[GUIDE] Recovering Recovery/Obtaining SKB

Search This thread

srbeen

Member
Sep 6, 2010
6
38
Recently I decided to upgrade to ICS. True ICS, new bootloader and stuff from my quazi-ICS install (HC bootloader, ICS rom)
This sounds easy, however, my recovery was too old!
Being used to using my forgiving Samsung SGS2X, I just flashed a NEW recovery while IN recovery - thus REMOVING recovery. (rather than using the problem-free Acer Recovery Installer via google play like smart people do)

Heres where it begins.

symtoms:
-Boots to ACER logo and stops
-Refuses to read update.zip package from microSD/USB (likely, as the recovery was corrupted!)
-I can enter APX mode however.
I have no recovery, no boot, no ADB mode, no way to read internal flash.

I did do a NANDROID backup, which is immensely important and EVERYONE should have at least ONE of these, due to your UID being recorded. This is where my problem came in. The NANDROID backup was on the internal storage!

So, I have a tablet that has no recovery, won't update.zip install, but WILL get to APX mode. I have NO UID, no SKB, no NANDROID backup. Solution is to send to acer? I think not!

Theres some brilliant people on this forum. One post in particular was golden. http://xdaforums.com/showpost.php?p=23783875&postcount=9 by eppeP

"If you can get the device into APX mode it will answer the first read request with the UID."

This is 100% true, and he provided a simple source example but little instructions. I hope I can elaborate and make someone elses life easier.

Requirements:
-Ubuntu (I used 12.04 LTS)
-microUSB cable
-powered tablet (can't be dead)
-paper clip, tac, needle - something to hit reset with
-patience

Boot Ubuntu, can be from CD/DVD/USB/network or installed copy
Install GCC, lsusb, libusb-1.0.x, libusb-1.0-dev - you NEED these! (hoping these are the only ones required for fresh installs)
Grab the code eppeP posted and save to a text file as apx.c
fire up terminal, browse to where the apx.c file is ('cd /home/<user>/Desktop/APX' for me)
run the following commands

sudo su
gcc apx.c -o apx -lusb-1.0

You should now have a file called apx on your desktop, that is ready to run.
If you get errors, you are likely missing a package. This should be fairly straight-forward, but refer to google and post the results please!

Next, pop your tablet into APX mode - plug in microUSB, hold the RESET button, and press power for around 4 sec. Windows gave me a 'usb detected' noise but Ubuntu just don't care.

Now run the following commands (assuming same root terminal permissions. If not run sudo su beforehand)

./apx

the terminal window should spit back to you a 15 character UID if everythings correct. 0x123456789ABCDEF (yours should be different combos of those hex values)

Proceed to guard this with your life! (although now you know how to retrieve again provided APX works)

now visit http://vache-android.com/v1/index.php?site=sbk MOD EDIT: Link no longer valid. SBK generator is available in the forums. Just check @dibb_nz profile signature and there's a link to a downloadable version in the guides.
and enter your UID. The website should spit back a series of 4, 8 character keys known as your SKB. Guard that too in case the website ever disappears.

Hard parts over. The tablet will live on now.
Next - choose how to recover!

I used a file called:

V8-UNL-ICS-HC-bootloader-MULTI-cwm.zip 32MB
MD5: 33D6692A997649111995CB690EF73213

I sadly lost the link to this package but im sure if you search google/this forum you will find it.

It uses nvflash. Amazing program. Theres also A500APXflash, based off nvflash. The rest mainly require ADB or USB debugging which you can't set as the tablet won't boot so don't waste your time with proggies like afterota (which won't work if you only have APX) You can also do everything in ubuntu with nvflash and the terminal. just read the commands from the batch, they should be nearly identical commands in either environment.

I booted back to windows, ran the V8.bat file, and followed instructions.
In 30 seconds my iconia was booting recovery again and that ROM I initially tried to install worked perfect!

After it booted, I realized I used 44% of my battery attempting to recover the tablet. This whole process takes maybe 30 minutes first-time through, getting ubuntu packages took the longest. LiveBoot will want to update everything as well, which I never considered, and usually fails (due to live install). Everything should be installed from Terminal if possible if using a live distro. It should be one command-line for the packages, reference exact package names in the package manager maybe.
My nandroid backup was still on the flash though! I knew enough that a 'hard reset' wasn't going to fix anything, so I never erased any userdata ironically, but botched the ROM and recovery.

This is the 100% fool-proof way to get your UID using APX. If its your only method this is your only option.
 
Last edited by a moderator:

eppeP

Senior Member
Nov 29, 2011
127
75
It doesn't work correctly for me. It gives me only the last 8 digits of my uid. The rest is filled up with zeroes.
You are probably using a 32bit system, while the others have been using a 64bit system.
Try replacing
Code:
printf("uid: %#016lx\n", *(uint64_t*)data);
with
Code:
    printf("uid: 0x%016llx\n", *(uint64_t*)data);
or
Code:
printf("uid: 0x%08X%08X\n", *((uint32_t*)data+1), *((uint32_t*)data+0));

I would expect either to work.
 

VelosCohagen

Senior Member
Feb 18, 2012
297
92
Wölfersheim
Will try it out.

Edit: You were right. Tried it with 64bit opensuse, and it worked.

Gesendet von meinem Iconia A501 mit Tapatalk 2
 
Last edited:

BCSC

Senior Member
Nov 5, 2009
610
213
New Westminster
I also had lost recovery after flashing from Thor's rom to CM9. In the end after stressing out and not being able to figure anything out, I ran Blackthund3r's "A500 APX Flash Tool". After running this, I had re instated recovery and was free to launch the Jelly Bean AOSP You will need some knowledge in findiing ANDROIDSERIALNO, but not too hard if you google it.
 

yodanov

New member
Jul 28, 2012
2
0
Recovery failed

Hi, thank you for your post, I apply your solution, i have my cpuid, skb but when i use V8.bat I see "rcm version 0x4 command send failed (usb write failed)" anyone can help me?
 

yodanov

New member
Jul 28, 2012
2
0
"Usb write failed" message appears when your cpuid is wrong. How many digits has your cpuid?

Gesendet von meinem Iconia A501 mit Tapatalk 2

I've got 16 digits (0x000000XXXXXXXX) got with ubuntu

My problem was resolved with "printf("uid: 0x%08X%08X\n", *((uint32_t*)data+1), *((uint32_t*)data+0));"
 
Last edited:

sanjayayogi

Member
Dec 31, 2010
18
0

TechiiGirl

Member
Aug 1, 2012
11
0
philadelphia
when i try to get to where the file is on my desktop in terminal it does nothing else i just get this symbol > and if i keep typing the next steps it does nothing but give me the same symbol again i don't know where i went wrong
help please
 

eppeP

Senior Member
Nov 29, 2011
127
75
does anybody know another way to generate the SBK?
Yes, the algorithm it is quite simple and can without to much trouble be reversed out of known UID/SBK pair.
A short description http://projects.pappkartong.se/a500/#generatesbk.

Seriously, what genius decided the only way to flash your tablet was via a magic number you have to get off a website?
Acer, except for the part where you can actually get it which was most likely not part of the plan.

when i try to get to where the file is on my desktop in terminal it does nothing else i just get this symbol > and if i keep typing the next steps it does nothing but give me the same symbol again i don't know where i went wrong
help please
You will have to be much more specific if you want help.
Describe exactly what did you did and the results, step by step.
 

sanjayayogi

Member
Dec 31, 2010
18
0
Yes, the algorithm it is quite simple and can without to much trouble be reversed out of known UID/SBK pair.
A short description http://projects.pappkartong.se/a500/#generatesbk.

Acer, except for the part where you can actually get it which was most likely not part of the plan.


You will have to be much more specific if you want help.
Describe exactly what did you did and the results, step by step.

0x0288424341e173d7
0x

0288
4243
41e1
73d7

0288
4243
41e1
73d7

FROM THIS LINK: HOW TO CREATE THE SECURE BOOT KEY (SBK) from the UID

http://projects.pappkartong.se/a500/

Generating the SBK

To generate the SBK from the UID (assuming UID is a hexadecimal string)

1. Discard any leading 0x in the UID

2. Split the UID into four 4 character strings

3. For each part, take the ascii values and multiply with 100 raised to the position.

e.g. "89AB" => 56*100**3 + 57*100**2 + 65*100**2 + 66*100**0 = 56576566.

4. xor

5. If using a little-endian architecture, swap the byte order

6. Print the key

============================================

UID:

0x0288424341e173d7

============================================

STEP 1. Remove 0x

0288424341e173d7

============================================
============================================

STEP 2. Split the UID into four 4 character strings

0288

4243

41e1

73d7

============================================
============================================
============================================

STEP 3 - For each part, take the ascii values and multiply with 100 raised to the position.

FIRST SET

Text Converted 0288

http://www.whatasciicode.com/?cmd=submit

Dec
48
50
56
56

============================================

https://www.google.com/search?q=48*100^3&sugexp=chrome,mod=4&sourceid=chrome&ie=UTF-8

0 => 48*100^3 = 48000000

============================================

https://www.google.com/webhp?source...f.&fp=6c7790a71c61b51c&biw=1274&bih=604&ion=1

2 => 50*100^2 = 500000

============================================

https://www.google.com/webhp?source...&bav=on.2,or.r_gc.r_pw.r_qf.&biw=1274&bih=604

8 => 56*100^1 = 5600

============================================

https://www.google.com/webhp?source...&bav=on.2,or.r_gc.r_pw.r_qf.&biw=1274&bih=604

8 => 56*100^0 = 56

============================================
FIRST SET: SUM the PARTS

https://www.google.com/search?q=480...cp.r_qf.&fp=917465cf75d369c2&biw=1274&bih=604

48000000 + 500000 + 5600 + 56 = 48505605

RESULT:

0288 => 48505605

ASCII TO HEX

http://www.dolcevie.com/js/converter.html

34:38:35:30:35:36:30:35

============================================
============================================

SECOND SET


Text Converted 4243

Dec
52
50
52
51

http://www.whatasciicode.com/?cmd=submit

============================================

http://www.google.com/webhp#hl=en&g...pw.r_qf.&fp=6c7790a71c61b51c&biw=1274&bih=648

52 => 52*100^3 = 52000000

============================================

http://www.google.com/webhp?sourcei...&bav=on.2,or.r_gc.r_pw.r_qf.&biw=1274&bih=648

50 = 50*100^2 = 500000

============================================

http://www.google.com/webhp?sourcei...&bav=on.2,or.r_gc.r_pw.r_qf.&biw=1274&bih=648

52 => 52*100^1 = 5200

============================================

http://www.google.com/webhp?sourcei...&bav=on.2,or.r_gc.r_pw.r_qf.&biw=1274&bih=648

51 => 51*100^0 = 51

============================================
SECOND SET: SUM the PARTS

http://www.google.com/webhp?sourcei...&bav=on.2,or.r_gc.r_pw.r_qf.&biw=1274&bih=648

52000000 + 500000 + 5200 + 51 = 52505251

4243 => 52505251

ASCII => HEX

http://www.dolcevie.com/js/converter.html

35:32:35:30:35:32:35:31

============================================
============================================
============================================

THIRD SET

Text Converted 41e1

http://www.whatasciicode.com/?cmd=submit


Dec
52
49
101
49

============================================

http://www.google.com/webhp?sourcei...&bav=on.2,or.r_gc.r_pw.r_qf.&biw=1274&bih=648

52 => 52*100^3 = 52000000

============================================

http://www.google.com/webhp?sourcei...f.&fp=6c7790a71c61b51c&biw=1274&bih=648&ion=1

49 => 49*100^2 = 490000

============================================

http://www.google.com/webhp?sourcei...&bav=on.2,or.r_gc.r_pw.r_qf.&biw=1274&bih=648

101 => 101*100^1 = 10100

============================================

http://www.google.com/webhp?sourcei...&bav=on.2,or.r_gc.r_pw.r_qf.&biw=1274&bih=648

49 => 49*100^0 = 49


============================================
THIRD SET: SUM the PARTS

http://www.google.com/webhp?sourcei...&bav=on.2,or.r_gc.r_pw.r_qf.&biw=1274&bih=648

52000000 + 490000 + 10100 + 49 = 52500149

ASCII => HEX

http://www.dolcevie.com/js/converter.html

35:32:35:30:30:31:34:39

============================================
============================================
============================================
============================================

FOURTH SET

Text Converted 73d7

http://www.whatasciicode.com/?cmd=submit



Dec
55
51
100
55

============================================

http://www.google.com/webhp?sourcei...&bav=on.2,or.r_gc.r_pw.r_qf.&biw=1274&bih=648

55 => 55*100^3 = 55000000

============================================

http://www.google.com/webhp?sourcei...&bav=on.2,or.r_gc.r_pw.r_qf.&biw=1274&bih=648

51 => 51*100^2 = 510000

============================================

http://www.google.com/webhp?sourcei...f.&fp=6c7790a71c61b51c&biw=1274&bih=648&ion=1

100 => 100*100^1 = 10000

============================================

http://www.google.com/webhp?sourcei...f.&fp=6c7790a71c61b51c&biw=1274&bih=648&ion=1

55 => 55*100^0 = 55

============================================
FOURTH SET: SUM the PARTS

http://www.google.com/webhp?sourcei...&bav=on.2,or.r_gc.r_pw.r_qf.&biw=1274&bih=648

55000000 + 510000 + 10000 + 55 = 55520055

ASCII => HEX

35:35:35:32:30:30:35:35

============================================
============================================
============================================
============================================

ASCII => HEX

http://www.dolcevie.com/js/converter.html

ALSO THIS SEEMS TO WORK (I am on MAC OSX 10.7):

echo "48505605" | od -t x1
0000000 34 38 35 30 35 36 30 35 0a
0000011

echo "52505251" | od -t x1
0000000 35 32 35 30 35 32 35 31 0a
0000011

halcasteel$ echo "52500149" | od -t x1
0000000 35 32 35 30 30 31 34 39 0a
0000011

echo "55520055" | od -t x1
0000000 35 35 35 32 30 30 35 35 0a
0000011


48505605 => 34:38:35:30:35:36:30:35
52505251 => 35:32:35:30:35:32:35:31
52500149 => 35:32:35:30:30:31:34:39
55520055 => 35:35:35:32:30:30:35:35

Sorry this is so verbose, but I wanted to show all of my steps.

THIS IS WHERE I AM STUCK, any ideas?
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 38
    Recently I decided to upgrade to ICS. True ICS, new bootloader and stuff from my quazi-ICS install (HC bootloader, ICS rom)
    This sounds easy, however, my recovery was too old!
    Being used to using my forgiving Samsung SGS2X, I just flashed a NEW recovery while IN recovery - thus REMOVING recovery. (rather than using the problem-free Acer Recovery Installer via google play like smart people do)

    Heres where it begins.

    symtoms:
    -Boots to ACER logo and stops
    -Refuses to read update.zip package from microSD/USB (likely, as the recovery was corrupted!)
    -I can enter APX mode however.
    I have no recovery, no boot, no ADB mode, no way to read internal flash.

    I did do a NANDROID backup, which is immensely important and EVERYONE should have at least ONE of these, due to your UID being recorded. This is where my problem came in. The NANDROID backup was on the internal storage!

    So, I have a tablet that has no recovery, won't update.zip install, but WILL get to APX mode. I have NO UID, no SKB, no NANDROID backup. Solution is to send to acer? I think not!

    Theres some brilliant people on this forum. One post in particular was golden. http://xdaforums.com/showpost.php?p=23783875&postcount=9 by eppeP

    "If you can get the device into APX mode it will answer the first read request with the UID."

    This is 100% true, and he provided a simple source example but little instructions. I hope I can elaborate and make someone elses life easier.

    Requirements:
    -Ubuntu (I used 12.04 LTS)
    -microUSB cable
    -powered tablet (can't be dead)
    -paper clip, tac, needle - something to hit reset with
    -patience

    Boot Ubuntu, can be from CD/DVD/USB/network or installed copy
    Install GCC, lsusb, libusb-1.0.x, libusb-1.0-dev - you NEED these! (hoping these are the only ones required for fresh installs)
    Grab the code eppeP posted and save to a text file as apx.c
    fire up terminal, browse to where the apx.c file is ('cd /home/<user>/Desktop/APX' for me)
    run the following commands

    sudo su
    gcc apx.c -o apx -lusb-1.0

    You should now have a file called apx on your desktop, that is ready to run.
    If you get errors, you are likely missing a package. This should be fairly straight-forward, but refer to google and post the results please!

    Next, pop your tablet into APX mode - plug in microUSB, hold the RESET button, and press power for around 4 sec. Windows gave me a 'usb detected' noise but Ubuntu just don't care.

    Now run the following commands (assuming same root terminal permissions. If not run sudo su beforehand)

    ./apx

    the terminal window should spit back to you a 15 character UID if everythings correct. 0x123456789ABCDEF (yours should be different combos of those hex values)

    Proceed to guard this with your life! (although now you know how to retrieve again provided APX works)

    now visit http://vache-android.com/v1/index.php?site=sbk MOD EDIT: Link no longer valid. SBK generator is available in the forums. Just check @dibb_nz profile signature and there's a link to a downloadable version in the guides.
    and enter your UID. The website should spit back a series of 4, 8 character keys known as your SKB. Guard that too in case the website ever disappears.

    Hard parts over. The tablet will live on now.
    Next - choose how to recover!

    I used a file called:

    V8-UNL-ICS-HC-bootloader-MULTI-cwm.zip 32MB
    MD5: 33D6692A997649111995CB690EF73213

    I sadly lost the link to this package but im sure if you search google/this forum you will find it.

    It uses nvflash. Amazing program. Theres also A500APXflash, based off nvflash. The rest mainly require ADB or USB debugging which you can't set as the tablet won't boot so don't waste your time with proggies like afterota (which won't work if you only have APX) You can also do everything in ubuntu with nvflash and the terminal. just read the commands from the batch, they should be nearly identical commands in either environment.

    I booted back to windows, ran the V8.bat file, and followed instructions.
    In 30 seconds my iconia was booting recovery again and that ROM I initially tried to install worked perfect!

    After it booted, I realized I used 44% of my battery attempting to recover the tablet. This whole process takes maybe 30 minutes first-time through, getting ubuntu packages took the longest. LiveBoot will want to update everything as well, which I never considered, and usually fails (due to live install). Everything should be installed from Terminal if possible if using a live distro. It should be one command-line for the packages, reference exact package names in the package manager maybe.
    My nandroid backup was still on the flash though! I knew enough that a 'hard reset' wasn't going to fix anything, so I never erased any userdata ironically, but botched the ROM and recovery.

    This is the 100% fool-proof way to get your UID using APX. If its your only method this is your only option.
    12
    It doesn't work correctly for me. It gives me only the last 8 digits of my uid. The rest is filled up with zeroes.
    You are probably using a 32bit system, while the others have been using a 64bit system.
    Try replacing
    Code:
    printf("uid: %#016lx\n", *(uint64_t*)data);
    with
    Code:
        printf("uid: 0x%016llx\n", *(uint64_t*)data);
    or
    Code:
    printf("uid: 0x%08X%08X\n", *((uint32_t*)data+1), *((uint32_t*)data+0));

    I would expect either to work.
    4
    Ok. I am uploading the files that you need to my Dropbox. I'll send you a pm with the link. If anyone else would like a copy please pm me rather than post here.

    There are 4 files in there.

    apx.c. Thanks for veryifing that it worked for you.

    Shortcut to blackthund3r_A500_APX-Flash_Tool webpage hosted somewhere else. Thank you blackthund3r.

    HC BL TWRP Recovery.a500apx. This is number one from blackthund3r's APX Tool Bundle Maker Market.
    V8 BL Thor1.73.a500apx. Again, thank you blackthund3r. It is number 17. It would be best if you just use the bundle maker and don't download those 2.

    You can use Acer_AV041_A500_1.031.00_WW_GEN1 found here. Thanks Civato. You can use any rom you like once you get cwm going. It's a pretty good place to start.

    I've also put in a stock rooted HC rom. So if you are want to go back to stock 3.1. The process below will still apply. It is stock 3.1 ACER_A500_4.010.38_COM_GEN1. Thanks Vache.

    I was where you are with your tablet, and this worked fine for me.

    Step 1.
    APXWalkthrough02.jpg
    Step 2.
    APXWalkthrough03.jpg

    Step 3.
    APXWalkthrough04.jpg


    Step 4. I used number 17.
    APXWalkthrough05.jpg
    Step 5.
    APXWalkthrough07.jpg
    Step 6.
    APXWalkthrough08.jpg


    Step 7. I used the default since my tab was fried.
    APXWalkthrough09.jpg
    Step 8.
    APXWalkthrough10.jpg


    Once you are in APX mode and plugged into the pc you should see the message APX device connected. Choose the next arrow, once it runs for a few seconds it will ask you to confirm that the APX download mode has started.
    21_Old_Logo1-568x412.jpg


    Once it has. Confirm and wait for it to finish. Get into CWM, flash the rom and you should be good to go.

    Once you get settled in go visit Skrylax, Civato, srbeen, ezterry, eppeP, Vache, blackthund3r, Thor, MoscowDesire, (hope I didn't forget someone...) and click the thanks button for making this possible.
    3
    I don't know if it will help or not. But I installed every package that came up when I searched for libusb. Well, I didn't download the iPhone stuff...
    But I got the rest of it.

    Use the following command:
    Code:
    sudo apt-get install libusb-1.0-0-dev libusb-1.0-0

    Now you can go ahead and compile apx.c :)
    2
    does anybody know another way to generate the SBK?
    Yes, the algorithm it is quite simple and can without to much trouble be reversed out of known UID/SBK pair.
    A short description http://projects.pappkartong.se/a500/#generatesbk.

    Seriously, what genius decided the only way to flash your tablet was via a magic number you have to get off a website?
    Acer, except for the part where you can actually get it which was most likely not part of the plan.

    when i try to get to where the file is on my desktop in terminal it does nothing else i just get this symbol > and if i keep typing the next steps it does nothing but give me the same symbol again i don't know where i went wrong
    help please
    You will have to be much more specific if you want help.
    Describe exactly what did you did and the results, step by step.