[Dev] Bypass "bootloader" [PROPER METHOD]

Search This thread

DooMLoRD

Inactive Recognized Developer
Jul 27, 2010
13,187
39,710
Pune
Ok i will not entertain this conversation off topic in this thread... But can you fully downgrade your FW using Xrecovery? Including Kernel & Baseband?...

Long Story Short you can't unlock Bootloader if you have a broken USB port...

Please refer to My_Inmortal thread related to it Here

J!M

well if u check the files (batch script) its possible to unlock bootloader using just a few files and commands (may be even create a small app for it)... so u dont necessarily need a working USB connector...
THOUGH u cant flash new kernels OR get back to 2.1 kernel if u dont have USB CONNECTOR... so then there is no point to unlock, UNLESS some one can create a way to flash the SIN file when u are right in OS/recovery without entering flashmode...


@the_laser
can u make the module for 2.3.3 stock FW? the version string is: 2.6.29-00054-g5f01537
 
  • Like
Reactions: jimbo77

bharadwaj1991

Senior Member
Feb 20, 2011
230
47
I have attached the meflash.dll you need. Just put it in the same folder as the setool1.exe file. Extract the meflash.7z.

It seems you still need to flash 2.1, I tried kernel downgrade but doesn't recognize phone. Now trying to flash 2.1 and see what happens. NOPE. I don't know something is wrong...won't recognize phone when in flash mode...flashtool works fine.

EDIT: Okay re-downloaded S1 Tool and it works now. BAD news...my phone isn't good, damn.
 

Attachments

  • meflash.7z
    24.9 KB · Views: 2,829
Last edited:
  • Like
Reactions: Zocker Tko

9Lukas5

Senior Member
Dec 14, 2010
3,914
2,076
near Stuttgart
@the_laser
can u make the module for 2.3.3 stock FW? the version string is: 2.6.29-00054-g5f01537

Hi doom, I would say there isn't any need to do this.

I have unlocked the bootloader the following way and now running your kernel:

flashed the azuzu kernel downgrade ftf with flashtool
disconnected usb cable, pressed power button until phone vibrates shortly and immidiatly connected the usb cable again
started the batch file for unlocking bootloader, cause it says press any button before it starts
then waited until flashtool recognized my x10
closed flashtool and then pressed any button in the cmd window that the unlocking process started (please close flashtool, instead the bl unlock cmd and flashtool are constantly killing and restarting adb!!)
after unlocking was finished I flashed azuzu kernel upgrade
now powered on phone to check if my phone is starting after the unlock (had to wipe dalvik-cache in xrecovery to get out of the bootloop the ck used with the bypass method caused, then phone started again and everything was working)
now I have placed the wifi modules for dooms ck with rootexplorer
powered off phone and flashed dooms ck v04-fs with flashtool
powered on phone again and
WOOOHOOO!!! Here I was with unlocked bootloader, custom kernel directly loaded AND without reflashing any rom, means I have kept my installation of miui 1.9.2 with all my apps, settings, phone numbers, sms, etc!!


Regards,

L
 
  • Like
Reactions: SpikeNaples

DooMLoRD

Inactive Recognized Developer
Jul 27, 2010
13,187
39,710
Pune
@9Lukas5

mate if there is a new module for 2.3.3 stock kernel then u dont need to bother with the hassle of kernel downgrade/upgrade
 
  • Like
Reactions: SpikeNaples

colossus

Retired Senior Moderator
Aug 28, 2009
3,215
3,072
Last edited:
  • Like
Reactions: qwer23
D

Deleted member 3665957

Guest
@doomlord:

root rights required to load kernel module,but stock fw 2.3.3 have fixed root exploit .

to change module string, get any hexeditor and change modinfo string in module to desired.
 

DooMLoRD

Inactive Recognized Developer
Jul 27, 2010
13,187
39,710
Pune
@doomlord:

root rights required to load kernel module,but stock fw 2.3.3 have fixed root exploit .

to change module string, get any hexeditor and change modinfo string in module to desired.

nice... i think it would be best if u can post it...

cause most users already have rooted 2.3.3 ROMS (stock/custom)...

it would save a lot of time for them....
 

bharadwaj1991

Senior Member
Feb 20, 2011
230
47
S1 Tool is not will not recognize my phone while in flash mode. At first I didn't have meflash.dll and it wouldn't run, I found meflash.dll online got it and then it ran...but won't pick up phone. Just keeps waiting... Any help?
 

zuli007

Senior Member
Oct 19, 2007
194
20
Katowice
Second Question for Developers:

How about warranty for X10 after unlock - If I reflash whole firmware with flashtool unlocked bootloader stay or dissapear ?
If stay , there is any possibility to back to clean SE bootloader?
 

astrall

Senior Member
Jan 12, 2011
578
124
So what does this mean?


Code:
RUNNING S1_EROM VER "R8A013"
SOFTWARE AID: 0001
LOADER AID: 0001
FLASH ID: "002C/00B3"
LOADER VERSION: "R4A024" 
MODEL (from GDFS): X10i
SOFTWARE VERSION: 1227-4612_3.0.1.G.0.75
CUSTOM VERSION: 1235-7836_R9B
FILESYSTEM VERSION: WORLD-1-4-8_2.1.B.0.1
SEMC SIMLOCK CERTIFICATE
 
D

Deleted member 3665957

Guest
So what does this mean?


Code:
SOFTWARE VERSION: 1227-4612_3.0.1.G.0.75
[B]SEMC SIMLOCK CERTIFICATE[/B]


you have officially unlocked ( or locked ;) ) phone with 2.3 firmware on board.
you should downgrade kernel ( somebody report that it is working ) and use qsd8250_semc.cmd

or you should flash 2.0, 2.1 firmware and run qsd8250_semc.cmd
 

Sharaz22

Senior Member
Mar 7, 2011
175
309
So what does this mean?


Code:
RUNNING S1_EROM VER "R8A013"
SOFTWARE AID: 0001
LOADER AID: 0001
FLASH ID: "002C/00B3"
LOADER VERSION: "R4A024" 
MODEL (from GDFS): X10i
SOFTWARE VERSION: 1227-4612_3.0.1.G.0.75
CUSTOM VERSION: 1235-7836_R9B
FILESYSTEM VERSION: WORLD-1-4-8_2.1.B.0.1
SEMC SIMLOCK CERTIFICATE
How did you manage to get this to work mine won't recognise the phone which kernel did you use and what firmware
 

ten_tickles

Senior Member
Nov 1, 2010
272
46
Leicester
I failed to understand this part.....and now my phone can no longer be used as a phone! :(


if your phone unlocked by 3rd-party software other than setool2, do not run anything -
it will disable radio capability of your phone and you will need to unlock phone by setool2 software.
hopefully, mizerable flea and mOxImKo will release something similar for your phone.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 159
    D
    Deleted member 3665957
    Greetings.

    warning.
    if you are not developer, please quit reading that post.
    wait for user friendly tool with one big button.


    here ( View attachment qsd8250.7z) is toolset to permanently "unlock" semcboot of qsd8250 semc phones ( x10a,x10i, so-o1b )

    that means, you can use own kernel and so on.

    it is much more better,stable,faster method, than present "bypass".

    steps,precautions, etc.

    unpack archive to any directory.

    if you using eset antivirus or similar ****, it will find evil virus in adb.exe.
    ignore that, it is not virus in any way, it is standard android debug bridge, bundled in one file to save space and usability.


    now, if your phone unlocked officially:

    flash phone with standard 2.0,2.1 android firmware,because kernel mapper module compiled for "2.6.29" kernel.

    of course, enable "usb debugging"

    run qsd8250_semc.cmd,
    ( if you want, examine it before run, it is pretty straightforward. )

    you will get similar output

    Code:
    process requires standard 2.x android firmware.
    Press any key to continue . . .
    Getting ROOT rights.
    1464 KB/s (585731 bytes in 0.390s)
    error: protocol fault (no status)
    Waiting ...
    Removing NAND MPU restrictions via SEMC backdoor. Permanent. Require ROOT rights.
    192 KB/s (3087 bytes in 0.015s)
    success
    Waiting ...
    Getting ROOT rights.
    Waiting ...
    Writing patched semcboot. Two step process
    First, we need get access to semcboot area
    504 KB/s (8064 bytes in 0.015s)
    Second, we need to write semcboot ;)
    1531 KB/s (588236 bytes in 0.375s)
    successfully wrote 0001ff80
    Press any key to continue . . .

    bingo, your phone now has unlocked bootloader.

    if your phone unlocked by setool2 software, use qsd8250_setool2.cmd

    if your phone unlocked by 3rd-party software other than setool2, do not run anything -
    it will disable radio capability of your phone and you will need to unlock phone by setool2 software.
    hopefully, mizerable flea and mOxImKo will release something similar for your phone.


    to find out what tool was used to unlock your phone, use that ( View attachment s1tool.7z ) tool.
    if you will see "NOT RECOGNIZED SIMLOCK CERTIFICATE", you are out of luck.


    okay, now about other details.

    1.
    unlocked bootloader require unlocked loader, yep ?

    loader\loader.sin is special unlocked loader, which will be accepted ONLY after your "unlock" semcboot with previous steps.

    to distinguish unlocked semcboot and original semcboot, first letter in version tag of semcboot output will be lower case, i. e. "r8A033"

    ( same applies for loader version tag )

    so, all that stuff with signatures are not for us, so i removed them - loader will ignore signature part of SIN file.

    2.
    we should make SIN file somehow, right ?
    for that i prepared "dumb" bin2sin utility.

    Syntax : bin2sin [input] [partition info, 32 digits] [type] [block size]

    [input] - is input binary file.

    [partition info]
    android implementation on s1 semc qualcomm phones based on partitions,so we MUST define it for our file.

    you can get required partition info from standard semc sin files, it is first 0x10 bytes of DATA, right after header, i.e.
    x10 kernel partition info
    03000000220000007502000062000000

    [type] - partition type, 9 - partition without spare, 0xA - partition with spare.
    kernel partition is partition without spare.
    if that parameter omitted, type = 9

    [block size] - nand block size, if omitted, it is standard size 0x20000

    there is example in sinTools\example_build.cmd

    3.
    kernel should be prepared specially to be accepted by semcboot.
    for that there is tool bin2elf.

    Syntax : bin2Elf.exe [nbrOfSegments] [EntryPoint] [Segment1] [LoadAddress1] [Attributes1] ...

    we need 2 segments:
    segment 1 is unpacked linux kernel image, i.e.
    ( x10/kernel/arch/arm/boot/Image )

    it looks like entrypoint and load address for segment 1 is always same for all qsd8250-based semc phone, it is 0x20008000

    attributes for image 0x0

    segment 2 is ramdisk.

    it looks like entrypoint and load address for segment 1 is always same for all qsd8250-based semc phone, it is 0x24000000

    set attributes for ramdisk 0x80000000, that is extremly important.

    there is simple kernel example in sinTools\example_build.cmd

    ps.

    patched semcboot is doing exactly same thing as official "bootloader unlock" ( for some idiotic reasons called "rooting" ) , it skips checking of aARM firmware part ONLY.

    it will NOT unlock your phone from network.

    after procedure, you CAN use Emma/seUS safely.
    14
    D
    Deleted member 3665957
    @the_laser

    1) wht do we do if we want to relock bootloader? i am asking just for having a fail-safe option open...

    "unlocked" bootloader does absolutely same things as original, nothing changed.
    no need to return back ;)

    2) can we modify the S1 loader to accept fastboot commands?

    it is like writing it from scratch.
    better build some kernel module for that.

    3) can we now write to /boot partition in OS/recovery? (raw_write)?

    sin signature checking removed totally, you can write anything in phone.
    however, there is few restrictions:

    1.
    partition info and sin type should be proper.
    you can check partition info in corresponding original semc firmware files.

    2.
    semcboot WILL check following and STOP phone in case of failure:

    - security zone validity
    - FOTA code validity
    - mARM ( AMSS or modem code ) validity
    - DSP code validity

    you can safely build and flash own

    kernel_S1-SW-LIVE-AC12-0001-S1-PARTITION.sin
    system_S1-SW-LIVE-AC12-0001-S1-PARTITION-WITH-SPARE.sin
    userdata_S1-SW-LIVE-AC12-0001-S1-PARTITION-WITH-SPARE.sin

    again, do not forget use proper SIN type.
    11
    yaay my 2.3.3 custom kernel booted :)

    no more SE text logo!!!


    @all
    KINDLY STOP CHATTING IN THIS THREAD

    THAT'S AWESOME NEWS!

    And the X10 gets yet another successful burst from the Dev defibrillator! It is alive and kicking once more!


    Here's been the timeline of the X10. It's quite spectacular actually.

    -Pre-release. Huge hype and frenzy and craziness
    -Release-Even more craziness and hype
    -Post-release-dissapointment at locked bootloader and FPS cap and lag
    -Most of 2010-dissapointment at lack of updates, 2.1 delay, lack of rooting
    -Late 2010-Huge hype about 2.1 and its release, phone rooted, dualtouch, phone alive again
    -Early 2011-Great new custom ROMs, phone is alive and kicking, bootloader bypass
    -March 2011-Gingerbread update news, Bootloader bypassed, 2.2 Camera
    -April-June 2011-Dissapointment over no update by SE
    -July-August 2011-Huge craze over upcoming 2.3 update and wild speculation begins
    -August 2011-Release of GB. Mixed reviews but mostly positive. New life breathed into X10. Great stuff ported from Arc.
    -September 2011-Bootloader UNLOCKED! Even more awesomeness coming up!


    Which phone has this kind of history, ever?!
    -
    7
    D
    Deleted member 3665957
    to solve confusions:

    to unlock bootloader you DO NOT need to have "network unlocked" phone.

    however, if your phone was unlocked from network by any other 3rd-party tool than setool2, your phone will lose radio capability due to mismatched security zone.

    to restore radio capability and have unlocked bootloader you will need "unlock from network" phone using setool2.

    but not worry, i'm sure, that omnibus software will soon "integrate" that method ;)
    6
    D
    Deleted member 3665957
    @doomlord:

    wht i wanted is the ability to flash boot.img via recovery (raw_write/flash_image)
    will that work?
    you can write whatever you want, but it is better stick to semc standards and use SIN files.

    also there seems to be restriction on size of kernel.sin... i tired a large ramdisk and flash was accpeted but ramdisk was unchanged

    maximum partition size is 0x62 blocks ( 0xC40000 bytes ) for x10i
    dunno about ramdisk/etc restrictions .