![]() |
#31 |
Wizard
![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() Posts: 1,194
Karma: 4236616
Join Date: Feb 2012
Location: Cape Canaveral
Device: Kindle Scribe
|
Thank you!
I've got some progress. Not a win yet, but at least a few new errors xD So I ditched all Qualcomm drivers and installed Zadig's WinUSB (v6.1.7600.16385), after fresh edl boot. Rebooted again to edl. "python edl.py --loader=QC_SDM636.bin --memory=eMMC rl dumps --skip=userdata --genxml" now outputs (I hid the sensitive device info): Code:
python edl.py --loader=QC_SDM636.bin --memory=eMMC rl dumps --skip=userdata --genxml Qualcomm Sahara / Firehose Client V3.52 (c) B.Kerler 2018-2021. main - Using loader QC_SDM636.bin ... main - Waiting for the device main - Device detected :) main - Mode detected: sahara Device is in EDL mode .. continuing. sahara - ------------------------ HWID: ... CPU detected: "SDM636" PK_HASH: ... Serial: ... sahara - Uploading loader QC_SDM636.bin ... Successfully uploaded programmer :) firehose - Nop succeeded. firehose - Chip serial num: 0 (0x0) firehose - firehose_client - Target detected: SDM636 firehose - TargetName=MSM8996 firehose - MemoryName=eMMC firehose - Version=1 firehose_client - Supported functions: ----------------- configure,program,firmwarewrite,patch,setbootablestoragedrive,ufs,emmc,power,benchmark,read,getstorageinfo,getcrc16digest,getsha256digest,erase,peek,poke,nop,xml Wrote partition xml as rawprogram0.xml firehose_client - Dumping partition xbl with sector count 7168 as dumps\xbl.bin. firehose - Reading from physical partition 0, sector 131072, sectors 7168 Progress: |--------------------------------------------------| 0.0% CompleteTraceback (most recent call last): File "C:\Users\merge\Documents\!KonTiki2\1 Update\edl\edl.py", line 358, in <module> base.run() File "C:\Users\merge\Documents\!KonTiki2\1 Update\edl\edl.py", line 340, in run fh.handle_firehose(cmd, options) File "C:\Users\merge\Documents\!KonTiki2\1 Update\edl\edl\Library\firehose_client.py", line 308, in handle_firehose if self.firehose.cmd_read(lun, partition.sector, partition.sectors, filename): File "C:\Users\merge\Documents\!KonTiki2\1 Update\edl\edl\Library\firehose.py", line 610, in cmd_read show_progress("Read", total - bytestoread, total, display) File "C:\Users\merge\Documents\!KonTiki2\1 Update\edl\edl\Library\firehose.py", line 174, in show_progress throughput=(((datasize)/(tdiff))) ZeroDivisionError: float division by zero Without "--memory=eMMC", LIB complained that GetStorageInfo function is not supported, but I can't reproduce it anymore O_o I'll try edl.py with debug mode. |
![]() |
![]() |
![]() |
#32 |
Wizard
![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() Posts: 1,194
Karma: 4236616
Join Date: Feb 2012
Location: Cape Canaveral
Device: Kindle Scribe
|
OK, so the problem is indeed with the size calculation.
Previous attempts generated and xml file all the partitions and their data. Start sector, file, label, etc. Out of these, it dumped only the first one, "xbl.bin", and strangely the last two, named "gpt_main0.bin" and "gpt_backup0". All three with smaller size than shown in the xml, so they are dumped wrong. I tried to dump only boot, recovery and system with "python edl.py --loader=QC_SDM636.bin --memory=eMMC r boot,recovery,system boot.img,recovery.img,system.img", but it stalls on the first one already: Code:
python edl.py --loader=QC_SDM636.bin --memory=eMMC r boot,recovery,system boot.img,recovery.img,system.img Qualcomm Sahara / Firehose Client V3.52 (c) B.Kerler 2018-2021. main - Using loader QC_SDM636.bin ... main - Waiting for the device main - Device detected :) main - Mode detected: sahara Device is in EDL mode .. continuing. sahara - ------------------------ HWID: ... CPU detected: "SDM636" PK_HASH: ... Serial: 0xadb323a2 sahara - Uploading loader QC_SDM636.bin ... Successfully uploaded programmer :) firehose - Nop succeeded. firehose - Chip serial num: 0 (0x0) firehose - firehose_client - Target detected: SDM636 firehose - TargetName=MSM8996 firehose - MemoryName=eMMC firehose - Version=1 firehose_client - Supported functions: ----------------- configure,program,firmwarewrite,patch,setbootablestoragedrive,ufs,emmc,power,benchmark,read,getstorageinfo,getcrc16digest,getsha256digest,erase,peek,poke,nop,xml firehose - Reading from physical partition 0, sector 262144, sectors 131072 Progress: |--------------------------------------------------| 0.0% CompleteTraceback (most recent call last): File "D:\edl\edl.py", line 358, in <module> base.run() File "D:\edl\edl.py", line 340, in run fh.handle_firehose(cmd, options) File "D:\edl\edl\Library\firehose_client.py", line 245, in handle_firehose if self.firehose.cmd_read(lun, rpartition.sector, rpartition.sectors, partfilename): File "D:\edl\edl\Library\firehose.py", line 610, in cmd_read show_progress("Read", total - bytestoread, total, display) File "D:\edl\edl\Library\firehose.py", line 174, in show_progress throughput=(((datasize)/(tdiff))) ZeroDivisionError: float division by zero |
![]() |
![]() |
Advert | |
|
![]() |
#33 |
Wizard
![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() Posts: 2,851
Karma: 12000011
Join Date: Feb 2012
Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5
|
I'm not sure that it supports arguments like that.
Use a single command to load the loader. After that you can use any number of separate commands since the firehose protocol is not as stupid as sahara. Code:
C:\>python edl.py --loader=sdm636.bin --memory=emmc ... C:\>python edl.py r boot mypart08 --memory=emmc ... C:\>python edl.py r recovery mypart09 --memory=emmc |
![]() |
![]() |
![]() |
#34 |
Wizard
![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() Posts: 1,194
Karma: 4236616
Join Date: Feb 2012
Location: Cape Canaveral
Device: Kindle Scribe
|
Thanks!
Those commands I used are given as examples from their GitHub page. So I tried your suggested commands. Loader part is fine: Code:
C:\..\edl > python edl.py --loader=QC_SDM636.bin --memory=eMMC Qualcomm Sahara / Firehose Client V3.52 (c) B.Kerler 2018-2021. main - Using loader QC_SDM636.bin ... main - Waiting for the device main - Device detected :) main - Mode detected: sahara Device is in EDL mode .. continuing. sahara - ------------------------ HWID: ... CPU detected: "SDM636" PK_HASH: ... Serial: ... sahara - Uploading loader QC_SDM636.bin ... Successfully uploaded programmer :) firehose - Nop succeeded. firehose - Chip serial num: 0 (0x0) firehose - firehose_client - Target detected: SDM636 firehose - TargetName=MSM8996 firehose - MemoryName=eMMC firehose - Version=1 firehose_client - Supported functions: ----------------- configure,program,firmwarewrite,patch,setbootablestoragedrive,ufs,emmc,power,benchmark,read,getstorageinfo,getcrc16digest,getsha256digest,erase,peek,poke,nop,xml Spoiler:
Start sector and its size are fine, according to the xml: Code:
<program SECTOR_SIZE_IN_BYTES="512" file_sector_offset="0" filename="boot.bin" label="boot" num_partition_sectors="131072" partofsingleimage="false" physical_partition_number="0" readbackverify="false" size_in_KB="65536.0" sparse="false" start_byte_hex="0x8000000" start_sector="262144"/> ![]() |
![]() |
![]() |
![]() |
#35 |
Wizard
![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() Posts: 2,851
Karma: 12000011
Join Date: Feb 2012
Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5
|
Yes, I was using version 3.3
In version 3.52 they added verbose throughput statistics which broke everything. In library\firehose.py, line #162 replace the whole function with this: Code:
def show_progress(self, prefix, pos, total, display=True): if display: prog = round(float(pos) / float(total) * float(100), 2) print_progress(prog, 100, prefix='Progress:', bar_length=50) |
![]() |
![]() |
Advert | |
|
![]() |
#36 |
Wizard
![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() Posts: 1,194
Karma: 4236616
Join Date: Feb 2012
Location: Cape Canaveral
Device: Kindle Scribe
|
@Renate
Wow! Thank you soooo much! I finally was able to dump all partitions except userdata ![]() Thank you very much for helping me learn so much about all this boot stuff ^^) Now I am super confident I will be able to restore things, if they get awfully broken xD So could you please outline how should I safely unpack it and build again? The tools I mentioned don't work properly on newly extracted boot and recovery images too. The create ramdisk and split_img directories, and only "-origsize" file with a number. On the other hand, I see that "system.img" is basically "/", but its "/data" directory is empty, so there is no "/data/property" directory. Is it in the missing "userdata.img"? Or are some of these directories encrypted? (I miss lsblk, which is not present in Android, AFAIK) |
![]() |
![]() |
![]() |
#37 | |
Wizard
![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() Posts: 2,851
Karma: 12000011
Join Date: Feb 2012
Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5
|
Quote:
![]() Look for imgutil.exe (in sig) I've already seen the problem in recovery, it's prop.default, persist.sys.usb.config=none But there seems to be a bigger problem getting a (unmodified) recovery image to boot over fastboot. It seems to just default to booting the regular system image. Code:
$ reboot bootloader C:\>fastboot boot part09 Have you tried zerostat (in sig)? Code:
C:\>adb push zerostat /data/local/tmp C:\>adb shell $ cd /data/local/tmp $ chmod 755 zerostat $ su # ./zerostat |
|
![]() |
![]() |
![]() |
#38 |
Wizard
![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() Posts: 1,194
Karma: 4236616
Join Date: Feb 2012
Location: Cape Canaveral
Device: Kindle Scribe
|
Thank you, your imgutil.exe is great!
Tidy and quick extraction/overwriting. Yes, I also couldn't "fastboot boot recovery_mod.bin". It just leapfrogged ahead to usual boot of and un-modded boot, where Magisk is not working Oo. Maybe some locks present? vendor.bin , which I dumped among many other things today, contains /etc/fstab.qcom , which contains Code:
/dev/block/bootdevice/by-name/system / ext4 ro,barrier=1,discard wait,verify |
![]() |
![]() |
![]() |
#39 |
Wizard
![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() Posts: 1,194
Karma: 4236616
Join Date: Feb 2012
Location: Cape Canaveral
Device: Kindle Scribe
|
"Have you tried zerostat (in sig)?"
Sorry, I can't find it in http://www.temblast.com/android.htm >< |
![]() |
![]() |
![]() |
#40 |
Wizard
![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() Posts: 1,194
Karma: 4236616
Join Date: Feb 2012
Location: Cape Canaveral
Device: Kindle Scribe
|
The most straightforward approach I currently is stupid:
1) dump whole ~20 GB of /userdata (as it turns out to be /data mount point) 2) modify /data and /system to enable adb on boot 3) Flash everything back. If we don't find something better, I shall probably try this ![]() |
![]() |
![]() |
![]() |
#41 | |
Wizard
![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() Posts: 2,851
Karma: 12000011
Join Date: Feb 2012
Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5
|
Quote:
Modifying /system is not the way to go. That might make future updates difficult. For ADB we don't need to modify anything there. Also, the magisk patching capabilities allow us to patch without modifying. |
|
![]() |
![]() |
![]() |
#42 |
Wizard
![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() Posts: 1,194
Karma: 4236616
Join Date: Feb 2012
Location: Cape Canaveral
Device: Kindle Scribe
|
@Renate,
Ah, sorry! Somehow my ad blocker selectively blocked some of the lines Oo. Thank you, zerostat works great! Last edited by mergen3107; 08-13-2021 at 06:12 PM. |
![]() |
![]() |
![]() |
#43 | |
Wizard
![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() Posts: 1,194
Karma: 4236616
Join Date: Feb 2012
Location: Cape Canaveral
Device: Kindle Scribe
|
Quote:
The only reasons I kept com.onyx were enhancements, which can makes some apps really readable with better fonts and contrast, the ability to apply custom DPI scale, and screensavers. For fonts and contrast, I was mostly concerned about GoldenDict dictionary, which I call from Reading apps. However, I found how to tweak it's CSS. For DPI, there is a Developer option to change "Smallest width" in Drawing section, in dp units. So I set it to 600, and it is about the same scale as "400 DPI" in the Onyx enhancement. As for contrast, most of the apps look washed with enhancements, but reading apps are optimized for e-ink. So it is bearable. Also, there is a global contrast option, which I occasionally need. Screensavers were manually copied to /data/local/assets/ and given 777 permission. The images must be rotated 90deg CCW w.r.t up-right position (i.e. their top side is aligned with the screen's left edge) to properly draw on the lockscreen. So I disabled onyx.com. I don't use multi-window, so it's not a big deal. Other things work as expected: swipe gestures, Navigation ball (really handy, to be honest), Music Player, Gallery, Clock. Voice Recorder is disabled because it has Mic access even if the app is closed. |
|
![]() |
![]() |
![]() |
#44 |
Wizard
![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() Posts: 1,194
Karma: 4236616
Join Date: Feb 2012
Location: Cape Canaveral
Device: Kindle Scribe
|
Oh, yes, finally!
I found a working method to run sshd server on the Onyx Boox. All other apps didn't connect properly, maybe there are too old for Android 10. The solution is Magisk SSH Module. After you install the module in the Magisk itself, the setup is typical for SSH: generate a pair of keys with PuTTy, put one on PC (*.ppk), one on the device (copied key from the window to authorized_keys /data/ssh/root/.ssh/authorized_keys). Then connect with WinSCP, for example. The IP address can be found in the Wi-Fi settings. I don't need to manually enable adb upon boot and connect the cable anymore, the SSH access can be root (or shell, if you need). |
![]() |
![]() |
![]() |
#45 |
Wizard
![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() Posts: 2,851
Karma: 12000011
Join Date: Feb 2012
Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5
|
I don't know why you keep losing ADB.
Using SSH will allow you to see why. Although, Onyx does a lot of goofy stuff with the USB configuration. |
![]() |
![]() |
![]() |
|
![]() |
||||
Thread | Thread Starter | Forum | Replies | Last Post |
Kon-tiki | mirage | Onyx Boox | 1 | 01-21-2021 10:30 PM |
Onyx Boox is releasing Note3 & Nova3 in China | winstonma | Onyx Boox | 23 | 10-20-2020 10:49 PM |
Apps for onyx boox | Narwhall85 | Onyx Boox | 0 | 05-08-2020 02:51 AM |
Removing Google apps on the Onyx Boox Note | Dav_25 | Onyx Boox | 4 | 04-29-2019 05:22 AM |
Readability/instapaper-like apps on onyx boox M92? | Acryde | Onyx Boox | 2 | 04-26-2012 10:05 AM |