Help me rooting the Go 10.3

[DanyDanman]

Originally Posted by Renate

That's why I asked you for those mbr's so I can have my own "play it at home"
[/code]

Would my full raw backup be of any use? I can upload that on my own personal space.

[Renate]

Originally Posted by DanyDanman

Would my full raw backup be of any use?

Noooo... My internet drops below dial-up speed at times.

[DanyDanman]

Maybe a stupid question. How would you install the correct fastboot driver?
Is still the one from https://www.mobileread.com/forums/sh...26&postcount=1

And than part 6. Download this Fastboot Driver.

Just want to make sure I have the right one.

[Renate]

Originally Posted by DanyDanman

Just want to make sure I have the right one.

Actually, all the ADB and all the fastboot are using the stock Windows WinUSB driver.
That's as generic as white sandwich bread.
Since you had fastboot working, that's good enough.
(And you can forget about fastbogus.exe too.)

I've updated edl.exe once again. You should DL it even though there is no functional difference. Simply better error handling for scenarios that you will never use.

C:\>edl /u /r /plast_parti trash
Found EDL 9008, configuring... nope, configuring... ok
Requesting info on LUN 0... ok
Requesting GPT 0 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting GPT 1 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting GPT 2 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting GPT 3 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting GPT 4 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting GPT 5 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Ambiguous partition name "last_parti" needs LUN

Eventually we'll have to address the real problem: We can't write anything.

[DanyDanman]

I have been hard at work to find a solution. No luck yet.

I have checked

build.prop

ro.boot.verifiedbootstate: Set to orange. This indicates that your device's verified boot state is less secure, generally associated with an unlocked bootloader in a development setting.

ro.boot.flash.locked: Set to 0. This correctly reflects that the bootloader is unlocked, aligning with the ro.boot.verifiedbootstate being orange.

sys.oem_unlock_allowed: Set to 0. This seems contradictory given the bootloader status is unlocked. Normally, this would be set to 1 if the bootloader unlocking is permissible. If your intention is for the device to allow OEM unlocking, this property should be set to 1.

The property ro.oem_unlock_supported, which you mentioned should be set based on the device's support for flashing unlock, is not listed in your output. If your device supports this feature, you should ensure this property is explicitly defined in your system configuration with the appropriate value (1 for support, 0 for no support).

This what I got from it tnx to my second brain. Posting here just incase.

I have tried a different fastboot driver the google instead xaomi
I have chosen a different fastboot and bogus one no luck

I really hope we can crack this togher.

[Renate]

Theoretically, none of that unlocking stuff should matter. Firehose should be OS agnostic and not know anything about that stuff.

It surprising that both the GoCo7 and Go103 with different flash types have the same problem.

So to recap (please correct me):

Writing a partition with EDL freezes when it tries to write.

Normal bootloader fastboot has had the commands ripped out of it.
(Whether this is Onyx being mean or just the migration to fastbootd, I don't know.)

Recovery fastbootd accepts commands but fails on write.

I've been doing some reverse engineering on this Firehose loader.
It really shouldn't freeze like that even for errors.
I've learned "many cheerful facts about the square of the hypotenuse".

[Renate]

Here's another thing to try that might work out better.
Always do a reset and back to EDL between things that didn't work out well.

edl /l<alpha or patched>
edl /u /r /pmisc /c1 small.img
edl /u /w /pmisc /c1 /v small.img

I don't need to see all the GPT verbose stuff, just the write section.

[DanyDanman]

Hi sorry for the delay.

C:\Users\User>edl.exe /lpatched.bin
Found EDL 9008, handshaking... version 2.1
HWID: 001b80e100000000, JTAG: 001b80e1, OEM: 0000, Model: 0000
Hash: d40eee56f3194665-574109a39267724a-e7944134cd53cb76-7e293d3c40497955-bc8a4519ff992b03-1fadc6355015ac87 (x3)
Sending patched.bin 100% ok, starting... ok, waiting for Firehose... ok

C:\Users\User>edl /u /r /pmisc /c1 small.img
Found EDL 9008, configuring... ok
Requesting info on LUN 0... ok
Requesting GPT 0 header...
<log value="ERROR: Failed to run the last command -1" />
No ack/nak

Did not run the second command.

[DanyDanman]

Originally Posted by Renate

Here's another thing to try that might work out better.
Always do a reset and back to EDL between things that didn't work out well.

edl /l<alpha or patched>
edl /u /r /pmisc /c1 small.img
edl /u /w /pmisc /c1 /v small.img

I don't need to see all the GPT verbose stuff, just the write section.

This is the one with the non patched one. As you can see in the output.
I have included everything just to make sure you have all the details as it not clear what is safe to be left out.

C:\Users\User>adb reboot edl

C:\Users\User>edl.exe /lA235F_LOADER_BIT5_Alephgsm_com.elf
Found EDL 9008, handshaking... version 2.1
HWID: 001b80e100000000, JTAG: 001b80e1, OEM: 0000, Model: 0000
Hash: d40eee56f3194665-574109a39267724a-e7944134cd53cb76-7e293d3c40497955-bc8a4519ff992b03-1fadc6355015ac87 (x3)
Sending A235F_LOADER_BIT5_Alephgsm_com.elf 100% ok, starting... ok, waiting for Firehose... ok

C:\Users\User>edl /u /r /pmisc /c1 small.img
Found EDL 9008, configuring... ok
Requesting info on LUN 0... ok
Requesting GPT 0 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting GPT 1 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting GPT 2 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting GPT 3 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting GPT 4 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting GPT 5 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting read small.img... ok, reading 100% ok

C:\Users\User>edl /u /w /pmisc /c1 /v small.img
Found EDL 9008, configuring...
<log value="INFO: Calling handler for configure" />
<log value="INFO: Storage type set to value UFS" />
<response value="ACK" MemoryName="UFS" MinVersionSupported="1" Version="1" MaxPayloadSizeToTargetInBytes="65536" MaxPayloadSizeToTargetInBytesSupported="1048576" MaxXMLSizeInBytes="4096" DateTime="Jan 10 2024 - 18:16:46" />
Ok
Requesting info on LUN 0...
<log value="INFO: Calling handler for getstorageinfo" />
<log value="INFO: Device Total Logical Blocks: 0xdd5c00" />
<log value="INFO: Device Block Size in Bytes: 0x1000" />
<log value="INFO: Device Total Physical Partitions: 0x6" />
<log value="INFO: Device Manufacturer ID: 0xa25" />
<log value="INFO: Device Serial Number: 0x4f4e0000" />
<log value="INFO: {&quot;storage_info&quot;: {&quot;total_blocks&quot;:14507008, &quot;block_size&quot;:4096, &quot;page_size&quot;:4096, &quot;num_physical&quot;:6, &quot;manufacturer_id&quot;:2597, &quot;serial_num&quot;:1330511872, &quot;fw_version&quot;:&quot;1.7&quot;,&quot;mem_type&quot;:&quot;UFS&quot;,&quot;prod_name&quot;:&quot;eUFS2.2_064&quot;}}" />
<log value="INFO: UFS fInitialized: 0x1" />
<log value="INFO: UFS Current LUN Number: = 0x0" />
<log value="INFO: UFS Total Active LU: 0x6" />
<log value="INFO: UFS wManufacturerID: 0xa25" />
<log value="INFO: UFS Boot Partition Enabled: 0x1" />
<log value="INFO: UFS Raw Device Capacity: = 0x7746000" />
<log value="INFO: UFS Min Block Size: 0x8" />
<log value="INFO: UFS Erase Block Size: 0x2000" />
<log value="INFO: UFS Allocation Unit Size: 0x1" />
<log value="INFO: UFS RPMB ReadWrite Size: = 0x40" />
<log value="INFO: UFS Number of Allocation Uint for This LU: 0x3757" />
<log value="INFO: UFS Logical Block Size: 0xc" />
<log value="INFO: UFS Provisioning Type: 0x2" />
<log value="INFO: UFS LU Write Protect: 0x0" />
<log value="INFO: UFS Boot LUN ID: = 0x0" />
<log value="INFO: UFS Memory Type: 0x0" />
<log value="INFO: UFS LU Total Blocks: 0xdd5c00" />
<log value="INFO: UFS Supported Memory Types: 0x807f" />
<log value="INFO: UFS dEnhanced1MaxNAllocU: 0x3ba3" />
<log value="INFO: UFS wEnhanced1CapAdjFac: 0x300" />
<log value="INFO: UFS dEnhanced2MaxNAllocU: = 0x3ba3" />
<log value="INFO: UFS wEnhanced2CapAdjFac: 0x300" />
<log value="INFO: UFS dEnhanced3MaxNAllocU: 0x3ba3" />
<log value="INFO: UFS wEnhanced3CapAdjFac: 0x300" />
<log value="INFO: UFS dEnhanced4MaxNAllocU: 0x0" />
<log value="INFO: UFS wEnhanced4CapAdjFac: 0x0" />
<log value="INFO: UFS LUN Enable Bitmask: 0x3f" />
<log value="INFO: UFS Logical Block Count: 0xdd5c00" />
<log value="INFO: UFS bConfigDescrLock: 0x0" />
<log value="INFO: UFS iManufacturerName String Index: 0x1" />
<log value="INFO: UFS iProductName String Index: 0x2" />
<log value="INFO: UFS iSerialNumber String Index: 0x4" />
<log value="INFO: UFS iOemID String Index: 0x3" />
<log value="INFO: UFS Inquiry Command Output: PHISON  eUFS2.2_064     01.7 " />
<response value="ACK" rawmode="false" />
Ok
Requesting GPT 0 header...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok
Requesting GPT 1 header...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok
Requesting GPT 2 header...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok
Requesting GPT 3 header...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok
Requesting GPT 4 header...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok
Requesting GPT 5 header...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok
Requesting write small.img...
<log value="INFO: Calling handler for program" />
<response value="ACK" rawmode="true" />
Ok, writing   0%
Could not write device

[Renate]

Well, we didn't learn anything new.

The patched OnePlus and the Samsung A235F Firehose loaders are very similar.

If we had UART connected we might get some more insight.
It's hard to see where the problem is when it just freezes.

[DanyDanman]

Evening, I found this post:

https://xdaforums.com/t/question-fas...#post-87923023

As it is:

C:\Users\User>adb shell
Go103:/ $ getprop sys.get_unlock_ability

Go103:/ $ getprop ro.oem_unlock_supported

Go103:/ $ getprop ro.oem_unlock_allowed

3 times blank.

This make me wonder can you patch in support for this action like in that tool
Maybe than I can try it out. (this https://github.com/bkerler/edl#for-generic-unlocking) Nvm, read the situation wrong. His is locked.

I have tried different pc (non ryzen) usb 2.0 port and no luck getting resolved the unknow command. Found that as possible solution. I truly hope that they did no remove those commands, I have read accounts from people that they can.

[Renate]

No, I don't think the problem lies there.
Firehose is pretty good with error messages (it has to be).
When it locks up without a peep...

As I said, the bootloader fastboot does not have any flashing commands inside it.

I've been doing some more reverse engineering on this.
If I had one of these in my hands things would go quicker.
If I make a test patch it will take 24 hours cycle time to get it tested vs one minute.

[DanyDanman]

Yesterday I have googled myself tired. So many topics with missing fastboot commands but no real solution.

If it's really needed I might send you a device, I really want to patch in support for certain apps. I might first test the patch on other boox supported device that has root. Going to see who can help me with that. (need to find someone)

I found a nice post too, well worth it:
https://alephsecurity.com/2018/01/22/qualcomm-edl-1/

Tnx for the reply.

[Renate]

Ok, here is a test patched Firehose loader.
Please keep them straight.
I'm already confused enough as it is.

This should work happily, but non-functionally.
All the normal functions work except write only goes through the motions.
This is so we can determine if the problem is in the process or in the UFS writing itself.

edl /lnowrite.bin
edl /u /g
edl /u /r /pmisc test.img
edl /u /w /pmisc /v test.img

This should all execute happily, only it won't actually write.
Only quote the write stuff unless there was a problem earlier.

[DanyDanman]

Hmm, no dice yet.

Here is the output. As there is no write here is the some what full output:

C:\Users\User>edl /u /w /pmisc /v test.img
Found EDL 9008, configuring...
<log value="INFO: Calling handler for configure" />
<log value="INFO: Storage type set to value UFS" />
<response value="ACK" MemoryName="UFS" MinVersionSupported="1" Version="1" MaxPayloadSizeToTargetInBytes="65536" MaxPayloadSizeToTargetInBytesSupported="1048576" MaxXMLSizeInBytes="4096" DateTime="Jan 10 2024 - 18:16:46" />
Ok
Requesting info on LUN 0...
<log value="INFO: Calling handler for getstorageinfo" />
<log value="INFO: Device Total Logical Blocks: 0xdd5c00" />
<log value="INFO: Device Block Size in Bytes: 0x1000" />
<log value="INFO: Device Total Physical Partitions: 0x6" />
<log value="INFO: Device Manufacturer ID: 0xa25" />
<log value="INFO: Device Serial Number: 0x4f4e0000" />
<log value="INFO: {&quot;storage_info&quot;: {&quot;total_blocks&quot;:14507008, &quot;block_size&quot;:4096, &quot;page_size&quot;:4096, &quot;num_physical&quot;:6, &quot;manufacturer_id&quot;:2597, &quot;serial_num&quot;:1330511872, &quot;fw_version&quot;:&quot;1.7&quot;,&quot;mem_type&quot;:&quot;UFS&quot;,&quot;prod_name&quot;:&quot;eUFS2.2_064&quot;}}" />
<log value="INFO: UFS fInitialized: 0x1" />
<log value="INFO: UFS Current LUN Number: = 0x0" />
<log value="INFO: UFS Total Active LU: 0x6" />
<log value="INFO: UFS wManufacturerID: 0xa25" />
<log value="INFO: UFS Boot Partition Enabled: 0x1" />
<log value="INFO: UFS Raw Device Capacity: = 0x7746000" />
<log value="INFO: UFS Min Block Size: 0x8" />
<log value="INFO: UFS Erase Block Size: 0x2000" />
<log value="INFO: UFS Allocation Unit Size: 0x1" />
<log value="INFO: UFS RPMB ReadWrite Size: = 0x40" />
<log value="INFO: UFS Number of Allocation Uint for This LU: 0x3757" />
<log value="INFO: UFS Logical Block Size: 0xc" />
<log value="INFO: UFS Provisioning Type: 0x2" />
<log value="INFO: UFS LU Write Protect: 0x0" />
<log value="INFO: UFS Boot LUN ID: = 0x0" />
<log value="INFO: UFS Memory Type: 0x0" />
<log value="INFO: UFS LU Total Blocks: 0xdd5c00" />
<log value="INFO: UFS Supported Memory Types: 0x807f" />
<log value="INFO: UFS dEnhanced1MaxNAllocU: 0x3ba3" />
<log value="INFO: UFS wEnhanced1CapAdjFac: 0x300" />
<log value="INFO: UFS dEnhanced2MaxNAllocU: = 0x3ba3" />
<log value="INFO: UFS wEnhanced2CapAdjFac: 0x300" />
<log value="INFO: UFS dEnhanced3MaxNAllocU: 0x3ba3" />
<log value="INFO: UFS wEnhanced3CapAdjFac: 0x300" />
<log value="INFO: UFS dEnhanced4MaxNAllocU: 0x0" />
<log value="INFO: UFS wEnhanced4CapAdjFac: 0x0" />
<log value="INFO: UFS LUN Enable Bitmask: 0x3f" />
<log value="INFO: UFS Logical Block Count: 0xdd5c00" />
<log value="INFO: UFS bConfigDescrLock: 0x0" />
<log value="INFO: UFS iManufacturerName String Index: 0x1" />
<log value="INFO: UFS iProductName String Index: 0x2" />
<log value="INFO: UFS iSerialNumber String Index: 0x4" />
<log value="INFO: UFS iOemID String Index: 0x3" />
<log value="INFO: UFS Inquiry Command Output: PHISON  eUFS2.2_064     01.7 " />
<response value="ACK" rawmode="false" />
Ok
Requesting GPT 0 header...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok
Requesting GPT 1 header...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok
Requesting GPT 2 header...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok
Requesting GPT 3 header...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok
Requesting GPT 4 header...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok
Requesting GPT 5 header...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok, requesting entries...
<log value="INFO: Calling handler for read" />
<response value="ACK" rawmode="true" />
Ok, receiving...
<response value="ACK" rawmode="false" />
Ok
Requesting write test.img...
<log value="INFO: Calling handler for program" />
<response value="ACK" rawmode="true" />
Ok, writing   0%
Could not write device

I am happy to test more! Tnx again. Hopefully this will posted right a way.