[BOUNTY] MSM with T-Mobile firmware for 5G McLaren (hotdogg)

Search This thread

DanDroidOS

Senior Member
Jul 26, 2009
451
103
Southern California
dandroidos.com
Has anyone been able to get that super.img extracted?:confused:

I get this error every time!
[email protected]:~/Firmware_extractor$ ./extractor.sh firmware.zip
Create Temp and out dir
Extracting firmware on: /home/eosdev/Firmware_extractor/out
./extractor.sh: line 168: gawk: command not found
./extractor.sh: line 207: gawk: command not found
 

ntzrmtthihu777

Senior Member
May 17, 2015
126
74
When in doubt, run or compile on Arch.
As much as I love(d) arch (currently a gentooist) thats the exact type of distro
that binaries floating around the web are not going to work for forever. You
can build your own lpunpack, which will definitely work on your system, but
I don't know how to do that outside of using the lineageos/etc build tree
yet, however.
 

NEMES|S

Member
May 12, 2017
40
14
In my case, I just want a clean hybrid img in order to activate the dual sim function. That's all I want, the TMO firmware is perfectly fine... (and replace boot/shutdown animations with original McLaren bootanimations) This super.img pull procedure and the ability to push/restore it back is a huge step forward for our McLaren 5G. At least there is a bit of light the end of the tunnel. (even without the damn MSM Tool)

@ntzrmtthihu777 Can you post the super.img extracted... at least that way we can flash images individually. (and test replacing/swapping images)

Also... you do have a 7T Pro too? lol... You have the full kit required... lol (we also need the 7T Pro images... lol)
 
Last edited:
  • Like
Reactions: Yuhfhrh

ntzrmtthihu777

Senior Member
May 17, 2015
126
74
Has anyone been able to get that super.img extracted?:confused:

I get this error every time!
[email protected]:~/Firmware_extractor$ ./extractor.sh firmware.zip
Create Temp and out dir
Extracting firmware on: /home/eosdev/Firmware_extractor/out
./extractor.sh: line 168: gawk: command not found
./extractor.sh: line 207: gawk: command not found

well, gawk (gnu awk) is not found in your path. And where did you get firmware.zip from?
 

ntzrmtthihu777

Senior Member
May 17, 2015
126
74
Just renamed the super.zip to firmware.zip. Installed gawk and still nothing, no error but empty output folder:(
Yeah. super.zip is not anything from the mfgs. Its the super partition, compressed with plain' ol' zip after the guy dumped it. Extract it, then run
lpunpack (its in the repo you cloned/downloaded, probably) super.img out-dir. it will crap out 8 images. the *_b.img images come out empty. the *_a.img
files have the following sha1sum's:
Code:
255e61557828a0781a7a781fc9f4e5d5a6b22d00  odm_a.img
9f2ee6cb21f8fd63a7c9008bc4bb8ee68a9ed0df  product_a.img
6ca738a6ed64c755ab24d7fc318466063d5fa3ac  system_a.img
cbbdf61bb14afc0f54a042180f7cc94fe7aabbf5  vendor_a.img
 
  • Like
Reactions: LLStarks

jhofseth

Senior Member
Feb 27, 2016
474
282
Seattle, Washington
Perhaps the a/b thing loses context outside of a live device, and lpunpack just names them whatever.

Maybe, but cat /proc/mounts indicates /dev/block/dm-8 is mounted as / and I am running slot b right now with November 1, 2019 security update. The SHA1 of the system_a image in super does not match /dev/block/dm-8. I think that super image is how the phone came before the first OTA update to November 1, 2019 security update.
 

ntzrmtthihu777

Senior Member
May 17, 2015
126
74
Maybe, but cat /proc/mounts indicates /dev/block/dm-8 is mounted as / and I am running slot b right now with November 1, 2019 security update. The SHA1 of the system_a image in super does not match /dev/block/dm-8. I think that super image is how the phone came before the first OTA update to November 1, 2019 security update.
Nope. After using the super.img to restore my phone I was immediately back on the Nov 1, 2019
update. Perhaps system_a has some trailing 'padding' data but after being setup with devmapper
(what creates /dev/block/dm-* devices, at least on desktop android) it does not?
 
  • Like
Reactions: jhofseth

TEKHD

Inactive Recognized Developer / XDA Portal Scout
I would like to create a hybrid super.img with Global 7T Pro img & 5G 7T Pro img. (maybe keeping modem/vendor/kernel from 5G) It should be possible.

I can't compile lpunpack. (Ubuntu 18.10) Still can't extract super.img for individual images... and what about repack? (in order to create hybrid super.img)

Has anyone been able to get that super.img extracted?:confused:

I get this error every time!
[email protected]:~/Firmware_extractor$ ./extractor.sh firmware.zip
Create Temp and out dir
Extracting firmware on: /home/eosdev/Firmware_extractor/out
./extractor.sh: line 168: gawk: command not found
./extractor.sh: line 207: gawk: command not found

As much as I love(d) arch (currently a gentooist) thats the exact type of distro
that binaries floating around the web are not going to work for forever. You
can build your own lpunpack, which will definitely work on your system, but
I don't know how to do that outside of using the lineageos/etc build tree
yet, however.

In my case, I just want a clean hybrid img in order to activate the dual sim function. That's all I want, the TMO firmware is perfectly fine... (and replace boot/shutdown animations with original McLaren bootanimations) This super.img pull procedure and the ability to push/restore it back is a huge step forward for our McLaren 5G. At least there is a bit of light the end of the tunnel. (even without the damn MSM Tool)

@ntzrmtthihu777 Can you post the super.img extracted... at least that way we can flash images individually. (and test replacing/swapping images)

Also... you do have a 7T Pro too? lol... You have the full kit required... lol (we also need the 7T Pro images... lol)

Just renamed the super.zip to firmware.zip. Installed gawk and still nothing, no error but empty output folder:(

Don't rename to .zip. Keep the .img file (super.img) and run:

Code:
[email protected]:~/Desktop/oneplus/Firmware_extractor-master/tools/Linux/bin$ ./lpunpack super.img

inside the bin directory "bin" (that's where lpunpack is located)

see screenshot...

and of course make sure you installed all the packages:


Code:
sudo -i

Code:
apt install unace unrar zip unzip p7zip-full p7zip-rar sharutils rar uudeview mpack arj cabextract file-roller

Code:
apt install liblzma-dev python-pip brotli lz4

Code:
pip install backports.lzma protobuf pycrypto

Code:
apt install gawk
 
Last edited:

ntzrmtthihu777

Senior Member
May 17, 2015
126
74
Well, uninstalling magisk bricked the phone (probably something I did wrong; I've never used
magisk before) so I ended up flashing the entire super.img and a boot.img I saved from my original
attempts at it and I ended up back on 10.0.16. Need more testing before I turn it into a proper how-to.
 

TEKHD

Inactive Recognized Developer / XDA Portal Scout
@ntzrmtthihu777 , it's interesting only the super slot a ones have data, because I'm definitely on slot b with the November 1, 2019 security update. I run cat /proc/mounts and no slot a are mounted, only slot b.

Perhaps the a/b thing loses context outside of a live device, and lpunpack just names them whatever.

Maybe, but cat /proc/mounts indicates /dev/block/dm-8 is mounted as / and I am running slot b right now with November 1, 2019 security update. The SHA1 of the system_a image in super does not match /dev/block/dm-8. I think that super image is how the phone came before the first OTA update to November 1, 2019 security update.

Nope. After using the super.img to restore my phone I was immediately back on the Nov 1, 2019
update. Perhaps system_a has some trailing 'padding' data but after being setup with devmapper
(what creates /dev/block/dm-* devices, at least on desktop android) it does not?

This is the build.prop inside the super.img

Code:
# begin common build properties
# autogenerated by build/make/tools/buildinfo_common.sh
ro.system.build.date=Sat Nov 23 19:21:37 CST 2019
ro.system.build.date.utc=1574508097
ro.system.build.fingerprint=OnePlus/OnePlus7TProNR/OnePlus7TProNR:10/QKQ1.190716.003/1911231913:user/release-keys
ro.system.build.id=QKQ1.190716.003
ro.system.build.tags=release-keys
ro.system.build.type=user
ro.system.build.version.incremental=1911231913
ro.system.build.version.release=10
ro.system.build.version.sdk=29
ro.product.system.brand=OnePlus
ro.product.system.device=OnePlus7TProNR
ro.product.system.manufacturer=OnePlus
ro.product.system.name=OnePlus7TProNR
# end common build properties
#
#
# autogenerated by oem_log_prop.sh
persist.sys.kernel=yes
persist.sys.main=yes
persist.sys.system=yes
persist.sys.radio=yes
persist.sys.event=yes
persist.sys.crash=yes
persist.sys.qxdm=no
debug.sf.dump.primary=true
debug.sf.dump.external=true
debug.sf.dump.enable=true
debug.sf.dump=0
persist.sys.qsee=yes
persist.sys.tz=yes
persist.sys.assert.panic=false
persist.sys.assert.enable=false
persist.sys.cfu_auto=1
#
#
# autogenerated by oem_buildinfo.sh
ro.control_privapp_permissions=log
ro.opa.eligible_device=true
ro.setupwizard.mode=OPTIONAL
ro.com.google.clientidbase=android-oneplus
ro.com.google.clientidbase.ms=android-tmus-us-revc
ro.build.os_type=
persist.sys.oem.region=OverSeas
ro.build.product=OnePlus7TProNR
ro.product.device=OnePlus7TProNR
ro.build.date.Ymd=191123
ro.build.date.ymd=191123
ro.build.date.YmdHM=201911231936
ro.build.user=OnePlus
ro.build.flavor=OnePlus7TProNR-user
ro.build.description=OnePlus7TProNR-user 10 QKQ1.190716.003 1911231913 release-keys
ro.common.soft=OnePlus7TProNR
ro.build.release_type=release
ro.build.soft.version=O.14
ro.xxversion=v0.5
ro.build.kernel.id=4.14-G1911231936
ro.display.series=OnePlus 7T Pro 5G
ro.build.ota.versionname=OnePlus7TProNROxygen_13_1911231936
ro.build.version.ota=OnePlus7TProNROxygen_13.O.14_GLO_014_1911231936
ro.build.soft.majorversion=A
ro.product.brand=OnePlus
ro.product.manufacturer=OnePlus
persist.sys.timezone=America/New_York
ro.rom.version=10.0.13.HD61CB
ro.imei.check=yes
# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=QKQ1.190716.003
ro.build.keys=release-keys
ro.build.version.incremental=1911231913
ro.build.version.sdk=29
ro.build.version.preview_sdk=0
ro.build.version.preview_sdk_fingerprint=REL
ro.build.version.codename=REL
ro.build.version.all_codenames=REL
ro.build.version.release=10
ro.build.version.security_patch=2019-10-01
ro.build.version.base_os=
ro.build.version.min_supported_target_sdk=23
ro.build.date=Sat Nov 23 19:21:37 CST 2019
ro.build.date.utc=1574508097
ro.build.type=user
ro.build.user=jenkins
ro.build.host=rd-build-91
ro.build.tags=release-keys
ro.build.flavor=hotdogg-user
ro.build.system_root_image=false
ro.build.ab_update=true
ro.product.cuptsm=ONEPLUS|ESE|01|02|80T
# ro.product.cpu.abi and ro.product.cpu.abi2 are obsolete,
# use ro.product.cpu.abilist instead.
ro.product.cpu.abi=arm64-v8a
ro.product.cpu.abilist=arm64-v8a,armeabi-v7a,armeabi
ro.product.cpu.abilist32=armeabi-v7a,armeabi
ro.product.cpu.abilist64=arm64-v8a
ro.product.locale=en-US
ro.wifi.channels=
# Do not try to parse thumbprint
# end build properties

#
# from vendor/oneplus/config/msmnile/system.prop
#
#
# system.prop for sdm845
#

rild.libpath=/vendor/lib64/libril-qc-hal-qmi.so
#rild.libargs=-d /dev/smd0
persist.rild.nitz_plmn=
persist.rild.nitz_long_ons_0=
persist.rild.nitz_long_ons_1=
persist.rild.nitz_long_ons_2=
persist.rild.nitz_long_ons_3=
persist.rild.nitz_short_ons_0=
persist.rild.nitz_short_ons_1=
persist.rild.nitz_short_ons_2=
persist.rild.nitz_short_ons_3=
ril.subscription.types=NV,RUIM
DEVICE_PROVISIONED=1
# Set network mode to (T/L/G/W/1X/EVDO, T/L/G/W/1X/EVDO) for 7+7 mode device on DSDS mode
ro.telephony.default_network=22,22

dalvik.vm.heapsize=36m
dev.pm.dyn_samplingrate=1

#ro.hdmi.enable=true
#persist.speaker.prot.enable=false
qcom.hw.aac.encoder=true
#
# system props for the cne module
#
persist.vendor.cne.feature=1

#system props for the MM modules
media.stagefright.enable-player=true
media.stagefright.enable-http=true
media.stagefright.enable-aac=true
media.stagefright.enable-qcp=true
media.stagefright.enable-fma2dp=true
media.stagefright.enable-scan=true
media.stagefright.thumbnail.prefer_hw_codecs=true
mmp.enable.3g2=true
media.aac_51_output_enabled=true
mm.enable.smoothstreaming=true

#ifdef VENDOR_EDIT
# [email protected], 2019/07/10, [HD-1693],use qcom media profile
media.settings.xml=/vendor/etc/media_profiles_vendor.xml
#endif

#13631487 is decimal sum of supported codecs in AAL
#codecs:(PARSER_)AAC AC3 AMR_NB AMR_WB ASF AVI DTS FLV 3GP 3G2 MKV MP2PS MP2TS MP3 OGG QCP WAV FLAC AIFF APE DSD MOV XVID
#ifdef VENDOR_EDIT
# [email protected], 2019/06/12, [GCEQ-182] Sync from SM8150P ,Add codecs:DIVX & DIVXHD and remove ogg
#vendor.mm.enable.qcom_parser=63963135
#vendor.mm.enable.qcom_parser=67092479
# [email protected], 2019/08/23, [EIDQ-4020]remove qcom FLAC-8bit , PARSER_FLAC[0x00020000]
vendor.mm.enable.qcom_parser=66961407
#endif
persist.mm.enable.prefetch=true

#ifdef VENDOR_EDIT
# [email protected], 2019/07/29, [GCEQ-3488] Sync from SM8150P ,for audio config
#Netflix custom property
ro.netflix.bsp_rev=Q855-16947-1
#endif

#
# system props for the data modules
#
ro.vendor.use_data_netmgrd=true
persist.vendor.data.mode=concurrent

#system props for time-services
persist.timed.enable=true

#
# system prop for opengles version
#
# 196608 is decimal for 0x30000 to report version 3
# 196609 is decimal for 0x30001 to report version 3.1
# 196610 is decimal for 0x30002 to report version 3.2
ro.opengles.version=196610

#
# System props for telephony
# System prop to turn on CdmaLTEPhone always
telephony.lteOnCdmaDevice=1

#Simulate sdcard on /data/media
#
persist.fuse_sdcard=true

#system prop for Bluetooth SOC type
vendor.bluetooth.soc=cherokee
ro.bluetooth.library_name=libbluetooth_qti.so
persist.vendor.btstack.enable.splita2dp=true
persist.vendor.btstack.a2dp_offload_cap=sbc-aptx-aptxtws-aptxhd-aac-ldac
persist.vendor.btstack.enable.twsplus=true

#system prop for wipower support
ro.bluetooth.emb_wp_mode=false
ro.bluetooth.wipower=false

#
#snapdragon value add features
#
ro.qc.sdk.audio.ssr=false

##fluencetype can be "fluence" or "fluencepro" or "none"
ro.qc.sdk.audio.fluencetype=none
persist.audio.fluence.voicecall=true
persist.audio.fluence.voicerec=false
persist.audio.fluence.speaker=true

#system prop for RmNet Data
persist.rmnet.data.enable=true
persist.data.wda.enable=true
persist.data.df.dl_mode=5
persist.data.df.ul_mode=5
persist.data.df.agg.dl_pkt=10
persist.data.df.agg.dl_size=4096
persist.data.df.mux_count=8
persist.data.df.iwlan_mux=9
persist.data.df.dev_name=rmnet_usb0

#property to enable user to access Google WFD settings
persist.debug.wfd.enable=1
##property to choose between virtual/external wfd display
persist.sys.wfd.virtual=0

# enable tunnel encoding for amrwb
tunnel.audio.encode = true

#ifdef VENDOR_EDIT
# [email protected], 2019/07/29, [GCEQ-3488] Sync from SM8150P ,for audio config
#Buffer size in kbytes for compress offload playback
#audio.offload.buffer.size.kb=32
#endif

#Enable offload audio video playback by default
av.offload.enable=true

#enable voice path for PCM VoIP by default
use.voice.path.for.pcm.voip=true

# system prop for NFC DT
ro.nfc.port=I2C

#ifdef VENDOR_EDIT
# [email protected], 2019/07/29, [GCEQ-3488] Sync from SM8150P ,for audio config
#enable dsp gapless mode by default
#audio.offload.gapless.enabled=true
#endif

#initialize QCA1530 detection
sys.qca1530=detect

#Enable stm events
persist.debug.coresight.config=stm-events

#hwui properties
ro.hwui.texture_cache_size=72
ro.hwui.layer_cache_size=48
ro.hwui.r_buffer_cache_size=8
ro.hwui.path_cache_size=32
ro.hwui.gradient_cache_size=1
ro.hwui.drop_shadow_cache_size=6
ro.hwui.texture_cache_flushrate=0.4
ro.hwui.text_small_cache_width=1024
ro.hwui.text_small_cache_height=1024
ro.hwui.text_large_cache_width=2048
ro.hwui.text_large_cache_height=1024

config.disable_rtt=true

#Bringup properties
persist.sys.force_sw_gles=1
persist.vendor.radio.atfwd.start=true
ro.kernel.qemu.gles=0
qemu.hw.mainkeys=0

#ifdef VENDOR_EDIT
#[email protected], 2015/12/23, Modify for support offload Is greater than 30s Audio source
audio.offload.min.duration.secs=30
#Turn on the "ro.audio.monitorRotation" property and use RotationHelper to control left and right channel switching.
ro.audio.monitorRotation=true
#[email protected], 2017/09/25, add for support wechat voice and video msg
nxpWechatDebugEnable=1
#endif
#ifdef VENDOR_EDIT
#[email protected],20180322,reduce video swdev logs,default only print error logs
vendor.vidc.debug.level=1
vendor.swvdec.log.level=1
#endif

#ifdef VENDOR_EDIT
#[email protected], 2018/1/17,use for hac feature
persist.vendor.audio.hac.enable=false
#endif
#Expose aux camera for below packages
#ifndef VENDOR_EDIT
#vendor.camera.aux.packagelist=org.codeaurora.snapcam
#else
vendor.camera.aux.packagelist=org.codeaurora.snapcam,com.oneplus.factorymode,com.oneplus.camera,com.oneplus.healthcheck
persist.vendor.camera.privapp.list=com.oneplus.camera
#endif
#ifdef VENDOR_EDIT
persist.vendor.camera.oissr.debug=0
#endif

#enable IZat OptInApp overlay
persist.vendor.overlay.izat.optin=rro

#Property to enable Mag filter
persist.vendor.sensors.enable.mag_filter=true

#property to enable HWC for VDS
debug.sf.enable_hwc_vds=1

#property to latch unsignaled buffer
debug.sf.latch_unsignaled=1

#ifdef VENDOR_EDIT
persist.vendor.naruto.light.support=true
#endif

#ifdef VENDOR_EDIT
#[email protected], 2019/05/12, add osnlp.package
# ro.location.osnlp.package sets the name of default
# OS sepecific network location provider package to use
# ro.location.osnlp.region.package is set to the name
# of the alternative network location provider package
# network location provider is not functional
ro.location.osnlp.region.package=com.amap.android.location
#endif

# ifdef VENDOR_EDIT
# [email protected], 2019/05/16, add for GCE-12831 to enable bservice limit
ro.vendor.qti.sys.fw.bservice_enable=true
ro.vendor.qti.sys.fw.bservice_limit=8
ro.vendor.qti.sys.fw.bservice_age=5000
# endif

#ifdef VENDOR_EDIT
#[email protected],2019/08/14,It is Google design not to bring down Data call when Wifi is up for inger timer
persist.netmon.linger=5000
#endif

#ifdef VENDOR_EDIT
#if OP_FEATURE_MM_24BIT == 1
#[email protected], 2019/07/15, use 24bit offload playback
persist.vendor.audio_hal.dsp_bit_width_enforce_mode=24
#endif
#endif

# ifdef VENDOR_EDIT
# [email protected], 2019/09/25, add for solve audio crash
persist.vendor.bt.a2dp.hal.implementation=true
# endif
# end of vendor/oneplus/config/msmnile/system.prop

#
# ADDITIONAL_BUILD_PROPERTIES
#
ro.treble.enabled=true
net.bt.name=Android
ro.vendor.qti.va_aosp.support=1


It's definitely 10.0.13.HD61CB

Code:
ro.rom.version=10.0.13.HD61CB
ro.build.version.security_patch=2019-10-01

I will post a series of files so EVERYONE can compare Global Firmware vs TMO 5G Firmware... (all 4 super.img partitions from both firmwares) That should help a lot in the dev and research area... You can use an app like Beyond Compare and you can literally setup left side Global Firmware and Right side TMO 5G Firmware. (and you will be able to compare literally everything between the 2 firmwares)
 
Last edited:

jhofseth

Senior Member
Feb 27, 2016
474
282
Seattle, Washington
The super.img didn't work for me:( Everything flashes ok with no errors but when I "fastboot reboot" it goes to some Qualcomm error screen?

after unzipping attached, maybe this could help
fastboot erase boot_a
fastboot erase boot_b
fastboot flash boot_a boot_a.img
fastboot flash boot_b boot_b.img
fastboot --set-active=b


boot_a is older
boot_b is November 1, 2019 security update one

these are original, unmodified, without magisk
 

Attachments

  • boot_a.zip
    12.7 MB · Views: 20
  • boot_b.zip
    12.7 MB · Views: 17
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 5
    I think I found how to activate Dual SIM on TMO firmware (and 5G Radio on Global Firmware)

    Will create a new thread soon...
    4
    Is it possible for someone to pull all these partitions?
    aop.img
    bluetooth.img
    boot.img
    dsp.img
    dtbo.img
    LOGO.img
    modem.img
    oem_stanvbk.img
    qupfw.img
    storsec.img
    multiimgoem.img
    uefisecapp.img
    recovery.img
    vbmeta.img
    vbmeta_system.img
    opproduct.img
    system.img
    vendor.img
    product.img

    The super.img method isn't working for me:(
    https://drive.google.com/open?id=1J5_igi3ekdHM-nXT72wKyfHK9pxfI0gc
    SHA1 of flash.zip: 1573fb5d6daf63005f54673469b27603c8676131

    Android security patch level
    November 1, 2019
    Manual below, also included flash-all.bat and flash-all.sh , etc., in the zipped flash folder; I haven't tested the two scripts yet, so please let me know if they need edits. If anyone was going to use Google's files, I would recommend copying extracted content to the same folder as the images (or cut/pasting extracted images vice-versa).
    (note: fastboot -w wipes userdata; this avoids errors, but please have a backup of important files first)
    Starting in bootloader is OK for all partitions except super; it has to reboot into userspace to flash the super partition without forcing, because of dynamic partitioning. Thats why the command fastboot reboot fastboot.
    fastboot -w
    fastboot flash aop_a aop_a.img
    fastboot flash aop_b aop_b.img
    fastboot flash bluetooth_a bluetooth_a.img
    fastboot flash bluetooth_b bluetooth_b.img
    fastboot flash boot_a boot_a.img
    fastboot flash boot_b boot_b.img
    fastboot flash dsp_a dsp_a.img
    fastboot flash dsp_b dsp_b.img
    fastboot flash dtbo_a dtbo_a.img
    fastboot flash dtbo_b dtbo_b.img
    fastboot flash LOGO_a LOGO_a.img
    fastboot flash LOGO_b LOGO_b.img
    fastboot flash modem_a modem_a.img
    fastboot flash modem_b modem_b.img
    fastboot flash oem_stanvbk oem_stanvbk.img
    fastboot flash qupfw_a qupfw_a.img
    fastboot flash qupfw_b qupfw_b.img
    fastboot flash storsec_a storsec_a.img
    fastboot flash storsec_b storsec_b.img
    fastboot flash multiimgoem_a multiimgoem_a.img
    fastboot flash multiimgoem_b multiimgoem_b.img
    fastboot flash uefisecapp_a uefisecapp_a.img
    fastboot flash uefisecapp_b uefisecapp_b.img
    fastboot flash recovery_a recovery_a.img
    fastboot flash recovery_b recovery_b.img
    fastboot --disable-verity flash vbmeta_a vbmeta_a.img
    fastboot --disable-verity flash vbmeta_b vbmeta_b.img
    fastboot --disable-verity flash vbmeta_system_a vbmeta_system_a.img
    fastboot --disable-verity flash vbmeta_system_b vbmeta_system_b.img
    fastboot reboot fastboot
    fastboot --set-active=b
    fastboot flash super super.img


    (If your logo_a.img and logo_b.img are not LOGO_A.img and LOGO_B.img (i.e., if the images are lower-case), then use fastboot flash LOGO_A logo_a.img and fastboot flash LOGO_b logo_b.img; this has been corrected, and only matters if downloaded before corrected.)
    3
    I also asked OnePlus https://www.oneplus.com/support/contact for a MSM image for the OnePlus 7T Pro 5G McLaren, since it's critical for safe development. In my case, they did not say no, they just gave me a boilerplate response of, "About your concern we would like to inform you that we will take this as feedback and pass it along to our developer team so that this update can be rectified in the upcoming updates in the near future." They emailed me again asking for a further response and I haven't replied yet, because that second email was more obviously automated and did not have a name like the first one did. I think they could possibly let a tech post it to XDA, etc., if convinced by someone with experience like a XDA Recognized Developer. :)

    I just got off a chat with an agent and they tell me I'll get a remote session with their technical team in 24-48 hours I'm gonna do my best to get the image/ password for you guys
    3
    I would like to create a hybrid super.img with Global 7T Pro img & 5G 7T Pro img. (maybe keeping modem/vendor/kernel from 5G) It should be possible.

    I can't compile lpunpack. (Ubuntu 18.10) Still can't extract super.img for individual images... and what about repack? (in order to create hybrid super.img)

    Has anyone been able to get that super.img extracted?:confused:

    I get this error every time!
    [email protected]:~/Firmware_extractor$ ./extractor.sh firmware.zip
    Create Temp and out dir
    Extracting firmware on: /home/eosdev/Firmware_extractor/out
    ./extractor.sh: line 168: gawk: command not found
    ./extractor.sh: line 207: gawk: command not found

    As much as I love(d) arch (currently a gentooist) thats the exact type of distro
    that binaries floating around the web are not going to work for forever. You
    can build your own lpunpack, which will definitely work on your system, but
    I don't know how to do that outside of using the lineageos/etc build tree
    yet, however.

    In my case, I just want a clean hybrid img in order to activate the dual sim function. That's all I want, the TMO firmware is perfectly fine... (and replace boot/shutdown animations with original McLaren bootanimations) This super.img pull procedure and the ability to push/restore it back is a huge step forward for our McLaren 5G. At least there is a bit of light the end of the tunnel. (even without the damn MSM Tool)

    @ntzrmtthihu777 Can you post the super.img extracted... at least that way we can flash images individually. (and test replacing/swapping images)

    Also... you do have a 7T Pro too? lol... You have the full kit required... lol (we also need the 7T Pro images... lol)

    Just renamed the super.zip to firmware.zip. Installed gawk and still nothing, no error but empty output folder:(

    Don't rename to .zip. Keep the .img file (super.img) and run:

    Code:
    [email protected]:~/Desktop/oneplus/Firmware_extractor-master/tools/Linux/bin$ ./lpunpack super.img

    inside the bin directory "bin" (that's where lpunpack is located)

    see screenshot...

    and of course make sure you installed all the packages:


    Code:
    sudo -i

    Code:
    apt install unace unrar zip unzip p7zip-full p7zip-rar sharutils rar uudeview mpack arj cabextract file-roller

    Code:
    apt install liblzma-dev python-pip brotli lz4

    Code:
    pip install backports.lzma protobuf pycrypto

    Code:
    apt install gawk
    2
    Barring actually getting the MSM I may have a method of recovery using fastboot and friends. However, I need the help of
    a hotdogg owner with stock firmware & unlocked bootloader. The method is non-destructive (aside from the unlocking nuking
    your data); just requires you to use fastboot to boot a twrp image and use adb to pull a partition (its 15gb, so to make it faster
    you may want to use a real usb-c 3.0 cable; I don't think the orange one that comes with it is) and unpack it with a tool
    called 'lpunpack' (unfortunately I don't know how to build it outside of an aosp/lineageos/grapheneos tree yet).