Kill the kill switch - "ST - yy"

Search This thread

cartert

New member
Dec 31, 2017
2
0
Somebody else had that problem... Read through the q&a forum. I don't think he ever fixed it. You can try to format data in twrp and see if it helps.


Thanks, I've already tried format data but it doesn't help. I have also read q&a forum but as you noticed he never fixed it.
It seems to me that the partitions are damaged. I' ve read about the adb shell dd commands but I do not know it.
Maybe you know if and how I can repair this partitions.

I asked the question in this section because I thought it had something to do with the kill switch
although I have read a lot about this topic, nobody has written clearly whether it is exactly revealed
anyway thanks for the answer
 

Vartom

Senior Member
Apr 2, 2015
509
804
Thanks, I've already tried format data but it doesn't help. I have also read q&a forum but as you noticed he never fixed it.
It seems to me that the partitions are damaged. I' ve read about the adb shell dd commands but I do not know it.
Maybe you know if and how I can repair this partitions.

I asked the question in this section because I thought it had something to do with the kill switch
although I have read a lot about this topic, nobody has written clearly whether it is exactly revealed
anyway thanks for the answer
It looks like your problem with the internal flash memory chip on your tablet.
 

cpalmer2k

Member
Jun 21, 2010
9
0
Recently I purchased a new, in box Shield Tablet off of eBay. I had been looking for an Android tablet with HDMI output that I could use to fake my GPS location for YouTube TV/Hulu Live TV and by all accounts this one fit the bill. I wasn't aware of the recall at the time though, but discovered it while shopping for a case. As soon as the tablet arrived I checked and based on the serial # on the box the tablet I received would be covered under the recall. I've read through the thread, but at 1700 messages it is impossible to read all of them. Right now the tablet is still unopened in the box. What is the easiest path to get it running and up to date without worrying about the "kill switch"?
 

topcat36

Senior Member
Jan 4, 2007
211
74
Unless it connects to internet by wifi or mobile, the killswitch cannot be loaded.
Turn the tablet on, see if it starts. If is only black screen, is already killed.
I would suggest either way (works or not) to open a case on Ebay, because this tablet is under a recall and cannot be sold legally.

If it starts, go to About Tablet in Settings and check System Updates tab. The background color of the app is the key: green = waiting for killswitch, blue = already fixed and you can go online.

If is green, you need to flash a file you can find in the beginning of this thread, called nomoreota.zip. That would remove the nVidia updater (TegraOTA.zip) that downloads the killswitch (and also makes the app look green). To flash nomoreota.zip, you need to unlock the bootloader, flash another recovery program and from inside it, flash nomoreota.zip. You could also remove the file manually.

For all these steps, you can look on Google for tutorials. Are also detailed here, but you have to search through the thread. Good luck :)

One more thing: everytime you want to update Android, you need to flash the OTA manually (since the program that does automatic updating is gone). That would bring back TegraOTA. Just be careful to remove it after each update and check if is gone before going online.

Sent from my old SHIELD Tablet.
 
Last edited:

topcat36

Senior Member
Jan 4, 2007
211
74
Once you turn on your new tab, it will release the kill update. Be sure TegraOTA is gone from the old tab.
I actually removed TegraOTA from both tablets. I don't like updates sneaking in without me knowing.
Maybe one day nVidia decides some tablets are used enough and we need to buy new ones and randomly releases killer updates for the new tabs also !

Sent from my old SHIELD Tablet.
 
Last edited:

cpalmer2k

Member
Jun 21, 2010
9
0
Unless it connects to internet by wifi or mobile, the killswitch cannot be loaded.
Turn the tablet on, see if it starts. If is only black screen, is already killed.
I would suggest either way (works or not) to open a case on Ebay, because this tablet is under a recall and cannot be sold legally.

If it starts, go to About Tablet in Settings and check System Updates tab. The background color of the app is the key: green = waiting for killswitch, blue = already fixed and you can go online.

If is green, you need to flash a file you can find in the beginning of this thread, called nomoreota.zip. That would remove the nVidia updater (TegraOTA.zip) that downloads the killswitch (and also makes the app look green). To flash nomoreota.zip, you need to unlock the bootloader, flash another recovery program and from inside it, flash nomoreota.zip. You could also remove the file manually.

For all these steps, you can look on Google for tutorials. Are also detailed here, but you have to search through the thread. Good luck :)

One more thing: everytime you want to update Android, you need to flash the OTA manually (since the program that does automatic updating is gone). That would bring back TegraOTA. Just be careful to remove it after each update and check if is gone before going online.

Sent from my old SHIELD Tablet.

Thank you for the detailed summary. I contacted Nvidia and found out the recall is still active, so I opened the tablet and confirmed it was covered by the recall. I submitted all the paperwork and it said a replacement will ship within 4-6 weeks. I'm going to hold off on unlocking & changing the recovery until the new one actually gets here. The e-mail made reference to returning the old one to them in a timely manner, so I guess maybe they want them back now? I imagine what I get will likely be a refurbished model since I seriously doubt they still have stock sitting around.

My last Android device was a Droid Razr Maxx so I've been away from this circle for some time. It does seem based on Googling that unlocking the Shield is a breeze compared to what I went through with the Razr Maxx years ago lol.
 

topcat36

Senior Member
Jan 4, 2007
211
74
Wow, you are kidding me ! You bought a recalled tablet that the seller did not do the recall procedure yet ? Lucky you ! Repairing this tab is nothing to them. Actually the kill switch is very easy to undo if you have a special key that only they own. They just replace the battery, put the latest rom and is back to life (if the battery is the real reason, I am still skeptical). So, they have a lot of tablets available !

Sent from my old SHIELD Tablet.
 

lafester

Senior Member
Feb 11, 2007
3,399
648
Thank you for the detailed summary. I contacted Nvidia and found out the recall is still active, so I opened the tablet and confirmed it was covered by the recall. I submitted all the paperwork and it said a replacement will ship within 4-6 weeks. I'm going to hold off on unlocking & changing the recovery until the new one actually gets here. The e-mail made reference to returning the old one to them in a timely manner, so I guess maybe they want them back now? I imagine what I get will likely be a refurbished model since I seriously doubt they still have stock sitting around.

My last Android device was a Droid Razr Maxx so I've been away from this circle for some time. It does seem based on Googling that unlocking the Shield is a breeze compared to what I went through with the Razr Maxx years ago lol.
I did the same thing last year and got a new one. Sold the new one for like $350 and made $250 profit plus the old tablet.
 

pinchez

Member
Aug 28, 2011
16
1
I have a simple question, can you sign into Nvidia on the pyro tablet (already have an account on my Shield TV) without bricking my tablet or getting banned by Nvidia?
 

cpalmer2k

Member
Jun 21, 2010
9
0
Kill the kill switch - "ST - yy"

topcat36 said:
Wow, you are kidding me ! You bought a recalled tablet that the seller did not do the recall procedure yet ? Lucky you ! Repairing this tab is nothing to them. Actually the kill switch is very easy to undo if you have a special key that only they own. They just replace the battery, put the latest rom and is back to life (if the battery is the real reason, I am still skeptical). So, they have a lot of tablets available !

Sent from my old SHIELD Tablet.



Yes, it was factory sealed with the original security tape still intact on the box. I figured they had somehow been exchanged in bulk already based on serial #’s and that I had been scammed but it booted up and completed the recall procedure fine with no issues.
 

Juloc

New member
May 2, 2018
2
0
Ok, so 3 years ago my tablet got killed by nvidia, tried to unbrick it for days with the help of this post but gave it up...Didn't have the SBK's needed for nvflash...
Yesterday I found the tablet between my junk and decided to start it up again, so I charged the battery and boom, it just started working again!!! How is this possible?!?
I didn't go online yet, and I'm going to delete TegraOTA before I do...
So there is still hope for bricked shield's, I just have no idea what I did besides not charging it for 3 years... :)
 

Juloc

New member
May 2, 2018
2
0
I checked it on the url provided in the first post and the killswitch was triggered on my device...I gave up because there was no way I could get it to work. Untill now, it just booted. I plugged in the charger, did not boot it, left it on the table and when I came home from work it was on the 'first time start up' screen of android....No idea what happened...
Now I have 2 working shield tablets, I'm happy :D
And yes, I'm carefull for the battery fire thing... ;)
 

pinchez

Member
Aug 28, 2011
16
1
I have a quick question , I’ve not used my 32GB LTE RoW tablet for a while, it’s currently on official 5.2 with killswtch blocked. Is it worth upgrading to 5.4? I want to keep to official Nvidia roms for compatibility.
 

p3dboard

Senior Member
Oct 20, 2013
1,003
616
5.4 still has slightly higher battery usage i feel. 5.2 is probably the best if you are not worried about the security updates for meltdown and spectre bugs. If you do update, then i suggest choosing custom cpu scheme as in the default cpu scheme i find that all cpu cores constantly run, none ever go to idle, whereas when in custom the CPU gets to idle, which is part of the battery drain issue
 
  • Like
Reactions: pinchez

pinchez

Member
Aug 28, 2011
16
1
5.4 still has slightly higher battery usage i feel. 5.2 is probably the best if you are not worried about the security updates for meltdown and spectre bugs. If you do update, then i suggest choosing custom cpu scheme as in the default cpu scheme i find that all cpu cores constantly run, none ever go to idle, whereas when in custom the CPU gets to idle, which is part of the battery drain issue

Thanks, I’m not worried about security updates so I’ll stay with 5.2, I only really wanted to update if there were any optimisations :good:
 

wogarro

New member
Aug 8, 2011
1
0
Ok, so 3 years ago my tablet got killed by nvidia, tried to unbrick it for days with the help of this post but gave it up...Didn't have the SBK's needed for nvflash...
Yesterday I found the tablet between my junk and decided to start it up again, so I charged the battery and boom, it just started working again!!! How is this possible?!?
I didn't go online yet, and I'm going to delete TegraOTA before I do...
So there is still hope for bricked shield's, I just have no idea what I did besides not charging it for 3 years... :)
Did the same for me. Original tablet was in storage for some time(Over a year and a half at least). Was looking into replacing the battery on the replacement unit and decided to check if there was anyway to resuscitate the original device. I knew the battery had to be charged so i plugged it up and the red battery icon came on. After a few minutes of charging, i started unit and it boot right in to the tablet with out the lockout that it previously had. Any thoughts as to what happened and what steps can i take now to prevent it from locking again?
 

Bryanx86

Senior Member
Apr 8, 2016
776
329
👽
Google Pixel 7 Pro
Did the same for me. Original tablet was in storage for some time(Over a year and a half at least). Was looking into replacing the battery on the replacement unit and decided to check if there was anyway to resuscitate the original device. I knew the battery had to be charged so i plugged it up and the red battery icon came on. After a few minutes of charging, i started unit and it boot right in to the tablet with out the lockout that it previously had. Any thoughts as to what happened and what steps can i take now to prevent it from locking again?
That's crazy. You guys think Nvidia sent an update to unbrick your device from their kill-switch? If so , that's great, but one has to wonder why...?
 

IMysliwiec

New member
Sep 14, 2018
1
0
32
Busko Zdroj
Wake up thread:

I have nVidia Shield LTE 32GB - it's gonna be in progress of bricking pretty soon.

I have a problem when flashing the no-more-ota zip.
I'm using the PowerShell instead of cmd (couldn't overrun Windows in terms of turning off PowerShell).

After using command "adb reboot bootloader" it's shown that the device is unlocked. All debugging options are unlocked on the device, as well.
I can choose from 5 options:
1. Continue - cold linux boot - device normally booting
2. Fastboot Protocol - rebooting the same screen
3. Recovery Mode - doesn't work, shows the android sign with "no command" written on it.
4. Reboot - normal booting
5. Poweroff - turning off the device

After that I'm using the command "fastboot flash recovery MY FILE NAME.img" PowerShell shows:
"< waiting for device >"

the device is still the same, nothing is happening.
Whichever option I choose, doesn't work for the PowerShell commands.

What is it about?

Sorry if this question came out before but I'm a n00b in this and just trying to rescue my Shield from being bricked.

Help?
 

Top Liked Posts

  • There are no posts matching your filters.
  • 410
    < include generic disclaimer here >

    TL;DR

    Since update 3.1, Nvidia can force updates (such as the one that bricks your tablet) to be downloaded and installed silently. No guarantees, but:
    • If you're on stock, delete TegraOTA (/system/app/TegraOTA or /system/priv-app/TegraOTA if you're on 5.0 or newer, or /system/app/TegraOTA.apk if you're still on 4.4) before booting into Android (the attached ZIP file does this for you, but please check with the file manager in recovery before rebooting and let me know if it didn't work), then reboot
      Note: you also will need to delete TegraOTA again if you ever install an OTA from Nvidia or a recovery image
    • If you're not on stock, you're probably safe
    EDIT: The urgent OTA is currently not getting sent out to any devices anymore, not even to those who have been getting it before.
    EDIT 2: The urgent OTA is now being delivered again, this time named "ST - yy"!

    What if my tablet is already deactivated?

    Unless you can still boot into fastboot mode (in which case your tablet isn't really deactivated yet), your tablet is probably gone for good. The only way to fix this would be through nvflash, and using it requires the SBK that is unique to each device and that only Nvidia knows, so it's pretty unlikely that we'll ever be able to fix these deactivated tablets.

    What/why/how?

    In the last OTA (Update 3.1), Nvidia has made some changes to their TegraOTA application. The most important/interesting/suspicious of which is the ability for them to mark OTAs as "urgent". What this means is that these updates will be downloaded without ever notifying the user, and they will be installed without asking the user for permission first. If this is how the kill switch is delivered, all users will see is the tablet randomly rebooting and installing an update, then the tablet would never boot again. As some of you might notice, this would match what has been happening to a few users already, both here and on reddit.

    But that's not all. I've been connecting to the OTA servers using various serial numbers (both found and provided to me by a few people) in hopes of actually finding the update that bricks the device. The first serial number I've tried that wasn't mine was the serial number from the screenshot on the recall page. It revealed an interesting "urgent" OTA, named "SHIELD Tablet xx - LTE", which does nothing but flash a blob (which, among other things, contains the bootloader). Many more questions appear now, but the main one is: if this is nothing but a routine bootloader update, why is it marked urgent? And why is it not attached to any Android update? But this by itself is not enough to prove anything, as I could only obtain it with one serial number, so as far as I could have known, it might had just been an internal update or something similar. (update is linked and analysed in the second post below)

    Today, however, one of the serial numbers I've been given by some of the people here (thanks for the help guys!) turned out to have the same update waiting for it the next time it connected to the Internet. This rules out the possibility of an internal update, so the next somewhat obvious possibility is that this is the kill switch. Mind you, I still have no direct way of proving this without flashing the ZIP to see what happens (which I'm not planning to do myself), but I will keep checking on the other serial numbers I've gotten to see if this update turns up for them too.

    The same person who has given me this serial number has also tested running the old tablet on the latest stock Android version but with TegraOTA removed, and, as expected, the tablet is still working perfectly fine now. Your mileage may vary.

    How can I know if the kill switch has been triggered for my tablet?

    Go to http://shield.bogdacutu.me/ and enter the full serial number of your old tablet. If the next OTA returned is "SHIELD Tablet xx" "ST - yy", the kill switch has been triggered for your tablet.
    Warning: the serial number from the box of the tablet and the one etched on the side of the tablet are not complete, as they only contain the first 13 characters of the full (20 characters) serial number. You can get the full serial number from Android (Settings -> About -> Status), from the bootloader (it will be on the screen when you boot into bootloader mode), or from your computer if the tablet is or (in some cases) if it was previously connected, using various tools such as USBDeview. Example: 0413714803249000a4cf (you can try this on the page and it will return that the kill switch is activated).

    Why would I want to also do the fix on my new tablet too?

    The update is signed by Nvidia, and communication with the OTA server does not use HTTPS, so, for example, a malicious WiFi network could MITM your connection and cause this update (as well as any other signed update) to be flashed to your new tablet without your permission, thus permanently disabling it too. If you have the stock recovery, only updates signed by Nvidia can run. The story might be slightly different if your recovery doesn't enforce signature verification (such as TWRP and CWM by default).

    Can I still get updates from Nvidia after doing this?

    Not directly, but people will post OTA download links here on xda when new updates get released. I'd personally recommend that you wait before flashing though until someone here checks the new update to confirm that there's no new way for Nvidia to kill your tablet.


    Many hours of work have gone into investigating this. Even if it doesn't help your specific scenario, consider hitting that Thanks button, so that I can at least know it wasn't for nothing. :)
    I'd also like to thank the people who have given me their serial numbers to use for testing again, this wouldn't have been possible without their help: @Beauenheim, @Jackill, and @runandhide05 (who has even volunteered to test removing TegraOTA with the latest update on his old tablet :highfive:)
    19
    Fragments of code from TegraOTA.apk

    < screenshots temporarily removed >

    Also, from what I've seen so far, the update isn't delivered instantly after activating the new tablet. I don't know exactly what the rule is, but out of the 4 serial numbers that I have, only 2 have this update waiting for them.

    EDIT: One more serial number from the ones I have has gotten the xx update. Only one left...

    EDIT 2: All the serial numbers I have have the urgent OTA waiting for them now.
    18
    "SHIELD Tablet xx" - Update Analysis

    OTA URL: http://ota.nvidia.com/ota/data/post...wf-full_ota-32256_554.0168.20150624152335.zip
    yy OTA URL: http://ota.nvidia.com/ota/data/posted-roms/uploaded/st---yy--092704233775---7294.20150819152732.zip (if you don't know what you're doing, DO NOT DOWNLOAD THIS, it's very likely that this will permanently brick your device upon flashing it!!!) - also attached to this post in case this link becomes invalid

    updater-script is the first file we check:
    Code:
    getprop("ro.product.device") == "shieldtablet" || abort("This package is for \"shieldtablet\" devices; this is a \"" + getprop("ro.product.device") + "\".");
    nv_copy_blob_file("blob", "/staging");
    reboot_now("/dev/block/platform/sdhci-tegra.3/by-name/MSC", "");

    Suspiciously enough, this only flashes a blob to the staging partition. But what exactly does this blob do, you might ask? Well, the blob actually contains data for 9 partitions, which are automatically replaced during the next boot (before the bootloader does anything else at all, so once you've rebooted, there's no going back) with the contents present in this blob. The 9 partitions are as follows (also detailing comparison with files from update 3.1):

    • BCT (Boot Configuration Table) - stores some information that is needed for the device to find the bootloader stored on the other partitions, initialize the RAM and some other stuff
      Status after update: probably corrupted - the previous OTAs have binary BCTs, but this update replaces it with a text file (which, while it does contain somewhat relevant information, is likely not a valid format). If this is corrupted, it's enough for the device not to be able to boot anymore.
    • BMP (boot logo) - intact
    • DTB - intact
    • EBT (part of the bootloader) - has a zeroed out region
    • NVC (part of the bootloader) - intact
    • RBL (part of the bootloader) - has a zeroed out region
    • RP4 (landscape boot logo) - intact
    • TOS (Trusted OS - probably part of the bootloader too) - has a zeroed out region
    • WB0 (related to the boot process, source file is named "nvbootwb0.bin") - has a zeroed out region
    The update also contains a few other files, but those are not used at all (probably leftovers from the 5.1 AOSP update template that they are using).

    DO NOT DOWNLOAD THE ATTACHMENT IF YOU DON'T KNOW WHAT YOU'RE DOING. THIS IS THE XX OTA, NOT THE ZIP THAT REMOVES TEGRAOTA!
    10
    I don't mind the OTA app on my new tablet, but I don't like the ability to just download silent updates. That concerns me, especially considering legitimate tablets getting nuked.

    I made the attached Xposed module if you're running 5.1.1 that will disable the silent download method. It will also mark "urgent" updates as no longer urgent (thus they will show a notification instead). This means you can theoretically have the OTA app installed on your terminated tablet. But you will have a persistent notification for an OTA available. Screenshot of this on my terminated tablet is also attached (for fun, don't do it on yours, I can't/won't be responsible).

    So if you'd like the peace of mind of not having silent updates snuck past you even on your perfectly good tablet, install this Xposed module. I only tested on 5.1.1 by the way.

    Code:
    package biz.underpants_gnomes.android.xposed.mods.nvsilentupdatekiller;
    
    import android.content.Context;
    
    import java.lang.reflect.Array;
    
    import de.robv.android.xposed.IXposedHookLoadPackage;
    import de.robv.android.xposed.XC_MethodHook;
    import de.robv.android.xposed.XC_MethodReplacement;
    import de.robv.android.xposed.XposedBridge;
    import de.robv.android.xposed.XposedHelpers;
    import de.robv.android.xposed.callbacks.XC_LoadPackage;
    
    public class NVSilentUpdateKiller implements IXposedHookLoadPackage {
    
        @Override
        public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam lpparam) {
            if (!lpparam.packageName.equals("com.nvidia.ota"))
                return;
    
            try {
                final Class<?> mClsRomInfo = XposedHelpers.findClass("com.nvidia.ota.utils.RomInfo", lpparam.classLoader);
                XposedHelpers.findAndHookMethod("com.nvidia.ota.UpdateCheckService", lpparam.classLoader, "silentDownloadUpdate",
                        Context.class, mClsRomInfo, XC_MethodReplacement.returnConstant(null));
    
                final Class mClsArrOfRomInfo = Array.newInstance(mClsRomInfo, 0).getClass();
                XposedHelpers.findAndHookMethod("com.nvidia.ota.utils.RomInfo.FetchInfoTask", lpparam.classLoader, "onPostExecute",
                        mClsArrOfRomInfo, new XC_MethodHook() {
    
                            @Override
                            protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                                if ((param.args[0] == null) || (Array.getLength(param.args[0]) == 0)) { return; }
    
                                Object mRomInfo = Array.get(param.args[0], 0);
                                XposedHelpers.setBooleanField(mRomInfo, "urgent", false);
                            }
                        });
            } catch (Throwable t) { XposedBridge.log(t); }
        }
    }
    8
    Got The Urgent one of my my Tablets

    First of all, would like to thank Bogdacutu for all the research and work done.:good::good::good: Never rooted or flashed anything Android, the last experience I had with any type of root/jailbreak was with an Iphone 4 - redsn0w (no longer an Apple user). Anyway, I have 2 Shield Tablets, so did the whole recall process, got my replacements in the mail and left them untouched. I'm not anywhere near developer or programmer level, but I can work my way around PC's (built 5 desktops), but figured someone would figure out how to bypass this killswitch. Honestly I've had my original tablets since last November, and never really had a problem of them getting super hot, so definitely did not want to send these back. Followed Bogdacutu's instructions and with some simple research (Not asking on this thread) I first had to root, flash TWRP, flash 3.1 OTA, then flash nomoreota.zip to remove the TegraOTA folder and TegraOTA.apk, and today, via Bogdacutu's link, noticed one of them is pending the "Urgent update of Death!" So. out of curiosity..just restarted the tablet with the killswitch and booted up fine. :victory:. Been reading this thread since it was only 1 page and haven't really found stating if this actually worked after following Bogdacutu's instructions and then activating the new tablet. Well, so far my tablet restarted and all is well, i'll try again and restart tomorrow to see what happens. And guys, stop asking Bogdacutu how to root, flash, etc. Youtube is an amazing thing nowadays. Follow these links for those instructions and lets keep focused on results! Again, thank you Bogdacutu. Here's youtube links to root, flash, etc. and of course DON'T forget to flash nomoreota.zip (download link via OP) , literally this is all you need.

    https://www.youtube.com/watch?v=Ocar8LJZlt0
    https://www.youtube.com/watch?v=5BZGleRdqPk

    3.1 OTA, click on Download>OTA>Full, pick your model ...
    http://xdaforums.com/shield-tablet/general/stock-recovery-images-ota-library-guides-t2988881