[HARD BRICK Fixed] - N9005-Make your debrick.img and have it on extSdCard by security

[FeralFire]

To test it? How someone can brick his phone to have the QHSUSB_DLOAD, the way to flash by unbrickable sdcard?

Interesting theory.

I was making a joke.

 

[zetlorf]

If we flash this file in recovery (N9005_Partial_Sys_Dump_for_debrick.zip), it doesn't format/erase anything (internal/external SD), right?

 

[ValenteL]

If we flash this file in recovery (N9005_Partial_Sys_Dump_for_debrick.zip), it doesn't format/erase anything (internal/external SD), right?

No. It only make a partial dump and create a file debrick.img, You have it on sdcard. I use this on 5 devices whitout issues.

 

[Zionator]

Sorry to say this but the title of this thread is wrong "HARD BRICK Fixed" the only way to fix a hard brick is to change the motherboard.

You should change the title as what ever debrick.img you make is useless in case of a hard brick.

In case of a hard brick how will you flash the debrick.img ? You wont be able to turn on the phone.

 

[ValenteL]

Sorry to say this but ...

Sorry but HARD BRICK here is symbolic about Software, not physical brick about Hardware. And ...

Please, don't Post more here because Your signature trouble me.

Valente

 

[xclub_101]

...
PS: All People, make your debrick.img and have it on extSdCard by security.

My debrick.img N9005 4.4.2 Kitkat:
...

Flash this by Recovery. Saved on internal Sdcard. Copy it to extSdCard:

For people that still have knox 0x0 (so no custom recovery) here are a few alternatives (of which one is also mentioned in some other places around, for instance this thread):

- all images described here will also contain a backup of SOME (the 256MB image) or ALL (32GB image) of the information on your phone, including EFS and IMEI - so making at least the 256MB debrick image is a good idea even only for this backup!

- it is assumed that you are rooted and you have some form of busybox installed on the Note 3;

- also on the USB-based methods it is assumed that you have one PC where you have ADB and CYGWIN or similar (netcat for Windows might be enough) installed (and you have USB debugging enabled and approved that PC to use with adb on your Note 3; also certain paths are assumed to be active, if not just use the full pathname in the corresponding commands)


- 1 - simplest method, PC and one microSD needed, you connect the USB cable then do:

adb shell

su

then if you want to just SAVE the debrick image to microSD you do:

dd if=/dev/block/mmcblk0 count=524288 of=/storage/extSdCard/debrick.bin

or if you want to directly make the debrick microSD (which will NOT be seen as a microSD any more after this, and of course all previous content on the microSD will be lost)

dd if=/dev/block/mmcblk0 count=524288 of=/dev/block/mmcblk1

- 2 - if you do not want to use the PC you can even do the same commands above directly from the phone in Terminal Emulator - but typing will be a lot more complex

- on methods 1 and 2 you can also make a 32GB image (by omitting the count=524288 parameter) - as long as you have a microSD with 32GB or more free

- 3 - finally a method when you have no microSD (or no space on it, or you want to save the full 32GB image and do not want to wait twice) - connect your Note 3 over USB (somehow similar methods would also work over wireless connection, but slower; trying to use USB 3 will not be faster and will create huge problems since after 10 minutes USB 3 will be de-activated)

- on the PC create a port forward with something like

adb forward tcp:5555 tcp:5555

(you can check that it worked with adb forward --list)

- then still from PC start a shell over adb on the Note 3 and go superuser:

adb shell

su

- from that adb shell IF YOU WANT A FULL (32 GB) BACKUP start this command on the Note 3:

nc -l -p 5555 -e dd if=/dev/block/mmcblk0

(this should start netcat on Note 3 and set it to wait for a connection, then when that is established send the content of the entire internal flash)

- from that adb shell IF YOU WANT A MINIMAL 256 MB BACKUP start this command on the Note 3:

nc -l -p 5555 -e dd if=/dev/block/mmcblk0 count=524288


- still on the PC open a CYGWIN command prompt (elevated on Vista or newer) and from that one do:

nc 127.0.0.1 5555 > debrick.bin

that will open the connection and get the file sent from the Note 3 - this will take LONG (maybe over 2 hours on a 32 GB Note 3; OBVIOUSLY you need to have write permission and more than 32 GB free space).

The resulting debrick.bin will have like 112 extra bytes (or so) appended at the end (you can remove those with a program like trunc but it is unlikely to ever be a problem if you do not).

If you want to store it in a safe place - 7zip will compress those pretty well (depending on how full the internal storage of your Note 3 is) - mine fits after compression on one DVD-R.

You can also write it onto a miniSD for debricking purposes - writing all of it does not make so much sense unless you have many 32 GB microSD cards that you never use; for the purpose of just debricking it is said that even a 2-4 GB microSD will be able to boot in download mode, even a 128-256 MB one will boot (but IMHO 128MB is too little and might trigger knox on an ultra-paranoid bootloader, so 256MB is the size that I recommend).

Also note that it seems that entire "debricking using microSD" works a little different on Qualcomm-based Samsung phones vs Exynos-based phones - so far all in this thread is about Qualcomm-based models, for Exynos-based models you will need to search on Google after an original Samsung document called

13-58_SM-N900_Boot_Recovery_Guide_rev1.0.pdf

,which describes how on Exynos you also need one extra (and pretty simple) hardware trick (the same seems to be also valid on other Exynos phones, there is a similar document on debricking the S3 i9300).

 

[RIZWANN]

can anybody plz upload debrick image for n900w8?

 

[CNexus]

Thanks

I looked inside the updater_script from .zip file and it work only whit Pit file partition mmcblk0. Then if we not flashed a pit file from 4.3 to 4.4 the debrik.img must be the same because the pit file is the same. In this case I think it work.

Anyway, by security is easy make one to 4.3 and another to 4.4.

You should also credit @gTan64...he pioneered this method with my dump on the Sprint S3, and it was then ported to other devices.

 

[Trozzul]

hey ValenteL can you help me make a Debrick.img for my galaxy s2 t989? i have three of them and i see this method popping up everywhere and i dont see one for my t989 yet, i have three of them which one is bricked and the other is using cyanogenmod, so in order to get a drebrick.img we need to be on a rooted stock? i would gladly turn my device back to stock to help people.

 

[ValenteL]

You should also credit @gTan64...he pioneered this method with my dump on the Sprint S3, and it was then ported to other devices.

Sorry. I forgot the credits on the Thread from @KAsp3rd :

Thanks to the following:
@gTan64 for finding the fix while repairing their friend's phone. My special Thanks to @gTan64
@CNexus for Link to original thread here where I found the answer for this. Quote: with my dump on the Sprint S3. Thanks
@Techlyfe again for the SGH-T999 emmc dump
@DocHoliday77 for the odin guide and software
@Matt For being Matt
@jmcoffey for the SGH-T999L dump
And My wife for letting me mess with her phone (which in turn bricked it by overwriting the apm partition)

@deBricker for their thread another walkthrough

 

[ValenteL]

hey ValenteL can you help me make a Debrick.img for my galaxy s2 t989?

Me? I can't. I have not a S2 T989, it's impossible.

 

[Trozzul]

Me? I can't. I have not a S2 T989, it's impossible.

are you not able to show me a method i can use to be able to do it myself ?(thats what i was getting at, i didnt expect you to own a T989)

 

[ValenteL]

are you not able to show me a method i can use to be able to do it myself ?(thats what i was getting at, i didnt expect you to own a T989)

I'm sorry. I not understood You. Attached the original Mod to make the debrick.img called T999... I use this always, only change the device name, the mod is same.
- Put this on sdcard.
- Flash whit the custom recovery.
- You have the debrick.img on internal Sdcard. If is not here see on /data/media, another sdcard name.
- By security copy it to extSdCard.

 

[Trozzul]

I'm sorry. I don't understood You. Attached the original Mod to make the debrick.img called T999... I use this always, only change the device name, the mod is same.
- Put this on sdcard.
- Flash whit the custom recovery.
- You have the debrick.img on internal Sdcard. If is not here see on /data/media, another sdcard name.
- By security copy it to extSdCard.

so this file will work on any samsung device if i flash it? also do i need to be on rooted stock?

 

[ValenteL]

so this file will work on any samsung device if i flash it? also do i need to be on rooted stock?

See the update_script from META-inf from .zip Mod. You see that it work only whit partition mmcblk0, the Pit file:

package_extract_file("dd", "/tmp/dd");
set_perm(0, 0, 0777, "/tmp/dd");
ui_print("Data Dump running...");
run_program("/tmp/dd", "if=/dev/block/mmcblk0", "of=/sdcard/debrick.img", "bs=1M", "count=128");;
delete("/tmp/dd");
ui_print("Partial System Dump to debrick.img Complete!!!");

For all devices that have this partition.

Then, not need the rooted stock. I don't know if the cmd dd work also on a Rom no rooted.
But You can read more about this method on the Threads from @KAsp3rd and @DocHoliday77 links in OP. Thanks to them.

 

[Trozzul]

See the update_script from META-inf from .zip Mod. You see that it work only whit partition mmcblk0, the Pit file:

package_extract_file("dd", "/tmp/dd");
set_perm(0, 0, 0777, "/tmp/dd");
ui_print("Data Dump running...");
run_program("/tmp/dd", "if=/dev/block/mmcblk0", "of=/sdcard/debrick.img", "bs=1M", "count=128");;
delete("/tmp/dd");
ui_print("Partial System Dump to debrick.img Complete!!!");

For all devices that have this partition.

Then, not need the rooted stock. I don't know if the cmd dd work also on a Rom no rooted.
But You can read more about this method on the Threads from @KAsp3rd and @DocHoliday77 links in OP. Thanks to them.

how do i see if my devices has that partition?

 

[ValenteL]

how do i see if my devices has that partition?

Whit the Root Explorer see on /dev/block/ You have the rom partitions finished by p1,p2... but first You have the mmcblk0. Is the PIT.
Here if you can touch on ..block/platform/msm_sdcc.1/by-name you have all Rom name partitions. On S2 this can be different. Try it.

 

[xclub_101]

Whit the Root Explorer see on /dev/block/ You have the rom partitions finished by p1,p2... but first You have the mmcblk0. Is the PIT.
Here if you can touch on ..block/platform/msm_sdcc.1/by-name you have all Rom name partitions. On S2 this can be different. Try it.

mmcblk0 is the first emmc device = ALL internal flash memory (not just the PIT). And that is common for all devices that use that emmc driver - as far as I know all modern samsung Galaxy devices in the last 2-3 years, including the S2. But you need ROOT access to even open/read it!

 

[ValenteL]

mmcblk0 is the first emmc device = ALL internal flash memory (not just the PIT). And that is common for all devices that use that emmc driver - as far as I know all modern samsung Galaxy devices in the last 2-3 years, including the S2. But you need ROOT access to even open/read it!

Thank You. I read on this THREAD :

Here's is a flashable zip to get the first 128M of the emmc which is what we use to create our debrick.img

What are inside from first 128M of emmc?

 

[xclub_101]

Thank You. I read on this THREAD :

Here's is a flashable zip to get the first 128M of the emmc which is what we use to create our debrick.img

What are inside from first 128M of emmc?

Well, there is first one sector (512 bytes, 0x200) with the "legacy MS-DOS-type partition table" (which contains no usable info but to mark that a GUID partition table is used), then one sector with the basic GUID partition table info, then 0x4000 bytes with the first copy of the actual partition entries (those last two also have a 2nd copy in the last 0x4200 bytes of the disk) and then the PIT and some other stuff. At some point the first real partition starts - mmcblk0p0 - on Qualcomm devices I believe that is the non-hlos partition (apparently it is used by the modem CPU and not by normal application CPU), then the actual modem firmware, I believe only after that comes SBL1 (Secondary Boot Loader 1, which is the first thing on emmc booted by the application CPU, which comes from code that booted first in the PBL inside the CPU itself - Primary Boot Loader). Then also you have TZ (Trusted Zone) and a few other partitions that are pretty relevant in the security scheme of works, then you have ABOOT which is basically "Odin mode". Then later (but I believe over the 128MB mark) you have the kernel and the recovery - which is why I think it could be safer (against a very paranoid knox-checking bootloader) to use 256MB for a debrick image. Also at some point between the 64MB and 256MB mark you have the EFS partition and the (separate on Qualcomm devices) partitions with IMEI, IMEI backup and similar stuff - so IMHO it is worth having that saved even if only for the EFS and IMEI stuff!