_number = "0" size_in_KB = "500.0" start_sector = "69559" />
<program file_sector_offset = "0" filename = "sbl3.mbn "label =" SBL3 "num_partition_sectors =" 4096 "physical_partition_number =" 0 "size_in_KB =" 2048.0 "start_sector =" 70559 "/>
<program file_sector_offset =" 0 "filename =" emmc_appsboot.mbn "label =" ABOOT "num_partition_sectors =" 5000 "physical_partition_number =" 0 "size_in_KB =" 2500.0 "start_sector =" 74655 "/>
<program file_sector_offset =" 0 "filename =" "label =" BOOT "num_partition_sectors =" 20480 "physical_partition_number =" 0 "size_in_KB =" 10240.0 " start_sector = "79655" />
<program file_sector_offset="0" filename="tz.mbn" label="TZ" num_partition_sectors="1000" physical_partition_number="0" size_in_KB="500.0" start_sector="100135"/>
<program file_sector_offset = "0" filename = "pdl_phoneinfo.bin" label = "INFO" num_partition_sectors = "8192" physical_partition_number = "0" size_in_KB = "4096.0" start_sector = "131072" />
<program file_sector_offset = "0" filename = "partition0 . bin "label =" MBR "num_partition_sectors =" 1 "physical_partition_number =" 0 "size_in_KB =" 0.5 "start_sector =" 0 "/>
<program file_sector_offset =" 1 "filename =" partition0.bin "label =" EXT "num_partition_sectors = "22" physical_partition_number = "0" size_in_KB = "11.0" start_sector = "69537" />
</ data>
The relevant mbn images for the Nexus 4.
These can be extracted from either of the following files:
Code:
modem.img radio-mako-m9615a-cefwmazm-2.0.1700.48.img
which in turn is extracted using the BinExtractor tool (included in the tools package) from either the Nexus 4 factory image or a Nexus 4 tot image or .
In order to extract the mbn images from the image file, you have to mount it on a loopback device.
For example:
Code:
sudo mount -o loop /path/to/occam-jdq39/radio-mako-m9615a-cefwmazm-2.0.1700.48.img /mount/point
Nexus 4 Factory images
occam-jdq39-factory-345dc199.tgz
Nexus 4 tot images
LGE960AT-00-V10c-NXS-XX-NOV-14-2012-JVP15L-FACTORY_0.zip
BIN_LGE960AT-00-V10c-NXS-XX-NOV-13-2012-JOP40C-USER+0.zip
File links:
Nexus 4 Unbricking Tools Package Link
DMSS Protocol Documentation (Used by the QPST tool)
PBL Tool (A perl script that implements part of the DMSS protocol)
Some relevant information:
http://www.anyclub.org/2012/04/how-to-build-emmc-flash-programmer.html
http://forum.xda-developers.com/showthread.php?t=1978703
http://forum.xda-developers.com/showthread.php?t=2086142
Current Issues:
1. I cant figure out how to use the MPRG8064.hex with the QPST Software Download tool.
It claims that it can't unscramble the file, it could be that the file isn't valid or needs to be prepared in some way.
2. I'm not sure how to prepare the XML file for the emmcswdownload tool.
If the XML examples above are any indication, we might be able to do this by getting information
from the BinExtractor tool or by examining the Nexus 4 mbn files.
3. I'm not exactly sure which images need to be used in the QPST Software Download tool (Under the Multi-image tab).
If I understand correctly, the boot system we need to use here is Sec Boot 2.0.
More than 100 views and not one reply?
Come on people!
FLYN said:
More than 100 views and not one reply?
Come on people!
Click to expand...
Click to collapse
Here's your reply
But I'll dig into this like I dug into the TouchPad when WebOS Doctor was being an asshole, but for now:
5AM=sleep
FLYN said:
3. I'm not exactly sure which images need to be used in the QPST [/FONT]Software Download tool (Under the Multi-image tab).
If I understand correctly, the boot system we need to use here is Sec Boot 2.0.
Click to expand...
Click to collapse
Doesn't the apq8064 use Secure Boot 3?
At least the most recent QPST version in your package has the option for SB3.0 in the download tool, which in turn asks for a *.xml file.
What it needs to include? Heck if I know..
By the way, thanks for uploading that whole package, there's some nice stuff in there.
I took a good look at all this stuff when I was working on unbricking the at&t lg optimus g, e970, which is basically identical to this phone. By looking through some tools made to rescue samsung qualcomm based devices, and basically concluded that we would require a signed MPRG8064.hex. By using the qdload.pl script found here, http://forum.xda-developers.com/showthread.php?t=2086142, I found that my pbl would stop responding after I sent and attempted to execute the .hex file. I figured that it would seem that the code is signature checked by the pbl before execution, similar to how sbl1 is during the secureboot 3.0 sequence, causing it to die at that stage because of not having a valid signature.
Most likely, the 8064_msimage.mbn would need sbl1, sbl2, sbl3, rpm, and tz at a minimum, but I believe it is essentially just a raw file containing a header and those five partitions that is imaged directly to the internal storage using the MPRG8064.hex.
I found a couple other interesting threads on similar topics that helped me understand a lot of the secure boot sequence, and how qualcomm devices boot in general.
[SOLVED]-[BRICKED]SHV-E160L Korean model
[REF][R&D] MSM8960 Info, Architecture and Bootloader(s)
[REF][R&D] Building Bootloaders on Qualcomm Devices
[R&D] Unlock Bootloaders
I never got it working for my phone, as I found an alternate method to restore the phone based off of booting from our external sdcard, but if you find anything out, I would be interested in it.
I've seen the same concept on the HTC One X. They've never been able to get it to work. Proper hex and mbn files could never be sourced and in the end jtag was the only solution for some hardbricks.
I do however wish you luck and will follow the thread until it dies!
What do you guys think, could it be that the HEX file needs to be converted with Intel HEX2BIN?
Looks like these guys know how to unbrick stuff. I sent them my Nexus 4 couple of days ago with Nexus 7 kernel flashed, we'll see if they can fix it.
http://www.youtube.com/watch?feature=player_embedded&v=gYtNWt1h66E
moldovanos said:
Looks like these guys know how to unbrick stuff. I sent them my Nexus 4 couple of days ago with Nexus 7 kernel flashed, we'll see if they can fix it.
http://www.youtube.com/watch?feature=player_embedded&v=gYtNWt1h66E
Click to expand...
Click to collapse
jtag is "cheating"
lg tool or qualcomm tool method is preferred.
The radio image is not important to get your phone up and running from what I can tell. The APQ chip does not have the modem built in like traditional Qualcomm devices, so there are separate boot images for the APQ and the modem.
So I am not sure you can use those mbn images from the modem image. In the latest 4.2.2 update Google updated the core APQ mbn files, so you can look into the diff to see which files it uses exactly:
http://android.clients.google.com/p...4.signed-occam-JDQ39-from-JOP40D.de8b8d10.zip
If you open the file, you will notice these files:
bootloader.aboot.img
bootloader.rpm.img
bootloader.sbl2.img
bootloader.sbl3.img
bootloader.tz.img
Those are the equivilent mbn files (i.e rpm.mbn, sbl2.mbn). This is what it does with them:
Code:
ui_print("Writing bootloader...");
package_extract_file("bootloader-flag.txt", "/dev/block/platform/msm_sdcc.1/by-name/misc");
package_extract_file("bootloader.sbl2.img", "/dev/block/platform/msm_sdcc.1/by-name/sbl2");
package_extract_file("bootloader.sbl3.img", "/dev/block/platform/msm_sdcc.1/by-name/sbl3");
package_extract_file("bootloader.tz.img", "/dev/block/platform/msm_sdcc.1/by-name/tz");
package_extract_file("bootloader.rpm.img", "/dev/block/platform/msm_sdcc.1/by-name/rpm");
package_extract_file("bootloader.aboot.img", "/dev/block/platform/msm_sdcc.1/by-name/aboot");
package_extract_file("bootloader-flag-clear.txt", "/dev/block/platform/msm_sdcc.1/by-name/misc");
I would try these files instead of the ones in the modem image, as the modem image is flashed as a whole image to /dev/block/platform/msm_sdcc.1/by-name/modem later on instead of individual files to partitions. You also need to find sbl1 somewhere.
Where did you source the hex file? It was a consensus that a hex had to be signed for some devices (htc, wink-wink).
Did you try getting the nexus in download mode? I forgot the button combo, but worth a try. Lgnpst? Looks like you've already found the link for lgnpst stock roms.
What is the status of this forum? Any good news on unbricking the Nexus 4?
SnowLeopardJB said:
I took a good look at all this stuff when I was working on unbricking the at&t lg optimus g, e970, which is basically identical to this phone. By looking through some tools made to rescue samsung qualcomm based devices, and basically concluded that we would require a signed MPRG8064.hex. By using the qdload.pl script found here, http://forum.xda-developers.com/showthread.php?t=2086142, I found that my pbl would stop responding after I sent and attempted to execute the .hex file. I figured that it would seem that the code is signature checked by the pbl before execution, similar to how sbl1 is during the secureboot 3.0 sequence, causing it to die at that stage because of not having a valid signature.
Most likely, the 8064_msimage.mbn would need sbl1, sbl2, sbl3, rpm, and tz at a minimum, but I believe it is essentially just a raw file containing a header and those five partitions that is imaged directly to the internal storage using the MPRG8064.hex.
I found a couple other interesting threads on similar topics that helped me understand a lot of the secure boot sequence, and how qualcomm devices boot in general.
[SOLVED]-[BRICKED]SHV-E160L Korean model
[REF][R&D] MSM8960 Info, Architecture and Bootloader(s)
[REF][R&D] Building Bootloaders on Qualcomm Devices
[R&D] Unlock Bootloaders
I never got it working for my phone, as I found an alternate method to restore the phone based off of booting from our external sdcard, but if you find anything out, I would be interested in it.
Click to expand...
Click to collapse
Booting from an extsd on a nexus 4? R u on krak? Or am I missing something?
Sent from my Nexus 4 using xda app-developers app
"I took a good look at all this stuff when I was working on unbricking the at&t lg optimus g, e970, which is basically identical to this phone."
You missed the first line of the post.
andybfmv96 said:
Booting from an extsd on a nexus 4? R u on krak? Or am I missing something?
Sent from my Nexus 4 using xda app-developers app
Click to expand...
Click to collapse
Recon Freak said:
"I took a good look at all this stuff when I was working on unbricking the at&t lg optimus g, e970, which is basically identical to this phone."
You missed the first line of the post.
Click to expand...
Click to collapse
Oops maybe I on krak
Sent from my Nexus 4
Hmmm
FLYN said:
Current Issues:
1. I cant figure out how to use the MPRG8064.hex with the QPST Software Download tool.
It claims that it can't unscramble the file, it could be that the file isn't valid or needs to be prepared in some way.
2. I'm not sure how to prepare the XML file for the emmcswdownload tool.
If the XML examples above are any indication, we might be able to do this by getting information
from the BinExtractor tool or by examining the Nexus 4 mbn files.
3. I'm not exactly sure which images need to be used in the QPST Software Download tool (Under the Multi-image tab).
If I understand correctly, the boot system we need to use here is Sec Boot 2.0.
Click to expand...
Click to collapse
I've installed QPST, but since I don't have my nexus 4 bricked I can't tell you if this works. But I think that you just have to put the phone image there and the boot image and it shall work.
P.S.
My Nexus 4 is vanilla (just got it for 1 week) so I can provide backups and so on plus the Internal LG Service Manual for the N4(I found it on the web). We shall not give up finding the answer for this as it saves money (no RMA/JTAG repair)
Hello everyone,
In my tinkering with me bricked N4 i have gotten it to show up as QHSUSB_DLOAD in device manager once, and can't seem to get it to do it again. right now it shows up as either a "USB input Device" or an "Unknown device" with a yellow "!". suggestions any one?
Update: After mucking with it for hours, the device hardware ID only shows up as "USB\UNKNOWN" still. I drop on down to Radio Shack as well and picked up a few resistors and made my self a 910K-ohm "download cable"
Still no luck how ever.
Jeffery.Lenz said:
Hello everyone,
In my tinkering with me bricked N4 i have gotten it to show up as QHSUSB_DLOAD in device manager once, and can't seem to get it to do it again. right now it shows up as either a "USB input Device" or an "Unknown device" with a yellow "!". suggestions any one?
Click to expand...
Click to collapse
I'm interested too
JIG USB?
Jeffery.Lenz said:
Hello everyone,
In my tinkering with me bricked N4 i have gotten it to show up as QHSUSB_DLOAD in device manager once, and can't seem to get it to do it again. right now it shows up as either a "USB input Device" or an "Unknown device" with a yellow "!". suggestions any one?
Update: After mucking with it for hours, the device hardware ID only shows up as "USB\UNKNOWN" still. I drop on down to Radio Shack as well and picked up a few resistors and made my self a 910K-ohm "download cable"
Still no luck how ever.
Click to expand...
Click to collapse
Are you trying to do sth like the Samsung JIG USB (300k ohms)?:good:
Hte point of this thread is using the Qualcom HiSpeed USB Download Mode to unbrick our N4!!
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Python for automation using dtmilano's android ViewClient
Syllabus
1. What is python?
2. What is dtmilano's android ViewClient?
2a. How to install dtmilano's android ViewClient?
3. What all methods present in android viewclient?
4. How to import and use android viewclient in our project?
5. How do I automate android native/3rd party apps using android viewclient?
6. How to take screen shots using viewclient?
7. How to handle files using file library?
Let us begin the journey, I hope this one wont be boring
1. What is Python?Python is a general-purpose interpreted, interactive, object-oriented, and high-level programming language.
It was created by Guido van Rossum during 1985- 1990. Like Perl, Python source code is also available under the GNU General Public License (GPL).
2. What is Dtmilano's android viewclient?- AndroidViewClient is a 100% pure python library and tools that simplifies test script creation
and android test automation, providing higher level operations and the ability of obtaining the tree of Views present at any
given moment on the device or emulator screen and perform operations on it.
As it's 100% pure python it doesn't require monkeyrunner, jython or any interpreter other than python.
2a. How to install Dtmilano's android ViewClient?
Install Python from https://www.python.org/downloads/
Now download dtmilano's .egg file from https://pypi.python.org/pypi/androidviewclient/
Once it is done rename the downloaded file to .zip format and after that extract it to C:\Python27\Lib\site-packages.
The easiest method to install this is to use the command "easy_install". If you don't have easy_install installed, install the package python-setuptools(https://pypi.python.org/pypi/setuptools)
Once its done setup environment variable to C:\Python27\Scripts and after that run easy_install <path of downloaded dtmilano's .egg file> and you are good to go.
3. What all methods present in viewclient?- Some of the most used methods I have listed below -
Code:
'TRAVERSE_CIT', 'TRAVERSE_CITB', 'TRAVERSE_CITC', 'TRAVERSE_CITCD', 'TRAVERSE_CITCDS', 'TRAVERSE_CITG', 'TRAVERSE_CITPS', 'TRAVERSE_CITUI', 'TRAVERSE_S', '_ViewClient__findViewWithAttributeInTree', '_ViewClient__findViewWithAttributeInTreeOrRaise', '_ViewClient__findViewWithAttributeInTreeThatMatches', '_ViewClient__findViewsWithAttributeInTree', '_ViewClient__getFocusedWindowPosition', '_ViewClient__hammingDistance', '_ViewClient__levenshteinDistance', '_ViewClient__mapSerialNo', '_ViewClient__obtainAdbPath', '_ViewClient__obtainDeviceSerialNumber', '_ViewClient__parseTree', '_ViewClient__parseTreeFromUiAutomatorDump', '_ViewClient__pickleable', '_ViewClient__splitAttrs', '_ViewClient__traverse', '__del__', '__doc__', '__init__', '__module__', 'assertServiceResponse', 'connectToDeviceOrExit', 'distance', 'distanceTo', 'dump', 'excerpt', 'findViewById', 'findViewByIdOrRaise', 'findViewByTag', 'findViewByTagOrRaise', 'findViewWithAttribute', 'findViewWithAttributeOrRaise', 'findViewWithAttributeThatMatches', 'findViewWithContentDescription', 'findViewWithContentDescriptionOrRaise', 'findViewWithText', 'findViewWithTextOrRaise', 'findViewsContainingPoint', 'findViewsWithAttribute', 'getRoot', 'getSdkVersion', 'getViewIds', 'getViewsById', 'hammingDistance', 'imageDirectory', 'installPackage', 'isKeyboardShown', 'levenshteinDistance', 'list', 'longTouch', 'serviceResponse', 'setAlarm', 'setText', 'setViews', 'setViewsFromUiAutomatorDump', 'sleep', 'swipe', 'touch', 'traverse', 'traverseShowClassIdAndText', 'traverseShowClassIdTextAndBounds', 'traverseShowClassIdTextAndCenter', 'traverseShowClassIdTextAndContentDescription', 'traverseShowClassIdTextAndTag', 'traverseShowClassIdTextAndUniqueId', 'traverseShowClassIdTextContentDescriptionAndScreenshot', 'traverseShowClassIdTextPositionAndSize', 'traverseTakeScreenshot', 'writeImageToFile', 'writeViewImageToFileInDir'
4. How to import and use android viewclient?- Once you have installed android viewclient next step is to use this in our new project. Below is the code snippit for importing android view client -
Code:
'''
Created on Dec 19, 2015
@author: ravi h basawa
'''
from com.dtmilano.android.viewclient import ViewClient
device, serialno = ViewClient.connectToDeviceOrExit()
vc = ViewClient(device=device, serialno=serialno)
5. How do I automate android native/3rd party apps using android ViewClient?
Pre-conditions in your device:
1. Enable USB debugging.
2. Enable stay awake option.
Pre-conditions in PC:
1. android sdk should be present.
2. connect your testing device. (double check with cmd "adb devices")
3. python env. variables are all set.
4. Create a new folder named "Automation" on your desktop.
5. Inside it create a new text file and paste the below given code and save it as Settings.py (or whatever you want to give)
Lets start-- It is very easy to automate android apps using android ViewClient. Let me teach you a simple code which will open settings application.
NOTE: This program I have written using my Nexus device running Android latest version 6.0; So the below program may give you errors. Please edit the code accordingly.
Code:
'''
Created on Dec 19, 2015
@author: ravi h basawa
'''
from com.dtmilano.android.viewclient import ViewClient
device, serialno = ViewClient.connectToDeviceOrExit()
vc = ViewClient(device=device, serialno=serialno)
print "################## Settings application test ####################"
device.startActivity('com.android.settings/.Settings')
print 'TEST : PASS'
Once you write the above code, let us save it as Settings.py And then we will try to open it using IDLE software which will come pre-bundled with python as shown below:
* To execute our newly written code we gonna press F5.
Explanation on above code --
The first line of code is to import dtmilano's ViewClient method.
the second line is used to define the devices which you have connected, In my case as I have connected only one device I will not provide serialno,
Going further I will show you as how to connect to two devices and make them communicate.
6. How to take screen shots using viewclient?
- Now we will take our code to the next level, We gonna open settings app, and then we are going to click on About phone option. and also we'll take screen shot of the device to check as what is inside About phone.
NOTE: Create a folder named "Screenshots" at your current working directory(That is in our case folder named Automation) or else you will get Error saying no folder named "Screenshots" is present.
Code:
'''
Created on Dec 19, 2015
@author: ravi h basawa
'''
import re
import sys
import time
import os
from PIL import Image
from com.dtmilano.android.viewclient import ViewClient
device, serialno = ViewClient.connectToDeviceOrExit()
vc = ViewClient(device=device, serialno=serialno)
print "################## Settings application test ####################"
device.startActivity('com.android.settings/.Settings')
print 'SUCCESFULLY OPENED SETTINGS APP'
vc.dump() ## this is used to refresh the screen.
## below is the for loop used to swipe screen five times. the input swipe command takes 4 args that is X1,Y1,X2,Y2 which can be found using "Pointer location" option present in developer settings.
for i in range(5):
device.shell('input swipe 651 1307 677 680')
vc.dump()
vc.findViewWithText("About phone").touch()##this line will click on About phone option.
print 'About phone option found and clicked'
vc.dump()
time.sleep(2)
device.takeSnapshot(reconnect=True).save(os.getcwd()+'\\Screenshots\\'+'OS_version.png') #this line will take screenshot of the device and store it in the folder named Screenshots.
print 'Screenshot taken'
print 'TEST : PASS'
Now when you execute the above code you will see the result as below -
Now let us write a code to check the current android version displayed under settings app is proper or not.
Code:
'''
Created on Dec 19, 2015
@author: ravi h basawa
'''
import re
import sys
import time
import os
from PIL import Image
from com.dtmilano.android.viewclient import ViewClient
device, serialno = ViewClient.connectToDeviceOrExit()
vc = ViewClient(device=device, serialno=serialno)
print "################## Android OS VERSION TEST ####################"
device.startActivity('com.android.settings/.Settings')
print 'Settings app opened'
vc.dump()
for i in range(5):
device.shell('input swipe 651 1307 677 680')
vc.dump()
vc.findViewWithText("About phone").touch()
vc.dump()
print 'About phone option clicked'
device.shell('input swipe 651 1307 677 680')
vc.dump()
version = vc.findViewWithText('Android version')
if version:
vnum = vc.findViewWithText('6.0')
if vnum:
print 'Android OS version is 6.0'
vc.dump()
time.sleep(2)
device.takeSnapshot(reconnect=True).save(os.getcwd()+'\\Screenshots\\'+'OS_version.png') #this line will take screenshot of the device and store it in the folder named Screenshots.
print 'Screenshot taken'
print 'TEST : PASS'
device.press('KEYCODE_HOME')
else:
print 'Incorrect OS version'
print 'TEST : FAIL'
else:
print 'Android version string not found'
print 'TEST : FAIL'
device.press('KEYCODE_HOME')
In the above code you might be wondring as what does vc.dump() stands for, It is actually refreshes the screen and it makes easier to find required data on the screen. Without vc.dump() method there is 100% guarenty that our script gonna fail.
OK, Now we will wrtie a script which has Python functions in it.
Before this let us learn as what is 'def' in Pyhton is all about:
As we all know that we define functions to provide the required functionality. Below are some rules to define a function in Python.
[*] Function blocks begin with the keyword def followed by the function name and parentheses ( ( ) ).
[*] Any input parameters or arguments should be placed within these parentheses. You can also define parameters inside these parentheses.
[*] function names can be started with a _ or a small letter.
[*] The code block within every function starts with a colon ) and is indented.
Now I will write a simple code to show you as how def works.
Code:
'''
Created on Dec 19, 2015
@author: ravi h basawa
'''
def test():
print 'Hi I am inside a function'
test()
As you can see from the above code, there is a single tab given after the fucntion test():, these are called as indents. Once you start using IDLE for python script writing you will get to know more on these indents.
Just for testing purpose try to write your own functions using IDLE; Once you type as " def test(): " and hit ENTER without the qouats you will see a single tab occured. This is how Pyhton works. There are no curly brases in it. But only Indents. If you can handle these indents you are good to go.
And one more thing I forgot to explain you guys, That is you can Indent a region by using the shortcut ctrl+] and Dedent using the shortcut ctrl+[
For now let us write the same code; But this time we will use 'def' in it.
Code:
'''
Created on Dec 19, 2015
@author: ravi h basawa
'''
import re
import sys
import time
import os
from PIL import Image
from com.dtmilano.android.viewclient import ViewClient
device, serialno = ViewClient.connectToDeviceOrExit()
vc = ViewClient(device=device, serialno=serialno)
def os_test():
print "################## Android OS VERSION TEST ####################"
device.startActivity('com.android.settings/.Settings')
print 'Settings app opened'
vc.dump()
for i in range(5):
device.shell('input swipe 651 1307 677 680')
vc.dump()
vc.findViewWithText("About phone").touch()
vc.dump()
print 'About phone option clicked'
device.shell('input swipe 651 1307 677 680')
vc.dump()
version = vc.findViewWithText('Android version')
if version:
vnum = vc.findViewWithText('6.0')
if vnum:
print 'Android OS version is 6.0'
vc.dump()
time.sleep(2)
device.takeSnapshot(reconnect=True).save(os.getcwd()+'\\Screenshots\\'+'OS_version.png') #this line will take screenshot of the device and store it in the folder named Screenshots.
print 'Screenshot taken'
print 'TEST : PASS'
device.press('KEYCODE_HOME')
else:
print 'Incorrect OS version'
print 'TEST : FAIL'
else:
print 'Android version string not found'
print 'TEST : FAIL'
device.press('KEYCODE_HOME')
os_test()
Output of the above code will be as below:
============= RESTART: C:\Users\ravi\Desktop\testing\Settings.py =============
################## Android OS VERSION TEST ####################
Settings app opened
About phone option clicked
Android OS version is 6.0
Screenshot taken
TEST : PASS
>>>
About file handling
Before we move to the next, Let me teach you as what is 'class' in Python and how do we use it.. Below is the small code consists of a class and one function.
Code:
'''
Created on Dec 27, 2015
@author: ravi h basawa
'''
class ctest():
def test(self, value):
print 'Hi I am inside a function and passed value as >>' + ' ' + value
c = ctest()
c.test('testing')
* From the above code we have created a class named 'ctest' and a function named 'test'.
* Once we create a class to create a function we have to give one tab inside the 'ctest' class.
* The code 'c = ctest()' is creating a object for our class.
* The next line 'c.test('testing')' will pass value to our newly created function.
I hope now u have understood as how 'class' works in Python from the above code.
Ok, Now let us try to send a message and this time let us use "Class" in the below code -
Code:
'''
Created on Jan 10, 2016
@author: ravi h basawa
'''
import os
from com.dtmilano.android.viewclient import ViewClient
device, serialno = ViewClient.connectToDeviceOrExit()
vc = ViewClient(device=device, serialno=serialno)
fd = open('MsgTest.xls',"a+")
fd.write("\nMessanger")
class msg():
def newmsg(self):
print 'Opening Message app'
device.shell('am start com.google.android.apps.messaging')
vc.dump()
vc.findViewById('com.google.android.apps.messaging:id/start_new_conversation_button').touch()
vc.dump()
f = vc.findViewWithText('Frequents')
if f:
print 'TEST PASS'
print 'add button clicked'
fd.write("\tPASS")
fd.close()
else:
print 'TEST FAIL'
fd.write("\tFAIL")
c = msg()
c.newmsg()
The above code does these jobs -
* Creates a class named 'msg()'. And inside we have created a new function named 'newmsg()'.
* This code will open google Messenger app and clicks on the 'add recipients' button.
* If the 'add recipients' button is clicked, our test case will be passed else it will fail.
* 'open' function does the job of creating a new xls file in append mode.
* 'write' function does the job of writing the data to the new line inside the appended xls file.
* 'close' function is used to close the xls file.
is there a way to handle the device keyboard, say, i would like to press a key and then close the keyboard?
Also where can i find detailed documentation?
may be you need to use pointer location(x,y coordinates).
Implicit wait and explicit wait in vc
Hi,
Iam trying to use android view client to automate a task. However, I have a requirement wait for a perticular element to load up.
Is there are function in VC to use implicit or explicit wait.
Thanks
To go back to Sprint stock use this:
Sprint Restore:
https://forum.xda-developers.com/oneplus-7-pro/how-to/sprint-msmdownloadtool-unbrick-t3989841
Crossflashing to European 5G (GM1920):
Outdated method (REQUIRED BOOTLOADER UNLOCK):
Pie
(to set APNs on Sprint, go to *#*#4636#*#* and set the network mode to "LTE/CDMA/UMTS auto (PRL)" , then set your APNs and reboot.)
Input Sprint APNs:
Name: Sprint LTE
APN: x.ispsn
MMSC: http://mms.sprintpcs.com
MMS proxy: oap7.sprintpcs.com
MMS port: 80
APN type: default,mms,supl,hipri,ims,cbs,ia
Protocol/Roaming Protocol: IPv4/IPv6
Flash this in Magisk to enable VoLTE on Sprint:
https://github.com/edgd1er/voenabler/archive/master.zip
If you update to a newer Pie build, you will need to reflash your modem from Sprint, here's a link: http://www.mediafire.com/file/x5g69dx5q64tibk/modem.img/file
OTA updates are fully functional.
The missing information in "About Phone" is normal and does not affect the function of the phone.
If Sprint is your carrier and you update to 10, you will lose APN access for the time being. (Though, humorously, the modem has been unified as of 10 and doesn't need to be reflashed after 10)
10
(Not recommend for Sprint users right now, as there are issues with APNs, GSM/NON SPRINT CARRIERS ARE FINE!)
*Modem has been unified so, you don't need to reflash the Sprint modem after update as of 10.0.4*
Aside from any potential Google SafetyNet updates that break SafetyPatch., this build works perfectly.
"About Phone" is still missing information.
How to flash (applies to conversion and stock restore):
Unlock your bootloader as per:
https://forum.xda-developers.com/on...otloader-unlock-sprint-oneplus-7-pro-t4042145
Follow these steps in order or you will have to MSM restore to stock and try again
Run TWRPadb.bat first
Format Data after the successful flashing of TWRPadb.bat
Reboot bootloader
Run fastbootimages.bat
Reboot
NEW LOCKED BOOTLOADER METHOD: 04/07/2020 (FULL SAFETYNET PASS):
Download the conversion tool HERE
CONVERSION INSTRUCITONS:
Unplug and power off the phone COMPLETELY
Open the MSM download tool
Uncheck SHA256 check
Connect your USB cable to your PC
Hold Volume DOWN and UP at the same time.
While holding those keys, insert the USB.
Keep holding those keys, click 'Enum' in the tool.
Click start.
Wait about 5-10 minutes, setup over Wifi, OTA to 10, PROFIT!
Code:
[LIST]
[*] [COLOR="red"][COLOR="red"][B]*Modem will not work at first, setup over wifi and OTA to Android 10, it has been unified so, you just need to update to 10.0.5*[/B][/COLOR][/COLOR]
[*] Not recommend for Sprint customers right now, as there are issues with APNs.
[INDENT][INDENT][B][U][COLOR="Red"]**GSM/NON-SPRINT CARRIERS WORK FINE!**[/COLOR][/U][/B][/INDENT][/INDENT]
[*] "About Phone" is still missing information.
[/LIST]
Code:
Q. HELP! I HAVE NO SIGNAL AFTER CROSSFLASH!
A. Connect to wifi and update to Android 10 via OTA.
Q. Can I use a custom ROM built for OnePlus 7 Pro:
A. Not recommend as they have major issues, ROMs are coming!
Q. Can I crossflash to international non 5G and get dual SIM?
A.
[URL="https://forum.xda-developers.com/oneplus-7-pro/how-to/port-oxygen-os-beta-oneplus-7-pro-5g-t4075597"]See here for Open Beta 11[/URL]
Credits:
@nickman529
(Testing and flashing everything I told him to without question, and uploading the flash zips and writing the bats for me because my internet is way too slow)
@mauronofrio (for building us TWRP)
@Some_Random_Username(moral support and lots of OnePlus knowledge)
And lots of others in our test community!
Donations are also welcome, see my signature for way to donate or my PayPal is:
http://PayPal.me/windows8user
Screenshots:
(Reserved)
Magisk ROM should work with the unlocked Sprint phone. I've only tested xXx NoLimits but as long as these magisk ROMs don't interfere with much you should be good to go.
lreyes said:
Magisk ROM should work with the unlocked Sprint phone. I've only tested xXx NoLimits but as long as these magisk ROMs don't interfere with much you should be good to go.
Click to expand...
Click to collapse
Do you mean bootloader unlocked? Or sim unlock?
nickman529 said:
Do you mean bootloader unlocked? Or sim unlock?
Click to expand...
Click to collapse
Bootloader of course
Whoareyou said:
Bootloader of course
Click to expand...
Click to collapse
Do we have a twrp flashable modem?
*Due to differences in the metadata of recovery flashable zips, in order to install ROMs you need to extract the payload.bin and flash in fastboot*
Click to expand...
Click to collapse
Whats the flash command for this? reboot to recovery after and flash twrp and magisk?
nickman529 said:
Whats the flash command for this? reboot to recovery after and flash twrp and magisk?
Click to expand...
Click to collapse
To install a 7 Pro (non-5G) ROM on the 7 Pro 5G:
Use this tool to extract the payload.bin from inside the rom.zip, use fastboot to manually flash each image
https://github.com/cyxx/extract_android_ota_payload
fastboot -w flash system system.img
fastboot flash vendor_b(/a) vendor.img
fastboot flash dtbo_b(/a) dtbo.img
fastboot flash boot_b(/a) boot.img
fastboot --disable-verity --disable-verification flash vbmera_b(/a) vbmeta.img
fastboot boot twrp.img
Mount /system and /vendor IN TWRP
adb pull /system/system/build.prop build.prop.system
adb pull /vendor/build.prop build.prop.vendor
Open each build.prop and change this line in both or whichever it appears:
Code:
persist.radio.multisim.config=dsds
to
Code:
persist.radio.multisim.config=ssss
adb push build.prop.system /system/system/build.prop
adb push build.prop.vendor /vendor/build.prop
flash twrp from: https://dl.twrp.me/guacamole/twrp-installer-3.3.1-4-guacamole.zip.html
Reboot
Can't give you a 100% guarantee that every ROM will boot or function properly, but that is how I got Lineage 16 going somewhat well.
Whoareyou said:
To install a 7 Pro (non-5G) ROM on the 7 Pro 5G:
Use this tool to extract the payload.bin from inside the rom.zip, use fastboot to manually flash each image
https://github.com/cyxx/extract_android_ota_payload
fastboot -w flash system system.img
fastboot flash vendor_b(/a) vendor.img
fastboot flash dtbo_b(/a) dtbo.img
fastboot flash boot_b(/a) boot.img
fastboot --disable-verity --disable-verification flash vbmera_b(/a) vbmeta.img
fastboot boot twrp.img
Mount /system and /vendor IN TWRP
adb pull /system/system/build.prop build.prop.system
adb pull /vendor/build.prop build.prop.vendor
Open each build.prop and change this line in both or whichever it appears:
Code:
persist.radio.multisim.config=dsds
to
Code:
persist.radio.multisim.config=ssss
adb push build.prop.system /system/system/build.prop
adb push build.prop.vendor /vendor/build.prop
flash twrp from: https://dl.twrp.me/guacamole/twrp-installer-3.3.1-4-guacamole.zip.html
Reboot
Can't give you a 100% guarantee that every ROM will boot or function properly, but that is how I got Lineage 16 going somewhat well.
Click to expand...
Click to collapse
Okay cool, good info. i was going to try RR or Havoc and see what i could get working. Do you need to reflash sprint modem as well?
EDIT: Also should I flash to my active or inactive slot?
nickman529 said:
To install a 7 Pro (non-5G) ROM on the 7 Pro 5G:
Use this tool to extract the payload.bin from inside the rom.zip, use fastboot to manually flash each image
https://github.com/cyxx/extract_android_ota_payload
fastboot -w flash system system.img
fastboot flash vendor_b(/a) vendor.img
fastboot flash dtbo_b(/a) dtbo.img
fastboot flash boot_b(/a) boot.img
fastboot --disable-verity --disable-verification flash vbmera_b(/a) vbmeta.img
fastboot boot twrp.img
Mount /system and /vendor IN TWRP
adb pull /system/system/build.prop build.prop.system
adb pull /vendor/build.prop build.prop.vendor
Open each build.prop and change this line in both or whichever it appears:
to
Okay cool, good info. i was going to try RR or Havoc and see what i could get working. Do you need to reflash sprint modem as well?
EDIT: Also should I flash to my active or inactive slot?
Click to expand...
Click to collapse
Just your active slot, and no, you only need to flash the modem if you flash a different modem.img (like flashing the euro oos build)
C:\Users\remstar\Downloads\extract_android_ota_payload-master\extract_android_ot
a_payload-master>extract_android_ota_payload.py havocop7p.zip /tmp/
Extracting 'payload.bin' from OTA file...
Extracting 'boot.img'
Traceback (most recent call last):
File "C:\Users\remstar\Downloads\extract_android_ota_payload-master\extract_an
droid_ota_payload-master\extract_android_ota_payload.py", line 142, in <module>
main(filename, output_dir)
File "C:\Users\remstar\Downloads\extract_android_ota_payload-master\extract_an
droid_ota_payload-master\extract_android_ota_payload.py", line 121, in main
parse_payload(payload, p, out_f)
File "C:\Users\remstar\Downloads\extract_android_ota_payload-master\extract_an
droid_ota_payload-master\extract_android_ota_payload.py", line 95, in parse_payl
oad
r = decompress_payload('xzcat', data, e.num_blocks * BLOCK_SIZE, operation.d
ata_sha256_hash)
File "C:\Users\remstar\Downloads\extract_android_ota_payload-master\extract_an
droid_ota_payload-master\extract_android_ota_payload.py", line 78, in decompress
_payload
p = subprocess.Popen([command, '-'], stdout=subprocess.PIPE, stdin=subproces
s.PIPE)
File "C:\Users\remstar\AppData\Local\Programs\Python\Python38\lib\subprocess.p
y", line 854, in __init__
self._execute_child(args, executable, preexec_fn, close_fds,
File "C:\Users\remstar\AppData\Local\Programs\Python\Python38\lib\subprocess.p
y", line 1307, in _execute_child
hp, ht, pid, tid = _winapi.CreateProcess(executable, args,
FileNotFoundError: [WinError 2] The system cannot find the file specified
C:\Users\remstar\Downloads\extract_android_ota_payload-master\extract_android_ot
a_payload-master>extract_android_ota_payload.py havocop7p.zip /tmp/
Extracting 'payload.bin' from OTA file...
Extracting 'boot.img'
Traceback (most recent call last):
File "C:\Users\remstar\Downloads\extract_android_ota_payload-master\extract_an
droid_ota_payload-master\extract_android_ota_payload.py", line 142, in <module>
main(filename, output_dir)
File "C:\Users\remstar\Downloads\extract_android_ota_payload-master\extract_an
droid_ota_payload-master\extract_android_ota_payload.py", line 121, in main
parse_payload(payload, p, out_f)
File "C:\Users\remstar\Downloads\extract_android_ota_payload-master\extract_an
droid_ota_payload-master\extract_android_ota_payload.py", line 95, in parse_payl
oad
r = decompress_payload('xzcat', data, e.num_blocks * BLOCK_SIZE, operation.d
ata_sha256_hash)
File "C:\Users\remstar\Downloads\extract_android_ota_payload-master\extract_an
droid_ota_payload-master\extract_android_ota_payload.py", line 78, in decompress
_payload
p = subprocess.Popen([command, '-'], stdout=subprocess.PIPE, stdin=subproces
s.PIPE)
File "C:\Users\remstar\AppData\Local\Programs\Python\Python38\lib\subprocess.p
y", line 854, in __init__
self._execute_child(args, executable, preexec_fn, close_fds,
File "C:\Users\remstar\AppData\Local\Programs\Python\Python38\lib\subprocess.p
y", line 1307, in _execute_child
hp, ht, pid, tid = _winapi.CreateProcess(executable, args,
FileNotFoundError: [WinError 2] The system cannot find the file specified
EDIT: solved, bad dependancies
---------- Post added at 11:48 AM ---------- Previous post was at 11:17 AM ----------
I'm now getting "invalid sparse file format at header magi"
nickman529 said:
C:\Users\remstar\Downloads\extract_android_ota_payload-master\extract_android_ot
a_payload-master>extract_android_ota_payload.py havocop7p.zip /tmp/
Extracting 'payload.bin' from OTA file...
Extracting 'boot.img'
Traceback (most recent call last):
File "C:\Users\remstar\Downloads\extract_android_ota_payload-master\extract_an
droid_ota_payload-master\extract_android_ota_payload.py", line 142, in <module>
main(filename, output_dir)
File "C:\Users\remstar\Downloads\extract_android_ota_payload-master\extract_an
droid_ota_payload-master\extract_android_ota_payload.py", line 121, in main
parse_payload(payload, p, out_f)
File "C:\Users\remstar\Downloads\extract_android_ota_payload-master\extract_an
droid_ota_payload-master\extract_android_ota_payload.py", line 95, in parse_payl
oad
r = decompress_payload('xzcat', data, e.num_blocks * BLOCK_SIZE, operation.d
ata_sha256_hash)
File "C:\Users\remstar\Downloads\extract_android_ota_payload-master\extract_an
droid_ota_payload-master\extract_android_ota_payload.py", line 78, in decompress
_payload
p = subprocess.Popen([command, '-'], stdout=subprocess.PIPE, stdin=subproces
s.PIPE)
File "C:\Users\remstar\AppData\Local\Programs\Python\Python38\lib\subprocess.p
y", line 854, in __init__
self._execute_child(args, executable, preexec_fn, close_fds,
File "C:\Users\remstar\AppData\Local\Programs\Python\Python38\lib\subprocess.p
y", line 1307, in _execute_child
hp, ht, pid, tid = _winapi.CreateProcess(executable, args,
FileNotFoundError: [WinError 2] The system cannot find the file specified
C:\Users\remstar\Downloads\extract_android_ota_payload-master\extract_android_ot
a_payload-master>extract_android_ota_payload.py havocop7p.zip /tmp/
Extracting 'payload.bin' from OTA file...
Extracting 'boot.img'
Traceback (most recent call last):
File "C:\Users\remstar\Downloads\extract_android_ota_payload-master\extract_an
droid_ota_payload-master\extract_android_ota_payload.py", line 142, in <module>
main(filename, output_dir)
File "C:\Users\remstar\Downloads\extract_android_ota_payload-master\extract_an
droid_ota_payload-master\extract_android_ota_payload.py", line 121, in main
parse_payload(payload, p, out_f)
File "C:\Users\remstar\Downloads\extract_android_ota_payload-master\extract_an
droid_ota_payload-master\extract_android_ota_payload.py", line 95, in parse_payl
oad
r = decompress_payload('xzcat', data, e.num_blocks * BLOCK_SIZE, operation.d
ata_sha256_hash)
File "C:\Users\remstar\Downloads\extract_android_ota_payload-master\extract_an
droid_ota_payload-master\extract_android_ota_payload.py", line 78, in decompress
_payload
p = subprocess.Popen([command, '-'], stdout=subprocess.PIPE, stdin=subproces
s.PIPE)
File "C:\Users\remstar\AppData\Local\Programs\Python\Python38\lib\subprocess.p
y", line 854, in __init__
self._execute_child(args, executable, preexec_fn, close_fds,
File "C:\Users\remstar\AppData\Local\Programs\Python\Python38\lib\subprocess.p
y", line 1307, in _execute_child
hp, ht, pid, tid = _winapi.CreateProcess(executable, args,
FileNotFoundError: [WinError 2] The system cannot find the file specified
EDIT: solved, bad dependancies
---------- Post added at 11:48 AM ---------- Previous post was at 11:17 AM ----------
I'm now getting "invalid sparse file format at header magi"
Click to expand...
Click to collapse
That's not an error, it's normal when flashing system and I think vendor
Whoareyou said:
That's not an error, it's normal when flashing system and I think vendor
Click to expand...
Click to collapse
Even though I tried to flash and nothing happened? No change in phone and it still reboot to oos
nickman529 said:
Even though I tried to flash and nothing happened? No change in phone and it still reboot to oos
Click to expand...
Click to collapse
You need to let it flash everything.
Don't cancel it or unplug or interrupt it.
Flash all the images it extracted
Whoareyou said:
You need to let it flash everything.
Don't cancel it or unplug or interrupt it.
Flash all the images it extracted
Click to expand...
Click to collapse
Okay. Will fastboot show any indication of flashing. And why did it reboot to OOS even after I cancelled the flash. I thought it failed
nickman529 said:
Okay. Will fastboot show any indication of flashing. And why did it reboot to OOS even after I cancelled the flash. I thought it failed
Click to expand...
Click to collapse
No the only indication will be in the command prompt, because it didn't wipe the system or start anything, you canceled it before it even sent the image
Whoareyou said:
No the only indication will be in the command prompt, because it didn't wipe the system or start anything, you canceled it before it even sent the image
Click to expand...
Click to collapse
I understand. I'm sorry haha. This is my first a/b device and I'm still figuring everything out
Whoareyou said:
No the only indication will be in the command prompt, because it didn't wipe the system or start anything, you canceled it before it even sent the image
Click to expand...
Click to collapse
flashed all. now twrp wont boot up
---------- Post added at 01:57 PM ---------- Previous post was at 01:21 PM ----------
Well i got havoc Q based to boot up and run smooth but no mobile signal
Update, got havoc pie flashed. couldnt boot twrp at all. just goes to a black screen. swapped to slot b and it booted twrp. flashed installer. swapped slots. no luck. currently trying flashing havoc with a known good twrp on slot b
Hello All,
I am using a raspberry pi4 with a bullseye os - 64 bit.
In a virtual environment, I used - "pip install picamera" - to install the module
Whenever I try to import picamera, I get the following error message:
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/home/pi/Documents/proj_trash_can/cam.py", line 2, in <module>
from picamera import PiCamera
File "/home/pi/Documents/proj_trash_can/venv/lib/python3.9/site-packages/picamera/__init__.py", line 72, in <module>
from picamera.exc import (
File "/home/pi/Documents/proj_trash_can/venv/lib/python3.9/site-packages/picamera/exc.py", line 41, in <module>
import picamera.mmal as mmal
File "/home/pi/Documents/proj_trash_can/venv/lib/python3.9/site-packages/picamera/mmal.py", line 49, in <module>
_lib = ct.CDLL('libmmal.so')
File "/usr/lib/python3.9/ctypes/__init__.py", line 374, in __init__
self._handle = _dlopen(self._name, mode)
OSError: libmmal.so: cannot open shared object file: No such file or directory
Click to expand...
Click to collapse
I have updated and upgraded with sudo but to no luck. It seems I am missing a directory and some files. Requesting some guidance and help regarding this problem - I would be very grateful.
If any added information is needed to be provided from my side, kindly let me know how to do so and I will provide it.
Thank You.