[Dev] Bypass "bootloader" [PROPER METHOD]

Search This thread
By:
Advanced…
eamars

eamars

Member
Mar 27, 2010
42
6
Christchurch
i have a question

since i use sintool to make a new kernel,how i can flash it into my phone?

use loader with flashtool or anything else?
 
andrewddickey

andrewddickey

Senior Member
Jan 23, 2011
198
74
eamars said:
i have a question

since i use sintool to make a new kernel,how i can flash it into my phone?

use loader with flashtool or anything else?
Click to expand...
Click to collapse
Playing with it right now. Seems that you can flash the unlocked loader.sin via flashtool after using the "create bundle" tool to make .ftf

then you can flash the kernel by placing your .sin kernel into folder:
\FlashTool\devices\X10\kernel\

then push the "kernel" button in flashtool which will install your new kernel.
currently zkernel is in there.

then go to "advanced", "kernel", "reboot custom kernel"......

and that's where i've gotten stuck.


hope some of that makes sense
 
  • Like
Reactions: mutarito
eamars

eamars

Member
Mar 27, 2010
42
6
Christchurch
andrewddickey said:
Playing with it right now. Seems that you can flash the unlocked loader.sin via flashtool after using the "create bundle" tool to make .ftf

then you can flash the kernel by placing your .sin kernel into folder:
\FlashTool\devices\X10\kernel\

then push the "kernel" button in flashtool which will install your new kernel.
currently zkernel is in there.

then go to "advanced", "kernel", "reboot custom kernel"......

and that's where i've gotten stuck.


hope some of that makes sense
Click to expand...
Click to collapse

i think zkernel is not a complete kernel
now that the bl is unlocked ,it seems that we can replace the real kernel with the cust kernel

cheers
thanks alot
 
andrewddickey

andrewddickey

Senior Member
Jan 23, 2011
198
74
I was able to install doomkernel by placing the attached folder in:
\FlashTool\devices\X10\kernel\

then push the "kernel" button and go to "advanced", "kernel", "reboot custom kernel"

it rebooted phone and "about phone" shows
2.6.29-modFXP-DooMKernel-v04b
DooMLorD@chaos) )

I'm still on stock and haven't set anything up, so I can't test anything yet. Don't even have my 3G up.
 

Attachments

  • doomkernel.7z
    5.6 MB · Views: 236
andrewddickey

andrewddickey

Senior Member
Jan 23, 2011
198
74
andrewddickey said:
I was able to install doomkernel by placing the attached folder in:
\FlashTool\devices\X10\kernel\

then push the "kernel" button and go to "advanced", "kernel", "reboot custom kernel"

it rebooted phone and "about phone" shows
2.6.29-modFXP-DooMKernel-v04b
DooMLorD@chaos) )

I'm still on stock and haven't set anything up, so I can't test anything yet. Don't even have my 3G up.
Click to expand...
Click to collapse
But after I played with it a bit, got WLOD and reboot.
After checking "about phone", noticed that the kernel was back to stock.........weird.
 
iridaki

iridaki

Retired Forum Moderator
Feb 21, 2007
4,532
5,190
37
Edinburgh, Scotland
andrewddickey said:
I was able to install doomkernel by placing the attached folder in:
\FlashTool\devices\X10\kernel\

then push the "kernel" button and go to "advanced", "kernel", "reboot custom kernel"

it rebooted phone and "about phone" shows
2.6.29-modFXP-DooMKernel-v04b
DooMLorD@chaos) )

I'm still on stock and haven't set anything up, so I can't test anything yet. Don't even have my 3G up.
Click to expand...
Click to collapse

I think Flashtool uses the old bypass to install the kernel! If you make a kernel.sin, theoratically with an unlocked bootloader, you can put it in an ftf bundle and flash it.

Xperia X10i via Tapatalk
 
Last edited:
aZuZu

aZuZu

Inactive Recognized Developer
Jan 19, 2011
638
941
43
Zagreb
my question is if you flash "normal" loader.sin after unlock... what happends? Thanks!


p.s.
so now we use new loader and >> new kernel generated by sintools <<
 
Last edited:
  • Like
Reactions: HunteronX and pheel
-- X10B --

-- X10B --

Senior Member
Jan 20, 2011
483
126
Antipolo
@ the_laser

ive got a so-01b and network unlocked it with SEMC S1 Unlock tool
what should i use ?

qsd8250_semc or qsd8250_setool2 ??
 
DooMLoRD

DooMLoRD

Inactive Recognized Developer
Jul 27, 2010
13,187
39,710
Pune
@the_laser

thank you for ur work...

have a couple of questions:

1) wht do we do if we want to relock bootloader? i am asking just for having a fail-safe option open...

2) can we modify the S1 loader to accept fastboot commands?

3) can we now write to /boot partition in OS/recovery? (raw_write)?

4) the following:
aZuZu said:
my question is if you flash "normal" loader.sin after unlock... what happends? Thanks!


p.s.
so now we use new loader and >> new kernel generated by sintools <<
Click to expand...
Click to collapse
 
Last edited:
  • Like
Reactions: mossrulez
iridaki

iridaki

Retired Forum Moderator
Feb 21, 2007
4,532
5,190
37
Edinburgh, Scotland
aZuZu said:
my question is if you flash "normal" loader.sin after unlock... what happends? Thanks!


p.s.
so now we use new loader and >> new kernel generated by sintools <<
Click to expand...
Click to collapse

I don't know if it's related to X10 too but the_laser posted this in X8 thread:

the_laser said:
Emma/seUS WILL work flawless with phones using that semcboot, because i'm crafting things properly.
BOTH original and "unlocked" loaders will work.
Click to expand...
Click to collapse
 
DooMLoRD

DooMLoRD

Inactive Recognized Developer
Jul 27, 2010
13,187
39,710
Pune
@the_laser

ok done the steps u said to unlock/bypass bootloader...

hi i used one of the custom 2.1 kernel i had (boot.img), dumped the zImage and ramdisk.gz

then used the sinTools u provided to create a result.elf.sin

then renamed it to kernel.sin and created a new ftf using flashtool (and new loader.sin)

then flashed using flashtool

flashing seemed to be successful

but the SE text logo was still there and the kernel info (in About Phone) did not change...

so basically the modified kernel.sin was rejected by the S1 bootloader

any idea?


EDIT:
seems the kernel zimage HAS TO BE CALLED image and ramdisk.cpio.gz HAS TO BE ramdisk
then it works.. :)

right now stuck at bootloop ;)
 
Last edited:
P

Phantasm4489

Senior Member
Apr 16, 2010
498
708
colossus said:
Ok i have done it early this morning as instructed in the op, to be honest i have noticed no difference, i have done a multitoch test and it is still working on 2 but as this is all new maybe we need the Dev's to step in and tell us what to do with this bootloader unlock.;)
Click to expand...
Click to collapse

the bootloader unlock doesnt do anything useful by itself unless you have an unsigned kernal you want to flash. Thats why the post is only intended for devs.
 
K

KingCifer

Senior Member
Jul 7, 2010
85
3
Vienna
colossus said:
Ok i have done it early this morning as instructed in the op, to be honest i have noticed no difference, i have done a multitoch test and it is still working on 2 but as this is all new maybe we need the Dev's to step in and tell us what to do with this bootloader unlock.;)
Click to expand...
Click to collapse

seriously why should you get full multitouch if you unlock the bootloader? this makes no sense ... yes you need a custom kernel that has full multitouch support (but i doubt the hardware supports it) and then you ll be able to flash it coz of the newly unlocked bootloader ...
 
scoobysnacks

scoobysnacks

Senior Member
Jul 10, 2011
2,940
594
KingCifer said:
seriously why should you get full multitouch if you unlock the bootloader? this makes no sense ... yes you need a custom kernel that has full multitouch support (but i doubt the hardware supports it) and then you ll be able to flash it coz of the newly unlocked bootloader ...
Click to expand...
Click to collapse

you would need completely rewritten multitouch drivers....

What the hell do people thing bootloader unlock does? :confused:
 
iridaki

iridaki

Retired Forum Moderator
Feb 21, 2007
4,532
5,190
37
Edinburgh, Scotland
colossus said:
Ok i have done it early this morning as instructed in the op, to be honest i have noticed no difference, i have done a multitoch test and it is still working on 2 but as this is all new maybe we need the Dev's to step in and tell us what to do with this bootloader unlock.;)
Click to expand...
Click to collapse

I think it is rather clear that unlocking the bootloader will
just give us possibilities for new things, not new things immediately.

Now, I want to ask: you downgraded to 2.1 and unlocked the bootloader.
After that, were you able to update to 2.3 again?
Also, can you confirm that SEUS still works?
 
You must log in or register to reply here.

Similar threads

jerpelea
{X10}[DEVELOPMENT] -FXP130- CM7.2.0 - RELEASED - FreeXperia Project
Replies
15K
Views
5M
Erofich
Erofich
H
  • Locked
Bootloader Cracking : Devs only
Replies
865
Views
868K
-PiLoT-
-PiLoT-
9Lukas5
[HOW-TO]UNLOCK bootloader for X10
Replies
938
Views
595K
B
bootx
DooMLoRD
[KERNEL][X10] DooMKernel [UNLOCKED BOOTLOADERS]{Rel:v06}[Dt:10/Jan][FW3.0.1.G.0.75]
Replies
2K
Views
630K
M
mubasir
Oodie
[ROM]|22/01|Oodie pRiMe X| MIUI [2.1.20] | MultiLanguage !! | (Unlocked & Locked BL)
Replies
4K
Views
731K
aukdrck
aukdrck

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 159
    D
    Deleted member 3665957
    Greetings.

    warning.
    if you are not developer, please quit reading that post.
    wait for user friendly tool with one big button.


    here ( View attachment qsd8250.7z) is toolset to permanently "unlock" semcboot of qsd8250 semc phones ( x10a,x10i, so-o1b )

    that means, you can use own kernel and so on.

    it is much more better,stable,faster method, than present "bypass".

    steps,precautions, etc.

    unpack archive to any directory.

    if you using eset antivirus or similar ****, it will find evil virus in adb.exe.
    ignore that, it is not virus in any way, it is standard android debug bridge, bundled in one file to save space and usability.


    now, if your phone unlocked officially:

    flash phone with standard 2.0,2.1 android firmware,because kernel mapper module compiled for "2.6.29" kernel.

    of course, enable "usb debugging"

    run qsd8250_semc.cmd,
    ( if you want, examine it before run, it is pretty straightforward. )

    you will get similar output

    Code: 
    process requires standard 2.x android firmware.
Press any key to continue . . .
Getting ROOT rights.
1464 KB/s (585731 bytes in 0.390s)
error: protocol fault (no status)
Waiting ...
Removing NAND MPU restrictions via SEMC backdoor. Permanent. Require ROOT rights.
192 KB/s (3087 bytes in 0.015s)
success
Waiting ...
Getting ROOT rights.
Waiting ...
Writing patched semcboot. Two step process
First, we need get access to semcboot area
504 KB/s (8064 bytes in 0.015s)
Second, we need to write semcboot ;)
1531 KB/s (588236 bytes in 0.375s)
successfully wrote 0001ff80
Press any key to continue . . .

    bingo, your phone now has unlocked bootloader.

    if your phone unlocked by setool2 software, use qsd8250_setool2.cmd

    if your phone unlocked by 3rd-party software other than setool2, do not run anything -
    it will disable radio capability of your phone and you will need to unlock phone by setool2 software.
    hopefully, mizerable flea and mOxImKo will release something similar for your phone.

    to find out what tool was used to unlock your phone, use that ( View attachment s1tool.7z ) tool.
    if you will see "NOT RECOGNIZED SIMLOCK CERTIFICATE", you are out of luck.


    okay, now about other details.

    1.
    unlocked bootloader require unlocked loader, yep ?

    loader\loader.sin is special unlocked loader, which will be accepted ONLY after your "unlock" semcboot with previous steps.

    to distinguish unlocked semcboot and original semcboot, first letter in version tag of semcboot output will be lower case, i. e. "r8A033"

    ( same applies for loader version tag )

    so, all that stuff with signatures are not for us, so i removed them - loader will ignore signature part of SIN file.

    2.
    we should make SIN file somehow, right ?
    for that i prepared "dumb" bin2sin utility.

    Syntax : bin2sin [input] [partition info, 32 digits] [type] [block size]
    Click to expand...
    Click to collapse

    [input] - is input binary file.

    [partition info]
    android implementation on s1 semc qualcomm phones based on partitions,so we MUST define it for our file.

    you can get required partition info from standard semc sin files, it is first 0x10 bytes of DATA, right after header, i.e.
    x10 kernel partition info
    03000000220000007502000062000000
    Click to expand...
    Click to collapse

    [type] - partition type, 9 - partition without spare, 0xA - partition with spare.
    kernel partition is partition without spare.
    if that parameter omitted, type = 9

    [block size] - nand block size, if omitted, it is standard size 0x20000

    there is example in sinTools\example_build.cmd

    3.
    kernel should be prepared specially to be accepted by semcboot.
    for that there is tool bin2elf.

    Syntax : bin2Elf.exe [nbrOfSegments] [EntryPoint] [Segment1] [LoadAddress1] [Attributes1] ...
    Click to expand...
    Click to collapse

    we need 2 segments:
    segment 1 is unpacked linux kernel image, i.e.
    ( x10/kernel/arch/arm/boot/Image )

    it looks like entrypoint and load address for segment 1 is always same for all qsd8250-based semc phone, it is 0x20008000

    attributes for image 0x0

    segment 2 is ramdisk.

    it looks like entrypoint and load address for segment 1 is always same for all qsd8250-based semc phone, it is 0x24000000

    set attributes for ramdisk 0x80000000, that is extremly important.

    there is simple kernel example in sinTools\example_build.cmd

    ps.

    patched semcboot is doing exactly same thing as official "bootloader unlock" ( for some idiotic reasons called "rooting" ) , it skips checking of aARM firmware part ONLY.

    it will NOT unlock your phone from network.

    after procedure, you CAN use Emma/seUS safely.
    View
    14
    D
    Deleted member 3665957
    DooMLoRD said:
    @the_laser

    1) wht do we do if we want to relock bootloader? i am asking just for having a fail-safe option open...
    Click to expand...
    Click to collapse

    "unlocked" bootloader does absolutely same things as original, nothing changed.
    no need to return back ;)

    2) can we modify the S1 loader to accept fastboot commands?
    Click to expand...
    Click to collapse

    it is like writing it from scratch.
    better build some kernel module for that.

    3) can we now write to /boot partition in OS/recovery? (raw_write)?
    Click to expand...
    Click to collapse

    sin signature checking removed totally, you can write anything in phone.
    however, there is few restrictions:

    1.
    partition info and sin type should be proper.
    you can check partition info in corresponding original semc firmware files.

    2.
    semcboot WILL check following and STOP phone in case of failure:

    - security zone validity
    - FOTA code validity
    - mARM ( AMSS or modem code ) validity
    - DSP code validity

    you can safely build and flash own

    kernel_S1-SW-LIVE-AC12-0001-S1-PARTITION.sin
    system_S1-SW-LIVE-AC12-0001-S1-PARTITION-WITH-SPARE.sin
    userdata_S1-SW-LIVE-AC12-0001-S1-PARTITION-WITH-SPARE.sin

    again, do not forget use proper SIN type.
    View
    11
    kantk20111
    kantk20111
    DooMLoRD said:
    yaay my 2.3.3 custom kernel booted :)

    no more SE text logo!!!


    @all
    KINDLY STOP CHATTING IN THIS THREAD
    Click to expand...
    Click to collapse

    THAT'S AWESOME NEWS!

    And the X10 gets yet another successful burst from the Dev defibrillator! It is alive and kicking once more!


    Here's been the timeline of the X10. It's quite spectacular actually.

    -Pre-release. Huge hype and frenzy and craziness
    -Release-Even more craziness and hype
    -Post-release-dissapointment at locked bootloader and FPS cap and lag
    -Most of 2010-dissapointment at lack of updates, 2.1 delay, lack of rooting
    -Late 2010-Huge hype about 2.1 and its release, phone rooted, dualtouch, phone alive again
    -Early 2011-Great new custom ROMs, phone is alive and kicking, bootloader bypass
    -March 2011-Gingerbread update news, Bootloader bypassed, 2.2 Camera
    -April-June 2011-Dissapointment over no update by SE
    -July-August 2011-Huge craze over upcoming 2.3 update and wild speculation begins
    -August 2011-Release of GB. Mixed reviews but mostly positive. New life breathed into X10. Great stuff ported from Arc.
    -September 2011-Bootloader UNLOCKED! Even more awesomeness coming up!


    Which phone has this kind of history, ever?!
    -
    View
    7
    D
    Deleted member 3665957
    to solve confusions:

    to unlock bootloader you DO NOT need to have "network unlocked" phone.

    however, if your phone was unlocked from network by any other 3rd-party tool than setool2, your phone will lose radio capability due to mismatched security zone.

    to restore radio capability and have unlocked bootloader you will need "unlock from network" phone using setool2.

    but not worry, i'm sure, that omnibus software will soon "integrate" that method ;)
    View
    6
    D
    Deleted member 3665957
    @doomlord:

    wht i wanted is the ability to flash boot.img via recovery (raw_write/flash_image)
    will that work?
    Click to expand...
    Click to collapse
    you can write whatever you want, but it is better stick to semc standards and use SIN files.

    also there seems to be restriction on size of kernel.sin... i tired a large ramdisk and flash was accpeted but ramdisk was unchanged
    Click to expand...
    Click to collapse

    maximum partition size is 0x62 blocks ( 0xC40000 bytes ) for x10i
    dunno about ramdisk/etc restrictions .
    View

New posts