[BOUNTY] MSM with T-Mobile firmware for 5G McLaren (hotdogg)

[jhofseth]

Nice, nice. Yeah. that's to be expected. I think with that file I and dandroid would be able to restore our phones, assuming
that's stock firmware. Potentially others. Do you have a reliable means to share the file, if you're willing to? Per the link you
posted it contains no userdata so it should be safe to share.

I think it would it be something like:
fastboot -w
fastboot flash aop_b aop_b.img
fastboot flash bluetooth_b bluetooth_b.img
fastboot flash boot_b boot_b.img
fastboot flash dsp_b dsp_b.img
fastboot flash dtbo_b dtbo_b.img
fastboot flash LOGO_b LOGO_b.img
fastboot flash modem_b modem_b.img
fastboot flash oem_stanvbk oem_stanvbk.img
fastboot flash qupfw_b qupfw_b.img
fastboot flash storsec_b storsec_b.img
fastboot flash multiimgoem_b multiimgoem_b.img
fastboot flash uefisecapp_b uefisecapp_b.img
fastboot flash recovery_b recovery_b.img
fastboot --disable-verity flash vbmeta_b vbmeta_b.img
fastboot --disable-verity flash vbmeta_system_b vbmeta_system_b.img
fastboot reboot fastboot
fastboot --set-active=b
fastboot flash super super.img
fastboot reboot

 

[ntzrmtthihu777]

I think it would it be something like:
fastboot -w
fastboot flash aop_b aop_b.img
fastboot flash bluetooth_b bluetooth_b.img
fastboot flash boot_b boot_b.img
fastboot flash dsp_b dsp_b.img
fastboot flash dtbo_b dtbo_b.img
fastboot flash logo_b logo_b.img
fastboot flash modem_b modem_b.img
fastboot flash oem_stanvbk oem_stanvbk.img
fastboot flash qupfw_b qupfw_b.img
fastboot flash secdata_b secdata_b.img
fastboot flash multiimgoem_b multiimgoem_b.img
fastboot flash uefisecapp_b uefisecapp_b.img
fastboot flash recovery_b recovery_b.img
fastboot --disable-verity flash vbmeta_b vbmeta_b.img
fastboot --disable-verity flash vbmeta_system_b vbmeta_system_b.img
fastboot reboot fastboot
fastboot --set-active=b
fastboot flash super super.img
fastboot reboot

Exactly. Most of them wouldn't matter, and I wouldn't flash the entire super.img (there's a tool to break it into chunks but the
build for it more or less assumes a full setup to build an android rom which requires quite a bit of downloading and disk space;
no standalone build as far as I can tell yet) but the internal partitions in it. Granted a lot of super.img is blank space so it may
just work but I'd rather only flash over what was my lineageos side and keep my working if unupdatable 10.0.13 OxygenOS side
intact in case it doesn't work.

 

[jhofseth]

Exactly. Most of them wouldn't matter, and I wouldn't flash the entire super.img (there's a tool to break it into chunks but the
build for it more or less assumes a full setup to build an android rom which requires quite a bit of downloading and disk space;
no standalone build as far as I can tell yet) but the internal partitions in it. Granted a lot of super.img is blank space so it may
just work but I'd rather only flash over what was my lineageos side and keep my working if unupdatable 10.0.13 OxygenOS side
intact in case it doesn't work.

https://drive.google.com/open?id=15liTbTgvTZgIceQp_1XU3HnkXZJVgTOo
SHA1 of zip extracted super image: c0edacffa05e1066e02bf64e3dc988117cb8da31

Android security patch level
November 1, 2019

 

[LLStarks]

Do these contain any personal or device-specific markers?

 

[ntzrmtthihu777]

https://drive.google.com/open?id=15liTbTgvTZgIceQp_1XU3HnkXZJVgTOo
SHA1 of zip extracted super image: c0edacffa05e1066e02bf64e3dc988117cb8da31

Android security patch level
November 1, 2019

Excellent. Downloaded, unzipping, thanks for the hash. I'll let you know how it goes.

 

[jhofseth]

Do these contain any personal or device-specific markers?

TBH, I don't know for sure. All I know right now about super is here: https://source.android.com/devices/tech/ota/dynamic_partitions/implement

 

[ntzrmtthihu777]

https://drive.google.com/open?id=15liTbTgvTZgIceQp_1XU3HnkXZJVgTOo
SHA1 of zip extracted super image: c0edacffa05e1066e02bf64e3dc988117cb8da31

Android security patch level
November 1, 2019

Oh, and one thing else. Could you check for me one thing: `adb reboot fastboot` and `fastboot getvar current-side`.
This should return either 'a' or 'b'.

Do these contain any personal or device-specific markers?

Should not. The super partition is not supposed to contain any userdata and we all get the same
OTAs so they should be the same.

 

[LLStarks]

This super is likely only useful for when fastboot is functional and overall partition layout is in tact. If you brick to the point where EDL and MSM is the only option, you're SOL.

I'd certainly like to think that having a repository of partitions (probably starting with 10.0.16 as a baseline) should at least let us start messing around with the system partition.

If all else fails, this device should be a decent candidate for LineageOS.

 

[omariscal1019]

U guys should start a new thread with your findings. Its way better for exposure trust me!!

Maybe getting the system from a non 5g 7t pro or mclaren and swapping it maybe getting closer to global conversion but after msm is out to have a fall back

 

[NEMES|S]

U guys should start a new thread with your findings. Its way better for exposure trust me!!

Maybe getting the system from a non 5g 7t pro or mclaren and swapping it maybe getting closer to global conversion but after msm is out to have a fall back

@jhofseth @ntzrmtthihu777

And with exact stepts on how to pull & flash super.img (Clear steps, only the required steps 1 by 1)

Also, I can't find Ipunpack anywhere.

 

[thepotatoman1]

I contacted both TMobile and OnePlus over the phone 2 times to figure out if I received different responses and also got moved to tier two support. OnePlus says they only have the files for global. TMobile said they have nothing to do with software development and OnePlus develops their modified version for them. OnePlus says the only real way is if I sent it to them for repairs meaning somebody in the company has some sort of recovery tool, but support has not received it yet.

 

[omariscal1019]

https://github.com/AndroidDumps/Firmware_extractor/blob/master/tools/Linux/bin/lpunpack

They just added support for super.img

 

[ntzrmtthihu777]

This super is likely only useful for when fastboot is functional and overall partition layout is in tact. If you brick to the point where EDL and MSM is the only option, you're SOL.
I'd certainly like to think that having a repository of partitions (probably starting with 10.0.16 as a baseline) should at least let us start messing around with the system partition.

Very true, but the A/B update system should generally keep you safe if you're not doing anything freaky
or dangerous or experimental. Hell, my phone works, its just on some sort of prerelease firmware which
can't OTA update anymore. Hopefully flashing this should allow me to get that working again.

If all else fails, this device should be a decent candidate for LineageOS.

I'm actually looking into that myself; have a bootable image but no networking so next to useless.

U guys should start a new thread with your findings. Its way better for exposure trust me!!
Maybe getting the system from a non 5g 7t pro or mclaren and swapping it maybe getting closer to global conversion but after msm is out to have a fall back

@jhofseth @ntzrmtthihu777
And with exact stepts on how to pull & flash super.img (Clear steps, only the required steps 1 by 1)
Also, I can't find Ipunpack anywhere.

Intended, but its not quite to new thread status yet. If/when it is determined this is a working recovery
method I will definitely be doing the documentation.
No idea bout the 'global' conversion stuff. What would converting to global get you?
lpunpack is part of android's platform tools (same repo as adb and fastboot) but are generally not packaged for
distributions. Had to build it myself as part of the lineageos source tree.

 

[LLStarks]

U guys should start a new thread with your findings. Its way better for exposure trust me!!

Maybe getting the system from a non 5g 7t pro or mclaren and swapping it maybe getting closer to global conversion but after msm is out to have a fall back

We'd probably lose 5G with a non-5G, but I'm not sure. Maybe vendor.img plays a bigger role.

 

[omariscal1019]

We'd probably lose 5G with a non-5G, but I'm not sure. Maybe vendor.img plays a bigger role.

Its modem issue only and maybe a kernel issue but who know until someone digs in it

---------- Post added at 08:30 PM ---------- Previous post was at 08:29 PM ----------

Very true, but the A/B update system should generally keep you safe if you're not doing anything freaky
or dangerous or experimental. Hell, my phone works, its just on some sort of prerelease firmware which
can't OTA update anymore. Hopefully flashing this should allow me to get that working again.

I'm actually looking into that myself; have a bootable image but no networking so next to useless.



Intended, but its not quite to new thread status yet. If/when it is determined this is a working recovery
method I will definitely be doing the documentation.
No idea bout the 'global' conversion stuff. What would converting to global get you?
lpunpack is part of android's platform tools (same repo as adb and fastboot) but are generally not packaged for
distributions. Had to build it myself as part of the lineageos source tree.

Global just faster updates and remove tmo **** other that i dont see a anything else lol

 

[ntzrmtthihu777]

https://github.com/AndroidDumps/Firmware_extractor/blob/master/tools/Linux/bin/lpunpack

They just added support for super.img

This should work for most folks, however, sometimes binaries online will
break on distributions with a more aggressive update policy (app depends on libfoo.so.4 but the distro is
already on libfoo.so.5).

---------- Post added at 07:36 PM ---------- Previous post was at 07:34 PM ----------

Its modem issue only and maybe a kernel issue but who know until someone digs in it
Global just faster updates and remove tmo **** other that i dont see a anything else lol

Honestly I'm surprised at the lack of tmo bloat on the phone. Granted I don't care about faster
updates from the vendor; I'm more interested in getting onto lineageos asap so that's a non-issue for
me.

 

[omariscal1019]

This should work for most folks, however, sometimes binaries online will
break on distributions with a more aggressive update policy (app depends on libfoo.so.4 but the distro is
already on libfoo.so.5).

---------- Post added at 07:36 PM ---------- Previous post was at 07:34 PM ----------


Honestly I'm surprised at the lack of tmo bloat on the phone. Granted I don't care about faster
updates from the vendor; I'm more interested in getting onto lineageos asap so that's a non-issue for
me.

Thats true !!

 

[ntzrmtthihu777]

https://drive.google.com/open?id=15liTbTgvTZgIceQp_1XU3HnkXZJVgTOo
SHA1 of zip extracted super image: c0edacffa05e1066e02bf64e3dc988117cb8da31

Android security patch level
November 1, 2019

One other thing. I screwed up (was trying to uninstall magisk and it went south) and was hoping you could dump and
upload recovery_a.img. Never even got to try flashing because of that :<

---------- Post added at 08:44 PM ---------- Previous post was at 08:04 PM ----------

False alarm! I'm now back on 10.0.16! Not sure what did it; I was flailing pretty hard there after the
magisk uninstall fiasco.

 

[NEMES|S]

One other thing. I screwed up (was trying to uninstall magisk and it went south) and was hoping you could dump and
upload recovery_a.img. Never even got to try flashing because of that :<

---------- Post added at 08:44 PM ---------- Previous post was at 08:04 PM ----------

False alarm! I'm now back on 10.0.16! Not sure what did it; I was flailing pretty hard there after the
magisk uninstall fiasco.

I would like to create a hybrid super.img with Global 7T Pro img & 5G 7T Pro img. (maybe keeping modem/vendor/kernel from 5G) It should be possible.

I can't compile lpunpack. (Ubuntu 18.10) Still can't extract super.img for individual images... and what about repack? (in order to create hybrid super.img)

 

[LLStarks]

When in doubt, run or compile on Arch.