mtd_utils

Search This thread

iPlasm

Senior Member
Feb 15, 2011
729
481
I asked some in HD2 XDA, hope they reply soon..

- about you said the Modified SPL or Signing ROM with RSA Key, I don't have that info really, I'm not have very info about Mobile phones, I know about Computer..

- And about Partitioning Layout File System, YAFFS2 FileSytem is most on Android Mobile (Froyo 2.2), and also EXT4 available on GingerBread. see this: http://elinux.org/Android_File_Systems
So you can choose you prefer it. :) and also if you can Create Clean Fully Format the NAND at MBR and partition to two one for Android and one for WM, for MultiBoot. maybe your good idea is better to do in free space for creating partition.
Also if you be able to edit/delete/table/, then how it can't read good? because the Reading is the first thing must have after that it will be able to do other things sure and stably. ;)
 
Last edited:

munjeni

Senior Member
Jun 2, 2011
9,720
22,374
About spl and "signing" I will explain to you. Fist to you to understand what I say about moodifying spl "rsa modulus": if you open, rom.nbh with hex editor you will see all 0x10000 bytes (block) is signed with rsa and have sha1 signature (all signed blocks have own signature). When you modify one byte of the rom you will not be able instaling that rom with original htc flash utility becouse spl have inside htc rsa modulus (passing check for sha1 signatures inside rom.nbh when it go uploading to phone memory/nand)! If you modified byte inside rom you modified also sha1 signature and signature not match for that block, so it will cause "wrong image" and spl can not accept it! But if we hack spl and modify modulus inside, we will be able creating own room image signing with own rsa key and spl will accept it. But I not found way how to write to memory region to change rsa modulus, it is problem now (I know position in mtd for the spl rsa modulus but no way to write to that memory region becouse is locked).


About partition layout I not know how to create small partition layout compatible for phone (including photon android with zImage, initrd...) but I know offset where wince mbr start and I am able to write to nand from that offset but not have knownledge in this time creating new mbr...etc, maybe a little later or maybe with your help guys! First of all is: Maybe you have knownledge creating small partition layout (1 megabyte) including mbr...etc but placing only spl to it (to be executed) instead of the wince partition layout "wince operating system"???

iPlasm said:
then how it can't read good
I do not care now about it, only want to see something executed from nand (bootloader or something other) instead of wince! Good will be executing our spl (original or modified)!
 
Last edited:
  • Like
Reactions: youkid90 and iPlasm

iPlasm

Senior Member
Feb 15, 2011
729
481
Thank you very much for explaining +1 :)
Well, the HD2 forum didn't reply.. I'm sorry :( but no problem :) I will try to help you about partitioning.

Now,
1-The everything you can do is only by MTD Utilites on the phone? and how you can do it (is there codes to enter or what)? and how much partitions are there?
2- In my info, you should erase NAND and then Create new Partitions.. (the default it self must Create MBR, if not.. it will create something that it wont affect any about FileSystems) and then Format as you prefer choose, YAFFS2 or EXT4. and then maybe copy the Android's already we have in SDHC.

Note: you must be able about the size you wish to create for partitions..

I looked also about Hackinkg SPL and Changing RSA Key (not sure): http://stackoverflow.com/questions/6897899/how-add-change-password-for-rsa-priv-key-using-pycrypto

-HD2
maybe something this can help: http://leoandroid.com/viewforum.php?f=286
this can be useful about:
"Boot AD NAND"- boots android from NAND.
zImage and initrd.gz loaded from YAFFS2 (Filesystem) partition with "boot" flag.
----------------------------

Hope those helps you.. :)
Please if you need helps... explain the exactly your needs, to understand your needs :) Have a nice time.
Remember, I'm Advanced User not Developer User :)
 

munjeni

Senior Member
Jun 2, 2011
9,720
22,374
I made communication with the bootloader (MTTY) and managed task29 (format):D there is other task ... will try. Also mtd offsets I got from mtd utils is same as from task29 so it mean I am at good way \o/

About partitions it need to be in binfs format before uploading to nand!? Also some blocks need to be skiped if we use full nand!
 

Attachments

  • mtty.jpg
    mtty.jpg
    93.8 KB · Views: 126
Last edited:

munjeni

Senior Member
Jun 2, 2011
9,720
22,374
hmmm there is very dangerous tasks (do not try!!!) :D I performed task 2a (format all :eek:)
Code:
Cmd>task 2a
Format ALL start
backup SPL OK
backup MISC configuration OK
SPL start start block=288, total block of CE=3808
ERASE block 431 FAIL !!!
ERASE block 614 FAIL !!!
ERASE block 1176 FAIL !!!
ERASE block 1924 FAIL !!!
ERASE block 1943 FAIL !!!
ERASE block 2324 FAIL !!!
ERASE block 3746 FAIL !!!
Write 0xFF start page=0x4800, total page=0x3B800
restore SPL OK
restore MISC configuratoin OK
restore MFG configuratoin OK
Format ALL end

Cmd>
Also performed command ramdump and got full dump to sd card;)

other usefull comands
Code:
Command error !!!

Cmd>password xxxxxxPass.

HTCST   ÚÈÒHTCE
Cmd>info 0
Platform Model ID:PB9210000
Platform HW Board ID:255, UNKNOWN

Cmd>info 1

Cmd>info 2
HTCSVODAP304P‚ÃHTCE
Cmd>info 3
HTCSPB9210000
Cmd>info 4
HTCSVODAP304P‚ÃHTCE
Cmd>info 5

Cmd>info 6
HTCST   ÚÈÒHTCE
Cmd>info 7

HTC Integrated Re-Flash Utility, Common Base Version : 1.51d
Device Name: Photon, Bootloader Version : 1.31.0000
Built at: Apr 12 2010 13:08:04
Copyright (c) 1998-2009 High Tech Computer Corporation

CPU ID=0x4117B365
MicroP(LED)    0x05

Cmd>info 8

--- 2K bytes sector version ---

DEVICE NAME=samsung_kby00n00hm
DEVICE ID=0xBC
DEVICE MAKER ID=0xEC
PAGE SIZE=0x800
TOTAL PAGE SIZE=0x840
BLOCK COUNT=0x1000
BLOCK PAGE=0x40

Checking block information

BLOCK 431 (0x1AF) is bad block
BLOCK 614 (0x266) is bad block
BLOCK 1176 (0x498) is bad block
BLOCK 1924 (0x784) is bad block
BLOCK 1943 (0x797) is bad block
BLOCK 2324 (0x914) is bad block
BLOCK 3746 (0xEA2) is bad block
OS NOT FOUND !!! 


Cmd>info 9
NO user storage

NO user storage

NO Ext ROM


Cmd>info 10

Cmd>info 11

Cmd>info 12

Cmd>info 13

Cmd>info 14

Cmd>info 15

Cmd>info 16

Cmd>
 
Last edited:
  • Like
Reactions: youkid90

munjeni

Senior Member
Jun 2, 2011
9,720
22,374
There is wdata command (writing to memory) but I not know how to use it! Some useful commands from here (old spl) -> http://xdaforums.com/wiki/index.php?title=Hermes_BootLoader#wdatas

Disasembling spl I think we will get all hiden commands! To activate hiden commands you need to type:
password BsaD5SeoA
and activate with command:
set 1e 1
all times when want to use hiden commands!

I go now to try dft sspl commands :D
 
Last edited:

iPlasm

Senior Member
Feb 15, 2011
729
481
Well, In my info that you don't skip the blocks is better, because it can cause errors while booting BootLoader (or Hermes bootloader) or something another errors..

You know better what you should do.. :) That's Cool! :cool:
 

munjeni

Senior Member
Jun 2, 2011
9,720
22,374
I have good news - custom mtd layout is suported/successful ! :D
Code:
C:\Documents and Settings\savan\Desktop\adb>adb shell
# cat /proc/mtd
cat /proc/mtd
dev:    size   erasesize  name
[COLOR="Red"]mtd0: 00200000 00020000 "datacust"
mtd1: 00200000 00020000 "systemcust"[/COLOR]
# ls /dev/block
ls /dev/block
mmcblk0p2
vold
[COLOR="Red"]mtdblock1
mtdblock0[/COLOR]
loop7
loop6
loop5
loop4
loop3
loop2
loop1
loop0
mmcblk0
#
Partition layout will be only /system on nand (other will be on sdcard with haret boot) and I will try to get nand boot soon!
 
Last edited:

cnloonger

New member
Sep 8, 2011
4
1
Xiamen
I have good news - custom mtd layout is suported/successful ! :D
Code:
C:\Documents and Settings\savan\Desktop\adb>adb shell
# cat /proc/mtd
cat /proc/mtd
dev:    size   erasesize  name
[COLOR="Red"]mtd0: 00200000 00020000 "datacust"
mtd1: 00200000 00020000 "systemcust"[/COLOR]
# ls /dev/block
ls /dev/block
mmcblk0p2
vold
[COLOR="Red"]mtdblock1
mtdblock0[/COLOR]
loop7
loop6
loop5
loop4
loop3
loop2
loop1
loop0
mmcblk0
#
Partition layout will be only /system on nand (other will be on sdcard with haret boot) and I will try to get nand boot soon!

You are great ! thanks!!
 

iPlasm

Senior Member
Feb 15, 2011
729
481
I knew you can do it! :D

Hope you can done it soon! :) and we're ready for helping
 

munjeni

Senior Member
Jun 2, 2011
9,720
22,374
Some info about gpios and owerclocking

Code:
Cmd>task 55
GPIO [0], Owner=ARM11, Setting=I(PD), DrvStrength=2mA 
GPIO [1], Owner=ARM11, Setting=I(PD), DrvStrength=2mA 
GPIO [2], Owner=ARM11, Setting=I(PD), DrvStrength=2mA 
GPIO [3], Owner=ARM11, Setting=I(PD), DrvStrength=2mA 
GPIO [4], Owner=ARM11, Setting=I(PD), DrvStrength=2mA 
GPIO [5], Owner=ARM11, Setting=I(PD), DrvStrength=2mA 
GPIO [6], Owner=ARM11, Setting=I(PD), DrvStrength=2mA 
GPIO [7], Owner=ARM11, Setting=I(PD), DrvStrength=2mA 
GPIO [8], Owner=ARM11, Setting=I(PD), DrvStrength=2mA 
GPIO [9], Owner=ARM11, Setting=I(PD), DrvStrength=2mA 
GPIO [10], Owner=ARM11, Setting=I(PD), DrvStrength=2mA 
GPIO [11], Owner=ARM11, Setting=I(PD), DrvStrength=2mA 
GPIO [12], Owner=ARM11, Setting=I(PD), DrvStrength=2mA 
GPIO [13], Owner=ARM11, Setting=I(PD), DrvStrength=2mA 
GPIO [14], Owner=ARM11, Setting=I(PD), DrvStrength=2mA 
GPIO [15], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [16], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [17], Owner=ARM11, Setting=O(H) , DrvStrength=2mA 
GPIO [18], Owner=ARM11, Setting=I(NP), DrvStrength=2mA 
GPIO [19], Owner=ARM11, Setting=I(NP), DrvStrength=2mA 
GPIO [20], Owner=ARM11, Setting=I(PU), DrvStrength=2mA 
GPIO [21], Owner=ARM11, Setting=I(PD), DrvStrength=2mA 
GPIO [22], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [23], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [24], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [25], Owner=ARM11, Setting=O(H) , DrvStrength=2mA 
GPIO [26], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [27], Owner=ARM11, Setting=I(NP), DrvStrength=2mA 
GPIO [28], Owner=ARM11, Setting=I(NP), DrvStrength=2mA 
GPIO [29], Owner=ARM11, Setting=I(NP), DrvStrength=2mA 
GPIO [30], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [31], Owner=ARM11, Setting=O(H) , DrvStrength=2mA 
GPIO [32], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [33], Owner=ARM11, Setting=I(PU), DrvStrength=2mA 
GPIO [34], Owner=ARM11, Setting=I(PU), DrvStrength=2mA 
GPIO [35], Owner=ARM11, Setting=I(PU), DrvStrength=2mA 
GPIO [36], Owner=ARM11, Setting=I(NP), DrvStrength=2mA 
GPIO [37], Owner=ARM11, Setting=I(PU), DrvStrength=2mA 
GPIO [38], Owner=ARM11, Setting=I(PU), DrvStrength=2mA 
GPIO [39], Owner=ARM11, Setting=I(NP), DrvStrength=2mA 
GPIO [40], Owner=ARM11, Setting=I(PU), DrvStrength=2mA 
GPIO [41], Owner=ARM11, Setting=I(PU), DrvStrength=2mA 
GPIO [42], Owner=ARM11, Setting=I(PU), DrvStrength=2mA 
GPIO [43], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [44], Owner=ARM11, Setting=I(PU), DrvStrength=2mA 
GPIO [45], Owner=ARM11, Setting=I(PU), DrvStrength=2mA 
GPIO [46], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [47], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [48], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [49], Owner=ARM11, Setting=I(NP), DrvStrength=2mA 
GPIO [50], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [51], Owner=ARM11, Setting=I(PU), DrvStrength=2mA 
GPIO [52], Owner=ARM11, Setting=I(PU), DrvStrength=2mA 
GPIO [53], Owner=ARM11, Setting=I(PU), DrvStrength=2mA 
GPIO [54], Owner=ARM11, Setting=I(PU), DrvStrength=2mA 
GPIO [55], Owner=ARM11, Setting=I(PU), DrvStrength=2mA 
GPIO [56], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [57], Owner=ARM11, Setting=I(NP), DrvStrength=2mA 
GPIO [58], Owner=ARM11, Setting=I(NP), DrvStrength=2mA 
GPIO [59], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [60], Owner=ARM11, Setting=A(NP), DrvStrength=2mA 
GPIO [61], Owner=ARM11, Setting=A(NP), DrvStrength=2mA 
GPIO [62], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [63], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [64], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [65], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [66], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [67], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [68], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [69], Owner=ARM11, Setting=I(PU), DrvStrength=2mA 
GPIO [70], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [71], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [72], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [73], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [74], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [75], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [76], Owner=ARM11, Setting=O(H) , DrvStrength=2mA 
GPIO [77], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [78], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [79], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [80], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [81], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [82], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [83], Owner=ARM11, Setting=I(NP), DrvStrength=2mA 
GPIO [84], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [85], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [86], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [87], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [88], Owner=ARM11, Setting=O(H) , DrvStrength=2mA 
GPIO [89], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [90], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [91], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [92], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [93], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [94], Owner=ARM11, Setting=I(PU), DrvStrength=2mA 
GPIO [95], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [96], Owner=ARM11, Setting=I(NP), DrvStrength=2mA 
GPIO [97], Owner=ARM11, Setting=A(NP), DrvStrength=2mA 
GPIO [98], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [99], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [100], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [101], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [102], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [103], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [104], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [105], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [106], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [107], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [108], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [109], Owner=ARM11, Setting=O(H) , DrvStrength=2mA 
GPIO [110], Owner=ARM9 , Setting=I(NP), DrvStrength=2mA 
GPIO [111], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [112], Owner=ARM11, Setting=I(PD), DrvStrength=2mA 
GPIO [113], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [114], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [115], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [116], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [117], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [118], Owner=ARM11, Setting=O(H) , DrvStrength=2mA 
GPIO [119], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [120], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [121], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [122], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [123], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [124], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [125], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [126], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [127], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [128], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [129], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [130], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [131], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 
GPIO [132], Owner=ARM11, Setting=O(L) , DrvStrength=2mA 

Cmd>task 56
addr=0xB3200300, PLL[0]_MODE=0x7
addr=0xB3200304, PLL[0]_L_VAL=0x32
addr=0xB3200308, PLL[0]_M_VAL=0x0
addr=0xB320030C, PLL[0]_N_VAL=0x1
clk=960000K, 960M

addr=0xB320031C, PLL[1]_MODE=0x7
addr=0xB3200320, PLL[1]_L_VAL=0xC
addr=0xB3200324, PLL[1]_M_VAL=0x4
addr=0xB3200328, PLL[1]_N_VAL=0x5
clk=245760K, 245M

addr=0xB3200338, PLL[2]_MODE=0x7
addr=0xB320033C, PLL[2]_L_VAL=0x3E
addr=0xB3200340, PLL[2]_M_VAL=0x1
addr=0xB3200344, PLL[2]_N_VAL=0x2
clk=1200000K, 1200M

addr=0xB3200354, PLL[3]_MODE=0x0
addr=0xB3200358, PLL[3]_L_VAL=0x0
addr=0xB320035C, PLL[3]_M_VAL=0x0
addr=0xB3200360, PLL[3]_N_VAL=0x0
clk=0K, 0M


Cmd>

Creating siple partition scheme defining offset, size and name (haret startup.txt), example:
Code:
set cmdline "rw console=ram1 data_size=4000 swap_size=0 gps_zone=fr mtdparts=msm_nand:0x00200000@2820000(boot),0x05d40000@0x09320000(data)"

Photon nand offsets is here -> http://pastebin.com/xAhnEXBU
 
Last edited:
  • Like
Reactions: youkid90

sembhi421

Senior Member
Sep 12, 2013
67
2
bad block problem

Succesfully compiled! I think it will be useful to someone:)

what is the solution for this problem:-



C:\htc>adb shell
adb server is out of date. killing...
* daemon started successfully *
~ # su
su
/sbin/sh: su: not found
~ # cd /system/xbin
cd /system/xbin
/system/xbin # ./flash_erase -N /dev/mtd/mtd4 0 0
./flash_erase -N /dev/mtd/mtd4 0 0
Erasing 256 Kibyte @ 3ac0000 -- 100 % complete
/system/xbin # ./flash_erase -N /dev/mtd/mtd2 0 0
./flash_erase -N /dev/mtd/mtd2 0 0
Erasing 256 Kibyte @ 3c0000 -- 100 % complete
/system/xbin # ./flash_erase -N /dev/mtd/mtd3 0 0
./flash_erase -N /dev/mtd/mtd3 0 0
Erasing 256 Kibyte @ eb00000 -- 100 % complete
/system/xbin # ./flash_erase -N /dev/mtd/mtd5 0 0
./flash_erase -N /dev/mtd/mtd5 0 0
Erasing 256 Kibyte @ 1480000 -- 13 % complete libmtd: error!: MEMERASE64 ioctl f
ailed for eraseblock 82 (mtd5)
error 5 (I/O error)
flash_erase: error!: /dev/mtd/mtd5: MTD Erase failure
error 5 (I/O error)
Erasing 256 Kibyte @ 95c0000 -- 100 % complete
 

Top Liked Posts

  • There are no posts matching your filters.
  • 7
    3
    I have good news, nand driver is now able to write to region at 0x2820000 (there is master boot record, partition table, imgfs ...etc) I think we will be able now to create android nand rom creating new MBR and partition table (not 100% sure)!!!
    Here is erase block offsets http://pastebin.com/xAhnEXBU
    I confirm I sucessfully erased mbr and my partitions but no way to unlock spl (start offset 0x2400000) and I don't know why:
    Code:
    localhost:~/mtd/sbin# ./flash_erase /dev/mtd0 0x2400000 1
    Erasing 128 Kibyte @ 2400000 --  0 % complete libmtd: error!: MEMERASE64 ioctl failed for eraseblock 288 (mtd0)
            error 5 (Input/output error)
    flash_erase: error!: /dev/mtd0: MTD Erase failure
                 error 5 (Input/output error)
    Erasing 128 Kibyte @ 2400000 -- 100 % complete
    If someone have skills hex editing mbr it will be good! In attachment is mbr and msflsh dump... I waiting expert with ideas:) and my device will be testing device!:D
    2
    Succesfully compiled! I think it will be useful to someone:)
    2
    Writing only from offset 0x59c0000 and good news I think I cid unlocked my device!!!:D (offset 0x1FEE0000)

    Code:
    localhost:~/mtd/sbin# ./nandwrite -s 0x59c0000 -m --pad /dev/mtd0 ../mtd.img
    Writing data to block 718 at offset 0x59c0000
    Writing data to block 719 at offset 0x59e0000
    Bad block at 59e0000, 1 block(s) from 59e0000 will be skipped
    Writing data to block 720 at offset 0x5a00000
    Writing data to block 721 at offset 0x5a20000
    Writing data to block 722 at offset 0x5a40000
    Writing data to block 723 at offset 0x5a60000
    Writing data to block 724 at offset 0x5a80000
    Writing data to block 725 at offset 0x5aa0000
    Writing data to block 726 at offset 0x5ac0000
    Writing data to block 727 at offset 0x5ae0000
    Writing data to block 728 at offset 0x5b00000
    Writing data to block 729 at offset 0x5b20000
    Writing data to block 730 at offset 0x5b40000
    Writing data to block 731 at offset 0x5b60000
    Writing data to block 732 at offset 0x5b80000
    Writing data to block 733 at offset 0x5ba0000
    Writing data to block 734 at offset 0x5bc0000
    Writing data to block 735 at offset 0x5be0000
    Writing data to block 736 at offset 0x5c00000
    ....
    ....