[GUIDE] Recovering Recovery/Obtaining SKB

srbeen said:

Recently I decided to upgrade to ICS. True ICS, new bootloader and stuff from my quazi-ICS install (HC bootloader, ICS rom)
This sounds easy, however, my recovery was too old!
Being used to using my forgiving Samsung SGS2X, I just flashed a NEW recovery while IN recovery - thus REMOVING recovery. (rather than using the problem-free Acer Recovery Installer via google play like smart people do)

Heres where it begins.

symtoms:
-Boots to ACER logo and stops
-Refuses to read update.zip package from microSD/USB (likely, as the recovery was corrupted!)
-I can enter APX mode however.
I have no recovery, no boot, no ADB mode, no way to read internal flash.

I did do a NANDROID backup, which is immensely important and EVERYONE should have at least ONE of these, due to your UID being recorded. This is where my problem came in. The NANDROID backup was on the internal storage!

So, I have a tablet that has no recovery, won't update.zip install, but WILL get to APX mode. I have NO UID, no SKB, no NANDROID backup. Solution is to send to acer? I think not!

Theres some brilliant people on this forum. One post in particular was golden. http://xdaforums.com/showpost.php?p=23783875&postcount=9 by eppeP

"If you can get the device into APX mode it will answer the first read request with the UID."

This is 100% true, and he provided a simple source example but little instructions. I hope I can elaborate and make someone elses life easier.

Requirements:
-Ubuntu (I used 12.04 LTS)
-microUSB cable
-powered tablet (can't be dead)
-paper clip, tac, needle - something to hit reset with
-patience

Boot Ubuntu, can be from CD/DVD/USB/network or installed copy
Install GCC, lsusb, libusb-1.0.x, libusb-1.0-dev - you NEED these! (hoping these are the only ones required for fresh installs)
Grab the code eppeP posted and save to a text file as apx.c
fire up terminal, browse to where the apx.c file is ('cd /home/<user>/Desktop/APX' for me)
run the following commands

sudo su
gcc apx.c -o apx -lusb-1.0

You should now have a file called apx on your desktop, that is ready to run.
If you get errors, you are likely missing a package. This should be fairly straight-forward, but refer to google and post the results please!

Next, pop your tablet into APX mode - plug in microUSB, hold the RESET button, and press power for around 4 sec. Windows gave me a 'usb detected' noise but Ubuntu just don't care.

Now run the following commands (assuming same root terminal permissions. If not run sudo su beforehand)

./apx

the terminal window should spit back to you a 15 character UID if everythings correct. 0x123456789ABCDEF (yours should be different combos of those hex values)

Proceed to guard this with your life! (although now you know how to retrieve again provided APX works)

now visit http://vache-android.com/v1/index.php?site=sbk
and enter your UID. The website should spit back a series of 4, 8 character keys known as your SKB. Guard that too in case the website ever disappears.

Hard parts over. The tablet will live on now.
Next - choose how to recover!

I used a file called:

V8-UNL-ICS-HC-bootloader-MULTI-cwm.zip 32MB
MD5: 33D6692A997649111995CB690EF73213

I sadly lost the link to this package but im sure if you search google/this forum you will find it.

It uses nvflash. Amazing program. Theres also A500APXflash, based off nvflash. The rest mainly require ADB or USB debugging which you can't set as the tablet won't boot so don't waste your time with proggies like afterota (which won't work if you only have APX) You can also do everything in ubuntu with nvflash and the terminal. just read the commands from the batch, they should be nearly identical commands in either environment.

I booted back to windows, ran the V8.bat file, and followed instructions.
In 30 seconds my iconia was booting recovery again and that ROM I initially tried to install worked perfect!

After it booted, I realized I used 44% of my battery attempting to recover the tablet. This whole process takes maybe 30 minutes first-time through, getting ubuntu packages took the longest. LiveBoot will want to update everything as well, which I never considered, and usually fails (due to live install). Everything should be installed from Terminal if possible if using a live distro. It should be one command-line for the packages, reference exact package names in the package manager maybe.
My nandroid backup was still on the flash though! I knew enough that a 'hard reset' wasn't going to fix anything, so I never erased any userdata ironically, but botched the ROM and recovery.

This is the 100% fool-proof way to get your UID using APX. If its your only method this is your only option.

Click to expand...

Click to collapse

rdozier52 said:

Is there away to get a video on how this should look. i have tried for two days straight. i feel that it is something that i a missing. even if some one could message me i would appreciate it.

Click to expand...

Click to collapse

rdozier52 said:

Is there away to get a video on how this should look. i have tried for two days straight. i feel that it is something that i a missing. even if some one could message me i would appreciate it.

Click to expand...

Click to collapse

blackthund3r said:

Probably a stupid question but if the filter driver was configured correctly, could this be compiled on Windows 7? If so I can build it straight into the flash tool (or another solution ;D).

I guess a 32-bit and a 64-bit binary would be needed and same goes for installing libusb but I can handle the filter driver with a server bit for managing the latest version and a simple GUI that runs install-filter.exe -i but after that I'm stuck.

I did manage to compile it for windows with MinGW but I get nothing :/

Sent from my Iconia A500 using Tapatalk 2

Click to expand...

Click to collapse

eppeP said:

I made a version that compiles with msvc, someone got it to work with some windows version at least.
http://xdaforums.com/showthread.php?p=26768584#post26768584

I think it would be interesting to investigate the possibillity to use the NVidia driver instead of libusb so you don't have to switch drivers. It looks like they are using winusb so it shouldn't be that hard.

Click to expand...

Click to collapse

eppeP said:

I think it would be interesting to investigate the possibillity to use the NVidia driver instead of libusb so you don't have to switch drivers. It looks like they are using winusb so it shouldn't be that hard.

Click to expand...

Click to collapse

#include "stdafx.h"

#include <windows.h>
#include <stdio.h>
#include <tchar.h>
#include <strsafe.h>

#include <winusb.h>
#include <Usb100.h>
#include <Setupapi.h>

// Linked libraries
#pragma comment (lib , "setupapi.lib" )
#pragma comment (lib , "winusb.lib" )


BOOL GetDeviceHandle (GUID guidDeviceInterface, PHANDLE hDeviceHandle)
{
    if (guidDeviceInterface==GUID_NULL)
    {
        return FALSE;
    }

    BOOL bResult = TRUE;
    HDEVINFO hDeviceInfo;
    SP_DEVINFO_DATA DeviceInfoData;

    SP_DEVICE_INTERFACE_DATA deviceInterfaceData;
    PSP_DEVICE_INTERFACE_DETAIL_DATA pInterfaceDetailData = NULL;

    ULONG requiredLength=0;
    LPTSTR lpDevicePath = NULL;
    DWORD index = 0;

    // Get information about all the installed devices for the specified
    // device interface class.
    hDeviceInfo = SetupDiGetClassDevs(&guidDeviceInterface, NULL, NULL, DIGCF_PRESENT | DIGCF_DEVICEINTERFACE);
    if (hDeviceInfo == INVALID_HANDLE_VALUE)
    {
        // ERROR
        printf("Error SetupDiGetClassDevs: %d.\n", GetLastError());
        goto done;
    }

    //Enumerate all the device interfaces in the device information set.
    DeviceInfoData.cbSize = sizeof(SP_DEVINFO_DATA);

    for (index = 0; SetupDiEnumDeviceInfo(hDeviceInfo, index, &DeviceInfoData); index++)
    {
        //Reset for this iteration
        if (lpDevicePath)
        {
            LocalFree(lpDevicePath);
        }
        if (pInterfaceDetailData)
        {
            LocalFree(pInterfaceDetailData);
        }

        deviceInterfaceData.cbSize = sizeof(SP_INTERFACE_DEVICE_DATA);

        //Get information about the device interface.
        bResult = SetupDiEnumDeviceInterfaces(hDeviceInfo, &DeviceInfoData, &guidDeviceInterface, 0, &deviceInterfaceData);

        // Check if last item
        if (GetLastError () == ERROR_NO_MORE_ITEMS)
        {
            break;
        }

        //Check for some other error
        if (!bResult)
        {
            printf("Error SetupDiEnumDeviceInterfaces: %d.\n", GetLastError());
            goto done;
        }

        //Interface data is returned in SP_DEVICE_INTERFACE_DETAIL_DATA
        //which we need to allocate, so we have to call this function twice.
        //First to get the size so that we know how much to allocate
        //Second, the actual call with the allocated buffer

        bResult = SetupDiGetDeviceInterfaceDetail(hDeviceInfo, &deviceInterfaceData, NULL, 0, &requiredLength, NULL);
        //Check for some other error
        if (!bResult)
        {
            if ((ERROR_INSUFFICIENT_BUFFER==GetLastError()) && (requiredLength>0))
            {
                //we got the size, allocate buffer
                pInterfaceDetailData = (PSP_DEVICE_INTERFACE_DETAIL_DATA)LocalAlloc(LPTR, requiredLength);

                if (!pInterfaceDetailData)
                {
                    // ERROR
                    printf("Error allocating memory for the device detail buffer.\n");
                    goto done;
                }
            }
            else
            {
                printf("Error SetupDiEnumDeviceInterfaces: %d.\n", GetLastError());
                goto done;
            }
        }

        //get the interface detailed data
        pInterfaceDetailData->cbSize = sizeof(SP_DEVICE_INTERFACE_DETAIL_DATA);

        //Now call it with the correct size and allocated buffer
        bResult = SetupDiGetDeviceInterfaceDetail(
                hDeviceInfo,
                &deviceInterfaceData,
                pInterfaceDetailData,
                requiredLength,
                NULL,
                &DeviceInfoData);

        //Check for some other error
        if (!bResult)
        {
            printf("Error SetupDiGetDeviceInterfaceDetail: %d.\n", GetLastError());
            goto done;
        }

        //copy device path
        size_t nLength = wcslen (pInterfaceDetailData->DevicePath) + 1;
        lpDevicePath = (TCHAR *) LocalAlloc (LPTR, nLength * sizeof(TCHAR));
        StringCchCopy(lpDevicePath, nLength, pInterfaceDetailData->DevicePath);
        lpDevicePath[nLength-1] = 0;

        printf("Device path:  %s\n", lpDevicePath);
    }

    if (!lpDevicePath)
    {
        //Error.
        printf("Error %d.\n", GetLastError());
        goto done;
    }

    //Open the device
    *hDeviceHandle = CreateFile (
        lpDevicePath,
        GENERIC_READ | GENERIC_WRITE,
        FILE_SHARE_READ | FILE_SHARE_WRITE,
        NULL,
        OPEN_EXISTING,
        FILE_FLAG_OVERLAPPED,
        NULL);

    if (*hDeviceHandle == INVALID_HANDLE_VALUE)
    {
        //Error.
        printf("Error %d.\n", GetLastError());
        goto done;
    }

done:
    LocalFree(lpDevicePath);
    LocalFree(pInterfaceDetailData);
    bResult = SetupDiDestroyDeviceInfoList(hDeviceInfo);

    return (*hDeviceHandle != INVALID_HANDLE_VALUE);
}

int _tmain(int argc, _TCHAR* argv[])
{
    HANDLE hDeviceHandle = INVALID_HANDLE_VALUE;
    WINUSB_INTERFACE_HANDLE hWinUSBHandle = INVALID_HANDLE_VALUE;

    //Acer Picasso USB Boot-recovery driver GUID
    static const GUID APX_DRIVER = { 0xEAD8C4F6, 0x6102, 0x45c7, { 0xAA,0x66, 0x36, 0xE6, 0xD7, 0x20, 0x46, 0x00 } };

    if(GetDeviceHandle(APX_DRIVER, &hDeviceHandle))
    {
        printf("Got device handle.\n");
        if(WinUsb_Initialize(hDeviceHandle, &hWinUSBHandle))
        {
            printf("Got WinUSB handle.\n");

            //Set timeout to 1s, default is wait forever...
            ULONG theUsbReadTimeout = 1000;
            WinUsb_SetPipePolicy(hWinUSBHandle, 0x81, PIPE_TRANSFER_TIMEOUT, sizeof(theUsbReadTimeout), &theUsbReadTimeout);

            printf("Attempting to read UID...\n");
            ULONG cbRead = 0;
            UCHAR theUID[8];
            if(WinUsb_ReadPipe(hWinUSBHandle, 0x81, theUID, 8, &cbRead, 0))
            {
                printf("UID: 0x%08X%08X\n", *((int*)theUID+1), *((int*)theUID+0));
            }
            else
            {
                printf("Failed to read UID.\n");
            }
        }
        else
        {
            printf("WinUsb_Initialize Error %d.", GetLastError());
        }
    }
    else
    {
        printf("Failed to get device handle: %d\n", GetLastError());
    }
    if(hDeviceHandle != INVALID_HANDLE_VALUE)
        CloseHandle(hDeviceHandle);
    if(hWinUSBHandle != INVALID_HANDLE_VALUE)
        WinUsb_Free(hWinUSBHandle);
    fgetc(stdin);
    return 0;
}

sanfo said:

hi everyone, the method that gave you was successful for me, knowing that it is a Iconia Tab A100, then I got the CPUID. it has 15 digits after the 0x. but when I use the "EUUs_SBK_Acer_A100_1.008.05_COM_GEN1" he told me that the CPUID is incorrect. please help me ...

Click to expand...

Click to collapse

robkoehler said:

same problem here, but with an A500 (0x...... 16 characters long)

Click to expand...

Click to collapse

eppeP said:

It is supposed to be 16 charachters (18 including 0x), it is a hexadecimal representation of 8 bytes.
I can't really guess at what might be going wrong at which stage without more information.

Click to expand...

Click to collapse

robkoehler said:

well, i can get the EUUS to downgrade to 3.0.1 to take my cpuid - 16 characters - no 0x appended to it, but then it fails when it boots the tablet to download mode. i think the tablet is dead.

Click to expand...

Click to collapse

eppeP said:

Have you tried nvflash manually?
If you generate the SBK and run nvflash the first RCM command will fail if you don't have the correct key.
If you have a dump of the begining of mmcblk0 you could also try to manually decrypt that to verify the key.

I've been considering to extend the tool to make it send an RCM message to verify that the device is actually using an SBK genereated from the UID, but I have been too lazy to implement that. I have the parts to build, encrypt and sign an RCM message so it is mostly a question of putting it together.

Click to expand...

Click to collapse

robkoehler said:

I finally got the EUUS to apply. It was a combination of applying the V8 bootloader via the flash tool and the EUUS repeatedly. I started doing the V8 bootloader because at one point I couldn't even get the Acer logo to come up. Once I was back to 3.0.1 stock it would not update via OTA.

So I put the full 3.2 upgrade on the micro sd and applied it with no issues and did a factory reset.

From there, it applied to minor 3.2 updates and I updated the Acer update app in the play store which prompted the ICS update.

My tab hates ICS. I tried to apply it, and it put me back to where I started, soft brick, double Acer logos. A combination of V8 bootloader and EUUS is getting my back to 3.0.1 right now.

Guess I'll stick with 3.2......

Click to expand...

Click to collapse

srbeen said:

Recently I decided to upgrade to ICS. True ICS, new bootloader and stuff from my quazi-ICS install (HC bootloader, ICS rom)
This sounds easy, however, my recovery was too old!
Being used to using my forgiving Samsung SGS2X, I just flashed a NEW recovery while IN recovery - thus REMOVING recovery. (rather than using the problem-free Acer Recovery Installer via google play like smart people do)

Heres where it begins.

symtoms:
-Boots to ACER logo and stops
-Refuses to read update.zip package from microSD/USB (likely, as the recovery was corrupted!)
-I can enter APX mode however.
I have no recovery, no boot, no ADB mode, no way to read internal flash.

I did do a NANDROID backup, which is immensely important and EVERYONE should have at least ONE of these, due to your UID being recorded. This is where my problem came in. The NANDROID backup was on the internal storage!

So, I have a tablet that has no recovery, won't update.zip install, but WILL get to APX mode. I have NO UID, no SKB, no NANDROID backup. Solution is to send to acer? I think not!

Theres some brilliant people on this forum. One post in particular was golden. http://xdaforums.com/showpost.php?p=23783875&postcount=9 by eppeP

"If you can get the device into APX mode it will answer the first read request with the UID."

This is 100% true, and he provided a simple source example but little instructions. I hope I can elaborate and make someone elses life easier.

Requirements:
-Ubuntu (I used 12.04 LTS)
-microUSB cable
-powered tablet (can't be dead)
-paper clip, tac, needle - something to hit reset with
-patience

Boot Ubuntu, can be from CD/DVD/USB/network or installed copy
Install GCC, lsusb, libusb-1.0.x, libusb-1.0-dev - you NEED these! (hoping these are the only ones required for fresh installs)
Grab the code eppeP posted and save to a text file as apx.c
fire up terminal, browse to where the apx.c file is ('cd /home/<user>/Desktop/APX' for me)
run the following commands

sudo su
gcc apx.c -o apx -lusb-1.0

You should now have a file called apx on your desktop, that is ready to run.
If you get errors, you are likely missing a package. This should be fairly straight-forward, but refer to google and post the results please!

Next, pop your tablet into APX mode - plug in microUSB, hold the RESET button, and press power for around 4 sec. Windows gave me a 'usb detected' noise but Ubuntu just don't care.

Now run the following commands (assuming same root terminal permissions. If not run sudo su beforehand)

./apx

the terminal window should spit back to you a 15 character UID if everythings correct. 0x123456789ABCDEF (yours should be different combos of those hex values)

Proceed to guard this with your life! (although now you know how to retrieve again provided APX works)

now visit http://vache-android.com/v1/index.php?site=sbk
and enter your UID. The website should spit back a series of 4, 8 character keys known as your SKB. Guard that too in case the website ever disappears.

Hard parts over. The tablet will live on now.
Next - choose how to recover!

I used a file called:

V8-UNL-ICS-HC-bootloader-MULTI-cwm.zip 32MB
MD5: 33D6692A997649111995CB690EF73213

I sadly lost the link to this package but im sure if you search google/this forum you will find it.

It uses nvflash. Amazing program. Theres also A500APXflash, based off nvflash. The rest mainly require ADB or USB debugging which you can't set as the tablet won't boot so don't waste your time with proggies like afterota (which won't work if you only have APX) You can also do everything in ubuntu with nvflash and the terminal. just read the commands from the batch, they should be nearly identical commands in either environment.

I booted back to windows, ran the V8.bat file, and followed instructions.
In 30 seconds my iconia was booting recovery again and that ROM I initially tried to install worked perfect!

After it booted, I realized I used 44% of my battery attempting to recover the tablet. This whole process takes maybe 30 minutes first-time through, getting ubuntu packages took the longest. LiveBoot will want to update everything as well, which I never considered, and usually fails (due to live install). Everything should be installed from Terminal if possible if using a live distro. It should be one command-line for the packages, reference exact package names in the package manager maybe.
My nandroid backup was still on the flash though! I knew enough that a 'hard reset' wasn't going to fix anything, so I never erased any userdata ironically, but botched the ROM and recovery.

This is the 100% fool-proof way to get your UID using APX. If its your only method this is your only option.

Click to expand...

Click to collapse

eppeP said:

You are probably using a 32bit system, while the others have been using a 64bit system.
Try replacing

Code:

printf("uid: %#016lx\n", *(uint64_t*)data);

with

Code:

    printf("uid: 0x%016llx\n", *(uint64_t*)data);

or

Code:

printf("uid: 0x%08X%08X\n", *((uint32_t*)data+1), *((uint32_t*)data+0));

I would expect either to work.

Click to expand...

Click to collapse