[BOUNTY] MSM with T-Mobile firmware for 5G McLaren (hotdogg)

Search This thread

LLStarks

Senior Member
Jun 1, 2012
1,934
1,146
Holy hell. What.

Partial global with T-Mobile criticals? If that's the case, open betas and Android 11 dev previews should be possible.
 
Last edited:

tserv95

Senior Member
Mar 1, 2015
125
52
Can someone explain to me what this means for the T-Mobile users? Is it possible that a conversion to global firmware is within reach?
 

LLStarks

Senior Member
Jun 1, 2012
1,934
1,146
We're inching towards...something. The new thread is up with pretty interesting test requests. Whether people feel safe enough to test after the encouraging partition research is still not clear.
 

DanDroidOS

Senior Member
Jul 26, 2009
451
103
Southern California
dandroidos.com
Is it possible for someone to pull all these partitions?
aop.img
bluetooth.img
boot.img
dsp.img
dtbo.img
LOGO.img
modem.img
oem_stanvbk.img
qupfw.img
storsec.img
multiimgoem.img
uefisecapp.img
recovery.img
vbmeta.img
vbmeta_system.img
opproduct.img
system.img
vendor.img
product.img

The super.img method isn't working for me:(
 
Last edited:

LLStarks

Senior Member
Jun 1, 2012
1,934
1,146
If we're going to start messing around, we really need to start specifying 10.0.0.13 and 10.0.0.16 and putting together an organized repo of partitions.
 

jhofseth

Senior Member
Feb 27, 2016
474
282
Seattle, Washington
Is it possible for someone to pull all these partitions?
aop.img
bluetooth.img
boot.img
dsp.img
dtbo.img
LOGO.img
modem.img
oem_stanvbk.img
qupfw.img
storsec.img
multiimgoem.img
uefisecapp.img
recovery.img
vbmeta.img
vbmeta_system.img
opproduct.img
system.img
vendor.img
product.img

The super.img method isn't working for me:(
https://drive.google.com/open?id=1J5_igi3ekdHM-nXT72wKyfHK9pxfI0gc
SHA1 of flash.zip: 1573fb5d6daf63005f54673469b27603c8676131

Android security patch level
November 1, 2019
Manual below, also included flash-all.bat and flash-all.sh , etc., in the zipped flash folder; I haven't tested the two scripts yet, so please let me know if they need edits. If anyone was going to use Google's files, I would recommend copying extracted content to the same folder as the images (or cut/pasting extracted images vice-versa).
(note: fastboot -w wipes userdata; this avoids errors, but please have a backup of important files first)
Starting in bootloader is OK for all partitions except super; it has to reboot into userspace to flash the super partition without forcing, because of dynamic partitioning. Thats why the command fastboot reboot fastboot.
fastboot -w
fastboot flash aop_a aop_a.img
fastboot flash aop_b aop_b.img
fastboot flash bluetooth_a bluetooth_a.img
fastboot flash bluetooth_b bluetooth_b.img
fastboot flash boot_a boot_a.img
fastboot flash boot_b boot_b.img
fastboot flash dsp_a dsp_a.img
fastboot flash dsp_b dsp_b.img
fastboot flash dtbo_a dtbo_a.img
fastboot flash dtbo_b dtbo_b.img
fastboot flash LOGO_a LOGO_a.img
fastboot flash LOGO_b LOGO_b.img
fastboot flash modem_a modem_a.img
fastboot flash modem_b modem_b.img
fastboot flash oem_stanvbk oem_stanvbk.img
fastboot flash qupfw_a qupfw_a.img
fastboot flash qupfw_b qupfw_b.img
fastboot flash storsec_a storsec_a.img
fastboot flash storsec_b storsec_b.img
fastboot flash multiimgoem_a multiimgoem_a.img
fastboot flash multiimgoem_b multiimgoem_b.img
fastboot flash uefisecapp_a uefisecapp_a.img
fastboot flash uefisecapp_b uefisecapp_b.img
fastboot flash recovery_a recovery_a.img
fastboot flash recovery_b recovery_b.img
fastboot --disable-verity flash vbmeta_a vbmeta_a.img
fastboot --disable-verity flash vbmeta_b vbmeta_b.img
fastboot --disable-verity flash vbmeta_system_a vbmeta_system_a.img
fastboot --disable-verity flash vbmeta_system_b vbmeta_system_b.img
fastboot reboot fastboot
fastboot --set-active=b
fastboot flash super super.img


(If your logo_a.img and logo_b.img are not LOGO_A.img and LOGO_B.img (i.e., if the images are lower-case), then use fastboot flash LOGO_A logo_a.img and fastboot flash LOGO_b logo_b.img; this has been corrected, and only matters if downloaded before corrected.)
 
Last edited:

LLStarks

Senior Member
Jun 1, 2012
1,934
1,146
I'm still confused as to how the super partition factors in and what it will take to get a backup of 10.0.0.16 and put it on slot a. Manually? Is that even desirable?
 

jhofseth

Senior Member
Feb 27, 2016
474
282
Seattle, Washington
I'm still confused as to how the super partition factors in and what it will take to get a backup of 10.0.0.16 and put it on slot a. Manually? Is that even desirable?

@ntzrmtthihu777 said it took them back to that. I don't know why it worked for them, because that super.img only has data on system_a. I'm on slot b and on the November 1, 2019 Android security patch level. I'm still waiting to see if it worked for @DanDroidOS.
 
Last edited:

DanDroidOS

Senior Member
Jul 26, 2009
451
103
Southern California
dandroidos.com
@ntzrmtthihu777 said it took them back to that. I don't know why it worked for them, because that super.img only has data on system_a. I'm on slot b and on the November 1, 2019 Android security patch level. I'm still waiting to see if it worked for @DanDroidOS.
Worked perfectly!!! I can't thank you enough! The only issue is logo.img(a&b) failed. My fingerprint scanner won't register a fingerprint for some reason?
 
  • Like
Reactions: jhofseth

jhofseth

Senior Member
Feb 27, 2016
474
282
Seattle, Washington
Worked perfectly!!! I can't thank you enough! The only issue is logo.img(a&b) failed. My fingerprint scanner won't register a fingerprint for some reason?

Here is an attached app that may get wiped with if you chose to wipe userdata (not sure); it's zipped in a folder and should be installable as a normal app, if needed.
OnePlus McLaren Pack
/data/app/com.oneplus.iconpack.mclaren-XCe6jYwOACjDi3khyrhIbA==/base.apk
1_1.0.0.190912151920.aa4f1ca
 

Attachments

  • com.oneplus.iconpack.mclaren.zip
    1.3 MB · Views: 26
Last edited:
  • Like
Reactions: DanDroidOS

jhofseth

Senior Member
Feb 27, 2016
474
282
Seattle, Washington
@DanDroidOS , I uploaded a fix for the LOGO_a.img and LOGO_b.img; it was just case sensitivity. If the images are renamed with LOGO capital letters:
fastboot flash LOGO_a LOGO_a.img
fastboot flash LOGO_b LOGO_b.img
But, since you've already downloaded and if you don't rename the lower case logo to LOGO, you could type:
fastboot flash LOGO_a logo_a.img
fastboot flash LOGO_b logo_b.img
 
Last edited:

DanDroidOS

Senior Member
Jul 26, 2009
451
103
Southern California
dandroidos.com
@DanDroidOS , I uploaded a fix for the LOGO_a.img and LOGO_b.img; it was just case sensitivity. If the images are renamed with LOGO capital letters:
fastboot flash LOGO_a LOGO_a.img
fastboot flash LOGO_b LOGO_b.img
But, since you've already downloaded and if you don't rename the lower case logo to LOGO, you could type:
fastboot flash LOGO_a logo_a.img
fastboot flash LOGO_b logo_b.img
I'm trying again, don't see why my fingerprint won't register? Thanks for all your help!

UPDATE: Still no fingerprint? Everything else perfect 10.0.16!
UPDATE #2: I dialed *#808# and ran fingerprint tests and all passed. Still can't register a fingerprint.
 
Last edited:
  • Like
Reactions: jhofseth

jhofseth

Senior Member
Feb 27, 2016
474
282
Seattle, Washington
I'm trying again, don't see why my fingerprint won't register? Thanks for all your help!

UPDATE: Still no fingerprint? Everything else perfect 10.0.16!
UPDATE #2: I dialed *#808# and ran fingerprint tests and all passed. Still can't register a fingerprint.
Maybe this quote from this thread at https://forums.oneplus.com/threads/oneplus-7-pro-fingerprint-scanner-not-working-properly.1043768/ would work:
"first remove all the stored fingers, then clear the cache in recovery (see below for how), then try re-registering. Make sure when you do that your fingers are clean and dry. If still fails, try registering someone else's finger as a test.

Boot the phone into recovery mode and clear the cache.
1. Power off phone.
2. Power on phone whilst holding down the volume down button (this takes slightly longer to react than you would expect and after the initial splash screen goes blank for a slightly un-nerving amount of time. But just wait).
3. Enter the PIN/Password you use to unlock the phone when prompted.
4. Choose a language.
5. Choose "Wipe data and cache" (don't worry this is only a path to a submenu, it won't delete your data).
6. Choose "Wipe cache" (IMPORTANT - MAKE SURE YOU DON'T TAP ERASE EVERYTHING).
7. It will confirm that you have selected clear cache and ask you to say YES.
8. When it says success choose "Reboot""
 

DanDroidOS

Senior Member
Jul 26, 2009
451
103
Southern California
dandroidos.com
Maybe this quote from this thread at https://forums.oneplus.com/threads/oneplus-7-pro-fingerprint-scanner-not-working-properly.1043768/ would work:
"first remove all the stored fingers, then clear the cache in recovery (see below for how), then try re-registering. Make sure when you do that your fingers are clean and dry. If still fails, try registering someone else's finger as a test.

Boot the phone into recovery mode and clear the cache.
1. Power off phone.
2. Power on phone whilst holding down the volume down button (this takes slightly longer to react than you would expect and after the initial splash screen goes blank for a slightly un-nerving amount of time. But just wait).
3. Enter the PIN/Password you use to unlock the phone when prompted.
4. Choose a language.
5. Choose "Wipe data and cache" (don't worry this is only a path to a submenu, it won't delete your data).
6. Choose "Wipe cache" (IMPORTANT - MAKE SURE YOU DON'T TAP ERASE EVERYTHING).
7. It will confirm that you have selected clear cache and ask you to say YES.
8. When it says success choose "Reboot""
Thank you but sadly I have tried that:( I also tried switching to guest mode to try and register a fingerprint and even booted up in safe mode still nothing:(
 
  • Like
Reactions: jhofseth

Top Liked Posts

  • There are no posts matching your filters.
  • 5
    I think I found how to activate Dual SIM on TMO firmware (and 5G Radio on Global Firmware)

    Will create a new thread soon...
    4
    Is it possible for someone to pull all these partitions?
    aop.img
    bluetooth.img
    boot.img
    dsp.img
    dtbo.img
    LOGO.img
    modem.img
    oem_stanvbk.img
    qupfw.img
    storsec.img
    multiimgoem.img
    uefisecapp.img
    recovery.img
    vbmeta.img
    vbmeta_system.img
    opproduct.img
    system.img
    vendor.img
    product.img

    The super.img method isn't working for me:(
    https://drive.google.com/open?id=1J5_igi3ekdHM-nXT72wKyfHK9pxfI0gc
    SHA1 of flash.zip: 1573fb5d6daf63005f54673469b27603c8676131

    Android security patch level
    November 1, 2019
    Manual below, also included flash-all.bat and flash-all.sh , etc., in the zipped flash folder; I haven't tested the two scripts yet, so please let me know if they need edits. If anyone was going to use Google's files, I would recommend copying extracted content to the same folder as the images (or cut/pasting extracted images vice-versa).
    (note: fastboot -w wipes userdata; this avoids errors, but please have a backup of important files first)
    Starting in bootloader is OK for all partitions except super; it has to reboot into userspace to flash the super partition without forcing, because of dynamic partitioning. Thats why the command fastboot reboot fastboot.
    fastboot -w
    fastboot flash aop_a aop_a.img
    fastboot flash aop_b aop_b.img
    fastboot flash bluetooth_a bluetooth_a.img
    fastboot flash bluetooth_b bluetooth_b.img
    fastboot flash boot_a boot_a.img
    fastboot flash boot_b boot_b.img
    fastboot flash dsp_a dsp_a.img
    fastboot flash dsp_b dsp_b.img
    fastboot flash dtbo_a dtbo_a.img
    fastboot flash dtbo_b dtbo_b.img
    fastboot flash LOGO_a LOGO_a.img
    fastboot flash LOGO_b LOGO_b.img
    fastboot flash modem_a modem_a.img
    fastboot flash modem_b modem_b.img
    fastboot flash oem_stanvbk oem_stanvbk.img
    fastboot flash qupfw_a qupfw_a.img
    fastboot flash qupfw_b qupfw_b.img
    fastboot flash storsec_a storsec_a.img
    fastboot flash storsec_b storsec_b.img
    fastboot flash multiimgoem_a multiimgoem_a.img
    fastboot flash multiimgoem_b multiimgoem_b.img
    fastboot flash uefisecapp_a uefisecapp_a.img
    fastboot flash uefisecapp_b uefisecapp_b.img
    fastboot flash recovery_a recovery_a.img
    fastboot flash recovery_b recovery_b.img
    fastboot --disable-verity flash vbmeta_a vbmeta_a.img
    fastboot --disable-verity flash vbmeta_b vbmeta_b.img
    fastboot --disable-verity flash vbmeta_system_a vbmeta_system_a.img
    fastboot --disable-verity flash vbmeta_system_b vbmeta_system_b.img
    fastboot reboot fastboot
    fastboot --set-active=b
    fastboot flash super super.img


    (If your logo_a.img and logo_b.img are not LOGO_A.img and LOGO_B.img (i.e., if the images are lower-case), then use fastboot flash LOGO_A logo_a.img and fastboot flash LOGO_b logo_b.img; this has been corrected, and only matters if downloaded before corrected.)
    3
    I also asked OnePlus https://www.oneplus.com/support/contact for a MSM image for the OnePlus 7T Pro 5G McLaren, since it's critical for safe development. In my case, they did not say no, they just gave me a boilerplate response of, "About your concern we would like to inform you that we will take this as feedback and pass it along to our developer team so that this update can be rectified in the upcoming updates in the near future." They emailed me again asking for a further response and I haven't replied yet, because that second email was more obviously automated and did not have a name like the first one did. I think they could possibly let a tech post it to XDA, etc., if convinced by someone with experience like a XDA Recognized Developer. :)

    I just got off a chat with an agent and they tell me I'll get a remote session with their technical team in 24-48 hours I'm gonna do my best to get the image/ password for you guys
    3
    I would like to create a hybrid super.img with Global 7T Pro img & 5G 7T Pro img. (maybe keeping modem/vendor/kernel from 5G) It should be possible.

    I can't compile lpunpack. (Ubuntu 18.10) Still can't extract super.img for individual images... and what about repack? (in order to create hybrid super.img)

    Has anyone been able to get that super.img extracted?:confused:

    I get this error every time!
    [email protected]:~/Firmware_extractor$ ./extractor.sh firmware.zip
    Create Temp and out dir
    Extracting firmware on: /home/eosdev/Firmware_extractor/out
    ./extractor.sh: line 168: gawk: command not found
    ./extractor.sh: line 207: gawk: command not found

    As much as I love(d) arch (currently a gentooist) thats the exact type of distro
    that binaries floating around the web are not going to work for forever. You
    can build your own lpunpack, which will definitely work on your system, but
    I don't know how to do that outside of using the lineageos/etc build tree
    yet, however.

    In my case, I just want a clean hybrid img in order to activate the dual sim function. That's all I want, the TMO firmware is perfectly fine... (and replace boot/shutdown animations with original McLaren bootanimations) This super.img pull procedure and the ability to push/restore it back is a huge step forward for our McLaren 5G. At least there is a bit of light the end of the tunnel. (even without the damn MSM Tool)

    @ntzrmtthihu777 Can you post the super.img extracted... at least that way we can flash images individually. (and test replacing/swapping images)

    Also... you do have a 7T Pro too? lol... You have the full kit required... lol (we also need the 7T Pro images... lol)

    Just renamed the super.zip to firmware.zip. Installed gawk and still nothing, no error but empty output folder:(

    Don't rename to .zip. Keep the .img file (super.img) and run:

    Code:
    [email protected]:~/Desktop/oneplus/Firmware_extractor-master/tools/Linux/bin$ ./lpunpack super.img

    inside the bin directory "bin" (that's where lpunpack is located)

    see screenshot...

    and of course make sure you installed all the packages:


    Code:
    sudo -i

    Code:
    apt install unace unrar zip unzip p7zip-full p7zip-rar sharutils rar uudeview mpack arj cabextract file-roller

    Code:
    apt install liblzma-dev python-pip brotli lz4

    Code:
    pip install backports.lzma protobuf pycrypto

    Code:
    apt install gawk
    2
    Barring actually getting the MSM I may have a method of recovery using fastboot and friends. However, I need the help of
    a hotdogg owner with stock firmware & unlocked bootloader. The method is non-destructive (aside from the unlocking nuking
    your data); just requires you to use fastboot to boot a twrp image and use adb to pull a partition (its 15gb, so to make it faster
    you may want to use a real usb-c 3.0 cable; I don't think the orange one that comes with it is) and unpack it with a tool
    called 'lpunpack' (unfortunately I don't know how to build it outside of an aosp/lineageos/grapheneos tree yet).