Development Flashing GDPR version of original ROM available - Non MSM and with no dongles or $ - Realme 8 Pro

Greetings.
Got a new toy to play with it ...
Have sucessfully tried to enter fastboot and recovery mode of the realme 8 pro device.
The connection with RealmeFlash application and phone is ok.
Havent tried flashing yet, but strange previous versions of phone (bootloader) can be unlocked with fastboot flashing unlock, but on Android11, RMX3081_11A.41 (4.14.180-perf+) RMX3081GDPR_11_A.41_2021081818280000
this is not (for now guess) possible.
This is because GDPR version of rom is installed.
Code:
C:\Program Files (x86)\Minimal ADB and Fastboot>adb shell
RMX3081L1:/ $ getprop get_unlock_ability
RMX3081L1:/ $ getprop ro.oem_unlock_supported
1
RMX3081L1:/ $ getprop ro.boot.verifiedbootstate
green
RMX3081L1:/ $ getprop ro.boot.flash.locked
1
RMX3081L1:/ $
Guess also the flashing of the unlocked bootloader cannot be done easily.
Code:
C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot oem unlock
...
FAILED (remote: Unable to open fastboot HAL)
finished. total time: 0.016s
C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot flashing unlock
...
FAILED (remote: Unrecognized command flashing unlock)
finished. total time: 0.000s
remote: Unable to open fastboot HAL
DEV Blocks :
Code:
RMX3081L1:/dev/block/by-name $ ls -lR
.:
total 0
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 ALIGN_TO_128K_1 -> /dev/block/sdd1
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 ALIGN_TO_128K_2 -> /dev/block/sdf1
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 DRIVER -> /dev/block/sdf9
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 abl -> /dev/block/sde8
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 aop -> /dev/block/sde1
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 apdp -> /dev/block/sde25
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 apdp_full -> /dev/block/sde26
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 bluetooth -> /dev/block/sde5
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 boot -> /dev/block/sde11
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 cache -> /dev/block/sda6
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 catecontentfv -> /dev/block/sde41
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 catefv -> /dev/block/sde40
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 cateloader -> /dev/block/sde32
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 cdt -> /dev/block/sdd2
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 cdt_engineering -> /dev/block/sdd4
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 cmnlib -> /dev/block/sde12
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 cmnlib64 -> /dev/block/sde13
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 ddr -> /dev/block/sdd3
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 devcfg -> /dev/block/sde14
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 devinfo -> /dev/block/sde23
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 dip -> /dev/block/sde24
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 dsp -> /dev/block/sde9
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 dtbo -> /dev/block/sde19
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 frp -> /dev/block/sda5
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 fsc -> /dev/block/sdf11
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 fsg -> /dev/block/sdf10
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 hyp -> /dev/block/sde3
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 imagefv -> /dev/block/sde20
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 keymaster -> /dev/block/sde10
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 keystore -> /dev/block/sda4
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 limits -> /dev/block/sde29
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 logdump -> /dev/block/sde34
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 logfs -> /dev/block/sde31
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 mdtp -> /dev/block/sde7
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 mdtpsecapp -> /dev/block/sde6
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 metadata -> /dev/block/sda8
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 misc -> /dev/block/sda3
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 modem -> /dev/block/sde4
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 modemst1 -> /dev/block/sdf4
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 modemst2 -> /dev/block/sdf5
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 multiimgoem -> /dev/block/sde36
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 multiimgqti -> /dev/block/sde37
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 ocdt -> /dev/block/sdd5
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 oppo_sec -> /dev/block/sde22
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 oppodycnvbk -> /dev/block/sdf2
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 opporeserve1 -> /dev/block/sdf6
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 opporeserve2 -> /dev/block/sdf7
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 opporeserve3 -> /dev/block/sdf8
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 oppostanvbk -> /dev/block/sdf3
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 persist -> /dev/block/sda2
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 qupfw -> /dev/block/sde15
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 rawdump -> /dev/block/sde33
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 recovery -> /dev/block/sda7
lrwxrwxrwx 1 root root 14 1970-01-01 01:26 sda -> /dev/block/sda
lrwxrwxrwx 1 root root 14 1970-01-01 01:26 sdb -> /dev/block/sdb
lrwxrwxrwx 1 root root 14 1970-01-01 01:26 sdc -> /dev/block/sdc
lrwxrwxrwx 1 root root 14 1970-01-01 01:26 sdd -> /dev/block/sdd
lrwxrwxrwx 1 root root 14 1970-01-01 01:26 sde -> /dev/block/sde
lrwxrwxrwx 1 root root 14 1970-01-01 01:26 sdf -> /dev/block/sdf
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 secdata -> /dev/block/sde39
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 splash -> /dev/block/sde28
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 spunvm -> /dev/block/sde27
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 ssd -> /dev/block/sda1
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 storsec -> /dev/block/sde35
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 super -> /dev/block/sda9
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 toolsfv -> /dev/block/sde30
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 tz -> /dev/block/sde2
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 uefisecapp -> /dev/block/sde21
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 uefivarstore -> /dev/block/sde38
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 userdata -> /dev/block/sda10
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 vbmeta -> /dev/block/sde18
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 vbmeta_system -> /dev/block/sde16
lrwxrwxrwx 1 root root 16 1970-01-01 01:26 vbmeta_vendor -> /dev/block/sde17
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 xbl -> /dev/block/sdb1
lrwxrwxrwx 1 root root 15 1970-01-01 01:26 xbl_config -> /dev/block/sdb2
RMX3081L1:/dev/block/by-name $
Looking forward for feedback about flashing and bootloader ....
Code:
C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot getvar all
(bootloader) cpu-abi:arm64-v8a
(bootloader) super-partition-name:super
(bootloader) is-logical:ssd:no
(bootloader) is-logical:misc:no
(bootloader) is-logical:sda:no
(bootloader) is-logical:devcfg:no
(bootloader) is-logical:frp:no
(bootloader) is-logical:sdc:no
(bootloader) is-logical:recovery:no
(bootloader) is-logical:dip:no
(bootloader) is-logical:modem:no
(bootloader) is-logical:vbmeta:no
(bootloader) is-logical:logdump:no
(bootloader) is-logical:splash:no
(bootloader) is-logical:abl:no
(bootloader) is-logical:persist:no
(bootloader) is-logical:catecontentfv:no
(bootloader) is-logical:uefivarstore:no
(bootloader) is-logical:mdtpsecapp:no
(bootloader) is-logical:cmnlib64:no
(bootloader) is-logical:devinfo:no
(bootloader) is-logical:storsec:no
(bootloader) is-logical:hyp:no
(bootloader) is-logical:aop:no
(bootloader) is-logical:vbmeta_vendor:no
(bootloader) is-logical:secdata:no
(bootloader) is-logical:spunvm:no
(bootloader) is-logical:mdtp:no
(bootloader) is-logical:apdp:no
(bootloader) is-logical:keystore:no
(bootloader) is-logical:imagefv:no
(bootloader) is-logical:keymaster:no
(bootloader) is-logical:multiimgoem:no
(bootloader) is-logical:cateloader:no
(bootloader) is-logical:logfs:no
(bootloader) is-logical:bluetooth:no
(bootloader) is-logical:dsp:no
(bootloader) is-logical:tz:no
(bootloader) is-logical:limits:no
(bootloader) is-logical:toolsfv:no
(bootloader) is-logical:ocdt:no
(bootloader) is-logical:sde:no
(bootloader) is-logical:xbl_config:no
(bootloader) is-logical:xbl:no
(bootloader) is-logical:sdb:no
(bootloader) is-logical:oppo_sec:no
(bootloader) is-logical:cdt:no
(bootloader) is-logical:oppodycnvbk:no
(bootloader) is-logical:ddr:no
(bootloader) is-logical:ALIGN_TO_128K_1:no
(bootloader) is-logical:cdt_engineering:no
(bootloader) is-logical:userdata:no
(bootloader) is-logical:vbmeta_system:no
(bootloader) is-logical:boot:no
(bootloader) is-logical:modemst1:no
(bootloader) is-logical:rawdump:no
(bootloader) is-logical:fsc:no
(bootloader) is-logical:multiimgqti:no
(bootloader) is-logical:opporeserve3:no
(bootloader) is-logical:oppostanvbk:no
(bootloader) is-logical:catefv:no
(bootloader) is-logical:modemst2:no
(bootloader) is-logical:sdd:no
(bootloader) is-logical:fsg:no
(bootloader) is-logical:ALIGN_TO_128K_2:no
(bootloader) is-logical:opporeserve2:no
(bootloader) is-logical:DRIVER:no
(bootloader) is-logical:apdp_full:no
(bootloader) is-logical:uefisecapp:no
(bootloader) is-logical:qupfw:no
(bootloader) is-logical:dtbo:no
(bootloader) is-logical:cmnlib:no
(bootloader) is-logical:opporeserve1:no
(bootloader) is-logical:sdf:no
(bootloader) is-logical:cache:no
(bootloader) is-logical:metadata:no
(bootloader) is-logical:super:no
(bootloader) is-logical:vendor:yes
(bootloader) is-logical:system:yes
(bootloader) is-logical:product:yes
(bootloader) is-logical:odm:yes
(bootloader) is-logical:my_product:yes
(bootloader) is-logical:my_engineering:yes
(bootloader) is-logical:system_ext:yes
(bootloader) is-logical:my_stock:yes
(bootloader) is-logical:my_heytap:yes
(bootloader) is-logical:my_company:yes
(bootloader) is-logical:my_carrier:yes
(bootloader) is-logical:my_region:yes
(bootloader) is-logical:my_preload:yes
(bootloader) is-logical:my_manifest:yes
(bootloader) battery-voltage:4420
(bootloader) treble-enabled:true
(bootloader) is-userspace:yes
(bootloader) partition-size:ssd:0x2000
(bootloader) partition-size:misc:0x100000
(bootloader) partition-size:devcfg:0x20000
(bootloader) partition-size:frp:0x80000
(bootloader) partition-size:sdc:0x800000
(bootloader) partition-size:recovery:0x6000000
(bootloader) partition-size:dip:0x100000
(bootloader) partition-size:modem:0x8C00000
(bootloader) partition-size:vbmeta:0x10000
(bootloader) partition-size:logdump:0x4000000
(bootloader) partition-size:splash:0x20A4000
(bootloader) partition-size:abl:0x100000
(bootloader) partition-size:catecontentfv:0x100000
(bootloader) partition-size:uefivarstore:0x80000
(bootloader) partition-size:mdtpsecapp:0x400000
(bootloader) partition-size:cmnlib64:0x80000
(bootloader) partition-size:devinfo:0x1000
(bootloader) partition-size:storsec:0x20000
(bootloader) partition-size:hyp:0x80000
(bootloader) partition-size:aop:0x80000
(bootloader) partition-size:vbmeta_vendor:0x10000
(bootloader) partition-size:secdata:0x7000
(bootloader) partition-size:spunvm:0x800000
(bootloader) partition-size:mdtp:0x2000000
(bootloader) partition-size:apdp:0x40000
(bootloader) partition-size:keystore:0x80000
(bootloader) partition-size:imagefv:0x200000
(bootloader) partition-size:keymaster:0x80000
(bootloader) partition-size:multiimgoem:0x8000
(bootloader) partition-size:cateloader:0x200000
(bootloader) partition-size:logfs:0x800000
(bootloader) partition-size:bluetooth:0x100000
(bootloader) partition-size:dsp:0x2000000
(bootloader) partition-size:tz:0x400000
(bootloader) partition-size:limits:0x1000
(bootloader) partition-size:toolsfv:0x100000
(bootloader) partition-size:ocdt:0x20000
(bootloader) partition-size:sde:0x26000000
(bootloader) partition-size:xbl_config:0x20000
(bootloader) partition-size:xbl:0x380000
(bootloader) partition-size:sdb:0x800000
(bootloader) partition-size:oppo_sec:0xA00000
(bootloader) partition-size:cdt:0x20000
(bootloader) partition-size:oppodycnvbk:0xA00000
(bootloader) partition-size:ddr:0x100000
(bootloader) partition-size:ALIGN_TO_128K_1:0x1A000
(bootloader) partition-size:cdt_engineering:0x200000
(bootloader) partition-size:vbmeta_system:0x10000
(bootloader) partition-size:boot:0x4000000
(bootloader) partition-size:modemst1:0x200000
(bootloader) partition-size:rawdump:0x8000000
(bootloader) partition-size:fsc:0x20000
(bootloader) partition-size:multiimgqti:0x8000
(bootloader) partition-size:opporeserve3:0x4000000
(bootloader) partition-size:oppostanvbk:0xA00000
(bootloader) partition-size:catefv:0x80000
(bootloader) partition-size:modemst2:0x200000
(bootloader) partition-size:sdd:0x2000000
(bootloader) partition-size:fsg:0x200000
(bootloader) partition-size:ALIGN_TO_128K_2:0x1A000
(bootloader) partition-size:opporeserve2:0x8000000
(bootloader) partition-size:DRIVER:0x2000000
(bootloader) partition-size:apdp_full:0x40000
(bootloader) partition-size:uefisecapp:0x200000
(bootloader) partition-size:qupfw:0x10000
(bootloader) partition-size:dtbo:0x1800000
(bootloader) partition-size:cmnlib:0x80000
(bootloader) partition-size:opporeserve1:0x800000
(bootloader) partition-size:sdf:0x10400000
(bootloader) partition-size:vendor:0x23F45000
(bootloader) partition-size:system:0x3D57E000
(bootloader) partition-size:product:0x3F2000
(bootloader) partition-size:odm:0x47C0D000
(bootloader) partition-size:my_product:0x1F29000
(bootloader) partition-size:my_engineering:0x55000
(bootloader) partition-size:system_ext:0x4BC8F000
(bootloader) partition-size:my_stock:0x2EA31000
(bootloader) partition-size:my_heytap:0x40C16000
(bootloader) partition-size:my_company:0x55000
(bootloader) partition-size:my_carrier:0x55000
(bootloader) partition-size:my_region:0x21D27000
(bootloader) partition-size:my_preload:0xD52A000
(bootloader) partition-size:my_manifest:0xE5000
(bootloader) version-vndk:30
(bootloader) has-slot:ssd:no
(bootloader) has-slot:misc:no
(bootloader) has-slot:sda:no
(bootloader) has-slot:devcfg:no
(bootloader) has-slot:frp:no
(bootloader) has-slot:sdc:no
(bootloader) has-slot:recovery:no
(bootloader) has-slot:dip:no
(bootloader) has-slot:modem:no
(bootloader) has-slot:vbmeta:no
(bootloader) has-slot:logdump:no
(bootloader) has-slot:splash:no
(bootloader) has-slot:abl:no
(bootloader) has-slot:persist:no
(bootloader) has-slot:catecontentfv:no
(bootloader) has-slot:uefivarstore:no
(bootloader) has-slot:mdtpsecapp:no
(bootloader) has-slot:cmnlib64:no
(bootloader) has-slot:devinfo:no
(bootloader) has-slot:storsec:no
(bootloader) has-slot:hyp:no
(bootloader) has-slot:aop:no
(bootloader) has-slot:vbmeta_vendor:no
(bootloader) has-slot:secdata:no
(bootloader) has-slot:spunvm:no
(bootloader) has-slot:mdtp:no
(bootloader) has-slot:apdp:no
(bootloader) has-slot:keystore:no
(bootloader) has-slot:imagefv:no
(bootloader) has-slot:keymaster:no
(bootloader) has-slot:multiimgoem:no
(bootloader) has-slot:cateloader:no
(bootloader) has-slot:logfs:no
(bootloader) has-slot:bluetooth:no
(bootloader) has-slot:dsp:no
(bootloader) has-slot:tz:no
(bootloader) has-slot:limits:no
(bootloader) has-slot:toolsfv:no
(bootloader) has-slot:ocdt:no
(bootloader) has-slot:sde:no
(bootloader) has-slot:xbl_config:no
(bootloader) has-slot:xbl:no
(bootloader) has-slot:sdb:no
(bootloader) has-slot:oppo_sec:no
(bootloader) has-slot:cdt:no
(bootloader) has-slot:oppodycnvbk:no
(bootloader) has-slot:ddr:no
(bootloader) has-slot:ALIGN_TO_128K_1:no
(bootloader) has-slot:cdt_engineering:no
(bootloader) has-slot:userdata:no
(bootloader) has-slot:vbmeta_system:no
(bootloader) has-slot:boot:no
(bootloader) has-slot:modemst1:no
(bootloader) has-slot:rawdump:no
(bootloader) has-slot:fsc:no
(bootloader) has-slot:multiimgqti:no
(bootloader) has-slot:opporeserve3:no
(bootloader) has-slot:oppostanvbk:no
(bootloader) has-slot:catefv:no
(bootloader) has-slot:modemst2:no
(bootloader) has-slot:sdd:no
(bootloader) has-slot:fsg:no
(bootloader) has-slot:ALIGN_TO_128K_2:no
(bootloader) has-slot:opporeserve2:no
(bootloader) has-slot:DRIVER:no
(bootloader) has-slot:apdp_full:no
(bootloader) has-slot:uefisecapp:no
(bootloader) has-slot:qupfw:no
(bootloader) has-slot:dtbo:no
(bootloader) has-slot:cmnlib:no
(bootloader) has-slot:opporeserve1:no
(bootloader) has-slot:sdf:no
(bootloader) has-slot:cache:no
(bootloader) has-slot:metadata:no
(bootloader) has-slot:super:no
(bootloader) has-slot:vendor:no
(bootloader) has-slot:system:no
(bootloader) has-slot:product:no
(bootloader) has-slot:odm:no
(bootloader) has-slot:my_product:no
(bootloader) has-slot:my_engineering:no
(bootloader) has-slot:system_ext:no
(bootloader) has-slot:my_stock:no
(bootloader) has-slot:my_heytap:no
(bootloader) has-slot:my_company:no
(bootloader) has-slot:my_carrier:no
(bootloader) has-slot:my_region:no
(bootloader) has-slot:my_preload:no
(bootloader) has-slot:my_manifest:no
(bootloader) security-patch-level:2021-07-05
(bootloader) vendor-fingerprint:realme/RMX3081EEA/RMX3081L1:11/RKQ1.201112.002/1624959507004:user/release-keys
(bootloader) hw-revision:0
(bootloader) current-slot:
(bootloader) serialno:xxx
(bootloader) product:RMX3081L1
(bootloader) version-os:11
(bootloader) first-api-level:30
(bootloader) slot-count:0
(bootloader) max-download-size:0x10000000
(bootloader) version:0.4
(bootloader) version-baseband:
(bootloader) secure:yes
(bootloader) dynamic-partition:true
(bootloader) system-fingerprint:realme/RMX3081EEA/RMX3081L1:11/RKQ1.201112.002/1624959507004:user/release-keys
(bootloader) version-bootloader:unknown
(bootloader) unlocked:no
all:
Finished. Total time: 1.359s
[UPDATE]
From 23.12.2021 :
GDPR Roms won't have option for unlock bootloader soon.
The best way is to flash wia MSM the IN [EXPORT] version of rom.
The procedure is via current working Deep Test apk.
The videos and procedures for this types exists on the net.

Europe Realme8 Pro (RMX3081GDPR_11_A.41) still doesn't have a unlock bootloader option.
That is the answer from EU Realme service.
Code:
C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot flash boot magisk_patched.img
Sending 'boot' (65536 KB)
FAILED (remote: 'Download is not allowed on locked devices')
fastboot: error: Command failed
From the debug of the flashing procedure done in the "Download" fastbootd mode.
Since the *.opf contains the blocks and binaries (elf) to be extended in the download mode guess the flashing of the single block cannot be done. Bootloader cannot be unlocked since the HAL is not included in fastbootd.
Weird thing is that the whole package of the zip included the files inside ofp and flashing ELF binaries inside has to be "flashed". Guess only the checksum values are not being verified during the procedure.
Extraction procedures of opf files are available, compress version are not available.
Since dev/block partition are not accessible (Permission denied) in normal state we cannot change particular block/partition.
Bootloader cannot be unlocked.
It's hard to create the root from this state.
Hope for the best .... to be solved ....

After engaging "EDL" mode in witch the QC things are not implemented ?? (or need some extra approach) or this SAHARA MODE use some other drivers ...
Been able to partialy info and state from QC QDL mode :
So we are on a good position to go forward from here ...
For unlocking SBL guess we need the SN, HASH1 and HASH2 to unlock and load from OEM Secondbootloader.
For flashing via MSM the HWID number is also important to been able to flash correctly.
Need some extra USB debugger in this mode or while flash via MSM.
Help appritiated.

Qfil and/or qfil QSaharaServer is needed some extra configuration :
QFil log :
Code:
16:45:48: DEBUG: XML FILE (117 bytes): CharsInBuffer=775-117=658
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="INFO: Binary build date: Dec 19 2019 @ 20:53:50" /></data>
-------------------------------------------------------------------------------------------
16:45:48: INFO: TARGET SAID: 'INFO: Binary build date: Dec 19 2019 @ 20:53:50'
16:45:48: DEBUG: XML FILE (118 bytes): CharsInBuffer=658-118=540
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="INFO: Binary build date: Dec 19 2019 @ 20:53:50
" /></data>
-------------------------------------------------------------------------------------------
16:45:48: INFO: TARGET SAID: 'INFO: Binary build date: Dec 19 2019 @ 20:53:50
'
16:45:48: DEBUG: XML FILE (115 bytes): CharsInBuffer=540-115=425
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="INFO: Chip serial num: not shown here (0xnot shown)" /></data>
-------------------------------------------------------------------------------------------
16:45:48: INFO: TARGET SAID: 'INFO: Chip serial num: not shown here (0xnot shown)'
16:45:48: DEBUG: XML FILE (110 bytes): CharsInBuffer=425-110=315
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Verifying signature failed with 3" /></data>
-------------------------------------------------------------------------------------------
16:45:48: INFO: TARGET SAID: 'ERROR: Verifying signature failed with 3'
16:45:48: DEBUG: XML FILE (115 bytes): CharsInBuffer=315-115=200
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Authentication of signed hash failed 0" /></data>
-------------------------------------------------------------------------------------------
16:45:48: INFO: TARGET SAID: 'ERROR: Authentication of signed hash failed 0'
16:45:48: DEBUG: XML FILE (94 bytes): CharsInBuffer=200-94=106
-------------------------------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<response value="NAK" rawmode="false" /></data>
-------------------------------------------------------------------------------------------
16:45:48: DEBUG: Response was 'NAK'
16:45:48: INFO: fh.attrs.MaxPayloadSizeToTargetInBytes = 49152
16:45:48: INFO: fh.attrs.MaxPayloadSizeToTargetInBytesSupported = 1048576
16:45:48: INFO: Something failed. The target rejected your <configure>. Please inspect log for more information
If you combine my previos finding with this log.
Specially ERROR:
Authentication of signed hash failed 0 .
Verifying signature failed with 3.
Only flashing and communication regarding extra configuration is possible, but only with MSM !

- MSM HW ID - The Hardware ID of the MSM chipset. Burned in a QFPROM fuse.
- Serial Number - The serial number of the device. Burned in a QFPROM fuse.
- OEM_PK_HASH - The hash of the entire root certificate which is blown into the QFPROM fuses of the device. the root certificate is included in the X509 certificate store of the SBL1 image. (Thanks Tal Aloni)
- Log buffer - Get a raw log buffer of the failed boot process (?assumed? corred me here)
- SBL SW Version - Returns the SBL version.
GitHub - openpst/libopenpst: A multi-platform C++ library for working with Qualcomm MSM devices
A multi-platform C++ library for working with Qualcomm MSM devices - GitHub - openpst/libopenpst: A multi-platform C++ library for working with Qualcomm MSM devices
github.com

EU (GDPR) versions of Realme 8 Pro won't have a option to unlock bootloader. So only official flashing or use the EXPORT Flash to get the unlock bootloader.
Also no other option won't be available if bootloader locked.
That means root, custom roms ...

Got a feedback with emmcdl program in EDL :
emmcdl -p COM3 -info -verbose
Code:
Version 2.15
SerialNumber: 0xnot shown
MSM_HW_ID: 0x001490e1
OEM_PK_HASH: 0xd9a31a8af5966a594e587c615a96f9defd4cf18f86e84d966876706ada8b3669
SBL SW Version: 0xb5119f8f
Status: 0 The operation completed successfully.
emmcdl -p COM3 -gpt
Code:
Version 2.15
Finding all devices in emergency download mode...
Qualcomm HS-USB QDLoader 9008 (COM3)
Finding all disks on computer ...
0. \\.\PhysicalDrive0 Size: 953869MB, (1953525168 sectors), size: 512 Mount:D:, Name:[Data]
1. \\.\PhysicalDrive1 Size: 244198MB, (500118192 sectors), size: 512 Mount:C:, Name:[]
\\.\PhysicalDrive3
No valid GPT found
Status: 13 The data is invalid
emmcdl -t - p COM3
Code:
Version 2.15
Running performance tests disk -1
Finding all devices in emergency download mode...
Qualcomm HS-USB QDLoader 9008 (COM3)
Finding all disks on computer ...
0. \\.\PhysicalDrive0 Size: 953869MB, (1953525168 sectors), size: 512 Mount:D:, Name:[Data]
1. \\.\PhysicalDrive1 Size: 244198MB, (500118192 sectors), size: 512 Mount:C:, Name:[]
\\.\PhysicalDrive-1Successfully opened volume
Testing this stuff out
Sequential write test 4MB buffer 19922944
status 6 bWriteDone 0 bytesOut 0
This is the last thing to do. Don't want to mess with certs and hashes.
Guess I'll have to flash the EXPORT IN version to be able to do more.
To be able to operate in EDL first a "info" handshake should be initialized and then you can send other.
If needed the file operation I get the same error like in Qfil.
JavaScript:
Version 2.15
Downloading flash programmer: prog_firehose_ddr.elf
Successfully open flash programmer to write: prog_firehose_ddr.elf
Waiting for flash programmer to boot
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="INFO: Binary build date: Dec 19 2019 @ 20:53:50" /></data><?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="INFO: Binary build date: Dec 19 2019 @ 20:53:50
" /></data><?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="INFO: Chip serial num: not shown (0xnotshown)" /></data>
Programming device using SECTOR_SIZE=512
<?xml version = "1.0" ?><data><configure MemoryName="emmc" ZLPAwareHost="1" SkipStorageInit="1" SkipWrite="1" MaxPayloadSizeToTargetInBytes="1048576"/></data>
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Verifying signature failed with 3" /></data>
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Authentication of signed hash failed 0" /></data>
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<response value="NAK" rawmode="false" /></data>
---Target returned NAK---
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Failed to read XML command -1" /></data>
ERROR: No response to configure packet
Status: 21 The device is not ready.

Some more infos :
There are 6 physical partition on UFS drive/chip
Physical Partitions : 6
[0]
filename="" label="ssd"
filename="persist.img" label="persist"
filename="" label="misc"
filename="" label="keystore"
filename="" label="frp"
filename="cache.img" label="cache"
filename="recovery.img" label="recovery"
filename="metadata.img" label="metadata"
filename="super.img" label="super"
filename="userdata.img" label="userdata"
filename="gpt_main0.bin" label="PrimaryGPT"
filename="gpt_backup0.bin" label="BackupGPT"
[1]
filename="xbl.elf" label="xbl"
filename="xbl_config.elf" label="xbl_config"
filename="" label="last_parti"
filename="gpt_main1.bin" label="PrimaryGPT"
filename="gpt_backup1.bin" label="BackupGPT"
[2]
filename="" label="last_parti"
filename="gpt_main2.bin" label="PrimaryGPT"
filename="gpt_backup2.bin" label="BackupGPT"
[3]
filename="" label="ALIGN_TO_128K_1"
filename="" label="cdt"
filename="zeros_5sectors.bin" label="ddr"
filename="cdt_engineering_release.img"
filename="oppo" label="ocdt"
filename="" label="last_parti"
filename="gpt_main3.bin" label="PrimaryGPT"
filename="gpt_backup3.bin" label="BackupGPT"
[4]
filename="aop.mbn" label="aop"
filename="tz.mbn" label="tz"
filename="hyp.mbn" label="hyp"
filename="NON-HLOS.bin" label="modem"
filename="BTFM.bin" label="bluetooth"
filename="" label="mdtpsecapp"
filename="" label="mdtp"
filename="abl.elf" label="abl"
filename="dspso.bin" label="dsp"
filename="km4.mbn" label="keymaster"
filename="boot.img" label="boot"
filename="cmnlib.mbn" label="cmnlib"
filename="cmnlib64.mbn" label="cmnlib64"
filename="devcfg.mbn" label="devcfg"
filename="qupv3fw.elf" label="qupfw"
filename="vbmeta_system.img" label="vbmeta_system"
filename="vbmeta_vendor.img" label="vbmeta_vendor"
filename="vbmeta.img" label="vbmeta"
filename="dtbo.img" label="dtbo"
filename="imagefv.elf" label="imagefv"
filename="uefi_sec.mbn" label="uefisecapp"
filename="oppo_sec.mbn" label="oppo_sec"
filename="" label="devinfo"
filename="" label="dip"
filename="dpAP.mbn" label="apdp"
filename="" label="apdp_full"
filename="" label="spunvm"
filename="splash.img" label="splash"
filename="" label="limits"
filename="" label="toolsfv"
filename="logfs_ufs_8mb.bin" label="logfs"
filename="" label="cateloader"
filename="" label="rawdump"
filename="" label="logdump"
filename="storsec.mbn" label="storsec"
filename="multi_image.mbn" label="multiimgoem"
filename="" label="multiimgqti"
filename="" label="uefivarstore"
filename="sec.dat" label="secdata"
filename="" label="catefv"
filename="" label="catecontentfv"
filename="" label="last_parti"
filename="gpt_main4.bin" label="PrimaryGPT"
filename="gpt_backup4.bin" label="BackupGPT"
[5]
filename="" label="ALIGN_TO_128K_2"
filename="dynamic_nvbk.bin" label="oppodycnvbk"
filename="static_nvbk.bin" label="oppostanvbk"
filename="" label="modemst1"
filename="" label="modemst2"
filename="emmc_fw.bin"
filename="opporeserve2.img"
filename="" label="opporeserve3"
filename="DRIVER.ISO" label="DRIVER"
filename="" label="fsg"
filename="" label="fsc"
filename="" label="last_parti"
filename="gpt_main5.bin" label="PrimaryGPT"
filename="gpt_backup5.bin" label="BackupGPT"
The files for flashing are extracted from RMX3081GDPR*.ofp file.
Check the rawprogramY.xml and patchY.xml the files inside are corresponded to partition Y (0<=Y<=5)
since it uses UFS :
MemoryName : UFS
MaxPayloadSizeToTargetInBytes : 1048576
MaxPayloadSizeToTargetInBytesSupported : 1048576
MaxPayloadSizeFromTargetInBytes :
MaxXMLSizeInBytes : 4096
Qfil can be used to flash via UFS storrage.
Cannot set firehose with UFS validation - validation mode 2 (Always validate SHA 256 with validation) and pre-provision and provision.
And have a problem also with partially splitted parts of super*.img (Trace log)
and userdata.img have the sparse error Unknown chunk type cac2. (Trace.log)
There are couple of files of ChainedTableOfDigests*.bin and their DigestsToSign*.bin
There has to be way to configure it for validation/provision and signing and partition setting option for that.
Or the provision can be flashed again ?
I'm using Qfil 2.0.3.5.
Weird on Qfil I have also greyed (When not connected ?) the option under Tool tab: Partition information and flash information.
Will try to use it on emmcdl if it goes ...
Including logs for Qfil and port trace also.
Looking also for signed programmer for device withou verifying signature and Authentication.
But since ABV, meta and all other have signed and verified signature guess only official flashing would be allowed.
For now we are looking just for a procedure to do that ... So no MSM, dongles and $ in mind, just pure coding with programs available.

Loaders for Oppo/Realme/Oneplus
Code:
OEM:Oppo/Oneplus MODEL:0000 HWID:0000000000510000 SWID:0000000000000003 SWSIZE: PK_HASH:401e4aff39a09344153e776879cac4b407b811b62229fb6ac0d2a578662ef528877e89263d856bc9fdd0140498568836 0000000000510000_401e4aff39a09344_fhprg.bin 695676
OEM:Oppo/Oneplus MODEL:0000 HWID:0000000000510000 SWID:0000000000000003 SWSIZE: PK_HASH:d9a31a8af5966a594e587c615a96f9defd4cf18f86e84d966876706ada8b366947637bf3b443e3012580db52e0edf216 0000000000510000_d9a31a8af5966a59_fhprg.bin 665884
OEM:Oppo/Oneplus MODEL:4D6D HWID:0000000000514D6D SWID:0000000000000003 SWSIZE: PK_HASH:7c15a98db4e70963715f51c8da39c1e66fc1c3334e95f4c6a5627da6a49c842f06b43e8de1f589fc36ce1135c7fa5aa2 0000000000514d6d_7c15a98db4e70963_fhprg.bin 701440
OEM:Oppo/Oneplus MODEL:0000 HWID:000520E100510000 SWID:0000000000000003 SWSIZE:00000148 PK_HASH:c8b4fe1cd7221f8816f3f097277e9d7eeed74717761ff773a4267d70041b35d1 000520e100510000_c8b4fe1cd7221f88_fhprg_peek.bin 341244 OEMVER:ubuntu-96-22 QCVER:BOOT.BF.3.1.5-00035 VAR:WAADANAZA
OEM:Oppo/Oneplus MODEL:0000 HWID:3006000000510000 SWID:0000000100000003 SWSIZE:000001C8 PK_HASH:0cf6c9ce73e7368aff1f442f67f9bc35372162c68561716c0ee2e43c5177553b 3006000000510000_0cf6c9ce73e7368a_fhprg.bin 669808 OEMVER:ubuntu-122-95 QCVER:BOOT.XF.1.4-00258-S660LZB-1 VAR:Sdm660LA

Scatter file with extracted config and other needed info for GDPR version .44 of the rom.
Send a <CONFIG>

Have prepared the QFIL xml to flash and patch ... Tested via Qfil ...
but since firehose is using signed validation it's useless to do anything else more ...
Even some FS/system oppo and flashed QC ELF files are digitally signed so no RE.

program,configure,sig,nop,firmwarewrite,patch,setbootablestoragedrive,ufs,emmc,power,benchmark,read, getstorageinfo,getsha256digest,erase,peek,poke are the commands to communicate with firehose via XML.
Emmcdl don't have a full verbose info or log, like current Qfil, we get the sign request from the firehose after the initial handshake and info it sents the <configure>.
From the Qfil log or emmcdl we don't get the sign request for further authentication.
We get the Signature Request we have to Authenticate, since logs in current clients are not implemented for this we have to write a prog 4 it and break the encryption request.
After it we get the non requested error :
INFO: TARGET SAID: 'ERROR: Verifying signature failed with 3'
INFO: TARGET SAID: 'ERROR: Authentication of signed hash failed 0'
Also with the ETS HQXA emmc prog I get the MD5 via software version verification for only production used - Avtomatic verification mode.
Really weird is that it can do it in the phone DIAG mode not in the EDL ?
We'll have to wait 4 it ... or capture the MSM tool communication on the desired port to see what is happening further.
Just for info I'll post the initial program for flashing via Qfil and port trace and initial xml.
QFIL Sorting TAGS to ensure order is <configure>,<erase>, others, <patch>,<power>
via others there can also be sig as signature.
4 now this is it ...
The problem will be setting the (new) correct NV also I guess.
IF first 5 numbers of PCB (Project ID) is different.

Related

[INFO][DEV][DISCUSSION] All in one Androidone discussion thread for development

hi friends
Today i got my hands on Spice Dream Uno android one handset.
here is what i found for that device.
May be this info is common to all other android one devices that is why i am posting it in this section.
1. build.prop
Code:
#
# PRODUCT_OEM_PROPERTIES
#
import /oem/oem.prop ro.product.device
import /oem/oem.prop ro.product.name
import /oem/oem.prop ro.product.manufacturer
import /oem/oem.prop ro.product.model
import /oem/oem.prop ro.product.locale.language
import /oem/oem.prop ro.product.locale.region
import /oem/oem.prop ro.config.ringtone
import /oem/oem.prop ro.config.notification_sound
import /oem/oem.prop ro.config.alarm_alert
import /oem/oem.prop ro.config.wallpaper
import /oem/oem.prop ro.config.wallpaper_component
import /oem/oem.prop ro.oem.*
import /oem/oem.prop oem.*
# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=KPW53
ro.build.display.id=KPW53
ro.build.version.incremental=1379542
ro.build.version.sdk=19
ro.build.version.codename=REL
ro.build.version.release=4.4.4
ro.build.date=Fri Aug 22 22:49:18 UTC 2014
ro.build.date.utc=1408747758
ro.build.type=user
ro.build.user=android-build
ro.build.host=wpds12.hot.corp.google.com
ro.build.tags=release-keys
ro.product.brand=google
ro.product.board=
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.locale.language=en
ro.product.locale.region=US
ro.wifi.channels=
ro.board.platform=mt6582
# ro.build.product is obsolete; use ro.product.device
ro.build.product=sprout
# Do not try to parse description, fingerprint, or thumbprint
ro.build.description=sprout-user 4.4.4 KPW53 1379542 release-keys
ro.build.thumbprint=4.4.4/KPW53/1379542:user/release-keys
ro.build.characteristics=default
# end build properties
#
# from device/mediatek/sprout/sprout/system.prop
#
#
# system.prop for generic sdk
#
rild.libpath=/system/lib/mtk-ril.so
rild.libargs=-d /dev/ttyC0
# MTK, Infinity, 20090720 {
wifi.interface=wlan0
# MTK, Infinity, 20090720 }
# MTK, mtk03034, 20101210 {
ro.mediatek.wlan.wsc=1
# MTK, mtk03034 20101210}
# MTK, mtk03034, 20110318 {
ro.mediatek.wlan.p2p=1
# MTK, mtk03034 20110318}
# MTK, mtk03034, 20101213 {
mediatek.wlan.ctia=0
# MTK, mtk03034 20101213}
#
wifi.tethering.interface=ap0
#
ro.sf.lcd_density=240
ro.opengles.version=131072
wifi.direct.interface=p2p0
dalvik.vm.heapgrowthlimit=96m
dalvik.vm.heapsize=128m
# USB MTP WHQL
ro.sys.usb.mtp.whql.enable=0
# Power off opt in IPO
sys.ipo.pwrdncap=2
ro.sys.usb.storage.type=mtp,mass_storage
# USB BICR function
ro.sys.usb.bicr=yes
# USB Charge only function
ro.sys.usb.charging.only=yes
# audio
ro.camera.sound.forced=0
ro.audio.silent=0
ro.zygote.preload.enable=0
ro.kernel.zio=38,108,105,16
#ro.kernel.qemu=1
#ro.kernel.qemu.gles=0
ro.boot.selinux=disable
# Disable dirty region for Mali
debug.hwui.render_dirty_regions=false
#
# ADDITIONAL_BUILD_PROPERTIES
#
ro.config.ringtone=Titania.ogg
ro.config.notification_sound=Tethys.ogg
ro.config.alarm_alert=Oxygen.ogg
ro.com.android.dateformat=MM-dd-yyyy
ro.com.android.dataroaming=false
ro.url.legal=http://www.google.com/intl/%s/mobile/android/basic/phone-legal.html
ro.url.legal.android_privacy=http://www.google.com/intl/%s/mobile/android/basic/privacy.html
ro.com.google.clientidbase=android-google
ro.carrier=unknown
ro.com.android.wifi-watchlist=GoogleGuest
ro.error.receiver.system.apps=com.google.android.gms
ro.setupwizard.enterprise_mode=1
dalvik.vm.heapgrowthlimit=96m
dalvik.vm.heapsize=128m
ro.mediatek.chip_ver=S01
ro.mediatek.version.release=ALPS.W10.24.p0
ro.mediatek.platform=MT6582
ro.mediatek.version.sdk=1
ro.telephony.sim.count=2
persist.radio.default.sim=0
persist.radio.multisim.config=dsds
ro.telephony.default_network=0,1
persist.gemini.sim_num=2
ro.gemini.smart_3g_switch=1
ril.specific.sm_cause=0
bgw.current3gband=0
ril.external.md=0
ro.sf.hwrotation=0
ril.current.share_modem=2
curlockscreen=1
ro.mediatek.gemini_support=true
persist.radio.fd.counter=15
persist.radio.fd.off.counter=5
persist.radio.fd.r8.counter=15
persist.radio.fd.off.r8.counter=5
persist.mtk.wcn.combo.chipid=-1
drm.service.enabled=true
fmradio.driver.enable=0
ril.first.md=1
ril.flightmode.poweroffMD=1
ril.telephony.mode=0
dalvik.vm.mtk-stack-trace-file=/data/anr/mtk_traces.txt
ril.radiooff.poweroffMD=0
dalvik.vm.heapstartsize=8m
dalvik.vm.heaptargetutilization=0.75
dalvik.vm.heapminfree=512k
dalvik.vm.heapmaxfree=8m
ro.mediatek.version.branch=KK.AOSP
keyguard.no_require_sim=true
ro.facelock.black_timeout=400
ro.facelock.det_timeout=1500
ro.facelock.rec_timeout=2500
ro.facelock.lively_timeout=2500
ro.facelock.est_max_time=600
ro.facelock.use_intro_anim=false
persist.sys.dalvik.vm.lib=libdvm.so
net.bt.name=Android
dalvik.vm.stack-trace-file=/data/anr/traces.txt
2.Partition layout
Code:
adb shell
Code:
127|[email protected]_sprout:/ $ cat proc/partitions
major minor #blocks name
179 0 3817472 mmcblk0
179 1 3072 mmcblk0p1
179 2 5120 mmcblk0p2
179 3 10240 mmcblk0p3
179 4 10240 mmcblk0p4
179 5 256 mmcblk0p5
179 6 384 mmcblk0p6
179 7 10240 mmcblk0p7
179 8 10240 mmcblk0p8
179 9 6144 mmcblk0p9
179 10 512 mmcblk0p10
179 11 8192 mmcblk0p11
179 12 65536 mmcblk0p12
179 13 16768 mmcblk0p13
179 14 1024000 mmcblk0p14
179 15 131072 mmcblk0p15
179 16 2416640 mmcblk0p16
179 17 32768 mmcblk0p17
179 18 65024 mmcblk0p18
179 64 4096 mmcblk0boot1
179 32 4096 mmcblk0boot0
179 96 7782400 mmcblk1
179 97 7781376 mmcblk1p1
and
Code:
[email protected]_sprout:/ $ ls -l /dev/block/platform/mtk-msdc.0/by-name
lrwxrwxrwx root root 2010-01-01 05:30 boot -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 2010-01-01 05:30 bootloader -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 2010-01-01 05:30 cache -> /dev/block/mmcblk0p15
lrwxrwxrwx root root 2010-01-01 05:30 expdb -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 2010-01-01 05:30 gen -> /dev/block/mmcblk0p18
lrwxrwxrwx root root 2010-01-01 05:30 logo -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 2010-01-01 05:30 metadata -> /dev/block/mmcblk0p17
lrwxrwxrwx root root 2010-01-01 05:30 nvram -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 2010-01-01 05:30 oem -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 2010-01-01 05:30 para -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 2010-01-01 05:30 proinfo -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 2010-01-01 05:30 protect1 -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 2010-01-01 05:30 protect2 -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 2010-01-01 05:30 recovery -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 2010-01-01 05:30 seccfg -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 2010-01-01 05:30 secro -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 2010-01-01 05:30 system -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 2010-01-01 05:30 userdata -> /dev/block/mmcblk0p16
3.Mount points
Code:
adb shell
Code:
[email protected]_sprout:/ $ cat proc/mounts
rootfs / rootfs ro,seclabel,relatime 0 0
tmpfs /dev tmpfs rw,seclabel,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,seclabel,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,seclabel,relatime 0 0
selinuxfs /sys/fs/selinux selinuxfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
none /sys/fs/cgroup tmpfs rw,seclabel,relatime,mode=750,gid=1000 0 0
none /sys/fs/cgroup/memory cgroup rw,relatime,memory 0 0
tmpfs /mnt/asec tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/platform/mtk-msdc.0/by-name/system /system ext4 ro,seclabel,relatime,data=ordered 0 0
/dev/block/platform/mtk-msdc.0/by-name/userdata /data ext4 rw,seclabel,nosuid,nodev,noatime,discard,noauto_da_alloc,data=ordered 0 0
/dev/block/platform/mtk-msdc.0/by-name/cache /cache ext4 rw,seclabel,nosuid,nodev,noatime,discard,noauto_da_alloc,data=ordered 0 0
/dev/block/platform/mtk-msdc.0/by-name/protect1 /protect_f ext4 rw,seclabel,nosuid,nodev,noatime,nodelalloc,noauto_da_alloc,commit=1,data=ordered 0 0
/dev/block/platform/mtk-msdc.0/by-name/protect2 /protect_s ext4 rw,seclabel,nosuid,nodev,noatime,nodelalloc,noauto_da_alloc,commit=1,data=ordered 0 0
/dev/block/platform/mtk-msdc.0/by-name/oem /oem ext4 ro,context=u:object_r:oemfs:s0,nosuid,nodev,relatime,data=ordered 0 0
adb /dev/usb-ffs/adb functionfs rw,relatime 0 0
/sys/kernel/debug /sys/kernel/debug debugfs rw,relatime 0 0
/dev/block/vold/179:97 /mnt/media_rw/sdcard0 vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1023,gid=1023,fmask=0007,dmask=0007,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/block/vold/179:97 /mnt/secure/asec vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1023,gid=1023,fmask=0007,dmask=0007,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/fuse /storage/sdcard0 fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
4.fastboot
yes this device has fastboot.
Unlocking bootloader via fastboot
***reboot into fastboot mode
2ways
a] switch off the phone>>press volume up + power at same time>>boot menu should appear>>go to fastboot menu with volume up and then select by pressing volume down.
OR
b]connect phone to PC(i use linux i dont need to install any drivers or adb or fastboot packages).>>enable usb debugging mode (developer options)>>adb reboot bootloader
this will boot into fastboot directly.
***connect phone to the PC
***open terminal>>fastboot oem unlock>>press volume down to select fastboot again>>fastboot format cache>>fastboot format userdata>>fastboot reboot
now you have unloicked bootloader.
5. Recovery
when
adb reboot recovery
Click to expand...
Click to collapse
given >>it boot into recovery screen where only some chinese picture of recovery is present.
On chinese recovery screen, if you press volume up and power button you will get apply zip from sideload and sdcard.
6.there is no valid fstab present at the root
7. init rc files are seem to be hidden out or symlinked somewhere else.
if you try to open them they open as only a blank text file.
8. Build version in build.prop is KPW53.
i dont know which version of kitkat is that.
9. baseband version
WR8.W1412.MD.WG.GMP.SP.W14.26.P3,2014/08/15 11.39
10. KERNEL version
3.4.67 [email protected]#1 Wed Aug 20 14:13:29 PDT 2014
11. SELINUX is disabled in build.prop
13. SAR value is 0.641 W/Kg (1g)
14. oem.prop for spice dream uno mi-498
Code:
ro.product.device=Mi-498_sprout
ro.product.name=Mi-498
ro.product.manufacturer=Spice
ro.product.model=Spice Mi-498
ro.product.locale.language=en
ro.product.locale.region=IN
ro.config.wallpaper=/oem/media/Default.jpg
15. partition layout proc/dumchar type(this does not exist on our phone but this info may be useful to create scatter file for sp flash tool)
Code:
partno: start_sect nr_sects partition_name
emmc_p1: 00000400 00001800 "proinfo"
emmc_p2: 00001c00 00002800 "nvram"
emmc_p3: 00004400 00005000 "protect1"
emmc_p4: 00009400 00005000 "protect2"
emmc_p5: 0000e400 00000200 "seccfg"
emmc_p6: 0000e600 00000300 "bootloader"
emmc_p7: 0000e900 00005000 "boot"
emmc_p8: 00013900 00005000 "recovery"
emmc_p9: 00018900 00003000 "secro"
emmc_p10: 0001b900 00000400 "para"
emmc_p11: 0001bd00 00004000 "logo"
emmc_p12: 0001fd00 00020000 "oem"
emmc_p13: 0003fd00 00008300 "expdb"
emmc_p14: 00048000 001f4000 "system"
emmc_p15: 0023c000 00040000 "cache"
emmc_p16: 0027c000 0049c000 "userdata"
emmc_p17: 00718000 00010000 "metadata"
emmc_p18: 00728000 0001fc00 "gen"
16. more info for the android one partitions and bootloader and preloader methods
Code:
(bootloader) max-download-size: 0x8000000
(bootloader) partition-size:gen: 3f80000
(bootloader) partition-type:gen: raw data
(bootloader) partition-size:metadata: 2000000
(bootloader) partition-type:metadata: raw data
(bootloader) partition-size:userdata: 93800000
(bootloader) partition-type:userdata: ext4
(bootloader) partition-size:cache: 8000000
(bootloader) partition-type:cache: ext4
(bootloader) partition-size:system: 3e800000
(bootloader) partition-type:system: ext4
(bootloader) partition-size:expdb: 1060000
(bootloader) partition-type:expdb: raw data
(bootloader) partition-size:oem: 4000000
(bootloader) partition-type:oem: ext4
(bootloader) partition-size:logo: 800000
(bootloader) partition-type:logo: raw data
(bootloader) partition-size:para: 80000
(bootloader) partition-type:para: raw data
(bootloader) partition-size:secro: 600000
(bootloader) partition-type:secro: ext4
(bootloader) partition-size:recovery: a00000
(bootloader) partition-type:recovery: raw data
(bootloader) partition-size:boot: a00000
(bootloader) partition-type:boot: raw data
(bootloader) partition-size:bootloader: 60000
(bootloader) partition-type:bootloader: raw data
(bootloader) partition-size:seccfg: 40000
(bootloader) partition-type:seccfg: raw data
(bootloader) partition-size:protect2: a00000
(bootloader) partition-type:protect2: ext4
(bootloader) partition-size:protect1: a00000
(bootloader) partition-type:protect1: ext4
(bootloader) partition-size:nvram: 500000
(bootloader) partition-type:nvram: raw data
(bootloader) partition-size:proinfo: 300000
(bootloader) partition-type:proinfo: raw data
(bootloader) partition-size:preloader: 40000
(bootloader) partition-type:preloader: raw data
(bootloader) off-mode-charge: 1
(bootloader) warranty: no
(bootloader) unlocked: yes
(bootloader) secure: no
(bootloader) version-baseband: MOLY
(bootloader) kernel: lk
(bootloader) product: sprout
(bootloader) version-preloader: 0.1.02
(bootloader) version-bootloader: 0.5.17
17. how to access preloader
The preloader does exist and can be accessed.
Remove and replace the battery and keep the volume down button with the phone connected to activate it.
thanks to @joshuab227
reserved1
@k2wl
Can you send me output of
Code:
cat /proc/cmdline
Also check if you have adb access in the Chinese recovery.
varun.chitre15 said:
@k2wl
Can you send me output of
Code:
cat /proc/cmdline
Also check if you have adb access in the Chinese recovery.
Click to expand...
Click to collapse
cat proc/cmdline
Click to expand...
Click to collapse
permission denied.
and there is no adb access in chinese recovery
k2wl said:
permission denied.
and there is no adb access in chinese recovery
Click to expand...
Click to collapse
Hmm... and none of the exploits look to be working, Google has patched them all. Even if I had the command line I could have build up a recovery which could have opened all these barriers.
The factory images just like the Nexus line are likely to be posted by Google soon.
Is any reason adb not being available in recovery?
varun.chitre15 said:
Hmm... and none of the exploits look to be working, Google has patched them all. Even if I had the command line I could have build up a recovery which could have opened all these barriers.
The factory images just like the Nexus line are likely to be posted by Google soon.
Click to expand...
Click to collapse
varun.chitre15 said:
Hmm... and none of the exploits look to be working, Google has patched them all. Even if I had the command line I could have build up a recovery which could have opened all these barriers.
The factory images just like the Nexus line are likely to be posted by Google soon.
Click to expand...
Click to collapse
oh you need that for recovery build.
then here it is
console=tty0 console=ttyMT3,921600n1 root=/dev/ram vmalloc=496M slub_max_order=0 slub_debug=O androidboot.hardware=sprout
Click to expand...
Click to collapse
hope this helps!!
k2wl said:
oh you need that for recovery build.
then here it is
hope this helps!!
Click to expand...
Click to collapse
Try flashing this new recovery
https://s.basketbuild.com/filedl/devs?dev=varun.chitre15&dl=varun.chitre15/A1/recovery.img
fastboot flash recovery path/to/recovery.img
Check if it boots.
P.s: You will lose that Chinese recovery after this, it isn't of any use anyway.
varun.chitre15 said:
Try flashing this new recovery
https://s.basketbuild.com/filedl/devs?dev=varun.chitre15&dl=varun.chitre15/A1/recovery.img
fastboot flash recovery path/to/recovery.img
Check if it boots.
P.s: You will lose that Chinese recovery after this, it isn't of any use anyway.
Click to expand...
Click to collapse
recovery doesnt boot.
it stays on spice logo
saying recovery mode in the bottom and after a while it shows oem unlock and phone reboots.
k2wl said:
recovery doesnt boot.
it stays on spice logo
saying recovery mode in the bottom and after a while it shows oem unlock and phone reboots.
Click to expand...
Click to collapse
I have uploaded a new image at the same link. Check with that.
varun.chitre15 said:
I have uploaded a new image at the same link. Check with that.
Click to expand...
Click to collapse
this recovery does not boot.
spice mobile screen with recovery mode for 1 min. then spice screen with oem unlocked for 10-15 sec then phone reboots.
k2wl said:
this recovery does not boot.
spice mobile screen with recovery mode for 1 min. then spice screen with oem unlocked for 10-15 sec then phone reboots.
Click to expand...
Click to collapse
OK I have ordered the Micromax variant, will be able to experiment myself after that.
guys try this to gain root http://www.mgyun.com/en/getvroot
varunrocks17 said:
guys try this to gain root http://www.mgyun.com/en/getvroot
Click to expand...
Click to collapse
man it doesnt work. plz stop posting it on every android 1 thread. the phones have same everything internal.
can upload a backup of the system and boot?
walkman-star said:
can upload a backup of the system and boot?
Click to expand...
Click to collapse
no root access till now so no boot.img
but system dump can be taken.
System dump
Find system dump here http://dropjar.com/#YazLGa6
k2wl said:
no root access till now so no boot.img
but system dump can be taken.
Click to expand...
Click to collapse
sheldroid said:
Find system dump here
Click to expand...
Click to collapse
boot.img can upload ?
No root available so can't take boot image
Sent from my Spice Mi-498
k2wl said:
no root access till now...
Click to expand...
Click to collapse
So there are no exploits reported to working as of now?
How about towelroot? (BTW I've seen many devices with kernel build date greater than JUN 2014 and towelroot working) If it doesn't work, you can try to play with modstrings.

ZD551KL/ZE550KL/ZE551KL/ZE600KL/ZE601KL official bootloader unlock

Released on asus website 14/12/2015:
Marshmallow:
http://dlcdnet.asus.com/pub/ASUS/ZenFone/ZE551KL/UnlockTool_ASUS_AndroidM20160928_Singed.zip
Lollipop:
http://dlcdnet.asus.com/pub/ASUS/ZenFone/ZE600KL/ZE600KL_UnlockApp.zip
The APKs for each are binary identical, so it is not really important which unlock utility you download.
Frequently asked questions:
Q: will this work on ZE500KG / ZE500KL / ASUS_Z00RD / ASUS_Z00RD_5 / ASUS_Z00RD_7 / ASUS_Z00ED / ASUS_Z00EDB / ASUS_Z00E_1 / ASUS_Z00E_2 / ASUS_Z00E_3
A: we do not think so, but we do not know if anyone has tried it.
Q: can I relock bootloader?
A: we do not have a way of re-locking bootloader right now. Hopefully it will be possible using a backup of some partition to restore original bootloader, but we have not found it yet.
Q: can I restore my warranty by re-locking the bootloader?
A: we believe that ASUS records the serial number of the device through the unlock utility, so it will not be possible to make a warranty claim even if you do manage to re-lock the bootloader.
Q: can I still receive OTA updates?
A: we do not know, because no updates have been released since the unlock utility was released.
Q: can I still update firmware manually?
A: yes, definitely. fetch the new firmware zip from ASUS website and flash in stock recovery or transfer to root of sd-card and boot the phone normally (it will find the update zip file and prompt you).
Download notes from the site:
Unlock Device App: Unlock boot loader
Notice:
1. Update your software image to V1.15.40.771 or latest version
2. Before you download, install, and use the Unlock Device App you acknowledge and assume complete risk to the quality and performance of this App, including but not limited to the following: once you activate the App you will not be able to recover your ASUS product (“Original Product”) back to original locked conditions; the Original Product with the activated App will not be deemed the Original Product; the Revised Product will no longer be covered under the warranty of the Original Product; the software of Revised Product will no longer be deemed the software of the Original Product and can no longer receive ASUS software updates; your purchased digital content may also be affected.
You also acknowledge ASUS does not guarantee service satisfaction to any Revised Product, including events involving paid service requested by you to be performed to the Revised Product.
Furthermore, such repaired Revised Product will not be covered under the warranty of the Original Product; the software of the repaired Revised Product will not be deemed the software of the Original Product and will not receive ASUS software updates.
It is strongly advised that you avoid activating this App unless you fully understand and accept the risks that may arise.
Click to expand...
Click to collapse
Do you think this would work on the US 551KL? If so thatd be great
* edit *
firmware v1.15.40.771 now released for ZE600KL, so I will try to flash now on ZE550KL and then unlock
http://dlcdnet.asus.com/pub/ASUS/ZenFone/ZE600KL/UL-Z00L-WW-1.15.40.771-user.zip
Please note, I have ZE550KL-1A025TW version, Snapdragon 615, 2GB RAM (ASUS_Z00LD / ASUS_Z00L_93)
I updated my ZE550KL to firmware v1.15.40.771:
http://dlcdnet.asus.com/pub/ASUS/ZenFone/ZE600KL/UL-Z00L-WW-1.15.40.771-user.zip
then ran the ZE600KL unlock utility.
Unlock utility runs without errors, phone reboots, no errors, everything still working fine.
Confirmed unlock successful
Code:
C:\adb>fastboot oem device-info
...
(bootloader) Device unlocked: true
(bootloader) Charger screen enabled: false
(bootloader) Display panel:
OKAY [ 0.010s]
finished. total time: 0.010s
Let me get this straight, you flashed ZE600KL firmware on your ZE550KL and it worked? Not something I would recommend.
Yeh i did, in the source code they seem to be built with identical makefiles so i just figured i would experiment
Sent from my GT-I9195 using Tapatalk
You can test your bootloader status, if you type in fastboot mode "fastboot oem device-info"
Can someone please paste the output on a rooted ZE550KL in adb shell:
Code:
ls -al /dev/block/platform/dw_mmc/by-name
I already compiled a cm recovery, but i am not sure about the block names...
destilant said:
Can someone please paste the output on a rooted ZE550KL in adb shell:
I already compiled a cm recovery, but i am not sure about the block names...
Click to expand...
Click to collapse
Would the recovery also work for a 551KL? I can get you that, if i can help. And also test the recovery
wickedpygmy said:
Yeh i did, in the source code they seem to be built with identical makefiles so i just figured i would experiment
Sent from my GT-I9195 using Tapatalk
Click to expand...
Click to collapse
fair enough. How do it look? The 600KL is a 6" phone and the 5500KL a 5.5". Does it appear to overlap or anything?
capeorigins said:
Would the recovery also work for a 551KL? I can get you that, if i can help. And also test the recovery
Click to expand...
Click to collapse
Nope, the ZE551KL is shipped with a Snapdragon 615 MSM8939, the ZE550KL with a 610 MSM8916, so it wont work...
destilant said:
You can test your bootloader status, if you type in fastboot mode "fastboot oem device-info"
Click to expand...
Click to collapse
Code:
C:\adb>adb devices
List of devices attached
F8AZCY01P722 device
C:\adb>adb reboot bootloader
C:\adb>fastboot oem device-info
...
(bootloader) Device unlocked: true
(bootloader) Charger screen enabled: false
(bootloader) Display panel:
OKAY [ 0.010s]
finished. total time: 0.010s
C:\adb>
destilant said:
Can someone please paste the output on a rooted ZE550KL in adb shell:
Code:
ls -al /dev/block/platform/dw_mmc/by-name
I already compiled a cm recovery, but i am not sure about the block names...
Click to expand...
Click to collapse
Moreover, can somebody please upload raw backups of the 'aboot' (& 'abootbak' if present) partition before & after unlocking the bootloader? You need root access & can use something like this one.
destilant said:
You can test your bootloader status, if you type in fastboot mode "fastboot oem device-info"
Click to expand...
Click to collapse
heywheelie said:
fair enough. How do it look? The 600KL is a 6" phone and the 5500KL a 5.5". Does it appear to overlap or anything?
Click to expand...
Click to collapse
looks normal, both have same resolution. I think both phones use the same firmware since the kernel is identical and Asus don't release Z00m firmware but use Z00L for both models.
Titokhan said:
Moreover, can somebody please upload raw backups of the 'aboot' (& 'abootbak' if present) partition before & after unlocking the bootloader? You need root access & can use something like this one.
Click to expand...
Click to collapse
@Titokhan must be too late for me to do this, since I already unlocked and have no way to get back?
attached is aboot and abootbak after unlocking, maybe @heywheelie can upload the before?
destilant said:
Nope, the ZE551KL is shipped with a Snapdragon 615 MSM8939, the ZE550KL with a 610 MSM8916, so it wont work...
Click to expand...
Click to collapse
the ZE550KL has a snapdragon 615 not 610
destilant said:
Can someone please paste the output on a rooted ZE550KL in adb shell:
Code:
ls -al /dev/block/platform/dw_mmc/by-name
I already compiled a cm recovery, but i am not sure about the block names...
Click to expand...
Click to collapse
doesnt look like folder exists.
Code:
[email protected]_Z00L_93:/ # ls -al /dev/block/platform/
drwxr-xr-x root root 1970-05-15 01:49 7824900.sdhci
[email protected]_Z00L_93:/ #
heywheelie said:
the ZE550KL has a snapdragon 615 not 610
Click to expand...
Click to collapse
init! i wish people would stop polluting the version/hardware topic, especially since its so confusing already
wickedpygmy said:
looks normal, both have same resolution. I think both phones use the same firmware since the kernel is identical and Asus don't release Z00m firmware but use Z00L for both models.
Click to expand...
Click to collapse
might be same firmware but specs do differ slightly
https://www.asus.com/Phone/ZenFone-2-Laser-ZE550KL/specifications/
https://www.asus.com/Phone/ZenFone-2-Laser-ZE600KL/specifications/
WLAN bands differ, bluetooth is 4.0 on 550 and 4.1 on 6.0. Nothing dramatic but different
destilant said:
Can someone please paste the output on a rooted ZE550KL in adb shell:
Code:
ls -al /dev/block/platform/dw_mmc/by-name
I already compiled a cm recovery, but i am not sure about the block names...
Click to expand...
Click to collapse
This any use?
Code:
[email protected]_Z00L_93:/ # ls -al /dev/block/platform/7824900.sdhci/by-name
lrwxrwxrwx root root 1970-05-15 01:49 ADF -> /dev/block/mmcblk0p42
lrwxrwxrwx root root 1970-05-15 01:49 APD -> /dev/block/mmcblk0p43
lrwxrwxrwx root root 1970-05-15 01:49 DDR -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 1970-05-15 01:49 aboot -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 1970-05-15 01:49 abootbak -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 1970-05-15 01:49 abootdebug -> /dev/block/mmcblk0p34
lrwxrwxrwx root root 1970-05-15 01:49 asdf -> /dev/block/mmcblk0p33
lrwxrwxrwx root root 1970-05-15 01:49 asusfw -> /dev/block/mmcblk0p40
lrwxrwxrwx root root 1970-05-15 01:49 asusgpt -> /dev/block/mmcblk0p27
lrwxrwxrwx root root 1970-05-15 01:49 asusgpt1 -> /dev/block/mmcblk0p28
lrwxrwxrwx root root 1970-05-15 01:49 asusgpt2 -> /dev/block/mmcblk0p29
lrwxrwxrwx root root 1970-05-15 01:49 asuskey -> /dev/block/mmcblk0p22
lrwxrwxrwx root root 1970-05-15 01:49 asuskey2 -> /dev/block/mmcblk0p23
lrwxrwxrwx root root 1970-05-15 01:49 asuskey3 -> /dev/block/mmcblk0p24
lrwxrwxrwx root root 1970-05-15 01:49 asuskey4 -> /dev/block/mmcblk0p25
lrwxrwxrwx root root 1970-05-15 01:49 asuskey5 -> /dev/block/mmcblk0p26
lrwxrwxrwx root root 1970-05-15 01:49 boot -> /dev/block/mmcblk0p37
lrwxrwxrwx root root 1970-05-15 01:49 cache -> /dev/block/mmcblk0p44
lrwxrwxrwx root root 1970-05-15 01:49 config -> /dev/block/mmcblk0p32
lrwxrwxrwx root root 1970-05-15 01:49 devinfo -> /dev/block/mmcblk0p15
lrwxrwxrwx root root 1970-05-15 01:49 factory -> /dev/block/mmcblk0p20
lrwxrwxrwx root root 1970-05-15 01:49 factorybak -> /dev/block/mmcblk0p21
lrwxrwxrwx root root 1970-05-15 01:49 fsc -> /dev/block/mmcblk0p17
lrwxrwxrwx root root 1970-05-15 01:49 fsg -> /dev/block/mmcblk0p16
lrwxrwxrwx root root 1970-05-15 01:49 hyp -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 1970-05-15 01:49 hypbak -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 1970-05-15 01:49 keystore -> /dev/block/mmcblk0p31
lrwxrwxrwx root root 1970-05-15 01:49 misc -> /dev/block/mmcblk0p30
lrwxrwxrwx root root 1970-05-15 01:49 modem -> /dev/block/mmcblk0p41
lrwxrwxrwx root root 1970-05-15 01:49 modemst1 -> /dev/block/mmcblk0p18
lrwxrwxrwx root root 1970-05-15 01:49 modemst2 -> /dev/block/mmcblk0p19
lrwxrwxrwx root root 1970-05-15 01:49 oem -> /dev/block/mmcblk0p36
lrwxrwxrwx root root 1970-05-15 01:49 persist -> /dev/block/mmcblk0p39
lrwxrwxrwx root root 1970-05-15 01:49 persistent -> /dev/block/mmcblk0p35
lrwxrwxrwx root root 1970-05-15 01:49 recovery -> /dev/block/mmcblk0p38
lrwxrwxrwx root root 1970-05-15 01:49 rpm -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 1970-05-15 01:49 rpmbak -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 1970-05-15 01:49 sbl1 -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 1970-05-15 01:49 sbl1bak -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 1970-05-15 01:49 sec -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 1970-05-15 01:49 splash -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 1970-05-15 01:49 ssd -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 1970-05-15 01:49 system -> /dev/block/mmcblk0p45
lrwxrwxrwx root root 1970-05-15 01:49 tz -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 1970-05-15 01:49 tzbak -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 1970-05-15 01:49 userdata -> /dev/block/mmcblk0p46
[email protected]_Z00L_93:/ #

[tool][mod][OP6T] Splash screen modification [linux]

First, most - if not all - the credits go to @makers_mark.
Please read https://forum.xda-developers.com/oneplus-6/themes/wip-splash-screen-image-injector-t3800836 for technical details. I have just tried this on our OP6T and made slight modifications to the source code of the application.
This linux tool allows you to extract splash screen images from a raw dump of the LOGO partition.
You can then modify the images to your liking and repack them into a raw LOGO partition.
You do need at least basic linux knowledge/skill and you must have a working adb. If you don't know what this is, then this is not a thread for you.
Note: it should be very easy to compile the program under Windows and use it from Windows ... but I do not use Windows myself, I am a linux guy ... feel free to (re)use this and compile under Windows. Instructions below should be reasonably similar if you use PowerShell on Windows.
Note that the phone has 2 LOGO partitions ... more about that below.
Attached zip file contains the following:
- original.logo.bin (raw extract from the original 6T LOGO partition)
- lodepng.c, lodepng.h, OP6logo.c (C source of the utility)
- op6 (linux executable, compiled from source code)
- 0.png, 1.png, ..., 27.png (png splash screen files extracted with the tool from the original.logo.bin)
How to compile the utility (if you would want to do that yourself): download attached zip file, create a new directory and unzip the downloaded zip file into that directory. Then compile from source:
Code:
> mkdir splash
> cd splash
> unzip splash.zip
> cc *.c -o op6
After this you will have an executable called "op6". The zip file already contains a compiled op6, so you do not necessarily need to compile it yourself.
How to use:
1) First, make a raw dump of the LOGO partition. To do that, reboot your phone into twrp (see for example https://oneplus.gadgethacks.com/how-to/install-twrp-recovery-your-oneplus-6t-0190296/ for instructions). With the phone in twrp, open a linux shell, then do:
Code:
> adb shell
# dd if=/dev/block/bootdevice/by-name/LOGO_a of=/data/original.logo.bin
# exit
> adb pull /data/original.logo.bin
You should now have a file called "original.logo.bin" which is exactly 16MB in size. Copy this file to the directory which contains your op6 tool. Also make a backup of the file so you have a copy of the stock LOGO partition.
2) Second, extract (using the op6 tool) the png images from the raw logo dump. To do that, open a linux shell, then do:
Code:
> cd splash
> ./op6 -i original.logo.bin -d
You should see output like:
Code:
#01: Offset:0, Header=SPLASH!!, Width=1080, Height=1920, Data Length=245032, Special=1, Name=0.png, Metadata=, 6220800 decoded bytes
#02: Offset:249856, Header=SPLASH!!, Width=536, Height=60, Data Length=9162, Special=1, Name=1.png, Metadata=, 96480 decoded bytes
#03: Offset:266240, Header=SPLASH!!, Width=1080, Height=1920, Data Length=187698, Special=1, Name=2.png, Metadata=, 6220800 decoded bytes
#04: Offset:458752, Header=SPLASH!!, Width=1080, Height=1920, Data Length=55422, Special=1, Name=3.png, Metadata=, 6220800 decoded bytes
#05: Offset:520192, Header=SPLASH!!, Width=1080, Height=1920, Data Length=187698, Special=1, Name=4.png, Metadata=, 6220800 decoded bytes
#06: Offset:712704, Header=SPLASH!!, Width=392, Height=66, Data Length=6744, Special=1, Name=5.png, Metadata=, 77616 decoded bytes
#07: Offset:724992, Header=SPLASH!!, Width=487, Height=69, Data Length=8478, Special=1, Name=6.png, Metadata=, 100809 decoded bytes
#08: Offset:741376, Header=SPLASH!!, Width=1080, Height=1920, Data Length=119304, Special=1, Name=7.png, Metadata=, 6220800 decoded bytes
#09: Offset:868352, Header=SPLASH!!, Width=1080, Height=2160, Data Length=279186, Special=1, Name=8.png, Metadata=, 6998400 decoded bytes
#10: Offset:1155072, Header=SPLASH!!, Width=536, Height=60, Data Length=9162, Special=1, Name=9.png, Metadata=, 96480 decoded bytes
#11: Offset:1171456, Header=SPLASH!!, Width=1080, Height=2160, Data Length=193798, Special=1, Name=10.png, Metadata=, 6998400 decoded bytes
#12: Offset:1372160, Header=SPLASH!!, Width=1080, Height=2160, Data Length=61522, Special=1, Name=11.png, Metadata=, 6998400 decoded bytes
#13: Offset:1441792, Header=SPLASH!!, Width=1080, Height=2160, Data Length=193798, Special=1, Name=12.png, Metadata=, 6998400 decoded bytes
#14: Offset:1642496, Header=SPLASH!!, Width=392, Height=66, Data Length=6744, Special=1, Name=13.png, Metadata=, 77616 decoded bytes
#15: Offset:1654784, Header=SPLASH!!, Width=487, Height=69, Data Length=8478, Special=1, Name=14.png, Metadata=, 100809 decoded bytes
#16: Offset:1671168, Header=SPLASH!!, Width=1080, Height=2160, Data Length=125402, Special=1, Name=15.png, Metadata=, 6998400 decoded bytes
#17: Offset:1802240, Header=SPLASH!!, Width=1080, Height=2280, Data Length=303732, Special=1, Name=16.png, Metadata=, 7387200 decoded bytes
#18: Offset:2113536, Header=SPLASH!!, Width=536, Height=60, Data Length=9162, Special=1, Name=17.png, Metadata=, 96480 decoded bytes
#19: Offset:2129920, Header=SPLASH!!, Width=1080, Height=2280, Data Length=196846, Special=1, Name=18.png, Metadata=, 7387200 decoded bytes
#20: Offset:2334720, Header=SPLASH!!, Width=1080, Height=2280, Data Length=64572, Special=1, Name=19.png, Metadata=, 7387200 decoded bytes
#21: Offset:2404352, Header=SPLASH!!, Width=1080, Height=2280, Data Length=196848, Special=1, Name=20.png, Metadata=, 7387200 decoded bytes
#22: Offset:2609152, Header=SPLASH!!, Width=392, Height=66, Data Length=6744, Special=1, Name=21.png, Metadata=, 77616 decoded bytes
#23: Offset:2621440, Header=SPLASH!!, Width=487, Height=69, Data Length=8478, Special=1, Name=22.png, Metadata=, 100809 decoded bytes
#24: Offset:2637824, Header=SPLASH!!, Width=1080, Height=2280, Data Length=128452, Special=1, Name=23.png, Metadata=, 7387200 decoded bytes
#25: Offset:2772992, Header=SPLASH!!, Width=1080, Height=2340, Data Length=312118, Special=1, Name=24.png, Metadata=, 7581600 decoded bytes
#26: Offset:3092480, Header=SPLASH!!, Width=536, Height=60, Data Length=9162, Special=1, Name=25.png, Metadata=, 96480 decoded bytes
#27: Offset:3108864, Header=SPLASH!!, Width=1080, Height=2340, Data Length=198370, Special=1, Name=26.png, Metadata=, 7581600 decoded bytes
#28: Offset:3313664, Header=SPLASH!!, Width=1080, Height=2340, Data Length=66096, Special=1, Name=27.png, Metadata=, 7581600 decoded bytes
You should now 28 png files in the directory called "0.png", "1.png", ..., "27.png".
3) Third, check the images. Install an image viewer (for example "eog") on your linux distribution and then do:
Code:
> eog *.png
You will be able to view the splash screens one by one (with eog). The png's are also part of attached zip file.
4) Modify any of the png files to your liking. For example, you can use the linux "gimp" image processing tool. But note that you MUST keep the width and height of the images the same as the original sizes.
5) Repack the modified images. To do that, open a linux shell and do:
Code:
> cd splash
> ./op6 -i original.logo.bin -j 0
You will see output like:
Code:
Resolution Offset Name
-------------------------------------------------------------
1080x1920 0 0.png
536x60 249856 1.png
1080x1920 266240 2.png
1080x1920 458752 3.png
1080x1920 520192 4.png
392x66 712704 5.png
487x69 724992 6.png
1080x1920 741376 7.png
1080x2160 868352 8.png
536x60 1155072 9.png
1080x2160 1171456 10.png
1080x2160 1372160 11.png
1080x2160 1441792 12.png
392x66 1642496 13.png
487x69 1654784 14.png
1080x2160 1671168 15.png
1080x2280 1802240 16.png
536x60 2113536 17.png
1080x2280 2129920 18.png
1080x2280 2334720 19.png
1080x2280 2404352 20.png
392x66 2609152 21.png
487x69 2621440 22.png
1080x2280 2637824 23.png
1080x2340 2772992 24.png
536x60 3092480 25.png
1080x2340 3108864 26.png
1080x2340 3313664 27.png
______________________________________
Original filesize: 16.00 MB
Modified filesize: 3.23 MB
-------------------------------------------------------------
And you should have a file called "modified.logo.bin".
6) To flash the new splash screens, reboot your phone back into twrp. Then open a linux shell and do:
Code:
> adb push modified.logo.bin /data/
> adb shell
# dd if=/data/original.logo.bin of=/dev/block/bootdevice/by-name/LOGO_a
# sync
# sync
# reboot
With the last command, your phone will reboot and if all is well you should see your modified splash screens.
If you want to return to stock, just follow step 6 but flash original.logo.bin file.
What's the story with the 2 partitions? 6T uses the A/B partitioning scheme. Read this thread: https://forum.xda-developers.com/oneplus-6/how-to/guide-noobs-guide-to-b-partitions-op6-t3816123, if you want more details.
The LOGO partitions are called: LOGO_a and LOGO_b. In the commands above I have used always LOGO_a but obviously you can use LOGO_b as well.
How do you know which partition (A or B) your phone is booting from? Well, that i easy to find out. Boot your phone normally. Open a linux shell and then do:
Code:
> adb shell
$ getprop ro.boot.slot_suffix
And it will say "_a" or "_b" depending on the partition which your phone is booting from. So that determines whether you have to flash LOGO_a or LOGO_b.
Enjoy.
Note: attached there is also a example.zip file with a original.logo.bin file inside. This is an example where the splash screens from One+ have been replaced by black screens with the Google logo. You can straight flash that into the LOGO_a and/or LOGO_b partitions. I have attached also a bootanimation.zip (black Google pixel style) which plays very nicely with this. The bootanimation.zip file should go into /system/media/ on your device.
Big thanks for the proper credit @foobar66. I do not have the time anymore to even find/dissect bootloaders/partitions these days, and thanks for your documentation. I have seen several people walk away with my free information and dedicated work like they didn't steal it and try and make them self a name (I guess). Thank you!
makers_mark said:
Big thanks for the proper credit @foobar66. I do not have the time anymore to even find/dissect bootloaders/partitions these days, and thanks for your documentation. I have seen several people walk away with my free information and dedicated work like they didn't steal it and try and make them self a name (I guess). Thank you!
Click to expand...
Click to collapse
No problem ... that is only normal, decent and polite behavior. We are here to share and learn on XDA.
The program did not work initially on the original.logo.bin from the 6T (segmentation fault). I made a few small mods to the code to make it work.
Can you share some pictures of the splash screens you have changed to?
MishaalRahman said:
Can you share some pictures of the splash screens you have changed to?
Click to expand...
Click to collapse
See attach. I changed 0.png, 8.png, 16.png and 24.png. Note that they all have slightly different sizes !!!
Great work. I was waiting for this.
Quick question: any idea about the unlocked bootloader image location ?
Edit: works fine.
AnoopKumar said:
Great work. I was waiting for this.
Quick question: any idea about the unlocked bootloader image location ?
Edit: works fine.
Click to expand...
Click to collapse
No not precisely, but here is the list of partitions with their names:
Code:
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 ALIGN_TO_128K_1 -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 ALIGN_TO_128K_2 -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 ImageFv -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 LOGO_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 LOGO_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 abl_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 abl_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 aging -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 aop_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 aop_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 apdp -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 bluetooth_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 bluetooth_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 boot_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 boot_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 cdt -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 cmnlib64_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 cmnlib64_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 cmnlib_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 cmnlib_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 config -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 ddr -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 devcfg_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 devcfg_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 devinfo -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 dip -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 dsp_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 dsp_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 dtbo_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 dtbo_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 frp -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 fsc -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 fsg -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 fw_4j1ed_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 fw_4j1ed_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 fw_4u1ea_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 fw_4u1ea_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 fw_ufs3_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 fw_ufs3_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 fw_ufs4_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 fw_ufs4_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 fw_ufs5_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 fw_ufs5_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 fw_ufs6_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 fw_ufs6_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 fw_ufs7_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 fw_ufs7_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 fw_ufs8_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 fw_ufs8_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 hyp_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 hyp_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 keymaster_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 keymaster_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 keystore -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 limits -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 logdump -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 logfs -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 mdtp_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 mdtp_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 mdtpsecapp_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 mdtpsecapp_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 minidump -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 misc -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 modem_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 modem_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 modemst1 -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 modemst2 -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 msadp -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 odm_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 odm_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 oem_dycnvbk -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 oem_stanvbk -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 op1 -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 op2 -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 param -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 persist -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 qupfw_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 qupfw_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 reserve1 -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 reserve2 -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 sec -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 splash -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 spunvm -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 ssd -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 sti -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 storsec_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 storsec_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 system_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 system_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 toolsfv -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 tz_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 tz_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 userdata -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 vbmeta_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 vbmeta_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 vendor_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 16 1970-01-01 08:50 vendor_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 xbl_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 xbl_b -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 xbl_config_a -> /dev/block/[email protected]
0 lrwxrwxrwx 1 root root 15 1970-01-01 08:50 xbl_config_b -> /dev/block/[email protected]
I am just guessing it might be xbl_a and xbl_config_a ... but I am not sure.
I ran a string search using grep on stock fastboot images. No luck.
foobar66 said:
No not precisely, but here is the list of partitions with their names:
I am just guessing it might be xbl_a and xbl_config_a ... but I am not sure.
Click to expand...
Click to collapse
xbl is the eXtensible bootloader. A 64bit elf. Does it contain images ? is it possible ?
AnoopKumar said:
xbl is the eXtensible bootloader. A 64bit elf. Does it contain images ? is it possible ?
Click to expand...
Click to collapse
Hmm ... very difficult. ELF is the executable and linking format. I guess the images are static binaries which get included in the code as hex arrays or part of the ELF file's "data" section. Theoretically possible but I would not start on it ... will take a lot of time to find out.
foobar66 said:
See attach. I changed 0.png, 8.png, 16.png and 24.png. Note that they all have slightly different sizes !!!
Click to expand...
Click to collapse
Do you have this available for download?
dennisbednarz said:
Do you have this available for download?
Click to expand...
Click to collapse
I will add to |OP| ... I have black screens with central Google logo.
What's the splash screen, the one before the boot animation?
NateDev said:
What's the splash screen, the one before the boot animation?
Click to expand...
Click to collapse
Yes
Do you have plans for working on other device??
If yes, please do it for X00T (ASUS Zenfone Max Pro M1)
I'm uploading the stock splash.img here.
https://t.me/ASUSX00TD/76540
Also if you want any other help, here is our device support group
https://t.me/ZenfoneMaxProOfficial
https://t.me/ASUSX00TD
Thanks for taking the time to put this together.
Does anyone have instructions for how to do this on Windows? The only access I have to Linux is through Chrome OS which is still too finicky to get all if this done with.
clarkcant said:
Thanks for taking the time to put this together.
Does anyone have instructions for how to do this on Windows? The only access I have to Linux is through Chrome OS which is still too finicky to get all if this done with.
Click to expand...
Click to collapse
See the attachment. Just rename your LOGO.img to logo.img
Code:
op6t -i logo.img -d //to extract splash images
op6t -i logo.img -j 0 //repack with changes
For OnePlus 6T replace 24.png and 27.png
Click to expand...
Click to collapse
foobar66 said:
I will add to |OP| ... I have black screens with central Google logo.
Click to expand...
Click to collapse
Is the "Splash.zip" file the Google Logo?
Edit: disregard this. I didn't notice the note that was added
Mogul MAXX said:
Do you have plans for working on other device??
If yes, please do it for X00T (ASUS Zenfone Max Pro M1)
I'm uploading the stock splash.img here.
https://t.me/ASUSX00TD/76540
Also if you want any other help, here is our device support group
https://t.me/ZenfoneMaxProOfficial
https://t.me/ASUSX00TD
Click to expand...
Click to collapse
No ...
@foobar66 Thank you very much for this! Works on OP6 as well. My new splash logo

[ROM][UNOFFICIAL] LineageOS 17.1 for Xperia 1 II

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Code:
#include <std_disclaimer.h>
/*
* Your warranty is now void.
*
* I am not responsible for bricked devices, dead SD cards,
* thermonuclear war, or you getting fired because the alarm app failed. Please
* do some research if you have any concerns about features included in this ROM
* before flashing it! YOU are choosing to make these modifications, and if
* you point the finger at me for messing up your device, I will laugh at you.
*/
About LineageOS
LineageOS is a free, community built, aftermarket firmware distribution of Android 10.x (Q),
which is designed to increase performance and reliability over stock Android for your device.
All the source code for LineageOS is available in the LineageOS GitHub repo.
And if you would like to contribute to LineageOS, please visit our Gerrit Code Review.
Official LineageOS website : http://lineageos.org
About LineageOS Legal : http://lineageos.org/legal/
Important Information
1. This ROM has nothing related to ODM images! So you don't need to ask/install anything like that, just follow the instructions.
2. This ROM will never work with any versions of Google Camera (GCam)!
3. You need to flash Stock Android 10 before flashing this ROM.
4. For VoLTE, you need to boot into stock firmware and enable it before flashing this ROM!
5.If you cam from SODP ROMs, you need to go back to official Android 10 firmware, and boot into launcher.
Downloads Links
LineageOS 17.1:
Unofficial-build: Link
Google Applications (optional):
OpenGapps: http://opengapps.org/ (ARM64->Android 10.0->Pico, Nano or Micro)
Information: Flash the GApps before the first boot. If not, a clean flash is recommended.
Flashing and updating
How to flash
Make sure you upgraded to Official Android 10.0 from Sony
Unlock bootloader is necessary.
Download latest platform-tools from google
1. Install fastbootd drivers, guidance
2. Put your device into fastboot by volume up key.
3. Enter fastbootd:
Code:
fastboot reboot fastboot
4. Flash LineageOS:
Code:
fastboot set_active a
fastboot flash:raw boot boot.img
fastboot flash dtbo dtbo.img
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
fastboot --disable-verity --disable-verification flash vbmeta_system vbmeta_system.img
fastboot erase metadata
fastboot flash system system.img
fastboot flash product product.img
5. If you are first time to flash LineageOS, Wipe the old userdata:
Code:
fastboot erase userdata
Gapps:
Download Lineage Recovery
You could also choose twrp or else.
Flash and boot into Recovery then choose Apply update - Apply from ADB, then sideload the gapps package on your PC with adb tool:
Code:
adb sideload <PATH OF GAPPS>
Root access:
Flash Magisk in recovery.
Issues and reports
Report issues only if you are using the ROM kernel
If an additional mod is installed, make sure it's unrelated, and mention it
Make sure the issue wasn't discussed earlier in the threads
Share a log of the error with CatLog for example
Donation:
If you would like to donate me a cup of tea, you can:
Paypal
Also thanks to:
cramfs28
Shion Kagurazaka 神樂坂紫苑 云贵高原小白鼠扛把子
The LineageOS Team
The CyanogenMod Team
XDA:DevDB Information
Lineage-17.1 for Xperia 1 II, ROM for the Sony Xperia 1 II
Contributors
Sjll
Source Code:
GitHub - sjllls/android_device_sony_pdx203
Contribute to sjllls/android_device_sony_pdx203 development by creating an account on GitHub.
github.com
GitHub - sjllls/android_vendor_sony_pdx203
Contribute to sjllls/android_vendor_sony_pdx203 development by creating an account on GitHub.
github.com
ROM OS Version: Android 10
ROM Kernel: Linux 4.x
Version Information
Status: Beta
Created 2020-12-06
Last Updated 2020-12-06
FEATURES AND ISSUES
Code:
- Boot: Ok
- Bluetooth: Ok
- WiFi: Ok
- WiFi Hotspot: Ok
- Wireless display: Not tested
- RIL - Phone - Data: Ok
- VoLTE: Ok
- GPS: Ok
- Camera: Ok
- Camcorder: Ok
- Lights: Ok
- MicroSD: Ok
- Accelerometer: Ok
- Compass: Ok
- Gyroscope: Ok
- QTI sensors: Ok
- Touchscreen: Ok
- FM Radio: NA
- Fingerprint: Ok
- Vibrator: Ok
- Microphone: Ok
- Audio & music: Ok
- Bluetooth audio: Ok
- NFC: Ok
- Kernel: Ok
- Graphics: Ok
- 3D Rendering: Ok
- Clock: Ok
- DRM: Widewine L3
- Offline Charging: Ok
- USB: Ok
- USB Tethering: Ok
- USB OTG: Ok
- Encryption: Ok
- SEPolicies: Enforce
Reserved
Thank you! I love LineageOS
This is awesome, thanks!
Has anyone tested this ROM yet?
Hi, was it difficult to build an aosp for this device?
I would lite to try to build for 5 ii but have no experience at all so I'm wondering if it won't be to difficult.
danfauca said:
Hi, was it difficult to build an aosp for this device?
I would lite to try to build for 5 ii but have no experience at all so I'm wondering if it won't be to difficult.
Click to expand...
Click to collapse
If you have a PC with 16GB+ RAM, 200GB+ disk space, and know the basic operation of ubuntu. You could build LineageOS following some guidances. And if you could test on your Xperia 5 II, I could provide you devcie tree for Xperia 5 II.
I've just checked on sony website and sadly xperia 5 ii isn't on the list of unlockable devices.
I'll consider buying xpreria 5 and building LineageOS for it.
danfauca said:
I've just checked on sony website and sadly xperia 5 ii isn't on the list of unlockable devices.
I'll consider buying xpreria 5 and building LineageOS for it.
Click to expand...
Click to collapse
It is not on the list, but you can unlock bootloader. You need to select xperia 1 ii, and then pass IMEI of xperia 5 ii. Don't ask me why it is like that , but it supposedly works: https://forum.xda-developers.com/t/how-do-you-unlock-the-sony-xperia-5-ii-bootloader.4183593/
Good to know!
Thanks
So i go to unlock bootloader with code provided by sony and in cdm is says no phone is recognized. Can anyone help me out?? Thanks
Hey! Good job!
I am thinking about flashing to LineageOS, but (as a newbie) I have a important question:
- as I see, everything for HW works, but how about camera and photo quality? Is possible to somehow instal those Sony camera pro apps?
Thank you for your reply in advance!
Wow! Niice I will give it a try. I'm looking more into a de-googled phone. Is the pro camera app still working?
Do you have some instructions on how to build everything? I am interested in contributing.
UPDATE: Has anyone tried flashing after upgrading to Android 11?
Sjll said:
If you have a PC with 16GB+ RAM, 200GB+ disk space, and know the basic operation of ubuntu. You could build LineageOS following some guidances. And if you could test on your Xperia 5 II, I could provide you devcie tree for Xperia 5 II.
Click to expand...
Click to collapse
I have the 5 II too (58.0.A.22.21). Already unlocked bl and I'm ready for the next step but I'm an ubuntu noob. Maybe I can help on the testing end?
i wanna konw if i flash this rom,how can i reinstall Photography Pro and Cinematography Pro apps
momba5 said:
I have the 5 II too (58.0.A.22.21). Already unlocked bl and I'm ready for the next step but I'm an ubuntu noob. Maybe I can help on the testing end?
Click to expand...
Click to collapse
My friends already built it, I will ask him for help.
------------------EDIT-----------------------
Released, test and enjoy.
This is super interesting, really looking forward to it, but can't get the partitions to write.
Luckily, the failure did not effect the stock android, so its not bricked but no lineageos yet
This is the xq-at51 and I did unlock the bootloader. TWRP installed fine.
Here's what I did:
Code:
C:\Tools\android_tools\platform-tools>fastboot set_active a
Setting current slot to 'a' OKAY [ 0.009s]
Finished. Total time: 0.012s
C:\Tools\android_tools\platform-tools>fastboot flash:raw boot boot.img
Sending 'boot_a' (98304 KB) OKAY [ 2.527s]
Writing 'boot_a' OKAY [ 0.419s]
Finished. Total time: 3.015s
C:\Tools\android_tools\platform-tools>fastboot flash dtbo dtbo.img
Sending 'dtbo' (24576 KB) OKAY [ 0.638s]
Writing 'dtbo' OKAY [ 0.053s]
Finished. Total time: 0.707s
C:\Tools\android_tools\platform-tools>fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
Rewriting vbmeta struct at offset: 0
Sending 'vbmeta' (4 KB) OKAY [ 0.005s]
Writing 'vbmeta' OKAY [ 0.002s]
Finished. Total time: 0.019s
C:\Tools\android_tools\platform-tools>fastboot --disable-verity --disable-verification flash vbmeta_system vbmeta_system.img
Sending 'vbmeta_system' (4 KB) OKAY [ 0.004s]
Writing 'vbmeta_system' OKAY [ 0.002s]
Finished. Total time: 0.019s
C:\Tools\android_tools\platform-tools>fastboot erase metadata
Erasing 'metadata' FAILED (remote: 'Erasing is not allowed for partition
')
fastboot: error: Command failed
C:\Tools\android_tools\platform-tools>fastboot flash system system.img
Sending sparse 'system' 1/2 (773740 KB) OKAY [ 20.106s]
Writing 'system' FAILED (remote: 'No such partition.')
fastboot: error: Command failed
C:\Tools\android_tools\platform-tools>fastboot erase userdata
******** Did you mean to fastboot format this f2fs partition?
Erasing 'userdata' OKAY [ 9.540s]
Finished. Total time: 9.545s
And here's the partition list I get:
Code:
C:\Tools\android_tools\platform-tools>adb shell ls -l /dev/block/platform/soc/1d84000.ufshc/by-name
total 0
lrwxrwxrwx 1 root root 15 1970-01-01 03:01 LTALabel -> /dev/block/sda2
lrwxrwxrwx 1 root root 15 1970-01-01 03:01 TA -> /dev/block/sda1
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 abl_a -> /dev/block/sda14
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 abl_b -> /dev/block/sda28
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 aop_a -> /dev/block/sda11
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 aop_b -> /dev/block/sda25
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 apdp -> /dev/block/sda43
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 appslog -> /dev/block/sda55
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 bluetooth_a -> /dev/block/sda62
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 bluetooth_b -> /dev/block/sda76
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 boot_a -> /dev/block/sda64
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 boot_b -> /dev/block/sda78
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 cdt -> /dev/block/sda51
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 cmnlib64_a -> /dev/block/sda17
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 cmnlib64_b -> /dev/block/sda31
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 cmnlib_a -> /dev/block/sda16
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 cmnlib_b -> /dev/block/sda30
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 ddr -> /dev/block/sda41
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 devcfg_a -> /dev/block/sda18
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 devcfg_b -> /dev/block/sda32
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 devinfo -> /dev/block/sda40
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 diag -> /dev/block/sda56
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 dsp_a -> /dev/block/sda63
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 dsp_b -> /dev/block/sda77
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 dtbo_a -> /dev/block/sda69
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 dtbo_b -> /dev/block/sda83
lrwxrwxrwx 1 root root 15 1970-01-01 03:01 frp -> /dev/block/sda6
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 hyp_a -> /dev/block/sda13
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 hyp_b -> /dev/block/sda27
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 imagefv_a -> /dev/block/sda20
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 imagefv_b -> /dev/block/sda34
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 keymaster_a -> /dev/block/sda15
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 keymaster_b -> /dev/block/sda29
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 keystore -> /dev/block/sda53
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 limits -> /dev/block/sda46
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 limits-cdsp -> /dev/block/sda47
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 logdump -> /dev/block/sda49
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 logfs -> /dev/block/sda48
lrwxrwxrwx 1 root root 15 1970-01-01 03:01 mdm1m9kefs1 -> /dev/block/sda8
lrwxrwxrwx 1 root root 15 1970-01-01 03:01 mdm1m9kefs2 -> /dev/block/sda9
lrwxrwxrwx 1 root root 15 1970-01-01 03:01 mdm1m9kefs3 -> /dev/block/sda7
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 mdm1m9kefsc -> /dev/block/sda10
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 mdmddr -> /dev/block/sda42
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 metadata -> /dev/block/sda54
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 misc -> /dev/block/sda52
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 modem_a -> /dev/block/sda61
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 modem_b -> /dev/block/sda75
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 msadp -> /dev/block/sda44
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 multiimgoem_a -> /dev/block/sda71
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 multiimgoem_b -> /dev/block/sda85
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 multiimgqti_a -> /dev/block/sda72
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 multiimgqti_b -> /dev/block/sda86
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 oem_a -> /dev/block/sda70
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 oem_b -> /dev/block/sda84
lrwxrwxrwx 1 root root 15 1970-01-01 03:01 persist -> /dev/block/sda3
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 qupfw_a -> /dev/block/sda19
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 qupfw_b -> /dev/block/sda33
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 rddata -> /dev/block/sda91
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 rdimage_a -> /dev/block/sda66
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 rdimage_b -> /dev/block/sda80
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 recovery_a -> /dev/block/sda65
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 recovery_b -> /dev/block/sda79
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 secdata -> /dev/block/sda57
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 spunvm -> /dev/block/sda45
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 ssd -> /dev/block/sda39
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 storsec -> /dev/block/sda50
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 super -> /dev/block/sda89
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 tz_a -> /dev/block/sda12
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 tz_b -> /dev/block/sda26
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 tzxfl_a -> /dev/block/sda23
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 tzxfl_b -> /dev/block/sda37
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 tzxflattest_a -> /dev/block/sda22
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 tzxflattest_b -> /dev/block/sda36
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 uefisecapp_a -> /dev/block/sda24
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 uefisecapp_b -> /dev/block/sda38
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 uefivarstore -> /dev/block/sda58
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 userdata -> /dev/block/sda90
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 vbmeta_a -> /dev/block/sda67
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 vbmeta_b -> /dev/block/sda81
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 vbmeta_system_a -> /dev/block/sda68
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 vbmeta_system_b -> /dev/block/sda82
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 vm-data -> /dev/block/sda60
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 vm-keystore -> /dev/block/sda59
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 vm-linux_a -> /dev/block/sda74
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 vm-linux_b -> /dev/block/sda88
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 vm-system_a -> /dev/block/sda73
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 vm-system_b -> /dev/block/sda87
lrwxrwxrwx 1 root root 15 1970-01-01 03:01 xbl_a -> /dev/block/sdb1
lrwxrwxrwx 1 root root 15 1970-01-01 03:01 xbl_b -> /dev/block/sdc1
lrwxrwxrwx 1 root root 15 1970-01-01 03:01 xbl_config_a -> /dev/block/sdb2
lrwxrwxrwx 1 root root 15 1970-01-01 03:01 xbl_config_b -> /dev/block/sdc2
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 xfl_a -> /dev/block/sda21
lrwxrwxrwx 1 root root 16 1970-01-01 03:01 xfl_b -> /dev/block/sda35
lrwxrwxrwx 1 root root 15 1970-01-01 03:01 xflkeystore -> /dev/block/sda4
lrwxrwxrwx 1 root root 15 1970-01-01 03:01 xflkeystorebak -> /dev/block/sda5
Maybe the answer is from your other thread?
【Use Sony's Recovery and thank you. TWRP and Lineage Recovery not work in fastbootd 】
Click to expand...
Click to collapse
Nevermind, the reason for the issue was because I didn't understand that "fastboot reboot fastboot" is needed to get into fastbootd. Fastbootd is a new and confusing concept so I didn't realize I was in fastboot instead of fastbootd when trying to run the commands. Should be able to do this again after getting back to stock recovery.
Working great now, thanks for this rom!

Question Partition usage on an ASUS Zenfone 8

Hi
I want to create a backup of my ASUS Zenfone 8 using images from the partitions which I can then later flash using fastboot to restore the installation
But I do not know which of the partitions are mandatory to backup/restore an installation
In the payload.bin file used to install the ROM (AospExtended 9.x) there are these files that are used to install the ROM:
[[email protected] ~]# ls -lh /data/backup/ASUS_ZENFONE8/payload-dumper/test
total 3.3G
-rw-r--r--. 1 root root 96M Mar 11 11:17 boot.img
-rw-r--r--. 1 root root 24M Mar 11 11:17 dtbo.img
-rw-r--r--. 1 root root 1.4M Mar 11 11:17 odm.img
-rw-r--r--. 1 root root 307M Mar 11 11:18 product.img
-rw-r--r--. 1 root root 445M Mar 11 11:18 system_ext.img
-rw-r--r--. 1 root root 1.2G Mar 11 11:18 system.img
-rw-r--r--. 1 root root 8.0K Mar 11 11:18 vbmeta.img
-rw-r--r--. 1 root root 4.0K Mar 11 11:18 vbmeta_system.img
-rw-r--r--. 1 root root 96M Mar 11 11:19 vendor_boot.img
-rw-r--r--. 1 root root 1.2G Mar 11 11:19 vendor.img
[[email protected] ~]#
Some of the file names match a block device name in /dev/block/by-name but not all:
Spoiler: ls -l /dev/block/by-name
ASUS_I006D:/storage/emulated/0 #
ASUS_I006D:/storage/emulated/0 # ls -l /dev/block/by-name
total 0
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 ADF -> /dev/block/sda12
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 ALIGN_TO_128K_1 -> /dev/block/sdd1
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 ALIGN_TO_128K_2 -> /dev/block/sdf1
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 APD -> /dev/block/sda13
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 abl_a -> /dev/block/sde8
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 abl_b -> /dev/block/sde33
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 aop_a -> /dev/block/sde1
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 aop_b -> /dev/block/sde26
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 apdp -> /dev/block/sde52
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 asdf -> /dev/block/sda9
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 asusfw_a -> /dev/block/sda15
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 asusfw_b -> /dev/block/sda16
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 asuskey -> /dev/block/sdg2
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 asuskey2 -> /dev/block/sdg3
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 asuskey3 -> /dev/block/sdg4
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 asuskey4 -> /dev/block/sdg5
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 asuskey5 -> /dev/block/sdg6
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 asuskey6 -> /dev/block/sdg7
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 batinfo -> /dev/block/sda8
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 bluetooth_a -> /dev/block/sde5
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 bluetooth_b -> /dev/block/sde30
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 boot_a -> /dev/block/sde11
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 boot_b -> /dev/block/sde36
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 cdt -> /dev/block/sdd2
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 connsec -> /dev/block/sde63
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 cpucp_a -> /dev/block/sde21
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 cpucp_b -> /dev/block/sde46
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 ddr -> /dev/block/sdd3
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 devcfg_a -> /dev/block/sde12
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 devcfg_b -> /dev/block/sde37
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 devinfo -> /dev/block/sde50
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 dip -> /dev/block/sde51
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 dsp_a -> /dev/block/sde9
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 dsp_b -> /dev/block/sde34
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 dtbo_a -> /dev/block/sde15
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 dtbo_b -> /dev/block/sde40
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 factory -> /dev/block/sda7
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 fde -> /dev/block/sda6
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 featenabler_a -> /dev/block/sde22
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 featenabler_b -> /dev/block/sde47
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 frp -> /dev/block/sda5
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 fsc -> /dev/block/sdf6
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 fsg -> /dev/block/sdf4
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 fsgCA -> /dev/block/sdf5
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 ftm -> /dev/block/sda14
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 gpt -> /dev/block/sda10
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 hyp_a -> /dev/block/sde3
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 hyp_b -> /dev/block/sde28
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 imagefv_a -> /dev/block/sde17
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 imagefv_b -> /dev/block/sde42
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 keymaster_a -> /dev/block/sde10
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 keymaster_b -> /dev/block/sde35
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 keystore -> /dev/block/sda4
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 limits -> /dev/block/sde54
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 limits-cdsp -> /dev/block/sde55
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 logdump -> /dev/block/sde57
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 logfs -> /dev/block/sde56
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 mdcompress -> /dev/block/sde62
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 mdtp_a -> /dev/block/sde7
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 mdtp_b -> /dev/block/sde32
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 mdtpsecapp_a -> /dev/block/sde6
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 mdtpsecapp_b -> /dev/block/sde31
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 metadata -> /dev/block/sda22
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 misc -> /dev/block/sda3
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 modem_a -> /dev/block/sde4
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 modem_b -> /dev/block/sde29
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 modemst1 -> /dev/block/sdf2
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 modemst2 -> /dev/block/sdf3
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 multiimgoem_a -> /dev/block/sde20
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 multiimgoem_b -> /dev/block/sde45
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 persist -> /dev/block/sda2
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 qmcs -> /dev/block/sde24
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 qupfw_a -> /dev/block/sde13
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 qupfw_b -> /dev/block/sde38
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 qweslicstore_a -> /dev/block/sde25
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 qweslicstore_b -> /dev/block/sde49
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 rtice -> /dev/block/sde66
lrwxrwxrwx 1 root root 14 1970-01-04 04:42 sda -> /dev/block/sda
lrwxrwxrwx 1 root root 14 1970-01-04 04:42 sdb -> /dev/block/sdb
lrwxrwxrwx 1 root root 14 1970-01-04 04:42 sdc -> /dev/block/sdc
lrwxrwxrwx 1 root root 14 1970-01-04 04:42 sdd -> /dev/block/sdd
lrwxrwxrwx 1 root root 14 1970-01-04 04:42 sde -> /dev/block/sde
lrwxrwxrwx 1 root root 14 1970-01-04 04:42 sdf -> /dev/block/sdf
lrwxrwxrwx 1 root root 14 1970-01-04 04:42 sdg -> /dev/block/sdg
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 secdata -> /dev/block/sde60
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 shrm_a -> /dev/block/sde18
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 shrm_b -> /dev/block/sde43
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 splash -> /dev/block/sde53
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 spunvm -> /dev/block/sde65
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 ssd -> /dev/block/sda1
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 storsec -> /dev/block/sde58
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 super -> /dev/block/sda19
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 sysconf -> /dev/block/sdg1
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 sysinfo -> /dev/block/sda11
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 tz_a -> /dev/block/sde2
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 tz_b -> /dev/block/sde27
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 tzsc -> /dev/block/sde64
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 uefisecapp_a -> /dev/block/sde16
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 uefisecapp_b -> /dev/block/sde41
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 uefivarstore -> /dev/block/sde59
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 userdata -> /dev/block/sda23
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 vbmeta_a -> /dev/block/sde14
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 vbmeta_b -> /dev/block/sde39
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 vbmeta_system_a -> /dev/block/sda20
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 vbmeta_system_b -> /dev/block/sda21
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 vendor_boot_a -> /dev/block/sde23
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 vendor_boot_b -> /dev/block/sde48
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 vm-bootsys_a -> /dev/block/sde19
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 vm-bootsys_b -> /dev/block/sde44
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 vm-data -> /dev/block/sde61
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 xbl_a -> /dev/block/sdb1
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 xbl_b -> /dev/block/sdc1
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 xbl_config_a -> /dev/block/sdb2
lrwxrwxrwx 1 root root 15 1970-01-04 04:42 xbl_config_b -> /dev/block/sdc2
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 xrom_a -> /dev/block/sda17
lrwxrwxrwx 1 root root 16 1970-01-04 04:42 xrom_b -> /dev/block/sda18
ASUS_I006D:/storage/emulated/0 #
Which partitions must I backup to be able to restore an OS installation to the phone?
Which partition is used for what?
regards
Bernd
[Update 12.03.2022 12:30]
I think I found it:
The physical partitions to backup are (either _a or _b):
boot
dtbo
vbmeta
vbmeta_system
vendor_boot
and
super
The other partitions
odm
product
vendor
system
system_ext
are logical devices (also with the ending _a or _b) on the physical partition super
Would be great if some could confirm or correct this ....

Categories

Resources