[FIX][EMMC] Nexus 7 2013 ⊕ bricked, dead, frozen or stuck ⊕

Search This thread

Aprate

Senior Member
Mar 25, 2008
123
15
Firstly, don't worry about your eMMC, you have a solid Toshiba "MMC_NAME=016G92" (y)

Your log...
Code:
<3>[   24.211944] elan-ktf3k 3-0010: [elan] elan_ktf3k_ts_recv_data: i2c_master_recv error?!
<3>[   24.212432] qup_i2c qup_i2c.3: QUP: I2C status flags :0x11100c8, irq:183
<3>[   24.212707] qup_i2c qup_i2c.3: I2C slave addr:0x10 not connected

ELAN, the touch control IC, generates an error and stops/slows the boot process. It is very easy to fix.

However, I note a second problem. One of the newest ROMs you tried, LOS17.1 maybe, had messed up some data on the 'persist' partition. Again, no worries, I attached a fix for that - install it from TWRP. Stock ROM will be stuck on boot logo without the fix.

Cheers!
Oh, many thanks! I'll try to get my tablet up and running again. The tablet crashed after having repartition and Los 17.1 for a month.

It Boots again! Still dont know why it wouldnt flash the first time i tried... And because of the fix you included it booted. Now i can flash custom again!

Cheers!

@k23m might it be wiser to flash my persist.img backup instead of the fix ?
 
Last edited:

MasterFISHER

New member
Nov 29, 2013
2
0
Rovenki
ОШИБКА.jpg
what am I doing wrong? file size 0 is confusing. Is it a dead memory?
Google Translate
 

k23m

Senior Member
  • Jan 3, 2016
    897
    500
    It Boots again! Still dont know why it wouldnt flash the first time i tried... And because of the fix you included it booted. Now i can flash custom again!
    Cheers!
    @k23m might it be wiser to flash my persist.img backup instead of the fix ?
    The first time you also had the primary hardware problem, I guess...

    Yes an old, clean backup of persist image would work too but in this particular data corruption context, the fix is equally effective.

    (y)

    what am I doing wrong? file size 0 is confusing. Is it a dead memory? Google Translate

    Why are you unbricking? I note that many people do it unnecessarily. The only valid reasons are:
    • new eMMC chip
    • damaged bootloader
    • corrupt GPT
    Anyway, when I simulated "no-eMMC" by cutting off its power supply track, I got the same write 0 error...

    0.png
     

    Aprate

    Senior Member
    Mar 25, 2008
    123
    15
    The first time you also had the primary hardware problem, I guess...

    Yes an old, clean backup of persist image would work too but in this particular data corruption context, the fix is equally effective.

    (y)

    Los17.1 is up and running again. The connector might need to be reseated more often probaby. Did this multiple times already. Might use a little tape on it lol.

    And to comment why people use the unbricking tool, in my case i thought the emmc was dead. Tablet did nothing but giving me errors no matter what i did. But a few days later no problems at all anymore. Thanks to you :)
     

    jasonnewland

    New member
    Mar 24, 2021
    1
    0
    My PC sees the Nexus 7, Restock sees the Nexus 7, but restock seems to fail when it tries to send the bootloader to the Nexus 7. What am I doing wrong?

    Wed 03/24/2021 14:47:00.23
    ALLUSERSPROFILE=C:\ProgramData
    APPDATA=C:\Users\jdnew\AppData\Roaming
    CommonProgramFiles=C:\Program Files\Common Files
    CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
    CommonProgramW6432=C:\Program Files\Common Files
    COMPUTERNAME=DESKTOP-GJ6Q811
    ComSpec=C:\Windows\system32\cmd.exe
    DriverData=C:\Windows\System32\Drivers\DriverData
    FPS_BROWSER_APP_PROFILE_STRING=Internet Explorer
    FPS_BROWSER_USER_PROFILE_STRING=Default
    HOMEDRIVE=C:
    HOMEPATH=\Users\jdnew
    LOCALAPPDATA=C:\Users\jdnew\AppData\Local
    LOGONSERVER=\\DESKTOP-GJ6Q811
    MOZ_PLUGIN_PATH=C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\
    NUMBER_OF_PROCESSORS=12
    OneDrive=C:\Users\jdnew\OneDrive
    OneDriveConsumer=C:\Users\jdnew\OneDrive
    OS=Windows_NT
    Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Program Files\NVIDIA Corporation\NVIDIA NvDLISR;C:\Program Files\PuTTY\;C:\Users\jdnew\AppData\Local\Microsoft\WindowsApps;"D:\Desktop\Restock1\Restock\data"
    PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
    PROCESSOR_ARCHITECTURE=AMD64
    PROCESSOR_IDENTIFIER=AMD64 Family 25 Model 33 Stepping 0, AuthenticAMD
    PROCESSOR_LEVEL=25
    PROCESSOR_REVISION=2100
    PROD=flo
    ProgramData=C:\ProgramData
    ProgramFiles=C:\Program Files
    ProgramFiles(x86)=C:\Program Files (x86)
    ProgramW6432=C:\Program Files
    PROMPT=$P$G
    PSModulePath=C:\Program Files\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules
    PUBLIC=C:\Users\Public
    SESSIONNAME=Console
    SIDL=https://dl.google.com/dl/android/aosp/razor-mob30x-factory-52684dff.zip
    SIFN=razor-mob30x
    SIZN=razor-mob30x-factory-52684dff.zip
    SUPPORT=http://bit.ly/2C35sLZ
    SystemDrive=C:
    SystemRoot=C:\Windows
    TEMP=C:\Users\jdnew\AppData\Local\Temp
    TMP=C:\Users\jdnew\AppData\Local\Temp
    UDDL=https://dl-ssl.google.com/android/repository/latest_usb_driver_windows.zip
    UDFN=usb_driver
    UDZN=latest_usb_driver_windows.zip
    USERDOMAIN=DESKTOP-GJ6Q811
    USERDOMAIN_ROAMINGPROFILE=DESKTOP-GJ6Q811
    USERNAME=jdnew
    USERPROFILE=C:\Users\jdnew
    windir=C:\Windows
    Volume in drive D has no label.
    Volume Serial Number is 163D-2EB6

    Directory of D:\Desktop\Restock1\Restock\data

    03/24/2021 02:47 PM <DIR> .
    03/24/2021 02:47 PM <DIR> ..
    11/09/2012 08:54 PM 47,616 AdbWinApi.dll
    11/09/2012 08:54 PM 29,696 AdbWinUsbApi.dll
    08/20/2013 07:03 AM 4,004,960 bootloader-03.14.img
    06/17/2013 09:03 PM 306,176 DPInst.exe
    10/25/2019 11:34 AM 170 DPInst.xml
    06/17/2013 11:27 PM 328,192 DPInst64.exe
    11/09/2012 08:54 PM 82,432 fastboot.exe
    12/26/2014 10:43 PM 36,352 gpt_both0.bin
    09/19/2014 03:30 AM 8,682,859 latest_usb_driver_windows.zip
    03/24/2021 02:35 PM <DIR> razor-mob30x
    02/28/2020 09:53 AM 505,296,115 razor-mob30x-factory-52684dff.zip
    03/24/2021 02:47 PM 2,198 restock.log
    01/15/2001 01:34 AM 69,632 unzip.exe
    03/24/2021 02:35 PM <DIR> usb_driver
    09/12/2019 08:10 PM 956,928 wget.exe
    13 File(s) 519,843,326 bytes

    Directory of D:\Desktop\Restock1\Restock\data\razor-mob30x

    03/24/2021 02:35 PM <DIR> .
    03/24/2021 02:35 PM <DIR> ..
    07/28/2016 04:34 AM 4,009,488 bootloader-flo-flo-04.08.img
    07/28/2016 04:34 AM 852 flash-all.bat
    07/28/2016 04:34 AM 740 flash-all.sh
    07/28/2016 04:34 AM 698 flash-base.sh
    07/28/2016 04:34 AM 504,358,385 image-razor-mob30x.zip
    5 File(s) 508,370,163 bytes

    Directory of D:\Desktop\Restock1\Restock\data\usb_driver

    03/24/2021 02:35 PM <DIR> .
    03/24/2021 02:35 PM <DIR> ..
    03/24/2021 02:35 PM <DIR> amd64
    09/16/2014 05:08 AM 11,151 androidwinusb86.cat
    09/16/2014 05:08 AM 11,187 androidwinusba64.cat
    09/16/2014 05:08 AM 5,917 android_winusb.inf
    03/24/2021 02:35 PM <DIR> i386
    09/16/2014 05:08 AM 64 source.properties
    4 File(s) 28,319 bytes

    Directory of D:\Desktop\Restock1\Restock\data\usb_driver\amd64

    03/24/2021 02:35 PM <DIR> .
    03/24/2021 02:35 PM <DIR> ..
    09/16/2014 05:08 AM 236 NOTICE.txt
    09/16/2014 05:08 AM 1,721,576 WdfCoInstaller01009.dll
    09/16/2014 05:08 AM 1,002,728 winusbcoinstaller2.dll
    09/16/2014 05:08 AM 2,152,176 WUDFUpdate_01009.dll
    4 File(s) 4,876,716 bytes

    Directory of D:\Desktop\Restock1\Restock\data\usb_driver\i386

    03/24/2021 02:35 PM <DIR> .
    03/24/2021 02:35 PM <DIR> ..
    09/16/2014 05:08 AM 236 NOTICE.txt
    09/16/2014 05:08 AM 1,461,992 WdfCoInstaller01009.dll
    09/16/2014 05:08 AM 851,176 winusbcoinstaller2.dll
    09/16/2014 05:08 AM 1,837,296 WUDFUpdate_01009.dll
    4 File(s) 4,150,700 bytes

    Total Files Listed:
    30 File(s) 1,037,269,224 bytes
    14 Dir(s) 510,142,390,272 bytes free
    ...
    (bootloader) Device tampered: false
    (bootloader) Device unlocked: false
    (bootloader) SB=Y
    OKAY [ 0.005s]
    finished. total time: 0.005s
    (bootloader) version-bootloader: FLO-04.08
    (bootloader) version-baseband: none
    (bootloader) version-hardware: rev_e
    (bootloader) version-cdma: N/A
    (bootloader) variant: flo 16G
    (bootloader) serialno: 0874acdf
    (bootloader) product: flo
    (bootloader) secure_boot: enabled
    (bootloader) lock_state: unlocked
    (bootloader) project: flo
    (bootloader) off-mode-charge: yes
    (bootloader) uart-on: no
    (bootloader) partition-type:bootloader: emmc
    (bootloader) partition-size:bootloader: 0x0000000000aee000
    (bootloader) partition-type:recovery: emmc
    (bootloader) partition-size:recovery: 0x0000000000a00000
    (bootloader) partition-type:boot: emmc
    (bootloader) partition-size:boot: 0x0000000001000000
    (bootloader) partition-type:system: ext4
    (bootloader) partition-size:system: 0x0000000034800000
    (bootloader) partition-type:cache: ext4
    (bootloader) partition-size:cache: 0x0000000023000000
    (bootloader) partition-type:userdata: ext4
    (bootloader) partition-size:userdata: 0x000000031b3fbe00
    all:
    finished. total time: 0.026s
    ...
    (bootloader) partition[1].name = radio
    (bootloader) partition[1].first_lba = 131072
    (bootloader) partition[1].last_lba = 306143
    (bootloader) partition[1].size 87536 KB
    (bootloader) partition[2].name = modemst1
    (bootloader) partition[2].first_lba = 393216
    (bootloader) partition[2].last_lba = 399359
    (bootloader) partition[2].size 3072 KB
    (bootloader) partition[3].name = modemst2
    (bootloader) partition[3].first_lba = 399360
    (bootloader) partition[3].last_lba = 405503
    (bootloader) partition[3].size 3072 KB
    (bootloader) partition[4].name = persist
    (bootloader) partition[4].first_lba = 524288
    (bootloader) partition[4].last_lba = 554287
    (bootloader) partition[4].size 15000 KB
    (bootloader) partition[5].name = m9kefs1
    (bootloader) partition[5].first_lba = 655360
    (bootloader) partition[5].last_lba = 656919
    (bootloader) partition[5].size 780 KB
    (bootloader) partition[6].name = m9kefs2
    (bootloader) partition[6].first_lba = 656920
    (bootloader) partition[6].last_lba = 658479
    (bootloader) partition[6].size 780 KB
    (bootloader) partition[7].name = m9kefs3
    (bootloader) partition[7].first_lba = 786432
    (bootloader) partition[7].last_lba = 787991
    (bootloader) partition[7].size 780 KB
    (bootloader) partition[8].name = fsg
    (bootloader) partition[8].first_lba = 787992
    (bootloader) partition[8].last_lba = 794135
    (bootloader) partition[8].size 3072 KB
    (bootloader) partition[9].name = sbl1
    (bootloader) partition[9].first_lba = 917504
    (bootloader) partition[9].last_lba = 920503
    (bootloader) partition[9].size 1500 KB
    (bootloader) partition[10].name = sbl2
    (bootloader) partition[10].first_lba = 920504
    (bootloader) partition[10].last_lba = 923503
    (bootloader) partition[10].size 1500 KB
    (bootloader) partition[11].name = sbl3
    (bootloader) partition[11].first_lba = 923504
    (bootloader) partition[11].last_lba = 927599
    (bootloader) partition[11].size 2048 KB
    (bootloader) partition[12].name = aboot
    (bootloader) partition[12].first_lba = 927600
    (bootloader) partition[12].last_lba = 937839
    (bootloader) partition[12].size 5120 KB
    (bootloader) partition[13].name = rpm
    (bootloader) partition[13].first_lba = 937840
    (bootloader) partition[13].last_lba = 938863
    (bootloader) partition[13].size 512 KB
    (bootloader) partition[14].name = boot
    (bootloader) partition[14].first_lba = 1048576
    (bootloader) partition[14].last_lba = 1081343
    (bootloader) partition[14].size 16384 KB
    (bootloader) partition[15].name = tz
    (bootloader) partition[15].first_lba = 1179648
    (bootloader) partition[15].last_lba = 1180671
    (bootloader) partition[15].size 512 KB
    (bootloader) partition[16].name = pad
    (bootloader) partition[16].first_lba = 1180672
    (bootloader) partition[16].last_lba = 1180673
    (bootloader) partition[16].size 1 KB
    (bootloader) partition[17].name = sbl2b
    (bootloader) partition[17].first_lba = 1180674
    (bootloader) partition[17].last_lba = 1183673
    (bootloader) partition[17].size 1500 KB
    (bootloader) partition[18].name = sbl3b
    (bootloader) partition[18].first_lba = 1183674
    (bootloader) partition[18].last_lba = 1187769
    (bootloader) partition[18].size 2048 KB
    (bootloader) partition[19].name = abootb
    (bootloader) partition[19].first_lba = 1187770
    (bootloader) partition[19].last_lba = 1198009
    (bootloader) partition[19].size 5120 KB
    (bootloader) partition[20].name = rpmb
    (bootloader) partition[20].first_lba = 1198010
    (bootloader) partition[20].last_lba = 1199033
    (bootloader) partition[20].size 512 KB
    (bootloader) partition[21].name = tzb
    (bootloader) partition[21].first_lba = 1199034
    (bootloader) partition[21].last_lba = 1200057
    (bootloader) partition[21].size 512 KB
    (bootloader) partition[22].name = system
    (bootloader) partition[22].first_lba = 1310720
    (bootloader) partition[22].last_lba = 3031039
    (bootloader) partition[22].size 860160 KB
    (bootloader) partition[23].name = cache
    (bootloader) partition[23].first_lba = 3031040
    (bootloader) partition[23].last_lba = 4177919
    (bootloader) partition[23].size 573440 KB
    (bootloader) partition[24].name = misc
    (bootloader) partition[24].first_lba = 4194304
    (bootloader) partition[24].last_lba = 4196351
    (bootloader) partition[24].size 1024 KB
    (bootloader) partition[25].name = recovery
    (bootloader) partition[25].first_lba = 4325376
    (bootloader) partition[25].last_lba = 4345855
    (bootloader) partition[25].size 10240 KB
    (bootloader) partition[26].name = DDR
    (bootloader) partition[26].first_lba = 4456448
    (bootloader) partition[26].last_lba = 4456463
    (bootloader) partition[26].size 8 KB
    (bootloader) partition[27].name = ssd
    (bootloader) partition[27].first_lba = 4456464
    (bootloader) partition[27].last_lba = 4456479
    (bootloader) partition[27].size 8 KB
    (bootloader) partition[28].name = m9kefsc
    (bootloader) partition[28].first_lba = 4456480
    (bootloader) partition[28].last_lba = 4456481
    (bootloader) partition[28].size 1 KB
    (bootloader) partition[29].name = metadata
    (bootloader) partition[29].first_lba = 4587520
    (bootloader) partition[29].last_lba = 4587583
    (bootloader) partition[29].size 32 KB
    (bootloader) partition[30].name = userdata
    (bootloader) partition[30].first_lba = 4718592
    (bootloader) partition[30].last_lba = 30777310
    (bootloader) partition[30].size 13029359 KB
    (bootloader) partition[31].name =
    (bootloader) partition[31].first_lba = 0
    (bootloader) partition[31].last_lba = 0
    (bootloader) partition[31].size 0 KB
    (bootloader) partition[32].name =
    (bootloader) partition[32].first_lba = 0
    (bootloader) partition[32].last_lba = 0
    (bootloader) partition[32].size 0 KB
    (bootloader) partition[33].name =
    (bootloader) partition[33].first_lba = 0
    (bootloader) partition[33].last_lba = 0
    (bootloader) partition[33].size 0 KB
    (bootloader) partition[34].name =
    (bootloader) partition[34].first_lba = 0
    (bootloader) partition[34].last_lba = 0
    (bootloader) partition[34].size 0 KB
    (bootloader) partition[35].name =
    (bootloader) partition[35].first_lba = 0
    (bootloader) partition[35].last_lba = 0
    (bootloader) partition[35].size 0 KB
    (bootloader) partition[36].name =
    (bootloader) partition[36].first_lba = 0
    (bootloader) partition[36].last_lba = 0
    (bootloader) partition[36].size 0 KB
    (bootloader) partition[37].name =
    (bootloader) partition[37].first_lba = 0
    (bootloader) partition[37].last_lba = 0
    (bootloader) partition[37].size 0 KB
    OKAY [ 0.150s]
    finished. total time: 0.150s
     

    k23m

    Senior Member
  • Jan 3, 2016
    897
    500
    My PC sees the Nexus 7, Restock sees the Nexus 7, but restock seems to fail when it tries to send the bootloader to the Nexus 7. What am I doing wrong?

    How Restock fails?

    Code:
    If "FAILED (remote: failed to write gpt)", eMMC needs replacement.
    If "FAILED (remote: flash write failure)", eMMC needs replacement.

    Like this? Then, the reason is clearly stated.
     

    SomeSauce

    Member
    Mar 28, 2021
    7
    2
    Hi, first off, I'm totally new to Nexus 7 tinkering, my device is entirely stock; anyway, I couldn't get MiFlash to flash correctly, but first let me explain how I got there:

    I finally received my wireless charger for my N7, because the USB port wasn't working. I powered up my N7 2013 16GB Hynix, 4 months after it was constantly off... And the screen didn't turn on... The excitement to use my tablet back again was just gone.

    After tons of research, I found that my device was recognized as a QDLoad, and, after installing drivers, it was in 9006 mode luckily!

    I proceeded to use a linux machine, plugged in my tablet, and fortunately I had access to my eMMC storage, I backed up the aboot(b), boot, persist, radio, rpm(b), sbl(1/2/3)(b), tz(b) partitions, as well as my most important data from the userdata partition (media and the /data/app folder of all users, containing all the app data, my game saves are intact!). Besides, I noticed some strange I/O errors in dmesg while copying files. That doesn't smell good, but 99% of the files seemed OK.

    Then, I wanted to try out something: flash the aboot, abootb, boot (HUGE MISTAKE!!!!), sbl(2/3)(b) partitions from a working N7 using dd... Did that, and guess what? IT WORKED! And it even unlocked my bootloader! But... it was stuck in a bootloop. Crap. I'm sure it wouldn't bootloop if I hadn't replaced the "boot" partition.
    The USB port decided to not work anymore for some reason. I bought a replacement daughterboard from Aliexpress, put it in my tablet. USB now worked great!

    I now had access to fastboot, so I flashed TWRP and ran it successfully. Of course, this wouldn't be fun without another problem: the touchscreen is not responsive. I tried to reseat the large silver cable multiple times, but it didn't work. I decided to live with it and do what I could. By the way, I tried to use a OTG adapter to use an USB mouse with TWRP, it didn't work.

    Using TWRP and adb shell, I decided to try to repair my device using what I considered "the safest route for keeping my data": adb sideload. So that's what I did, using Google's official ota MOB30X.

    Result of that sideload: a catastrophic failure. My tablet was stuck on the "patching system image unconditionally" for over 4 hours without any signs of progress. I rebooted the tablet... Back to the initial problem, except that it's even worse, now in the 9008 mode!

    Morality: always do a clean install, sometimes your personal data is not worth your device. Learned that the hard way, I guess?

    ~​
    Anyway, before putting my tablet in the wonderful museum of devices I stupidly broke, I tried the last resort: MiFlash. Actually, this should've been the first thing to do, but I was way too attached to my data that I became insanely dumb. Also, this is giving me a disproportionate amount of anxiety everyday and it even prevent me from sleeping correctly, wow.

    I followed the instructions given there, using multiple devices:
    • Laptop: A windows 7 x64 laptop
    • PC: A windows 10 x64 PC
    And here are my multiple attempts:
    1. I tried to run MiFlash (the given version) on the Laptop, it ran, and got stuck with "WriteFile position 0000000000000000, size 0", I let it do its work for a little while, and it just crashed! While leaving behind its shameful death a 2GB log, filled with "WriteFile position 0000000000000000, size 0" lines. Unfortunately, I can't send the log right now, as I don't have access to the Laptop.
    2. I tried to run it on the PC, no USB issues and the devices is recognized correctly. That's some great signs, will my tablet come back to life? Of course not, it stops with various errors, there is either "Reached the end of file", "Unspecified error" or even "The specified service does not exist" combined with "receiving hello packet", "Send configure command", "Send nop command" or "Send parameters command". Of course, I tried to try other USB ports, restart my computer, restart my tablet with the two volume buttons pushed, etc. But no dice. I attached all the logs related to my attempts in this post.
    3. Then I tried to run it again on the Laptop, and it's essentially the same problems as with the PC.
    I will try tomorrow to use a Win 10 PE x86 with admin account, because it worked for n7br.

    Maybe that the eMMC just reached its end of life? I don't know, and it seems unlikely. But at this point it's really hard to keep hope. Nonetheless, although it cost my tablet (and a replacement daughterboard), it's was a fun adventure and I learned a TON about Android's internals, flashing, fastboot, repairing a N7, and Qualcomm internals as well. My N7 was crazy slow anyway, it's time for it to retire and let its successor I chose (the Lenovo Tab M8, cheap, almost stock Android, ok perfs, perfect for what I need!). Although, it's kind of frustrating to give efforts over 3 months on fixing a tablet that ends up hard bricked. Whatever, **** happens.

    But, I don't really want it to die now, see, there are others solutions, and I'm asking for your help so I don't make stupid self-taught beginner mistakes again. If I still cannot get MiFlash to work despite your precious advice, there are some alternative dangerous last-resort solutions I found:
    Please let me know what you think of these, and if it might work correctly with the N7. By the way, I learned the lesson and I don't care about my data anymore. Just make the damn thing work!

    Thanks a ton.

    Note about the logs: I did my best to convert them to UTF8 and translate them from French to English.
     

    Attachments

    • log_pc_7.txt
      3.5 KB · Views: 1
    • log_pc_9.txt
      1.3 KB · Views: 1
    • log_pc_1.txt
      1.3 KB · Views: 1
    • log_pc_2.txt
      1.2 KB · Views: 1
    • log_pc_3.txt
      8.8 KB · Views: 2
    • log_pc_4.txt
      2.9 KB · Views: 1
    • log_pc_5.txt
      8.9 KB · Views: 1
    • log_pc_6.txt
      3.5 KB · Views: 1
    • log_pc_8.txt
      3.3 KB · Views: 1
    • Like
    Reactions: ipdev and k23m

    k23m

    Senior Member
  • Jan 3, 2016
    897
    500
    But, I don't really want it to die now, see, there are others solutions, and I'm asking for your help so I don't make stupid self-taught beginner mistakes again. If I still cannot get MiFlash to work despite your precious advice, there are some alternative dangerous last-resort solutions I found:
    Please let me know what you think of these, and if it might work correctly with the N7.

    Hello! Thank you for a very detailed report. MiFlash works for sure and there is no need to struggle with adaptation (if even possible) of the other solutions for N7 unbricking. I attached a log of a no-or-bad-eMMC flash - your logs do not seem to indicate chip failure. Let's see how your x86 flash goes.

    Note:
    USB port fix
    new daughterboard issues
     

    Attachments

    • missing emmc miflash log.txt
      3.2 KB · Views: 5
    • Like
    Reactions: utfluc and ipdev

    SomeSauce

    Member
    Mar 28, 2021
    7
    2
    Hi,

    I tried to do it on another machine using WinPE x86. After many uninteresting failed attempts, I found a really intriguing one that also worries me a bit. It looks like it "crashed" while flashing something: it ended with an "unspecified error". I didn't reboot nor unplug my tablet and computer for precaution. The log is attached. Please tell me what would be the wisest to do, thanks!

    Update 1: Found that the error code of the "unspecified error", 0xc00cee61 meant that XMLLite's parsing/generation failed because of an "Illegal qualified name character". After poking around in the MiFlash exe, I found out that it does use the XMLLite.dll library! Now, what is this illegal name character? I have no clue.

    Update 2: Yup, it reads XML, but I'm a total potato at decompiling so I can't explain where the xml comes from.
    1617048240881.png
     

    Attachments

    Last edited:

    k23m

    Senior Member
  • Jan 3, 2016
    897
    500
    Your log has no "Catastrophic failure" entries like on the above, known bad eMMC log but it does stop or fail at the very first flash write attempt. I attached a complete 'good' log. Hopefully your issues have something to do with MiFlash run environment only.
     

    Attachments

    • MiFlash-OK.log
      13.5 KB · Views: 5
    • Like
    Reactions: utfluc

    SomeSauce

    Member
    Mar 28, 2021
    7
    2
    Your log has no "Catastrophic failure" entries like on the above, known bad eMMC log but it does stop or fail at the very first flash write attempt. I attached a complete 'good' log. Hopefully your issues have something to do with MiFlash run environment only.
    Great to hear, thanks for the log. Besides, this error seems to be internal from MiFlash as a google search with miflash and the error code yields absolutely NOTHING! I'll retry another flash, dump the memory and sniff the COM communications to see if there's any XML in there.
     

    k23m

    Senior Member
  • Jan 3, 2016
    897
    500
    Nexus 7 2013 Unbricking Guide for Windows 10 x64 - revised and simplified

    If your tablet can boot in fastboot mode, you do not need it.

    • unpack N7-MiFlash-min.zip
    • install MiFlash/MiPhone
    • turn on and connect N7 to PC
    • new "Qualcomm HS-USB Diagnostics 9008" device will be registered
    • install the driver from Win10-x64-VID_05C6&PID_9008-v2.1.0.5.zip
    • run MiFlash
    • click Refresh, note a new device on a high COM port number
    • click Browse and go to the N7-MiFlash-min folder
    • click Flash (see attachments)
    • when flashing is finished after 85 seconds, power N7 off
    • boot it in fastboot mode (power+vol-)
    • run RESTOCK, ignore errors and do "Restore original partitions"

    Note

    - on a new blank eMMC, stock ROM will be stuck on the boot logo. Format the 'persist' partition and flash k23m-persist-fix2.zip using: fastboot boot twrp.img

    - Nexus 7 2013 Unbricking Guide for Linux and Mac OS X

    - the original guide


    🖥️🖱️
     

    Attachments

    • Win10-x64-VID_05C6&PID_9008-v2.1.0.5.zip
      373.5 KB · Views: 27
    • flash-finished.png
      flash-finished.png
      10.3 KB · Views: 14
    • [email protected]
      1.2 KB · Views: 3
    • [email protected]
      15.2 KB · Views: 3
    • N7-MiFlash-min.zip
      866.2 KB · Views: 30
    Last edited:
    • Like
    Reactions: utfluc and ipdev

    k23m

    Senior Member
  • Jan 3, 2016
    897
    500
    I tried on many different computers, usb ports and everything, and still got the same results :(.

    Do you think that I can try to use this tool: https://tarciodownload.blogspot.com/2017/01/tool-studio-emmc-download-tool-flash-as.html to solve my problem?

    No, it works only with a newer generation of devices. I've just posted a new unbricking guide for Win10-x64 which you could try directly from your PC without any WinPE USB booting.

    The only problem with running the old MiFlash on x64 is an unsigned driver. I extracted a better driver from MiPhone20160401 and attached it above. You will also find there fresh Win10-x64 logs.

    🤞
     
    • Like
    Reactions: utfluc

    SomeSauce

    Member
    Mar 28, 2021
    7
    2
    No, it works only with a newer generation of devices. I've just posted a new unbricking guide for Win10-x64 which you could try directly from your PC without any WinPE USB booting.

    The only problem with running the old MiFlash on x64 is an unsigned driver. I extracted a better driver from MiPhone20160401 and attached it above. You will also find there fresh Win10-x64 logs.

    🤞
    Thanks for the files! I tried once more using your instructions (I uninstalled the old drivers and installed the one you gave) and, unfortunately, it yet again didn't work. I also tried swapping the USB cable with another, as well as USB ports, but no dice! Why is my device resilient to repairs??? Also, my device sometimes appears as "USB\DEVICE_DESCRIPTOR_FAILURE", the issue randomly disappears after a reboot or an USB port change.

    I attached the logs, and here is a video of MiFlash running, so you can see how much time each step takes.

    Thank you for your help!

    UPDATE: I got a much more interesting log when running MiFlash on another machine. The log is attached as "special_log.log", and there is a brand new error code: 0xC00CEE04. It again seems to be related with XMLLite, and describes an "Unrecognized input signature." The general issue seems to be revolving around XMLLite for some reason.

    UPDATE 2: Yup, it's always the same pattern: "StreamWrite address 00000000, size 40960", "Open serial port "\\.\COM20"", "Send configure command", and then it stops with the 0xc00cee04 error.

    Do you have any tools other than MiFlash to try? I think it would be useful to try some, so we get more detailed information
     

    Attachments

    Last edited:

    k23m

    Senior Member
  • Jan 3, 2016
    897
    500
    Do you have any tools other than MiFlash to try? I think it would be useful to try some, so we get more detailed information

    Hello SomeSauce, there are 3 possible reasons for the errors:
    1. flashing app and OS environment
    2. N7 hardware problem
    3. N7 eMMC fault
    Let's review them.

    #1

    MiFlash 2014 has never failed me in both x86 and x64 environments but you could try a newer version, eg MiPhone20160401, not the latest ones though as they have switched to a different flashing protocol in the new generation of devices. You had inspired me to check out "unbrick_8960" but as you can see there is a compatibility issue with the Linux script. Nevertheless try it out yourself, there is nothing to lose. Finally, no matter what the app/OS, it always comes down to delivering the two exact files to the device: MPRG8064.hex and 8064_msimage.mbn - there is no other way to initialize the eMMC in-circuit (except for JTAG).

    I note that you have another N7, so if you feel brave then you could verify the app/OS flashing process on the good working unit.

    #2

    You did mention that the N7 was off for several months and it is possible its battery is faulty now (discharged below 3.0V threshold and irreversibly deteriorated). In this case the entire power supply during flashing is delivered via USB only. If it is not enough (USB port specs, cable length, etc) errors will occur. I confirm that MiFlash works OK with the battery disconnected, however I did it on a USB3 port (min 0.8A) and a very short, good quality USB cable.

    #3

    "patching system image unconditionally for over 4 hours" - "Maybe that the eMMC just reached its end of life?"

    Yes, this scenario appears to be increasingly likely. Your 16GB eMMC has a low TBW rating and it was probably killed by constant NAND re-writing during the prolonged patching episode.
     

    SomeSauce

    Member
    Mar 28, 2021
    7
    2
    Hello SomeSauce, there are 3 possible reasons for the errors:
    1. flashing app and OS environment
    2. N7 hardware problem
    3. N7 eMMC fault
    Let's review them.

    #1

    MiFlash 2014 has never failed me in both x86 and x64 environments but you could try a newer version, eg MiPhone20160401, not the latest ones though as they have switched to a different flashing protocol in the new generation of devices. You had inspired me to check out "unbrick_8960" but as you can see there is a compatibility issue with the Linux script. Nevertheless try it out yourself, there is nothing to lose. Finally, no matter what the app/OS, it always comes down to delivering the two exact files to the device: MPRG8064.hex and 8064_msimage.mbn - there is no other way to initialize the eMMC in-circuit (except for JTAG).

    I note that you have another N7, so if you feel brave then you could verify the app/OS flashing process on the good working unit.

    #2

    You did mention that the N7 was off for several months and it is possible its battery is faulty now (discharged below 3.0V threshold and irreversibly deteriorated). In this case the entire power supply during flashing is delivered via USB only. If it is not enough (USB port specs, cable length, etc) errors will occur. I confirm that MiFlash works OK with the battery disconnected, however I did it on a USB3 port (min 0.8A) and a very short, good quality USB cable.

    #3

    "patching system image unconditionally for over 4 hours" - "Maybe that the eMMC just reached its end of life?"

    Yes, this scenario appears to be increasingly likely. Your 16GB eMMC has a low TBW rating and it was probably killed by constant NAND re-writing during the prolonged patching episode.
    Hi, thanks for your response, and indeed scenario 3 seems unfortunately likely. I don't have another N7 though, maybe that I could just buy another N7 2013 motherboard and replace it, but, to be honest, that would just be money wasted as I could just buy a much newer tablet with better capacities. Maybe I'll do that one time just for fun!

    Concerning the battery, I don't think that's the problem, my tablet was "patching system image" for over 4 hours on battery. It ended up with around 40% IIRC.

    I'll try running MiPhone20160401, and if it doesn't work, the last resort unbrick_8960 on a Linux machine. And if that doesn't work... Maybe try QPST tools? ...Or just accept that my N7's EMMC is dead lol.

    Though I'm still wondering... why was TWRP constantly writing while patching the system image? Couldn't it just... stop?
     

    SomeSauce

    Member
    Mar 28, 2021
    7
    2
    ...Looks like it is dead. I used a COM port sniffer that works, flashing using MiPhone20160401 and I read the following: "Write unsuccessful." That's sad. I'll try to unplug and plug the battery to see if it makes any difference, but I doubt it will actually no, it's useless. RIP Nexus 7, or at least, the Hynix 16GB eMMC chip.

    Since the eMMC seems to be dead anyway and that the only solution would be to replace the motherboard, I'll use this device as a playground for Qualcomm flashing, I'll try many tools just for fun and discovery.

    Thanks for the huge help though!
     
    Last edited:

    arkady789

    New member
    Apr 17, 2021
    4
    2
    Samsung Galaxy S4 VE
    I have Nexus 7 (2013), the idea was to install Android 11 via 'lineage-18.1-20210407-UNOFFICIAL-flo.zip', however some place soomething went wrong. My TWPR show all system, etc as zero. When I follow any giude via fastboot -w update image-razor-lmy48i.zip it cannot proceed - I am getting
    archive does not contain 'dtbo.img'
    archive does not contain 'dt.img'
    extracting recovery.img (7 MB) to disk... took 0.016s
    archive does not contain 'recovery.sig'
    Sending 'recovery' (7860 KB) OKAY [ 0.256s]
    Writing 'recovery' FAILED (remote: 'partition table doesn't exist')
    fastboot: error: Command failed.
    When I click reboot it comes to the black screen with white "Google' in the center and open lock on the bottom.
    Any ideas if I can save this device?
     

    k23m

    Senior Member
  • Jan 3, 2016
    897
    500
    Writing 'recovery' FAILED (remote: 'partition table doesn't exist')
    fastboot: error: Command failed.
    When I click reboot it comes to the black screen with white "Google' in the center and open lock on the bottom. Any ideas if I can save this device?

    Yes:
    1. get CROSS - Custom ROM Scripted Setup
    2. run repartition.bat
    3. select: ultimate
    4. reboot
    5. install LOS18
    If error, run relog.bat and attach "relog-xxxxxx.zip" to your post
    and run RESTOCK with "restore original partitions" YES
     
    • Like
    Reactions: ipdev and arkady789

    Top Liked Posts

    • There are no posts matching your filters.
    • 2
      Writing 'recovery' FAILED (remote: 'partition table doesn't exist')
      fastboot: error: Command failed.
      When I click reboot it comes to the black screen with white "Google' in the center and open lock on the bottom. Any ideas if I can save this device?

      Yes:
      1. get CROSS - Custom ROM Scripted Setup
      2. run repartition.bat
      3. select: ultimate
      4. reboot
      5. install LOS18
      If error, run relog.bat and attach "relog-xxxxxx.zip" to your post
      and run RESTOCK with "restore original partitions" YES
      1
      Yes:
      1. get CROSS - Custom ROM Scripted Setup
      2. run repartition.bat
      3. select: ultimate
      4. reboot
      5. install LOS18
      If error, run relog.bat and attach "relog-xxxxxx.zip" to your post
      and run RESTOCK with "restore original partitions" YES
      Great, works, thank you for fast and Correct reply.
    • 12
      Nexus 7 2013 Unbricking Guide

      Instructions for soft-bricked or blank/replaced eMMC. If your tablet can boot in fastboot mode, you do not need it.

      Download these files:
      Nexus 7 2013 Service ROM
      MiFlash-20141107
      "razor" Nexus 7 [2013] (Wi-Fi) 6.0.1 (MOB30X) factory image (flo), or...
      "razorg" Nexus 7 [2013] (Mobile) 6.0.1 (MOB30X) factory image (deb)
      latest Google USB Driver
      latest ADB and Fastboot Binaries (optional)

      Next...
      • unpack the service ROM
      • install MiFlash/MiPhone
      • turn on and connect N7 to PC
      • new USB\VID_05C6&PID_9008 "Qualcomm HS-USB Diagnostics 9008" device will be registered
      • if no driver is found, point it to "C:\Program Files\Xiaomi\MiPhone\Qualcomm\Driver"
      • run MiFlash
      • click Refresh, note a new device on a high COM port number, eg. I see COM20
      • click Browse and go to the service ROM folder with 28 files
      • click Flash (see attachments)
      • when flashing is finished (ignore error messages), power N7 off
      • boot it in fastboot mode (power+vol-)
      • if necessary for fastboot, install Google USB Driver
      • from the service ROM folder check for: fastboot devices
      • run "debrick-flashall.cmd" (ignore error messages)
      • if it was a blank eMMC, do this extra step using: fastboot boot twrp.img
      • flash factory image - instructions
      • run Android MOB30X once, then you can flash TWRP and a custom ROM

      2021 UPDATE:

      - Nexus 7 2013 Unbricking Guide for Windows 10 x64 - revised and simplified

      - Nexus 7 2013 Unbricking Guide for Linux and Mac OS X

      .
      7
      Quick Links

      In this thread I would like to consolidate information about eMMC flash memory failures and remedies.

      When flash memory fails it becomes inaccessible or unwriteable with errors like the following:

      Code:
      sending 'bootloader' <3911 KB>...
      OKAY [ 0.202s ]
      writing 'bootloader'...
      FAILED <remote: flash write failure>
         or
      E:can't mount /cache/recovery/last_install
      E:can't open /cache/recovery/last_install
      E:failed closing /dev/block/platform/msm_sdcc. 1/by-name/misc (I/O error)
      E:failed to mount /cache (Invalid argument)
         or
      E:Unable to find partition size for '/boot'
      E:Unable to find partition size for '/recovery'
      E:Unable to find partition size for '/misc'
      E:Primary block device '/dev/block/platform/msm_sdcc.1/by-name/userdata' for mount point '/data' is not present!
      E:Unable to mount '/data'
      E:Unable to recreate /data/media folder.
      
         dmesg...
      mmc0: error -110 whilst initialising MMC card



      We observe these hardware failure symptoms:
      1. device is totally dead
      2. dead but flashes a few times the white LED next to USB port
      3. dead but with active USB on PC device list
      4. works up to fastboot stage or Google logo
      5. may slowly boot Android sometimes
      6. intermittently Android does not boot or work at all


      #1 - eMMC unrelated

      #2 - battery fault is most likely

      #3 - catastrophic eMMC failure or GPT/bootloader damage, PC registers a new USB\VID_05C6&PID_9008 device, refer to QPST diagnostics below

      #4 - partial eMMC failure or OS error, refer to fastboot diagnostics below

      #5 - probably eMMC failure, unlocking and TWRP tests are required - post your logs

      #6 - unlikely eMMC fault


      Fastboot Diagnostics

      If your bricked unit still works in fastboot mode then please do the following tests:
      1. boot the Nexus in fastboot mode (when off press power+vol.dn)
      2. connect it to your PC
      3. on PC run:
        fastboot oem gpt-info
        fastboot format cache
      You can run the fastboot app from Windows or Linux...

      If you get "partition[30].size 27852783 KB" then your eMMC chip is from Kingston (very high failure rate).
      If the format command freezes at any stage, then the eMMC chip is faulty and needs to be replaced.
      The normal format output takes only 1 second and is:
      Code:
      Creating filesystem with parameters:
          Size: 587202560
          Block size: 4096
          Blocks per group: 32768
          Inodes per group: 7168
          Inode size: 256
          Journal blocks: 2240
          Label:
          Blocks: 143360
          Block groups: 5
          Reserved block group size: 39
      Created filesystem with 11/35840 inodes and 4616/143360 blocks
      erasing 'cache'...
      OKAY [  0.359s]
      sending 'cache' (10984 KB)...
      OKAY [  0.359s]
      writing 'cache'...
      OKAY [  0.484s]
      finished. total time: 1.203s



      QPST Diagnostics

      Please upload your bricked device's memory dump for investigation. Just try the unbricking guide.

      • download "New Qualcomm 2012.rar"
      • extract the "fre" folder
      • connect your N7 to PC and when asked for a driver point it to the above folder
      • download "New_Qualcomm_QPST-2.7.422.zip"
      • extract it and run "setup.exe"
      • run Start/QPST/MemoryDebugApp.exe
      • in Memory Debug keep clicking "Browse" until you see a new COM port
      • in Memory Debug click "Get Regions"
      • in Memory Debug select and save "CODERAM.BIN"
      • upload "CODERAM.BIN" here


      Repair Options
      • ASUS service - apparently they can now do it for free with paid shipping!
      • motherboard replacement - for example this one "pulled from a working unit" for $25
      • RIFF JTAG Box - while the box is not cheap it can be used for other devices too (v1 was $109). Optional tool.
      • off-circuit eMMC programming and chip replacement - it is difficult and expensive but feasible
      • in-circuit Service ROM flashing - after chip replacement or if eMMC is OK but with damaged partition table or bootloader

      eMMC chip replacement
      • do not replace it with another Kingston
      • search for eMMC in FBGA 153 or 169 package
      • you can upgrade it to a higher capacity memory
      • new high-performance eMMC v5.1 requires updated software, available here


      Nexus 7 2013 uses 3 brands of eMMC chips: Kingston, Hynix and Toshiba.

      Kingston was initially identified as unreliable in this post a few years ago:

      Google Nexus 7 2013 (Asus Razor)
      This is bootloader repair package for Google Nexus 7 based on QUALCOMM APQ8064 MCU. Tegra based is not supported !
      - GPT is for 32GB chip, hence it's not ticked by default. DO NOT tick it if You have 16GB version
      - EFS/CEFS partitions You can tick in case that nothing else works, it's not recommended to try it if You haven't made backup first. In this model, partitions layout is different from all other known Qualcomm devices, hence reading first 512MB for backup wont do any help. Do do proper backup, You have to read 2GB + size (from 0x0000 0000 0000 to 0x0000 9000 0000)
      Important ! ! !
      - If You have device which hangs on Google logo, and resurrection process hangs at 1%, You'll have to replace the eMMC chip first. Kingston eMMC chips used in these devices oftenly fail and become unwriteable !
      Attached Files Asus_Nexus_7.rar (103.60 MB)


      The above file is for RIFF JTAG flasher.



      My Nexus 7 JTAG collection:

      • Asus_Nexus_7.rar
      • Asus_Nexus_7.txt
      • nexus7 jtag.jpg
      • RIFF Box JTAG GettingStarted.pdf
      • RIFF Box JTAG Manager Setup v1.56.exe


      Please post your Nexus 7 2013 eMMC maker in this thread.

      So far I have collected the following reports:

      Code:
      BRICKED         Kingston  Hynix     Toshiba
      -------------------------------------------
      graphdarnell    1                
      fuser-invent    1                
      aungmyoswe      1                
      marc1706        1                
      micl9           1                
      consumer61                          1*
      bl4cKz4cK       1
      patmann03       1
      CWempe          1
      purian23        1
      NX3             1
      ali1234         1
      lowridincrew    1
      DaWeIII         1
      HTC Tytn...     1
      jaybea          1
      vfrvulcan       1
      TechnicsKuzya   2
      barbuda         1
      Snoob25         1
      Dazmatic        1
      459below        1
      amix            1
      hypochondrej    1
                                       
      WORKING         Kingston  Hynix     Toshiba
      -------------------------------------------
      fuser-invent    1                
      k23m                      2      
      yosmokinman               2      
      Tmzdroid        1                
      graphdarnell    1         2      
      OrBy                                1
      mydian                              1
      quickdraw86               1
      micl9                     1
      tegodwin                  1*
      noahvt                    1
      Carrick Glen              1*
      Axel85                    1
      NTRNSTR                   1
      
      *2015 production


      To check the chip in working units use this app or dmesg:

      Code:
      Kingston (MMC32G)
      -----------------
      mmc0: new HS200 MMC card at address 0001
      mmcblk0: mmc0:0001 MMC32G 28.8 GiB
      
      Hynix (HBG4e)
      -------------
      mmc0: new HS200 MMC card at address 0001
      mmcblk0: mmc0:0001 HBG4e 29.1 GiB
      
      Toshiba (016G92)
      ----------------
      mmcblk0: mmc0:0001 016G92 14.6 GiB


      It is not so simple with bricked units but this device is exceptionally easy to disassemble. The chip is on the bottom of the motherboard but unlike the top, it is not covered with any shield (the purple chip).


      DKDfcwe3sHZNIY3K.large



      :good:
      3
      Thank you for fast answer and help)
      This is my log:
      OK, let me explain the situation. When we re-uploaded the service ROM to an easily accessible server (thanks davefiddes), Jelly Bean 4.2.2 system image file was removed to decrease the download size, but Jelly Bean is great at raw eMMC presets and initialization. MM and custom ROMs can not handle empty 'persist' partition and just stop booting. No problem and we're not going to waste time downgrading to an ancient OS before flashing a modern one. Please boot TWRP, copy both attached files to the root of internal storage, 'install' p4-restore-int.zip and then reboot - Android will work now.

      You might consider changing wifi and bt addresses later from the ones I made up, if you wish.
      Code:
      .bdaddr
      D850E6444444
      
      .macaddr
      443835304536333633363336
      BTW, I noticed from your log that it is a deb device. Unfortunately I can't help you restoring lost IMEI. You may be able to recover it from your broken Kingston. These partitions need to be copied.

      /EDIT 2019
      If you have used eMMC v5.1 chip, check this post for updated software.

      :highfive:
      3
      ...I'm really thankful with you for all your support and time dedicated to solve my situation! And for those who own a N7 with a dead Kingstone eMMC, I encourage you to follow my steps and learn A LOT on the way :D.
      Here goes link to download factory image MOB30X and TWRP-3.3.1-0, both with updated kernel to support eMMC 5.1: mega.nz/#F!zM9BzS7D!LANr3czGEz7IqY_MJnzQRg
      P.D.: just some thought... would be possible to apply a new mcc.c to native support eMMC 5.1 HS400 (something like importing mcc.c from Android Pie)?
      Congratulations on the very first adaptation of eMMC v5.1 on Nexus 7 2013! :victory:

      Let's briefly compare original, old eMMC v4.5 to eMMC v5.1:
      • faster R/W performance
      • 2x Interface Bandwidth
      • SMART (Health) Report
      • F/W Update option
      But most importantly, there is no need to search for old stock of original or equivalent chips, as new high-performance, cheap ICs can be used (in FBGA 153/169 package of course). Furthermore, higher capacity memory like 64GB, works fine. While the advanced new features of eMMC v5.1 require additional kernel modifications and dedicated apps, we already have standard solutions for N7 ROMs. Links to stock ROM and RAM-bootable TWRP are in edovis' post, I also compiled a flashable TWRP and generic kernel for custom ROMs.
      :good:
      2
      Note, if you use eMMC v5.0 you will not be able to use Android older than 6.0 without a kernel tweak.
      Also, there is no firmware "flash" for N7 and you will have to use either hardware eMMC programmer or JTAG.
      Keep the above in mind before purchasing a replacement chip.

      I successfully replace 2 Kingston chips (at the 2 tablets) by:

      THGBMBG8D4KBAIR (EMMC 5.0)
      THGBMFG8C4LBAIR (EMMC 5.1)

      Repair bootloader with the MiFlash and engeneer ROM, now I can install engeneer ROM 4.2.2, Android 5.1.1 (razorg-lmy48z-factory-9a4845b2.zip) and 6.0.1 (razorg-mob30x-factory-10b7ca08.zip), but can`t official 4.3-4.4.4 it bootloop at "Google" screen? Why? Because EMMC 5.0 and EMMC 5.1?

      What about IMEI how I can change it to the legacy for the tablet, now I clone my worked device and all 3 tablets have a same IMEI!? :(
    Our Apps
    Get our official app!
    The best way to access XDA on your phone
    Nav Gestures
    Add swipe gestures to any Android
    One Handed Mode
    Eases uses one hand with your phone