[BOUNTY] MSM with T-Mobile firmware for 5G McLaren (hotdogg)

Search This thread

Lui914

Member
Dec 26, 2019
5
1
Life Saver

You are a life saver this un-bricked my device. My only issue now is that it wont OTA update. Have any idea how I can solve this?

P.S. Where can I donate for your help?
 
  • Like
Reactions: taxi333

ntzrmtthihu777

Senior Member
May 17, 2015
126
74
snip
fastboot --disable-verity flash vbmeta_system_b vbmeta_system_b.img
fastboot reboot fastboot
fastboot fastboot --set-active=b
fastboot flash super super.img
snip

Problem here. Should be 'fastboot --set-active=b',
one too many 'fastboot' in that line.

---------- Post added at 02:05 ---------- Previous post was at 02:01 ----------

You are a life saver this un-bricked my device. My only issue now is that it wont OTA update. Have any idea how I can solve this?

P.S. Where can I donate for your help?

Possibly you need to 'fastboot --set-active=b'. I was on 10.0.13 and couldn't update until
I did that. The included script flash-all.sh is wrong in that regard.
 
  • Like
Reactions: jhofseth
D

Deleted member 807276

Guest
bad news, after waiting for days for a response from Oneplus, I decided to phone them. They state that after speaking to the remote support team, they cannot even help us. As they apparently don't have the images for the T-Mobile firmware either/ firmware for the Mclaren edition. This is a big bummer as until they (if they for that matter) release the firmware on support site we have no way of really recovering a bricked device and any firmware flashing is gonna be very dangerous to attempt. So yeah.. really regretting buying a T-Mobile variant Oneplus phone atm.

i heard the same thing. probably going to ship to oneplus for reflash if you guys don't have any tricks. stuck in QCOM flash mode now :( no fastboot etc

---------- Post added at 07:13 PM ---------- Previous post was at 07:11 PM ----------

We'd probably lose 5G with a non-5G, but I'm not sure. Maybe vendor.img plays a bigger role.

i did this. vendor.img appears to have the qualcomm code for support for 5g, and is the reason i bootlooped before trying to flash super.img etc. for anyone curious, the super.img didn't get to flash; that reboot that came before it stuck it in a qcom loop.

---------- Post added at 07:14 PM ---------- Previous post was at 07:13 PM ----------

i heard the same thing. probably going to ship to oneplus for reflash if you guys don't have any tricks. stuck in QCOM flash mode now :( no fastboot etc

---------- Post added at 07:13 PM ---------- Previous post was at 07:11 PM ----------



i did this. vendor.img appears to have the qualcomm code for support for 5g, and is the reason i bootlooped before trying to flash super.img etc. for anyone curious, the super.img didn't get to flash; that reboot that came before it stuck it in a qcom loop.

if anyone cares for logs or can get me out of this qcom hell...
./flash-all.sh
Flashing partitions...
< waiting for any device >
Sending 'aop_a' (512 KB) OKAY [ 0.022s]
Writing 'aop_a' OKAY [ 0.005s]
Finished. Total time: 0.045s
Sending 'aop_b' (512 KB) OKAY [ 0.047s]
Writing 'aop_b' OKAY [ 0.004s]
Finished. Total time: 0.065s
Sending 'bluetooth_a' (1024 KB) OKAY [ 0.040s]
Writing 'bluetooth_a' OKAY [ 0.005s]
Finished. Total time: 0.062s
Sending 'bluetooth_b' (1024 KB) OKAY [ 0.041s]
Writing 'bluetooth_b' OKAY [ 0.006s]
Finished. Total time: 0.064s
Sending 'boot_a' (98304 KB) OKAY [ 2.756s]
Writing 'boot_a' OKAY [ 0.479s]
Finished. Total time: 3.252s
Sending 'boot_b' (98304 KB) OKAY [ 2.692s]
Writing 'boot_b' OKAY [ 0.461s]
Finished. Total time: 3.167s
Sending 'dsp_a' (65536 KB) OKAY [ 1.816s]
Writing 'dsp_a' OKAY [ 0.276s]
Finished. Total time: 2.105s
Sending 'dsp_b' (65536 KB) OKAY [ 1.773s]
Writing 'dsp_b' OKAY [ 0.265s]
Finished. Total time: 2.051s
Sending 'dtbo_a' (24576 KB) OKAY [ 0.686s]
Writing 'dtbo_a' OKAY [ 0.077s]
Finished. Total time: 0.779s
Sending 'dtbo_b' (24576 KB) OKAY [ 0.694s]
Writing 'dtbo_b' OKAY [ 0.100s]
Finished. Total time: 0.810s
Sending 'LOGO_a' (16384 KB) OKAY [ 0.456s]
Writing 'LOGO_a' OKAY [ 0.048s]
Finished. Total time: 0.518s
Sending 'LOGO_b' (16384 KB) OKAY [ 0.465s]
Writing 'LOGO_b' OKAY [ 0.081s]
Finished. Total time: 0.561s
Sending 'modem_a' (307200 KB) OKAY [ 8.292s]
Writing 'modem_a' OKAY [ 1.232s]
Finished. Total time: 9.539s
Sending 'modem_b' (307200 KB) OKAY [ 8.624s]
Writing 'modem_b' OKAY [ 1.209s]
Finished. Total time: 9.850s
Sending 'oem_stanvbk' (10240 KB) OKAY [ 0.276s]
Writing 'oem_stanvbk' OKAY [ 0.054s]
Finished. Total time: 0.346s
Sending 'qupfw_a' (80 KB) OKAY [ 0.015s]
Writing 'qupfw_a' OKAY [ 0.004s]
Finished. Total time: 0.033s
Sending 'qupfw_b' (80 KB) OKAY [ 0.010s]
Writing 'qupfw_b' OKAY [ 0.004s]
Finished. Total time: 0.028s
Sending 'storsec_a' (128 KB) OKAY [ 0.017s]
Writing 'storsec_a' OKAY [ 0.004s]
Finished. Total time: 0.035s
Sending 'storsec_b' (128 KB) OKAY [ 0.014s]
Writing 'storsec_b' OKAY [ 0.004s]
Finished. Total time: 0.031s
Sending 'multiimgoem_a' (32 KB) OKAY [ 0.009s]
Writing 'multiimgoem_a' OKAY [ 0.003s]
Finished. Total time: 0.028s
Sending 'multiimgoem_b' (32 KB) OKAY [ 0.010s]
Writing 'multiimgoem_b' OKAY [ 0.003s]
Finished. Total time: 0.027s
Sending 'uefisecapp_a' (2048 KB) OKAY [ 0.055s]
Writing 'uefisecapp_a' OKAY [ 0.008s]
Finished. Total time: 0.077s
Sending 'uefisecapp_b' (2048 KB) OKAY [ 0.065s]
Writing 'uefisecapp_b' OKAY [ 0.017s]
Finished. Total time: 0.097s
Sending 'recovery_a' (98304 KB) OKAY [ 2.509s]
Writing 'recovery_a' OKAY [ 0.392s]
Finished. Total time: 2.918s
Sending 'recovery_b' (98304 KB) OKAY [ 2.638s]
Writing 'recovery_b' OKAY [ 0.416s]
Finished. Total time: 3.068s
fastboot: error: Failed to find AVB_MAGIC at offset: 0
fastboot: error: Failed to find AVB_MAGIC at offset: 0
Sending 'vbmeta_system_a' (64 KB) OKAY [ 0.015s]
Writing 'vbmeta_system_a' OKAY [ 0.006s]
Finished. Total time: 0.044s
Sending 'vbmeta_system_b' (64 KB) OKAY [ 0.008s]
Writing 'vbmeta_system_b' OKAY [ 0.004s]
Finished. Total time: 0.032s
Rebooting before flashing super...
Rebooting into fastboot OKAY [ 0.003s]
< waiting for any device >

^C
 
Last edited by a moderator:
  • Like
Reactions: Yuhfhrh

jhofseth

Senior Member
Feb 27, 2016
474
282
Seattle, Washington
@josheee12 , you should be able to get out of crash dump by holding volume up + volume down + power, all at the same time. That will take you to bootloader, where you can flash most partitions with fastboot (but not super without forcing or unless you first 'fastboot reboot fastboot'). Some stock firmware for the OnePlus 7T Pro 5g McLaren is here: https://forum.xda-developers.com/showpost.php?p=81374031&postcount=67

(Side note: do not stay too long in some Qualcomm error screens. Multiple days in some static screens can cause permanent AMOLED burn-in.)
 
Last edited:

La_anvil

Senior Member
Feb 18, 2011
80
8
https://drive.google.com/open?id=1J5_igi3ekdHM-nXT72wKyfHK9pxfI0gc
SHA1 of flash.zip: 1573fb5d6daf63005f54673469b27603c8676131

Android security patch level
November 1, 2019
Manual below, also included flash-all.bat and flash-all.sh , etc., in the zipped flash folder; I haven't tested the two scripts yet, so please let me know if they need edits. )

im making progress, but not there yet. when I run your script or do it manual, I get these errors:

Update Errors:

Manual:
PS C:\ADB> fastboot --disable-verity flash vbmeta_a vbmeta_a.img
C:\Android\fastboot.exe: unknown option -- disable-verity
PS C:\ADB> fastboot --disable-verity flash vbmeta_b vbmeta_b.img
C:\Android\fastboot.exe: unknown option -- disable-verity
PS C:\ADB> fastboot --disable-verity flash vbmeta_system_a vbmeta_system_a.img
C:\Android\fastboot.exe: unknown option -- disable-verity
PS C:\ADB> fastboot --disable-verity flash vbmeta_system_b vbmeta_system_b.img
C:\Android\fastboot.exe: unknown option -- disable-verity

Bat:

fastboot: unknown option -- disable-verity
fastboot: unknown option -- disable-verity
fastboot: unknown option -- disable-verity
fastboot: unknown option -- disable-verity

Both manual and bat:
fastboot: unknown option -- set-active=b. I read the post about too many "fastboots". This is the command I used and the response.

PS C:\ADB> fastboot --set-active=b
C:\Android\fastboot.exe: unknown option -- set-active=b

Ive tried it both in fastboot and fastbootd


phone, wifi, bluetooth, messaging, all work. i dont know about fingerprint. No update. Im still in 10.0.13. When I started, it would quit updating around 10% or less. Now it runs til about 80%. What a tease when it first happened. I thought it was going to complete.

If you need it I saved the command line upgrade sequence for your bat file.
 

La_anvil

Senior Member
Feb 18, 2011
80
8
Thanks, Ill give it a try.

---------- Post added at 04:52 PM ---------- Previous post was at 04:18 PM ----------

Another question. I think I have the path set up correct. The variable is ADB. The value is C:\ADB\platform-tools. Doesn't this mean that whenever I use ADB.exe or Fastboot.exe it goes there and thats where all tools are? I'm running a crash refresher on dos commands and learning these new adb commands. If I put the latest tools there, and open a command prompt in that ADB directory, I should be all set?
 

WhiteEVO

Senior Member
Jul 19, 2010
614
101
How can I join the telegram grp. I'm going to be getting this phone soon. Thanks.
 

Alfa-Q L83r

New member
Nov 3, 2016
1
0
hope this helps sorry if it doesnt =/

i cant post links so i encoded everything with base64 haha its not links to the msmdownload tool but searches that may lead you there COPY the green part-----> W3VybF1odHRwczovL2ZvcnVtcy5vbmVwbHVzLmNvbS90aHJlYWRzL2h5ZHJvZ2VuLW9zLW1zbS1kb3dubG9hZC10b29sLjExNzEzNzYvWy91cmxdCi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uClt1cmxdaHR0cHM6Ly9zZWFyY2guY2Fycm90Mi5vcmcvIy9zZWFyY2gvd2ViL2hkNjFjYi9mb2xkZXJzWy91cmxdCi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uClt1cmxdaHR0cHM6Ly9zZWFyY2guY2Fycm90Mi5vcmcvIy9zZWFyY2gvd2ViL2hkMTkyNS9mb2xkZXJzWy91cmxdCi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uClt1cmxdaHR0cHM6Ly9zZWFyY2guY2Fycm90Mi5vcmcvIy9zZWFyY2gvd2ViL2hkMTkyNSUyMG1zbWRvd25sb2FkdG9vbC9mb2xkZXJzWy91cmxdCi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uClt1cmxdaHR0cDovL3RpbnkuY2MvaGQxOTI1Z29vc2VhcmNoWy91cmxdCi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uClt1cmxdaHR0cHM6Ly93ZWIuYXJjaGl2ZS5vcmcvd2ViLzIwMTkqL2h0dHBzOi8vd3d3Lm9uZXBsdXMuY29tLzd0LXByby1tY2xhcmVuWy91cmxdCi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uClt1cmxdaHR0cDovL3RpbnkuY2MvbW9yZXNlYXJjaGVzWy91cmxdCi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLiggIC4gICAgWCAgIC4gICkuLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4= <---END OF COPY and paste it here base64decode. org/
or ...............
go here if you dont want to decrypt that haha txt. fyi/+/408dbcd1/
(remove the space between txt. fyi./
 
Dec 25, 2019
29
2
can anyone tellme if this is the normal file for OP7T PRO 5G Mclaren

rev_OverSeas_200215_0222_release_mcl002_OTA-BLOCK_Signed_fp2002150222_cve2020-02-01_ufs_10.0.27.HD61CB
hotdogg_13_A.01_200215.ops
MsmDownloadTool V4.0.exe

or is this perhaps a dual sim version? bc thats what I am looking for
 
Last edited:

NotATreoFan

Senior Moderator / Developer Committee
Staff member
can anyone tellme if this is the normal file for OP7T PRO 5G Mclaren

rev_OverSeas_200215_0222_release_mcl002_OTA-BLOCK_Signed_fp2002150222_cve2020-02-01_ufs_10.0.27.HD61CB
hotdogg_13_A.01_200215.ops
MsmDownloadTool V4.0.exe

or is this perhaps a dual sim version? bc thats what I am looking for

There is no dual SIM build for the TMO variant.

Based on the hotdogg and 10.0.27.HD61CB in the name, it is for our device. I believe the global firmware is only up to 10.0.9.
 
Dec 25, 2019
29
2
well ive been harassing oneplus to activate the second sim. Out of at least 2 dozen reps I finally got them to send me files in anticipation of remote session.

On two seperate cases i filed they sent me the same files that i listed. I was completely clear that I needed to activate dual sim and that was the sole purpose. We all know theres no international rom but they claim this will do it.

They say theres such a long wait for remote session bc of the whole virus ordeal so who knows....
 

Top Liked Posts

  • There are no posts matching your filters.
  • 5
    I think I found how to activate Dual SIM on TMO firmware (and 5G Radio on Global Firmware)

    Will create a new thread soon...
    4
    Is it possible for someone to pull all these partitions?
    aop.img
    bluetooth.img
    boot.img
    dsp.img
    dtbo.img
    LOGO.img
    modem.img
    oem_stanvbk.img
    qupfw.img
    storsec.img
    multiimgoem.img
    uefisecapp.img
    recovery.img
    vbmeta.img
    vbmeta_system.img
    opproduct.img
    system.img
    vendor.img
    product.img

    The super.img method isn't working for me:(
    https://drive.google.com/open?id=1J5_igi3ekdHM-nXT72wKyfHK9pxfI0gc
    SHA1 of flash.zip: 1573fb5d6daf63005f54673469b27603c8676131

    Android security patch level
    November 1, 2019
    Manual below, also included flash-all.bat and flash-all.sh , etc., in the zipped flash folder; I haven't tested the two scripts yet, so please let me know if they need edits. If anyone was going to use Google's files, I would recommend copying extracted content to the same folder as the images (or cut/pasting extracted images vice-versa).
    (note: fastboot -w wipes userdata; this avoids errors, but please have a backup of important files first)
    Starting in bootloader is OK for all partitions except super; it has to reboot into userspace to flash the super partition without forcing, because of dynamic partitioning. Thats why the command fastboot reboot fastboot.
    fastboot -w
    fastboot flash aop_a aop_a.img
    fastboot flash aop_b aop_b.img
    fastboot flash bluetooth_a bluetooth_a.img
    fastboot flash bluetooth_b bluetooth_b.img
    fastboot flash boot_a boot_a.img
    fastboot flash boot_b boot_b.img
    fastboot flash dsp_a dsp_a.img
    fastboot flash dsp_b dsp_b.img
    fastboot flash dtbo_a dtbo_a.img
    fastboot flash dtbo_b dtbo_b.img
    fastboot flash LOGO_a LOGO_a.img
    fastboot flash LOGO_b LOGO_b.img
    fastboot flash modem_a modem_a.img
    fastboot flash modem_b modem_b.img
    fastboot flash oem_stanvbk oem_stanvbk.img
    fastboot flash qupfw_a qupfw_a.img
    fastboot flash qupfw_b qupfw_b.img
    fastboot flash storsec_a storsec_a.img
    fastboot flash storsec_b storsec_b.img
    fastboot flash multiimgoem_a multiimgoem_a.img
    fastboot flash multiimgoem_b multiimgoem_b.img
    fastboot flash uefisecapp_a uefisecapp_a.img
    fastboot flash uefisecapp_b uefisecapp_b.img
    fastboot flash recovery_a recovery_a.img
    fastboot flash recovery_b recovery_b.img
    fastboot --disable-verity flash vbmeta_a vbmeta_a.img
    fastboot --disable-verity flash vbmeta_b vbmeta_b.img
    fastboot --disable-verity flash vbmeta_system_a vbmeta_system_a.img
    fastboot --disable-verity flash vbmeta_system_b vbmeta_system_b.img
    fastboot reboot fastboot
    fastboot --set-active=b
    fastboot flash super super.img


    (If your logo_a.img and logo_b.img are not LOGO_A.img and LOGO_B.img (i.e., if the images are lower-case), then use fastboot flash LOGO_A logo_a.img and fastboot flash LOGO_b logo_b.img; this has been corrected, and only matters if downloaded before corrected.)
    3
    I also asked OnePlus https://www.oneplus.com/support/contact for a MSM image for the OnePlus 7T Pro 5G McLaren, since it's critical for safe development. In my case, they did not say no, they just gave me a boilerplate response of, "About your concern we would like to inform you that we will take this as feedback and pass it along to our developer team so that this update can be rectified in the upcoming updates in the near future." They emailed me again asking for a further response and I haven't replied yet, because that second email was more obviously automated and did not have a name like the first one did. I think they could possibly let a tech post it to XDA, etc., if convinced by someone with experience like a XDA Recognized Developer. :)

    I just got off a chat with an agent and they tell me I'll get a remote session with their technical team in 24-48 hours I'm gonna do my best to get the image/ password for you guys
    3
    I would like to create a hybrid super.img with Global 7T Pro img & 5G 7T Pro img. (maybe keeping modem/vendor/kernel from 5G) It should be possible.

    I can't compile lpunpack. (Ubuntu 18.10) Still can't extract super.img for individual images... and what about repack? (in order to create hybrid super.img)

    Has anyone been able to get that super.img extracted?:confused:

    I get this error every time!
    [email protected]:~/Firmware_extractor$ ./extractor.sh firmware.zip
    Create Temp and out dir
    Extracting firmware on: /home/eosdev/Firmware_extractor/out
    ./extractor.sh: line 168: gawk: command not found
    ./extractor.sh: line 207: gawk: command not found

    As much as I love(d) arch (currently a gentooist) thats the exact type of distro
    that binaries floating around the web are not going to work for forever. You
    can build your own lpunpack, which will definitely work on your system, but
    I don't know how to do that outside of using the lineageos/etc build tree
    yet, however.

    In my case, I just want a clean hybrid img in order to activate the dual sim function. That's all I want, the TMO firmware is perfectly fine... (and replace boot/shutdown animations with original McLaren bootanimations) This super.img pull procedure and the ability to push/restore it back is a huge step forward for our McLaren 5G. At least there is a bit of light the end of the tunnel. (even without the damn MSM Tool)

    @ntzrmtthihu777 Can you post the super.img extracted... at least that way we can flash images individually. (and test replacing/swapping images)

    Also... you do have a 7T Pro too? lol... You have the full kit required... lol (we also need the 7T Pro images... lol)

    Just renamed the super.zip to firmware.zip. Installed gawk and still nothing, no error but empty output folder:(

    Don't rename to .zip. Keep the .img file (super.img) and run:

    Code:
    [email protected]:~/Desktop/oneplus/Firmware_extractor-master/tools/Linux/bin$ ./lpunpack super.img

    inside the bin directory "bin" (that's where lpunpack is located)

    see screenshot...

    and of course make sure you installed all the packages:


    Code:
    sudo -i

    Code:
    apt install unace unrar zip unzip p7zip-full p7zip-rar sharutils rar uudeview mpack arj cabextract file-roller

    Code:
    apt install liblzma-dev python-pip brotli lz4

    Code:
    pip install backports.lzma protobuf pycrypto

    Code:
    apt install gawk
    2
    Barring actually getting the MSM I may have a method of recovery using fastboot and friends. However, I need the help of
    a hotdogg owner with stock firmware & unlocked bootloader. The method is non-destructive (aside from the unlocking nuking
    your data); just requires you to use fastboot to boot a twrp image and use adb to pull a partition (its 15gb, so to make it faster
    you may want to use a real usb-c 3.0 cable; I don't think the orange one that comes with it is) and unpack it with a tool
    called 'lpunpack' (unfortunately I don't know how to build it outside of an aosp/lineageos/grapheneos tree yet).