[GOAL] APX Mode on HOX

Search This thread

MrT69

Senior Member
May 9, 2006
1,748
4,422
54
Königsbrunn
www.keweon.de
Not sure but it seems I have found it:

1. Enter the bootloader
2. Unplug USB cable
3. Select FASTBOOT
4. Select POWER DOWN
5. Reconnect USB Cable

Now, it seems there are 4 additional options.
Vol+ > long press
Vol- > long press
Vol+ > short press (less than 1 sec)
Vol- > short press (less than 1 sec)

After all I have had additional USB devices within windows device manager:
sgjbxism.png

By default it was labled as USB Composite Device. I was searching and testing a lot of drivers within the web. The only one which is currently working seems to be this one:

http://www.androidroot.mobi/download/nvflash_binaries.zip
(Scroll down until you see the Windows/Linux drivers)

If you install the driver it is important that you choose the "NVIDIA USB Boot-recovery ..." driver. You will see the "not digitaly signed" Message which you need to confirm.
After all it is important to reboot your computer. I was playing around but it seems there is no other way to get this driver working.

Now, when I use the "nvflash.exe" and do some things with it I get now messages like this:

xauajutn.png


Not longer the "device unknown" error message. I don't know if it is the right Nvflash.exe or it also might be that my device needs to be fully charged or the driver is still the problem.
I can do "something" but no Echo or something else on the screen. On the secound hand I also have the problem that I don't know anything about the options of nvflash.

Who knows more about this 4 different modes?
 
Last edited:

ar4er

Member
Sep 6, 2009
34
35
Linux nvflash option

Code:
Nvflash v1.5.66719 started                                                                                 
--help command usage ->                                                                                    
displays all supported nvflash commands with usage and description                                         
                                                                                                           
--cmdhelp command usage ->                                                                                 
nvflash --cmdhelp <cmd>                                                                                    
-----------------------------------------------------------------------                                    
used to display usage and description about a particular command cmd                                       
-----------------------------------------------------------------------                                    
                                                                                                           
--resume command usage ->                                                                                  
nvflash --resume --read <part id> <filename> --bl <bootloader> --go                                        
-----------------------------------------------------------------------
must be first option in command line, used when device is looping
in 3pserver which is achieved when a command of nvflash is executed
either without sync or go or both, can be used with all nvflash commands
-----------------------------------------------------------------------

--create command usage ->
nvflash --bct <bct> --setbct --configfile <cfg> --create --odmdata <N> --bl <bootloader> --go
-----------------------------------------------------------------------
used to do full initialization of the target device using the config file
cfg start from creating all partitions, formatting them all, download
images to their respective partitions and syncing bct at end
-----------------------------------------------------------------------

--setboot command usage ->
nvflash --setboot N --bl <bootloader> --go
-----------------------------------------------------------------------
used to set partition N as bootable to already flashed device so that
next time on coldboot, device will boot from bootloader at partition N
must be used only for bootloader partitions
-----------------------------------------------------------------------

--format_partition command usage ->
nvflash --format_partition N --bl <bootloader> --go
-----------------------------------------------------------------------
used to format patition N in already flashed device making it empty
-----------------------------------------------------------------------

--verifypart command usage ->
nvflash --bct <bct> --setbct --configfile <cfg> --create --odmdata <N> --verifypart N --bl <bootloader> --go
-----------------------------------------------------------------------
used to verify contents of partition N in device, hash is calculated
and stored while downloading the data in partition and after all images
are downloaded, content is read back from partition N calculating hash
and matching it with stored hash, use N=-1 for verifying all partitions
must be used with --create command
-----------------------------------------------------------------------

--download command usage ->
1. nvflash --download N <filename> --bl <bootloader> --go (in nvprod mode)
2. nvflash --blob <blob> --setblhash <bct> --configfile <cfg> --download N <filename> --bl <bootloader> --go (in odm secure mode)
-----------------------------------------------------------------------
used to download filename in partition N into already flashed device
command 2 is used only for downloading the bootloader in secure mode,
it gets encrypted bct from sbktool containing hash of updated bootloader
to be downloaded. This bct is flashed to IRAM and update the system bct
with new hash of updated bootloader. In all other cases command 1 is used
Partition number N can be found from cfg file used for flash earlier
-----------------------------------------------------------------------

--read command usage ->
nvflash --read N <filename> --bl <bootloader> --go
-----------------------------------------------------------------------
used to read partition N from already flashed device into filename
Partition number N can be found from configuration file used while flash
-----------------------------------------------------------------------

--rawdevicewrite command usage ->
nvflash --rawdevicewrite S N <filename> --bl <bootloader> --go
-----------------------------------------------------------------------
used to write filename into N sectors of media starting from sector S to
already flashed device
-----------------------------------------------------------------------

--rawdeviceread command usage ->
nvflash --rawdeviceread S N <filename> --bl <bootloader> --go
-----------------------------------------------------------------------
used to read N sectors of media starting from sector S from already
flashed device into filename
-----------------------------------------------------------------------

--getpartitiontable command usage ->
nvflash --getpartitiontable <filename> --bl <bootloader> --go
-----------------------------------------------------------------------
used to read partition table in text from already flashed device into filename
-----------------------------------------------------------------------

--updatebct command usage ->
nvflash --bct <bct> --updatebct <bctsection> --bl <bootloader> --go
-----------------------------------------------------------------------
used to update some section of system bct(bctsection) from bct specified
this command is run in 3pserver. As of now, bctsection can be SDRAM which
updates SdramParams and NumSdramSets field of bct, DEVPARAM updates
DevParams, DevType and NumParamSets fields and BOOTDEVINFO updates
BlockSizeLog2, PageSizeLog2 and PartitionSize fields of system bct
-----------------------------------------------------------------------

--setblhash command usage ->
nvflash --blob <blob> --setblhash <bct> --configfile <cfg> --download N
<filename> --bl <bootloader> --go (in odm secure mode)
-----------------------------------------------------------------------
used to download bootloader in secure mode into already flashed device
it updates the hash value of updated bootloader to be downloaded, from
encrypted bct got from sbktool, into system bct in miniloader
-----------------------------------------------------------------------

--setbct command usage ->
as in full fledged nvflash command
-----------------------------------------------------------------------
used to download bct to IRAM, must be used with --sync command to update
it in mass storage.
-----------------------------------------------------------------------

--getbct command usage ->
nvflash --bct <filename> --getbct --bl <bootloader> --go
-----------------------------------------------------------------------
used to read back the BCT from already flashed device to user specified
filename, read in clear form whether device is secure or non-secure
-----------------------------------------------------------------------

--getbit command usage ->
nvflash --getbit <filename> --bl <bootloader> --go
-----------------------------------------------------------------------
used to read back the bit table to filename in binary form in miniloader
-----------------------------------------------------------------------

--dumpbit command usage ->
nvflash --dumpbit --bl <bootloader> --go
-----------------------------------------------------------------------
used to display the bit table read from device in text form on user
terminal. Also gives info about bct and various bootloaders present in
media, normally used for debugging cold boot failures
-----------------------------------------------------------------------

--odm command usage ->
nvflash --odm CMD data --bl <bootloader> --go
-----------------------------------------------------------------------
used to do some special diagnostics like sdram validation, fuelgauge etc
each CMD has data associated with it
-----------------------------------------------------------------------

--go command usage ->
as in full fledged nvflash command
-----------------------------------------------------------------------
used to boot bootloader after nvflash completes instead of looping in
3pserver in resume mode, however sync command is also required to get
out of resume mode, can be used with all nvflash commands
-----------------------------------------------------------------------

--obliterate command usage ->
nvflash --configfile <cfg> --obliterate --bl <bootloader> --go
-----------------------------------------------------------------------
used to erase all partitions and bad blocks in already flashed device
using partition info from configuration file cfg used in nvflash earlier
-----------------------------------------------------------------------

--configfile command usage ->
as in full fledged nvflash command
-----------------------------------------------------------------------
used to specify configuration file containing info about various partitions
to be made into device, their sizes, name and other attributes
-----------------------------------------------------------------------

--bct command usage ->
as in full fledged nvflash command
-----------------------------------------------------------------------
used to specify bct file containing device specific parametrs like
SDRAM configs, boot device configs etc. This is again modified by device
to include info about bootloader, partition table etc
-----------------------------------------------------------------------

--blob command usage ->
nvflash --blob <blob> --bct <bct> --setbct --configfile <cfg> --create --odmdata <N> --bl <bootloader> --go
-----------------------------------------------------------------------
used for nvflash in odm secure devices, can be used with any nvflash commands
blob contains encrypted and signed RCM messages for communication b/w nvflash
and bootrom at start, encrypted hash of encrypted bootloader(used with --bl
option) for it's validation by miniloader and nvsbktool version info
-----------------------------------------------------------------------

--bl command usage ->
as in full fledged nvflash command
-----------------------------------------------------------------------
used to specify bootloader which will run 3pserver on device side after
it is downloaded by miniloader in SDRAM, normally used with all commands
-----------------------------------------------------------------------

--odmdata command usage ->
as in full fledged nvflash command
-----------------------------------------------------------------------
specifies a 32 bit integer used to select particular instance of UART
determine SDRAM size to be used etc. Also used for some platform specific
operations, it is stored in bct by miniloader
-----------------------------------------------------------------------

--deviceid command usage ->
nvflash --bct <bct> --setbct --configfile <cfg> --create --odmdata <N> --deviceid <devid> --transport <transport_mode> --bl <bootloader> --go
-----------------------------------------------------------------------
used to set the device id of target in fpga emulation or simulation mode
depending on chip, can be hex or dec, only used with --transport option
-----------------------------------------------------------------------

--transport command usage ->
nvflash --bct <bct> --setbct --configfile <cfg> --create --odmdata <N> --deviceid <devid> --transport <transport_mode> --bl <bootloader> --go
-----------------------------------------------------------------------
used to specify the means of communication between host and target
USB, JTAG and Simulation are three modes supported as of now. JTAG is
for fpga emulation, Simulation is for nvflash in simulation mode and
default is USB, used in normal cases while interaction with device
-----------------------------------------------------------------------

--devparams command usage ->
nvflash --bct <bct> --setbct --configfile <cfg> --create --odmdata <N> --deviceid <devid> --transport <transport_mode> --devparams <pagesize> <blocksize> <totalblocks>  --bl <bootloader> --go
-----------------------------------------------------------------------
used to pass logical pagesize, erase block unit size and total number of
blocks for nvflash in simulation mode. As of this write, pagesize = 4K
blocksize = 2M and totalblocks = media_size/blocksize. These values can be
obtained using NvDdkBlockDevGetDeviceInfo api, a wrapper of SdGetDeviceInfo
api in block driver, used only for nvflash in simulation mode
-----------------------------------------------------------------------

--setbootdevtype command usage ->
nvflash --setbootdevtype S --bl <bootloader> --go
-----------------------------------------------------------------------
used to set boot device type fuse to S which tells boot media to boot from
used only in miniloader since cold boot uses bootrom and all settings get
reset at that time. Unlike miniloader, BL/kernel uses pinmuxes not fuses
S can be emmc, nand_x8, spi etc
-----------------------------------------------------------------------

--setbootdevconfig command usage ->
nvflash --setbootdevconfig N --bl <bootloader> --go
-----------------------------------------------------------------------
used to set boot device config fuse to N which tells slot of boot device
to boot from, used only in miniloader since cold boot uses bootrom and
all settings get reset at that time. BL/kernel uses pinmuxes not fuses
N is 33 for sdmmc4 pop slot and 17 for sdmmc4 planar slot of whistler
-----------------------------------------------------------------------

--diskimgopt command usage ->
nvflash --bct <bct> --setbct --configfile <cfg> --create --diskimgopt <N> --odmdata <N> --bl <bootloader> --go
-----------------------------------------------------------------------
used to convert .dio or a .store.bin file to the new format (dio2) by
inserting the required compaction blocks of size N, can be used with
any nvflash commands which downloads an image to device
-----------------------------------------------------------------------

--quiet command usage ->
nvflash --quiet --bct <bct> --setbct --configfile <cfg> --create --odmdata <N> --bl <bootloader> --go
-----------------------------------------------------------------------
used to suppress the exccessive console output like status info while send
or recieve data b/w host and device, can be used with all nvflash commands
-----------------------------------------------------------------------

--wait command usage ->
nvflash --wait --bct <bct> --setbct --configfile <cfg> --create --odmdata <N>  --bl <bootloader> --go
-----------------------------------------------------------------------
used to wait for USB cable connection before start executing any command
can be used with any commands of nvflash
-----------------------------------------------------------------------

--format_all command usage ->
nvflash --delete_all/--format_all --bl <bootloader> --go 
-----------------------------------------------------------------------
used to format/delete all existing partitions on already flashed device
-----------------------------------------------------------------------
 
  • Like
Reactions: MrT69 and nitrous²

Lloir

Inactive Recognized Developer
Mar 23, 2009
6,236
8,029
Samsung Galaxy Note 8 (2017 Phone)
Sorry i moved this from Dev discussion as this is NOT development related. if you think this is in error, please feel free to take this to this section mods. or feel free to PM me and i will explain further

thanks

Lloir
 

lenthele

Senior Member
Nov 24, 2010
311
37
Not sure but it seems I have found it:

1. Enter the bootloader
2. Unplug USB cable
3. Select FASTBOOT
4. Select POWER DOWN
5. Reconnect USB Cable

Now, it seems there are 4 additional options.
Vol+ > long press
Vol- > long press
Vol+ > short press (less than 1 sec)
Vol- > short press (less than 1 sec)

After all I have had additional USB devices within windows device manager:
sgjbxism.png

By default it was labled as USB Composite Device. I was searching and testing a lot of drivers within the web. The only one which is currently working seems to be this one:

http://www.androidroot.mobi/download/nvflash_binaries.zip
(Scroll down until you see the Windows/Linux drivers)

If you install the driver it is important that you choose the "NVIDIA USB Boot-recovery ..." driver. You will see the "not digitaly signed" Message which you need to confirm.
After all it is important to reboot your computer. I was playing around but it seems there is no other way to get this driver working.

Now, when I use the "nvflash.exe" and do some things with it I get now messages like this:

xauajutn.png


Not longer the "device unknown" error message. I don't know if it is the right Nvflash.exe or it also might be that my device needs to be fully charged or the driver is still the problem.
I can do "something" but no Echo or something else on the screen. On the secound hand I also have the problem that I don't know anything about the options of nvflash.

Who knows more about this 4 different modes?

Does your Phone stay in apx Mode? I don't wanna try your method if my phone gets stuck in apx mode :p


Gesendet von meinem iPad mit Tapatalk HD
 

MrT69

Senior Member
May 9, 2006
1,748
4,422
54
Königsbrunn
www.keweon.de
Currently I'm using the HD Revolution image with "default" boot.img

1. When I do POWER OFF via the Bootloader and plug in the USB CABLE I have full SU access when I just open ADB SHELL. The EBT partition is still not vissible.

Question: Is this also possible when the HOX is used with a original ROM?

2. Fastboot OEM lock
When you do this on a HOX device with a custom image it will not longer boot. When you unlock it again and do nothing the device will boot again and the only thing is that the DATA partition is lost.

Q: Does anybody knows what this unlock file is exactly doing? Is there a change of the Partition layout?


Sent from my HTC OneX using xda app-developers app
 
Last edited:

nitrous²

Senior Member
Jun 4, 2010
1,741
1,005
The Grid
Currently I'm using the HD Revolution image with "default" boot.img

1. When I do POWER OFF via the Bootloader and plug in the USB CABLE I have full SU access when I just open ADB SHELL. The EBT partition is still not vissible.

Question: Is this also possible when the HOX is used with a original ROM?

2. Fastboot OEM lock
When you do this on a HOX device with a custom image it will not longer boot. When you unlock it again and do nothing the device will boot again and the only thing is that the DATA partition is lost.

Q: Does anybody knows what this unlock file is exactly doing? Is there a change of the Partition layout?


Sent from my HTC OneX using xda app-developers app

Your first point is already known. EBT partition is not visible because it's not loaded when the device is off. It's also possible when you use the official Rom.

No idea to your second point. Sorry :(

Sent from my HTC One X using xda premium
 

Vcek

Senior Member
Aug 27, 2011
1,163
337
Simril
are you sure this is apx mode, and not just low power recovery mode?

Sent from my HTC One X using xda app-developers app
 

BABAK236

Senior Member
Jan 27, 2011
83
34
Hi
i have a little experiences
Im not sure but all phone based Tegra2-3 have a APX Mode For Repair Bricking Phone By Wrong Firmware or Repair phone after replace eMMC
---
i have 2pcs One_X and Samsung P7500 and P7300
all Phone have a problem with eMMC Chip(fault by Unknown Reason)
So,i did replace eMMC for P7500 and P7300....Also i have repair file for rewrite "bootloader" With USB cable in "APX" Mode
But Both Phone Stuck hang on "Odin-Mode"...So,I think needed "SBK"(Secure Boot Key)
--
But for 2pcs One_X.....Both Phone stuck in APX and Can't turn on...i did replace eMMC and both phone start in "H.boot"...i did reflash phone and phone back to life again
------
So,This is Point: i did used blank chip for samsung ...So i needed repair tools for rewrite bootloader in APX mode
But for One_X,i did used chip from another pcb.(working chip,not empty or blank) so no need Repair tools(maybe if i used blank chip,i need apx repait tools
 

XxKU134xX

Senior Member
Jul 10, 2012
62
3
Hi
i have a little experiences
Im not sure but all phone based Tegra2-3 have a APX Mode For Repair Bricking Phone By Wrong Firmware or Repair phone after replace eMMC
---
i have 2pcs One_X and Samsung P7500 and P7300
all Phone have a problem with eMMC Chip(fault by Unknown Reason)
So,i did replace eMMC for P7500 and P7300....Also i have repair file for rewrite "bootloader" With USB cable in "APX" Mode
But Both Phone Stuck hang on "Odin-Mode"...So,I think needed "SBK"(Secure Boot Key)
--
But for 2pcs One_X.....Both Phone stuck in APX and Can't turn on...i did replace eMMC and both phone start in "H.boot"...i did reflash phone and phone back to life again
------
So,This is Point: i did used blank chip for samsung ...So i needed repair tools for rewrite bootloader in APX mode
But for One_X,i did used chip from another pcb.(working chip,not empty or blank) so no need Repair tools(maybe if i used blank chip,i need apx repait tools

(Slow clap) :)

Sent from my HTC One X using xda premium
 

sieempi

Senior Member
Jul 30, 2010
295
401
Doesnt work for me... my phone always enters the "low-power" Recovery Mode. :(

Same here. I tried erasing recovery partition to stop that process and maybe get something, but the phone wouldn't even stay off, it immediately rebooted.
I knew it was too nice to be true.. :)
Can you please tell us more about s-on/off status, hboot version, recovery, radio?
 

vim1

Senior Member
May 7, 2006
67
38
40
Hi
i have a little experiences
Im not sure but all phone based Tegra2-3 have a APX Mode For Repair Bricking Phone By Wrong Firmware or Repair phone after replace eMMC
---
i have 2pcs One_X and Samsung P7500 and P7300
all Phone have a problem with eMMC Chip(fault by Unknown Reason)
So,i did replace eMMC for P7500 and P7300....Also i have repair file for rewrite "bootloader" With USB cable in "APX" Mode
But Both Phone Stuck hang on "Odin-Mode"...So,I think needed "SBK"(Secure Boot Key)
--
But for 2pcs One_X.....Both Phone stuck in APX and Can't turn on...i did replace eMMC and both phone start in "H.boot"...i did reflash phone and phone back to life again
------
So,This is Point: i did used blank chip for samsung ...So i needed repair tools for rewrite bootloader in APX mode
But for One_X,i did used chip from another pcb.(working chip,not empty or blank) so no need Repair tools(maybe if i used blank chip,i need apx repait tools

I am got half working HOX after rewriting eMMC , do you have any dumps from your device ?
 

Rublis777

New member
Feb 17, 2014
1
0
emmc

Hi
i have a little experiences
Im not sure but all phone based Tegra2-3 have a APX Mode For Repair Bricking Phone By Wrong Firmware or Repair phone after replace eMMC
---
i have 2pcs One_X and Samsung P7500 and P7300
all Phone have a problem with eMMC Chip(fault by Unknown Reason)
So,i did replace eMMC for P7500 and P7300....Also i have repair file for rewrite "bootloader" With USB cable in "APX" Mode
But Both Phone Stuck hang on "Odin-Mode"...So,I think needed "SBK"(Secure Boot Key)
--
But for 2pcs One_X.....Both Phone stuck in APX and Can't turn on...i did replace eMMC and both phone start in "H.boot"...i did reflash phone and phone back to life again
------
So,This is Point: i did used blank chip for samsung ...So i needed repair tools for rewrite bootloader in APX mode
But for One_X,i did used chip from another pcb.(working chip,not empty or blank) so no need Repair tools(maybe if i used blank chip,i need apx repait tools

For htc one X You use preloaded eMMC? If so than can You describe little how can I flash hboot in them? I got 3 htc one x (stucked in APX) and I believe that eMMC chips are faulty. I founded replace chips in alibaba, but before buying I want know little more.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 15
    Not sure but it seems I have found it:

    1. Enter the bootloader
    2. Unplug USB cable
    3. Select FASTBOOT
    4. Select POWER DOWN
    5. Reconnect USB Cable

    Now, it seems there are 4 additional options.
    Vol+ > long press
    Vol- > long press
    Vol+ > short press (less than 1 sec)
    Vol- > short press (less than 1 sec)

    After all I have had additional USB devices within windows device manager:
    sgjbxism.png

    By default it was labled as USB Composite Device. I was searching and testing a lot of drivers within the web. The only one which is currently working seems to be this one:

    http://www.androidroot.mobi/download/nvflash_binaries.zip
    (Scroll down until you see the Windows/Linux drivers)

    If you install the driver it is important that you choose the "NVIDIA USB Boot-recovery ..." driver. You will see the "not digitaly signed" Message which you need to confirm.
    After all it is important to reboot your computer. I was playing around but it seems there is no other way to get this driver working.

    Now, when I use the "nvflash.exe" and do some things with it I get now messages like this:

    xauajutn.png


    Not longer the "device unknown" error message. I don't know if it is the right Nvflash.exe or it also might be that my device needs to be fully charged or the driver is still the problem.
    I can do "something" but no Echo or something else on the screen. On the secound hand I also have the problem that I don't know anything about the options of nvflash.

    Who knows more about this 4 different modes?
    2
    Linux nvflash option

    Code:
    Nvflash v1.5.66719 started                                                                                 
    --help command usage ->                                                                                    
    displays all supported nvflash commands with usage and description                                         
                                                                                                               
    --cmdhelp command usage ->                                                                                 
    nvflash --cmdhelp <cmd>                                                                                    
    -----------------------------------------------------------------------                                    
    used to display usage and description about a particular command cmd                                       
    -----------------------------------------------------------------------                                    
                                                                                                               
    --resume command usage ->                                                                                  
    nvflash --resume --read <part id> <filename> --bl <bootloader> --go                                        
    -----------------------------------------------------------------------
    must be first option in command line, used when device is looping
    in 3pserver which is achieved when a command of nvflash is executed
    either without sync or go or both, can be used with all nvflash commands
    -----------------------------------------------------------------------
    
    --create command usage ->
    nvflash --bct <bct> --setbct --configfile <cfg> --create --odmdata <N> --bl <bootloader> --go
    -----------------------------------------------------------------------
    used to do full initialization of the target device using the config file
    cfg start from creating all partitions, formatting them all, download
    images to their respective partitions and syncing bct at end
    -----------------------------------------------------------------------
    
    --setboot command usage ->
    nvflash --setboot N --bl <bootloader> --go
    -----------------------------------------------------------------------
    used to set partition N as bootable to already flashed device so that
    next time on coldboot, device will boot from bootloader at partition N
    must be used only for bootloader partitions
    -----------------------------------------------------------------------
    
    --format_partition command usage ->
    nvflash --format_partition N --bl <bootloader> --go
    -----------------------------------------------------------------------
    used to format patition N in already flashed device making it empty
    -----------------------------------------------------------------------
    
    --verifypart command usage ->
    nvflash --bct <bct> --setbct --configfile <cfg> --create --odmdata <N> --verifypart N --bl <bootloader> --go
    -----------------------------------------------------------------------
    used to verify contents of partition N in device, hash is calculated
    and stored while downloading the data in partition and after all images
    are downloaded, content is read back from partition N calculating hash
    and matching it with stored hash, use N=-1 for verifying all partitions
    must be used with --create command
    -----------------------------------------------------------------------
    
    --download command usage ->
    1. nvflash --download N <filename> --bl <bootloader> --go (in nvprod mode)
    2. nvflash --blob <blob> --setblhash <bct> --configfile <cfg> --download N <filename> --bl <bootloader> --go (in odm secure mode)
    -----------------------------------------------------------------------
    used to download filename in partition N into already flashed device
    command 2 is used only for downloading the bootloader in secure mode,
    it gets encrypted bct from sbktool containing hash of updated bootloader
    to be downloaded. This bct is flashed to IRAM and update the system bct
    with new hash of updated bootloader. In all other cases command 1 is used
    Partition number N can be found from cfg file used for flash earlier
    -----------------------------------------------------------------------
    
    --read command usage ->
    nvflash --read N <filename> --bl <bootloader> --go
    -----------------------------------------------------------------------
    used to read partition N from already flashed device into filename
    Partition number N can be found from configuration file used while flash
    -----------------------------------------------------------------------
    
    --rawdevicewrite command usage ->
    nvflash --rawdevicewrite S N <filename> --bl <bootloader> --go
    -----------------------------------------------------------------------
    used to write filename into N sectors of media starting from sector S to
    already flashed device
    -----------------------------------------------------------------------
    
    --rawdeviceread command usage ->
    nvflash --rawdeviceread S N <filename> --bl <bootloader> --go
    -----------------------------------------------------------------------
    used to read N sectors of media starting from sector S from already
    flashed device into filename
    -----------------------------------------------------------------------
    
    --getpartitiontable command usage ->
    nvflash --getpartitiontable <filename> --bl <bootloader> --go
    -----------------------------------------------------------------------
    used to read partition table in text from already flashed device into filename
    -----------------------------------------------------------------------
    
    --updatebct command usage ->
    nvflash --bct <bct> --updatebct <bctsection> --bl <bootloader> --go
    -----------------------------------------------------------------------
    used to update some section of system bct(bctsection) from bct specified
    this command is run in 3pserver. As of now, bctsection can be SDRAM which
    updates SdramParams and NumSdramSets field of bct, DEVPARAM updates
    DevParams, DevType and NumParamSets fields and BOOTDEVINFO updates
    BlockSizeLog2, PageSizeLog2 and PartitionSize fields of system bct
    -----------------------------------------------------------------------
    
    --setblhash command usage ->
    nvflash --blob <blob> --setblhash <bct> --configfile <cfg> --download N
    <filename> --bl <bootloader> --go (in odm secure mode)
    -----------------------------------------------------------------------
    used to download bootloader in secure mode into already flashed device
    it updates the hash value of updated bootloader to be downloaded, from
    encrypted bct got from sbktool, into system bct in miniloader
    -----------------------------------------------------------------------
    
    --setbct command usage ->
    as in full fledged nvflash command
    -----------------------------------------------------------------------
    used to download bct to IRAM, must be used with --sync command to update
    it in mass storage.
    -----------------------------------------------------------------------
    
    --getbct command usage ->
    nvflash --bct <filename> --getbct --bl <bootloader> --go
    -----------------------------------------------------------------------
    used to read back the BCT from already flashed device to user specified
    filename, read in clear form whether device is secure or non-secure
    -----------------------------------------------------------------------
    
    --getbit command usage ->
    nvflash --getbit <filename> --bl <bootloader> --go
    -----------------------------------------------------------------------
    used to read back the bit table to filename in binary form in miniloader
    -----------------------------------------------------------------------
    
    --dumpbit command usage ->
    nvflash --dumpbit --bl <bootloader> --go
    -----------------------------------------------------------------------
    used to display the bit table read from device in text form on user
    terminal. Also gives info about bct and various bootloaders present in
    media, normally used for debugging cold boot failures
    -----------------------------------------------------------------------
    
    --odm command usage ->
    nvflash --odm CMD data --bl <bootloader> --go
    -----------------------------------------------------------------------
    used to do some special diagnostics like sdram validation, fuelgauge etc
    each CMD has data associated with it
    -----------------------------------------------------------------------
    
    --go command usage ->
    as in full fledged nvflash command
    -----------------------------------------------------------------------
    used to boot bootloader after nvflash completes instead of looping in
    3pserver in resume mode, however sync command is also required to get
    out of resume mode, can be used with all nvflash commands
    -----------------------------------------------------------------------
    
    --obliterate command usage ->
    nvflash --configfile <cfg> --obliterate --bl <bootloader> --go
    -----------------------------------------------------------------------
    used to erase all partitions and bad blocks in already flashed device
    using partition info from configuration file cfg used in nvflash earlier
    -----------------------------------------------------------------------
    
    --configfile command usage ->
    as in full fledged nvflash command
    -----------------------------------------------------------------------
    used to specify configuration file containing info about various partitions
    to be made into device, their sizes, name and other attributes
    -----------------------------------------------------------------------
    
    --bct command usage ->
    as in full fledged nvflash command
    -----------------------------------------------------------------------
    used to specify bct file containing device specific parametrs like
    SDRAM configs, boot device configs etc. This is again modified by device
    to include info about bootloader, partition table etc
    -----------------------------------------------------------------------
    
    --blob command usage ->
    nvflash --blob <blob> --bct <bct> --setbct --configfile <cfg> --create --odmdata <N> --bl <bootloader> --go
    -----------------------------------------------------------------------
    used for nvflash in odm secure devices, can be used with any nvflash commands
    blob contains encrypted and signed RCM messages for communication b/w nvflash
    and bootrom at start, encrypted hash of encrypted bootloader(used with --bl
    option) for it's validation by miniloader and nvsbktool version info
    -----------------------------------------------------------------------
    
    --bl command usage ->
    as in full fledged nvflash command
    -----------------------------------------------------------------------
    used to specify bootloader which will run 3pserver on device side after
    it is downloaded by miniloader in SDRAM, normally used with all commands
    -----------------------------------------------------------------------
    
    --odmdata command usage ->
    as in full fledged nvflash command
    -----------------------------------------------------------------------
    specifies a 32 bit integer used to select particular instance of UART
    determine SDRAM size to be used etc. Also used for some platform specific
    operations, it is stored in bct by miniloader
    -----------------------------------------------------------------------
    
    --deviceid command usage ->
    nvflash --bct <bct> --setbct --configfile <cfg> --create --odmdata <N> --deviceid <devid> --transport <transport_mode> --bl <bootloader> --go
    -----------------------------------------------------------------------
    used to set the device id of target in fpga emulation or simulation mode
    depending on chip, can be hex or dec, only used with --transport option
    -----------------------------------------------------------------------
    
    --transport command usage ->
    nvflash --bct <bct> --setbct --configfile <cfg> --create --odmdata <N> --deviceid <devid> --transport <transport_mode> --bl <bootloader> --go
    -----------------------------------------------------------------------
    used to specify the means of communication between host and target
    USB, JTAG and Simulation are three modes supported as of now. JTAG is
    for fpga emulation, Simulation is for nvflash in simulation mode and
    default is USB, used in normal cases while interaction with device
    -----------------------------------------------------------------------
    
    --devparams command usage ->
    nvflash --bct <bct> --setbct --configfile <cfg> --create --odmdata <N> --deviceid <devid> --transport <transport_mode> --devparams <pagesize> <blocksize> <totalblocks>  --bl <bootloader> --go
    -----------------------------------------------------------------------
    used to pass logical pagesize, erase block unit size and total number of
    blocks for nvflash in simulation mode. As of this write, pagesize = 4K
    blocksize = 2M and totalblocks = media_size/blocksize. These values can be
    obtained using NvDdkBlockDevGetDeviceInfo api, a wrapper of SdGetDeviceInfo
    api in block driver, used only for nvflash in simulation mode
    -----------------------------------------------------------------------
    
    --setbootdevtype command usage ->
    nvflash --setbootdevtype S --bl <bootloader> --go
    -----------------------------------------------------------------------
    used to set boot device type fuse to S which tells boot media to boot from
    used only in miniloader since cold boot uses bootrom and all settings get
    reset at that time. Unlike miniloader, BL/kernel uses pinmuxes not fuses
    S can be emmc, nand_x8, spi etc
    -----------------------------------------------------------------------
    
    --setbootdevconfig command usage ->
    nvflash --setbootdevconfig N --bl <bootloader> --go
    -----------------------------------------------------------------------
    used to set boot device config fuse to N which tells slot of boot device
    to boot from, used only in miniloader since cold boot uses bootrom and
    all settings get reset at that time. BL/kernel uses pinmuxes not fuses
    N is 33 for sdmmc4 pop slot and 17 for sdmmc4 planar slot of whistler
    -----------------------------------------------------------------------
    
    --diskimgopt command usage ->
    nvflash --bct <bct> --setbct --configfile <cfg> --create --diskimgopt <N> --odmdata <N> --bl <bootloader> --go
    -----------------------------------------------------------------------
    used to convert .dio or a .store.bin file to the new format (dio2) by
    inserting the required compaction blocks of size N, can be used with
    any nvflash commands which downloads an image to device
    -----------------------------------------------------------------------
    
    --quiet command usage ->
    nvflash --quiet --bct <bct> --setbct --configfile <cfg> --create --odmdata <N> --bl <bootloader> --go
    -----------------------------------------------------------------------
    used to suppress the exccessive console output like status info while send
    or recieve data b/w host and device, can be used with all nvflash commands
    -----------------------------------------------------------------------
    
    --wait command usage ->
    nvflash --wait --bct <bct> --setbct --configfile <cfg> --create --odmdata <N>  --bl <bootloader> --go
    -----------------------------------------------------------------------
    used to wait for USB cable connection before start executing any command
    can be used with any commands of nvflash
    -----------------------------------------------------------------------
    
    --format_all command usage ->
    nvflash --delete_all/--format_all --bl <bootloader> --go 
    -----------------------------------------------------------------------
    used to format/delete all existing partitions on already flashed device
    -----------------------------------------------------------------------
    1
    Does your Phone stay in apx Mode? I don't wanna try your method if my phone gets stuck in apx mode :p


    Gesendet von meinem iPad mit Tapatalk HD

    Just keep the power button pressed for aprox. 5 or 7 sec and the phone will reboot. I have done this so often the last days ;)

    Sent from my HTC OneX using xda app-developers app
    1
    I remember one time going over some system files on my HOX and i came across a file with the name SBK. I know that cant be the Secure Boot Key file and thus i just left it as is. Has anyone looked over that file in the past?

    To completely unlock the phone to s-off and editing those files / flashing unsigned things we need a java card etc and those things are really REALLY expensive...around 1000€ and can be just used a few times

    Gesendet von meinem HTC One X mit Tapatalk