[HOW TO] BOOT FROM SD CARD [SUCCESSFULLY] on QMobile Z8 with BRICKED/DEAD eMMC

mirfatif

Senior Member
Oct 18, 2016
645
371
63
t.me
I'm a mechanical engineer, not an IT guy. I can fix machines, perhaps, but not bricked phones. So try anything at your own extreme risk. This is NOT a step by step guide.

DEVICE:
QMobile Z8, same as Wikio Ridge 4G, (MSM8916).
Running Android 5.0.2, SuperSU rooted.
Kernel v 3.10.49
Thanks to @ASAZING for TWRP 3.0.2-0

PROBLEM:
So the screen started blinking and locking / unlocking automatically like UI resetting. And there was no SIM. At first I thought it's launcher or SuperSU causing problem. But it got worse over days. So I decided a factory flash since I didn't have untouched flashable zip.
Flashed firmware using QFIL but no success. Rebooted to recovery and TWRP was still there.
/data partition was locked and TWRP doesn't support decryption. So I did a factory reset and the message came: /data not mounted. Invalid Argument
Formatted /data from "Repair or Change Filesystem" option in TWRP and as a result /data and /cache both couldn't be mounted.
Formatted /cache, and /system too not mounted.
Manually formatted using 'make_ext4' and tried 'fastboot format:ext4 userdata' as well. Both succeeded apparently but mount still failed.
Run 'e2fsck' and that showed: "Bad magic number in super block" and "The superblock could not be read."
Run 'mke2fs -n' for alternate super blocks, run again 'e2fsck' but no success. Images are attached.
'sgdisk --verify' gives this error log:
Code:
sgdisk --verify mmcblk0p1

[COLOR="Red"]***************************************************************
Found invalid GPT and valid MBR; converting MBR to GPT format in memory. 
***************************************************************

Exact type match not found for type code 7200; assigning type code for 'Linux filesystem'
Exact type match not found for type code 6500; assigning type code for 'Linux filesystem'
Exact type match not found for type code 7900; assigning type code for 'Linux filesystem'
Exact type match not found for type code 0D00; assigning type code for 'Linux filesystem'
Warning! Main partition table overlaps the first partition by 34 blocks!
You will need to delete this partition or resize it in another utility.

Warning! Secondary partition table overlaps the last partition by 3805778618 blocks!
You will need to delete this partition or resize it in another utility.

Problem: partitions 2 and 1 overlap:
  Partition 2: 168689522 to 2104717761
  Partition 1: 778135908 to 1919645538

Problem: partitions 3 and 1 overlap:
  Partition 3: 1869881465 to 3805909656
  Partition 1: 778135908 to 1919645538

Problem: partitions 3 and 2 overlap:
  Partition 3: 1869881465 to 3805909656
  Partition 2: 168689522 to 2104717761

Problem: partition 1 is too big for the disk.
Problem: partition 2 is too big for the disk.
Problem: partition 3 is too big for the disk.
Problem: partition 4 is too big for the disk.

Warning! Main partition table overlaps the first partition by 34 blocks!
You will need to delete this partition or resize it in another utility.

Warning! Secondary partition table overlaps the last partition by 3805778618 blocks!
You will need to delete this partition or resize it in another utility.

Identified 9 problems![/COLOR]

==========================
sgdisk --verify mmcblk0p16

[COLOR="red"]Creating new GPT entries.

Problem: GPT claims the disk is larger than it is! (Claimed last usable sector is 18446744073709551584, but backup header is at 1 and disk size is 2 sectors.
The 'e' option on the experts' menu will probably fix this problem

Identified 1 problems!
[/COLOR]
==========================
sgdisk --verify mmcblk0p17

[COLOR="red"]Creating new GPT entries.

Problem: GPT claims the disk is larger than it is! (Claimed last usable sector is 18446744073709551598, but backup header is at 15 and disk size is 16 sectors.
The 'e' option on the experts' menu will probably fix this problem

Identified 1 problems![/COLOR]

==========================
sgdisk --verify mmcblk0p22

[COLOR="red"]Creating new GPT entries.

Problem: GPT claims the disk is larger than it is! (Claimed last usable sector is 18446744073709551614, but backup header is at 31 and disk size is 32 sectors.
The 'e' option on the experts' menu will probably fix this problem

Identified 1 problems![/COLOR]
'parted rm' and 'fastboot erase' didn't work either. Partition was still there.
Then I tried to flash stock recovery through TWRP. And recovery too gone.
Now, device boots directly to bootloader (fastboot mode) and is halted there. Have to 'fastboot boot recovery.img' or 'fastboot boot boot.img' each time.
Download Mode (QDLoader 9008) is also accessible.

FLASHING FACTORY FIRMWARE:
Now left only with fastboot and EDL, tried once again QFIL flasher, Wiko official flasher, QDownloader. Log says: "Read back verify failed at sector ...." for partitions misc, system, cache, persist, recovery, userdata (6 partitions) and 2 partition table *.bins
Hence proved, eMMC is malfunctioning and device now can't boot on its own due to no partition table.
Tried 'sgdisk --backup' and 'sgdisk --load-backup' options for partition table. It gives error: "Warning! Current disk size doesn't match that of backup." and "Problem: Partition 28 ends before it begins." etc.
'fastboot flash partition *.bin' also failed with error: "remote: failed to write partition".
'dd if=gpt_main0.bin of=/dev/block/mmcblk0' apparently succeeded but comparing octal dump ('od') files of 34 sectors at start shows no difference, means file is not written to eMMC.

SOLUTION SUMMARY:
  • Partition SD card according to already existing partition table on internal eMMC.
  • Flash partition images from factory firmware to newly created partitions.
  • Modify kernel (boot.img) and recovery to boot from sd card instead of internal memory.
  • Boot kernel or recovery through fastboot.


SECTION 1
PARTITION SD CARD:
Here comes Google. Following the footsteps of @lexelby at this, I created gpt (parted command) on 16GB C-10 sd card using Ubuntu virtual machine.
Created first partition for external_sd card and 6 more of same size as original ones (size checked by parted and from rawprogram_unsparse.xml). Filesystems: system, userdata, cache & persist of ext4 while misc, recovery of linux-swap (though 'dd' will overwrite them).
Then I unsparsed userdata, system and cache images from factory firmware (on Windows used packsparseimg.exe binary). Sparsed images can only be flashed through fastboot?
Copied 5 prtitions images: userdata, system, cache, persist and misc using dd command to /dev/block/mmcblk1p*.

MODIFYING BOOT & RECOVERY:
Now coming to the changes in mount paths of boot and recovery (fstab and init.*.rc).
Extracted boot.img and then ramdisk using "Image Studio for Android". 'unpackbootimg' and 'abootimg' don't extract all files on Ubuntu. 'mkbootimg' makes smaller boot.img file without boot.img-dtb. Perhaps I'm doing it wrong.
Anyway, then did 'grep dev/block' on all extracted files. Results are attached for reference.
Made changes in "fstab.qcom" and "init.target.rc". For details on changes made, please read on RE-MODIFYING BOOT & RECOVERY.
Repacked boot.img

Similarly extracted recovery.img, did 'grep dev/block' on all extracted files. And made changes in "recovery.fstab".
Repacked recovery.img

COPYING IMAGES TO PARTITIONS AND BOOTING:
'fastboot flash boot boot.img' and 'dd if=recovery.img of=dev/block/mmcblk1p*' (though useless, have to boot from fastboot)
Rebooted to recovery by 'fastboot boot recovery.img'
userdata, persist and cache couldn't be mounted in TWRP. Tried 'mount -t ext4 -o loop *.img' on Ubuntu but there too not mounted. Googled and using commands 'file', 'fdisk', 'sfdisk', 'e2fsck' and finally 'resize2fs -f /*.img' resolved the problem "bad geometry: block count xxx exceeds size of device...".
Also unsparsed userdata too large to handle and only a few MBs data inside, that too useless. Therefore, did 'make_ext4fs' on cache & userdata.

Now booted kernel by 'fastboot boot boot.img'
And.......... it boots. But very very slow (due to slow write speed of sd card obviously). Took almost half an hour at first boot.

UNRESOLVED PROBLEMS:
There is no sound. Because of /persist not mounted? And still no SIM, means radio firmware isn't readable from eMMC or this too due to /persist absent? After all that contains drivers. And also Wi-Fi and bluetooth not working.


SECTION 2
RE-PARTITION SD CARD:
So re-created gpt on sd card (using parted and fdisk) and in a hope to utilize all necessary partitions, 100% replicated all partitions (except larger userdata) including space required at start and end of eMMC for partition table. Partition tables of both mmcblk0 and mmvblk1 are attached.

RE-MODIFYING BOOT & RECOVERY:
Made following changes in boot.img:
DEVICE BOOTS ALSO WITHOUT MAKING ANY CHANGES TO BOOT.IMG.
I don't know why but 'bootdevice' is automagiacally changed from 7824900.sdhci (eMMC) to 7864900.sdhci (external SD card). It seems there is some auto-detection mechanism.
Code:
########## ./ramdisk/fstab.qcom ##########

#/dev/block/bootdevice/by-name/system         /system      ext4    ro,barrier=1,discard                                wait
#/dev/block/bootdevice/by-name/userdata       /data        ext4    nosuid,nodev,barrier=1,noauto_da_alloc,discard      wait,check,encryptable=footer
#CHANGED TO
/dev/block/[B]mmcblk1p24[/B]                          /system      ext4    ro,barrier=1,discard                                wait
/dev/block/[B]mmcblk1p32[/B]                          /data        ext4    nosuid,nodev,barrier=1,noauto_da_alloc,discard      wait,check,encryptable=footer

#/devices/soc.0/7864900.sdhci/mmc_host        /storage/sdcard1   vfat    nosuid,nodev         wait,voldmanaged=sdcard1:auto,noemulatedsd
#[B]disabled[/B]
Code:
########## ./ramdisk/init.target.rc ##########

on fs
    mount_all fstab.qcom

    #wait /dev/block/bootdevice/by-name/cache
    #mount ext4 /dev/block/bootdevice/by-name/cache /cache nosuid nodev barrier=1
#CHANGED TO
	wait /dev/block/[B]mmcblk1p26[/B]
    mount ext4 /dev/block/[B]mmcblk1p26[/B] /cache nosuid nodev barrier=1

    #wait /dev/block/bootdevice/by-name/persist
    #mount ext4 /dev/block/bootdevice/by-name/persist /persist nosuid nodev barrier=1
#CHANGED TO
	wait /dev/block/[B]mmcblk1p25[/B]
    mount ext4 /dev/block/[B]mmcblk1p25[/B] /persist nosuid nodev barrier=1
	
	#wait /dev/block/bootdevice/by-name/modem
    #mount vfat /dev/block/bootdevice/by-name/modem /firmware ro context=u:object_r:firmware_file:s0,shortname=lower,uid=1000,gid=1000,dmask=227,fmask=337
#CHANGED TO
	wait /dev/block/[B]mmcblk1p1[/B]
    mount vfat /dev/block/[B]mmcblk1p1[/B] /firmware ro context=u:object_r:firmware_file:s0,shortname=lower,uid=1000,gid=1000,dmask=227,fmask=337
	
on charger
    #wait /dev/block/bootdevice/by-name/system
    #mount ext4 /dev/block/bootdevice/by-name/system /system ro barrier=1
#CHANGED TO
	wait /dev/block/[B]mmcblk1p24[/B]
    mount ext4 /dev/block/[B]mmcblk1p24[/B] /system ro barrier=1
Code:
########## ./split_img/boot.img-cmdline ##########

#console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=qcom user_debug=30 msm_rtb.filter=0x3F ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci lpm_levels.sleep_disabled=1
#CHANGED TO
console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=qcom user_debug=30 msm_rtb.filter=0x3F ehci-hcd.park=3 [B]androidboot.bootdevice=7864900.sdhci[/B] lpm_levels.sleep_disabled=1
And following changes in recovery.img:
Code:
########## ./ramdisk/etc/recovery.fstab ##########

#/cache           ext4    /dev/block/bootdevice/by-name/cache            flags=display=Cache
#/system          ext4    /dev/block/bootdevice/by-name/system            flags=display=System
#/data            ext4    /dev/block/bootdevice/by-name/userdata            flags=encryptable=footer;length=-16384
#/persist         ext4    /dev/block/mmcblk0p25            flags=backup=1;display=Persist
#/boot            emmc    /dev/block/bootdevice/by-name/boot           flags=display=Boot
#/recovery        emmc    /dev/block/bootdevice/by-name/recovery            flags=backup=1;display=Recovery
#/misc            emmc    /dev/block/bootdevice/by-name/misc         /misc 		  flags=backup=1;display=Misc
#/firmware        vfat    /dev/block/mmcblk0p1             flags=backup=1;display=Modem
#/splash          emmc    /dev/block/mmcblk0p18            flags=backup=1;display=Splash
#/fsg		 emmc    /dev/block/mmcblk0p20		           flags=backup=1;subpartitionof=/oem
#/aboot           emmc    /dev/block/mmcblk0p4             flags=backup=1;display=Aboot
#/abootbak        emmc    /dev/block/mmcblk0p5	           flags=subpartitionof=/aboot;backup=1
#/hyp             emmc    /dev/block/mmcblk0p10            flags=backup=1;display=Firmware-update
#/sbl1            emmc    /dev/block/mmcblk0p2             flags=backup=1;subpartitionof=/hyp
#/rpm             emmc    /dev/block/mmcblk0p6             flags=backup=1;subpartitionof=/hyp
#/tz              emmc    /dev/block/mmcblk0p8             flags=backup=1;subpartitionof=/hyp
#/hypbak          emmc    /dev/block/mmcblk0p11            flags=backup=1;subpartitionof=/hyp
#/sbl1bak         emmc    /dev/block/mmcblk0p3             flags=backup=1;subpartitionof=/hyp
#/rpmbak          emmc    /dev/block/mmcblk0p7             flags=backup=1;subpartitionof=/hyp
#/tzbak           emmc    /dev/block/mmcblk0p9             flags=backup=1;subpartitionof=/hyp
#/modemst1        emmc    /dev/block/mmcblk0p13            flags=backup=1;display=EFS
#/modemst2        emmc    /dev/block/mmcblk0p14            flags=backup=1;subpartitionof=/modemst1
#/oem             emmc    /dev/block/mmcblk0p30            flags=backup=1;display=OEM
#/DDR             emmc    /dev/block/mmcblk0p20            flags=backup=1;subpartitionof=/oem
#/fsc             emmc    /dev/block/mmcblk0p16            flags=backup=1;subpartitionof=/oem
#/ssd             emmc    /dev/block/mmcblk0p17            flags=backup=1;subpartitionof=/oem
#/pad             emmc    /dev/block/mmcblk0p12            flags=backup=1;subpartitionof=/oem

#CHANGED TO

/cache           ext4    /dev/block/[B]mmcblk1p26[/B]            flags=display=Cache
/system          ext4    /dev/block/[B]mmcblk1p24[/B]            flags=display=System
/data            ext4    /dev/block/[B]mmcblk1p32[/B]            flags=encryptable=footer;length=-16384
/persist         ext4    /dev/block/[B]mmcblk1p25[/B]            flags=backup=1;display=Persist
/boot            emmc    /dev/block/[B]mmcblk1p23[/B]            flags=display=Boot
/recovery        emmc    /dev/block/[B]mmcblk1p27[/B]            flags=backup=1;display=Recovery
/misc            emmc    /dev/block/[B]mmcblk1p15[/B]         	  flags=backup=1;display=Misc
/firmware        vfat    /dev/block/[B]mmcblk1p1[/B]             flags=backup=1;display=Modem
/splash          emmc    /dev/block/[B]mmcblk1p18[/B]            flags=backup=1;display=Splash
/fsg             emmc    /dev/block/[B]mmcblk1p21[/B]		  	  flags=backup=1;subpartitionof=/oem
/aboot           emmc    /dev/block/[B]mmcblk1p4[/B]             flags=backup=1;display=Aboot
/abootbak        emmc    /dev/block/[B]mmcblk1p5[/B]	          flags=subpartitionof=/aboot;backup=1
/hyp             emmc    /dev/block/[B]mmcblk1p10[/B]            flags=backup=1;display=Firmware-update
/sbl1            emmc    /dev/block/[B]mmcblk1p2[/B]             flags=backup=1;subpartitionof=/hyp
/rpm             emmc    /dev/block/[B]mmcblk1p6[/B]             flags=backup=1;subpartitionof=/hyp
/tz              emmc    /dev/block/[B]mmcblk1p8[/B]             flags=backup=1;subpartitionof=/hyp
/hypbak          emmc    /dev/block/[B]mmcblk1p11[/B]            flags=backup=1;subpartitionof=/hyp
/sbl1bak         emmc    /dev/block/[B]mmcblk1p3[/B]             flags=backup=1;subpartitionof=/hyp
/rpmbak          emmc    /dev/block/[B]mmcblk1p7[/B]             flags=backup=1;subpartitionof=/hyp
/tzbak           emmc    /dev/block/[B]mmcblk1p9[/B]             flags=backup=1;subpartitionof=/hyp
/modemst1        emmc    /dev/block/[B]mmcblk1p13[/B]            flags=backup=1;display=EFS
/modemst2        emmc    /dev/block/[B]mmcblk1p14[/B]            flags=backup=1;subpartitionof=/modemst1
/oem             emmc    /dev/block/[B]mmcblk1p30[/B]            flags=backup=1;display=OEM
/DDR             emmc    /dev/block/[B]mmcblk1p20[/B]            flags=backup=1;subpartitionof=/oem
/fsc             emmc    /dev/block/[B]mmcblk1p16[/B]            flags=backup=1;subpartitionof=/oem
/ssd             emmc    /dev/block/[B]mmcblk1p17[/B]            flags=backup=1;subpartitionof=/oem
/pad             emmc    /dev/block/[B]mmcblk1p12[/B]            flags=backup=1;subpartitionof=/oem

#/external_sd     auto    /dev/block/mmcblk1p1     /dev/block/mmcblk1           flags=display="MicroSD Card";storage;wipeingui;removable
#CHANGED TO
# None. [B]External sd disabled[/B].
Code:
########## ./ramdisk/uneventd.rc ##########

#/dev/block/bootdevice/by-name/config                 0660   system     system
#CHANGED TO
/dev/block/[B]mmcblk1p29[/B]                 0660   system     system
Code:
########## ./split_img/recovery.img-cmdline ##########

#console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=qcom user_debug=30 msm_rtb.filter=0x3F ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci lpm_levels.sleep_disabled=1 androidboot.selinux=permissive
#CHANGED TO
console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=qcom user_debug=30 msm_rtb.filter=0x3F ehci-hcd.park=3 [B]androidboot.bootdevice=7864900.sdhci[/B] lpm_levels.sleep_disabled=1 androidboot.selinux=permissive
Repacked boot.img and recovery.img.

RE-COPYING IMAGES TO PARTITIONS AND BOOTING:
Copied (dd) all available (15) images to (20) partitions on sd card.
Copied (dd) the 10 images not found in factory firmware from mmcblk0 to mmcblk1. (Not sure if successful).
2 partitions (/data and /cache) already formatted in ext4.
'fastboot boot recovery.img'. All partitions are mounted now. No horrible error lines. :D
'fastboot boot boot.img'
ROM booted successfully WITH sounds, SIM, Wi-Fi and Bluetooth. All seems working well so far.


SECTION 3
Continued on post 3...
 

Attachments

Last edited:

jeksparo

Member
Nov 2, 2008
9
0
0
hello hi
i have xiaomi redmi 2 chinesse version with same problem with your device. stuck logo, only still can access recovery TWRP via fastboot boot trwp.img.
twrp cant wipe, cant format, internal storage 0mb, "failed argument ".cant flash stock rom with flash tools "failed write partition", . try terminal parted rm not solve. try to many google same issue not solve. i think emmc or hardware issue

i never using linux and linux command so
please help me.make step by step guide , boot from sdcard .
- make partition sd card to be like emmc partition block
- can i using windows os or using small linux distro
- how to modif image stock rom ,kernel ,and flashing to sdcard
- how to boot from sdcard

many thank you
 

mirfatif

Senior Member
Oct 18, 2016
645
371
63
t.me
Continued from OP...

SECTION 3
QUERIES:
UNCERTAIN PARTITIONS
But there are no images available for these 10 partitions in factory firmware:
pad, modemst1, modemst2, fsc, ssd, DDR, keystore, config, oem & devinfo.
These seem to be very essential for OS, also containing IMEI if I'm not mistaken? I'm not sure of their contents. How system working without them? All are useless?

HOW TO COMPLETELY BOOT FROM SD CARD
In boot.img, "fstab.qcom" contains mount paths for system & userdata. While "init.target.rc" contains only mount paths for cache, persist and modem. In total 5 partitions which are mounted (checked by 'mount').
Code:
[email protected]:/ $ mount | grep mmcblk1

/dev/block/mmcblk1p24 /system ext4 rw,seclabel,relatime,discard,data=ordered 0 0
/dev/block/mmcblk1p32 /data ext4 rw,seclabel,nosuid,nodev,relatime,discard,noauto_da_alloc 0 0
/dev/block/mmcblk1p26 /cache ext4 rw,seclabel,nosuid,nodev,relatime 0 0
/dev/block/mmcblk1p25 /persist ext4 rw,seclabel,nosuid,nodev,relatime,data=ordered 0 0
/dev/block/mmcblk1p1 /firmware vfat ro,context=u:object_r:firmware_file:s0,relatime,uid=1000,gid=1000,fmask=0337,dmask=0227,codepage=437,iocharset=iso8859-1,shortname=lower,errors=remount-ro 0 0
[email protected]:/ $
So the primary question is:
How to change mount source of other partitions from mmcblk0 to mmcblk1? Or how to force OS to read the essentially required partitions from mmcblk1 instead of mmcblk0?
Need to modify any other files in ramdisk or kernel-zimage or in /system or to modify init.d scripts or create new scripts? Any help?
Other than 10 partitions mentioned above, these "not mounted" partitions also include modem, sbl1, aboot, rpm, tz and hyp and fsg. Modem contains bootable code of MBR and following 5 are also executable binaries. I think these are all part of bootloader i.e. loading in initial booting process and not required by OS. But what about the fsg and ten others? Where are those used? Here is a partition detail.

Another primary issue is:
I think it's almost impossible to make Boot ROM (CPU embedded) hand over charge to bootloader at "mmcblk1". "mmcblk0" must be hardcoded in Boot ROM.
So, how to make bootloader load "kernel" and "rootfs" from mmcblk1p* instead of mmcblk0p*? Like there are switches in testing devices to optionally boot from different memories. Can we modify "aboot" (the little kernel) or "emmc_appsboot.mbn" ELF binary for this purpose? It must be complicated as bootloaders are signed by vendor (Qualcomm) and involve low-level programming as discussed here. Right?
Or in other words, how to force bootloader to read partition table from dev/mmcblk1 instead of dev/mmcblk0?
If we can't do this, system doesn't know how to boot in the absence of eMMC. That would have to be done through fastboot everytime we need to. Because boot chain will be stuck at bootloader.
Multi-booting solutions are also dependent on a fully working /boot partition on eMMC because they (one way or the other) re-flash/replace modified boot image every time a ROM is to be switched. EFIDroid is a secondary bootloader but that too replaces /boot and/or /recovery.

I have gone through this, this, this and this. But they only address partial booting from sd card e.g. dual booting in which only /system, /data and /cache are involved. None has discussed complete boot from sd. Is it really impossible? This link gives a little hope but it points to a ready made solution (bootloader) which boots kernel from SD card. But it gives no explanation how.
I have also come across a few threads discussing Samsung (and HTC too) booting from SD Card as a fix to QHSUSB_DLOAD mode or bricked-bootloaader state. They extracted "debrick" file from a working phone and flashed that to the start of SD Card. Debrick file seems to be a single bootloader file containing all bootloaders in it as explained here and here. So after flashing the bootloader(s) with its accompanying partitions to SD Card, when device was powered on, it automatically booted from SD Card. If it's that simple for all devices with Qualcomm SoC, the only thing I have to do is :laugh:
Code:
[COLOR="Red"]dd if=/dev/zero of=/dev/block/mmcblk0 bs=1m count=200[/COLOR]
Any suggestions? I believe this must be possible as they are discussing here.
Edit: Related quote from [GUIDE][9008][EDL|QDL][QUALCOMM ONLY] Unbrick via external sdcard (no QFIL!):
On eMMC devices, the boot path is /dev/block/mmcblk0. If you have a 9008 brick, the SD card is seen as /dev/block/mmcblk0 so the phone will boot from it on an eMMC device.
Some secondary questions:

  • HOW ARE PARTITIONS IDENTIFIED BY BOOT-ROM WITHOUT PARTITION TABLE ON eMMC
    If there is no readable partition table on a bricked eMMC, how Boot ROM (primary bootloader on SoC) switches control to secondary bootloader or bootable modem partition or other partitions used by processors? Means how SoC / Processors locate modem, sbl, rpm, tz or aboot (the little kernel's offspring) on eMMC? Also, why 'parted /dev/block/mmcblk0 p' and 'sgdisk --print /dev/block/mmcblk0'show partitions if there is no table?
    Though parted-2.2 shows warning:
    Code:
    [COLOR="Red"]Error: Both the primary and backup GPT tables are corrupt.  Try making a fresh
    table, and using Parted's rescue feature to recover partitions.[/COLOR]
    Or I'm thinking in wrong direction? This link discusses the issues but I'm not clear how it works.
    Once the a device is powered on it starts code from a know location (ROM) and looks for the first stage bootloader in a specific block.
    How is this "specific block" located by cpu ROM?
    It's talking about some "low-level" and "high-level" partition tables. How they differ? How can we manipulate the former?

    And finally...
  • HOW TO SPEED UP SD CARD
    Other than using a UHS-III or the most recent and expensive App Performance Class (A1) sd card, what changes we can make to kernel to boost read/write speed? Otherwise, it's almost useless with too slow speed, frequent ANRs, hangs and laggings.
    Default I/O scheduler being used on QMobile Z8 is cfq with default tune-able settings. I think it's one of best schedulers for higher throughput. Na? Try other? Details here:
    Code:
    [email protected]:/ # cat /sys/block/mmcblk0/queue/scheduler
    noop deadline row [cfq]
    
    [email protected]:/ # for fyle in $(find /sys/block/mmcblk0/queue/iosched/ -type f); do echo $fyle; cat $fyle; done;
    /sys/block/mmcblk0/queue/iosched/fifo_expire_async
    50
    /sys/block/mmcblk0/queue/iosched/group_idle
    0
    /sys/block/mmcblk0/queue/iosched/quantum
    20
    /sys/block/mmcblk0/queue/iosched/slice_async
    40
    /sys/block/mmcblk0/queue/iosched/slice_idle
    10
    /sys/block/mmcblk0/queue/iosched/slice_sync
    100
    /sys/block/mmcblk0/queue/iosched/low_latency
    0
    /sys/block/mmcblk0/queue/iosched/fifo_expire_sync
    50
    /sys/block/mmcblk0/queue/iosched/back_seek_max
    16384
    /sys/block/mmcblk0/queue/iosched/target_latency
    300
    /sys/block/mmcblk0/queue/iosched/back_seek_penalty
    2
    /sys/block/mmcblk0/queue/iosched/slice_async_rq
    2
    
    [email protected]:/ # cat /sys/block/mmcblk1/queue/scheduler
    noop deadline row [cfq]
    
    [email protected]:/ # for fyle in $(find /sys/block/mmcblk1/queue/iosched/ -type f); do echo $fyle; cat $fyle; done;
    /sys/block/mmcblk1/queue/iosched/fifo_expire_async
    50
    /sys/block/mmcblk1/queue/iosched/group_idle
    0
    /sys/block/mmcblk1/queue/iosched/quantum
    20
    /sys/block/mmcblk1/queue/iosched/slice_async
    40
    /sys/block/mmcblk1/queue/iosched/slice_idle
    10
    /sys/block/mmcblk1/queue/iosched/slice_sync
    100
    /sys/block/mmcblk1/queue/iosched/low_latency
    0
    /sys/block/mmcblk1/queue/iosched/fifo_expire_sync
    50
    /sys/block/mmcblk1/queue/iosched/back_seek_max
    16384
    /sys/block/mmcblk1/queue/iosched/target_latency
    300
    /sys/block/mmcblk1/queue/iosched/back_seek_penalty
    2
    /sys/block/mmcblk1/queue/iosched/slice_async_rq
    2
    [email protected]:/ #
    Tried different cache values (read_ahead_kb) from 64 to 4048. Makes no difference apparently.
    Also disabled jounalling using 'tune2fs -O ^has_journal' and e2fsck checks using 'tune2fs -c -1'.
    Changed mount options to for /data and /cache:
    Code:
    [email protected]:/ # mount | grep -E "/cache|/data"
    
    /dev/block/mmcblk1p32 /data ext4 rw,seclabel,[B]noatime,discard,nobarrier,noauto_da_alloc,commit=60[/B] 0 0
    /dev/block/mmcblk1p26 /cache ext4 rw,seclabel,noatime,discard,nobarrier,noauto_da_alloc,commit=60 0 0
    
    [email protected]:/ #
    Seems useless so far. Any ideas? Or it's a hardware limitation of device?
    Is there a way to get rid of FUSE and use ext4 in true sense for whole /data (only possible if someone is willing to quit using MTP), though it doesn't matter much for Android's internal operations? But it's a real pain for I/O operations on external media.
    Edit: Speed much improved by using a more certain branded SD Card; Sandisk C-10.
@yoAeroA00 Sir need your special attention for kernel part. You have a good history with kernel tweaking and multibooting.
 
Last edited:

mirfatif

Senior Member
Oct 18, 2016
645
371
63
t.me
I try to manual flash commands, one by one read from flash_all.bat. everything is okay finish, except file "gpt_both0.bin" and "sec.dat"
If flasher is unable to flash partitions, then flashing manually won't make any difference. "gpt_both0.bin" contains partition tables; main and backup. First sector is protective mbr for legacy partitioning tools and next 33 sectors contain gpt partition table. A backup of partition table is stores on last 33 sectors of disk or emmc in our case. Total 67 sectors make 33.5 KiB size which is same as that of gpt_both0.bin. Let me have a look at partition table for further clarity. Run these from twrp to save your partition table.
Code:
sgdisk -p /dev/block/mmcblk0 > pt1
parted /dev/block/mmcblk0 p free > pt2
 

jeksparo

Member
Nov 2, 2008
9
0
0
cant compile sgdisk -p /dev/block/mmcblk0 > pt1 invalid option --p
and parted /dev/block/mmcblk0 > pt2 blank line after entering

my device shell dont have parted command, so i run parted from sd card.
how to created gpt on sdcard using parted and fdisk, if my parted command in sdcard too, it is possible?
 

Attachments

Last edited:

mirfatif

Senior Member
Oct 18, 2016
645
371
63
t.me
cant compile sgdisk -p /dev/block/mmcblk0 > pt1 invalid option --p
and parted /dev/block/mmcblk0 > pt2 blank line after entering

my device shell dont have parted command, so i run parted from sd card.
how to created gpt on sdcard using parted and fdisk, if my parted command in sdcard too, it is possible?
For sgdisk use --print as help shown in your screenshot.
Code:
sgdisk --print /dev/block/mmcblk0 > /part_table
"> /partition_table" is to save the output in root directory so that you can copy paste it. Otherwise you can also take screenshots in TWRP with PWR + VOL- combination.
'parted' doesn't come bundled with TWRP. You can use the binary from your SD card but you need to copy it somewhere else like '/sbin' if you want to partition you SD card. 'fdisk' can't create GPT, it's legacy tool for MBR partition scheme. You need to use 'parted', 'gdisk' or 'sgdisk' etc. to create partitions. Binaries for Android are with limited functionality. That's why Linux is preferred, but not necessary. Also the copying of partition images will be easy on Linux, though very slow if you connect card reader in virtual machine.
These partitions on your device contain filesystem and will be mounted in ROM
modem vfat
system ext4
cache ext4
persist ext4
userdata ext4
Boot and recovery partitions can also be used if your partition table isn't too corrupt to recognize them. Otherwise you'll have to use fastboot on every boot like me.
Simple is to duplicate the whole internal partition table on SD card because rest of the partitions don't occupy much space. It makes partition numbering easy.
But before creating partitions, you need to know exact boundaries in bytes:
Code:
parted /dev/block/mmcblk0
(parted) u b
(parted) p free
(parted) q
 
Last edited:

_6ix._.9ine

Member
Feb 12, 2018
6
0
0
please hellp me

Hiii . i have wiko ridge 4g and i have the same problem as you it stuck on wiko logo and when i try to flash it with stock rom from wiko site nothing hapend and i tried to flash it using Qfil in the log i see "Read back verify failed at sector" the same problem as you sooooo please make step by step guid
i can boot to download mode . when i try to boot to recovery it boot to fastboot mode automaticly .....plz help me..... -sorry for my english-
 

mirfatif

Senior Member
Oct 18, 2016
645
371
63
t.me
Hiii . i have wiko ridge 4g and i have the same problem as you it stuck on wiko logo and when i try to flash it with stock rom from wiko site nothing hapend and i tried to flash it using Qfil in the log i see "Read back verify failed at sector" the same problem as you sooooo please make step by step guid
i can boot to download mode . when i try to boot to recovery it boot to fastboot mode automaticly .....plz help me..... -sorry for my english-
On what part you need help? It's all about partitioning an sd card and copying data to it. Then unpack, modify and re-pack boot.img
 

_6ix._.9ine

Member
Feb 12, 2018
6
0
0
plllllz help me

On what part you need help? It's all about partitioning an sd card and copying data to it. Then unpack, modify and re-pack boot.img
i've been trying to understand what u wrote for the last 7 days and i couldn't understand shiiiit :crying:
i don't know anything about this shiiiit :crying: i'm so sad plz make video and upload it on youtube and show me step by step how did u boot from sd card plllllllllllllllllz _sorry for my english_
 

rada80

Member
May 6, 2018
11
7
0
MODIFYING BOOT & RECOVERY:
Now coming to the changes in mount paths of boot and recovery (fstab and init.*.rc).
Extracted boot.img and then ramdisk using "Image Studio for Android". 'unpackbootimg' and 'abootimg' don't extract all files on Ubuntu. 'mkbootimg' makes smaller boot.img file without boot.img-dtb. Perhaps I'm doing it wrong.
Anyway, then did 'grep dev/block' on all extracted files. Results are attached for reference.
Made changes in "fstab.qcom" and "init.target.rc". For details on changes made, please read on RE-MODIFYING BOOT & RECOVERY.



In that part I used the "ABOOTIMG". To work, do the following:

Code:
$ sudo abootimg -x boot.img ramdisk ramdisk kernel kernel
or
Code:
#abootimg -x boot.img ramdisk ramdisk kernel kernel
You will find 3 files. The "RAMDISK" comes packaged in "GZIP". Unzip it and enter the folder that will be created. Inside this folder you will have the files to edit as the post follows.


By the way, congratulations for the initiative!
 
Last edited:
  • Like
Reactions: mirfatif

igorbounov

Member
Jun 18, 2018
9
1
0
mirfatif,
thanks for this interesting and promising information!
I'd like, though, get an additional explanation: you use "fastboot" to handle your smartphone. Does it mean,
that it was bootable when you've started all this stuff with booting from SD-card?
I'm asking because I'm trying to boot my samsung galaxy GT-N7100 from sd-card with completely dead emmc.
 

mirfatif

Senior Member
Oct 18, 2016
645
371
63
t.me
you use "fastboot" to handle your smartphone. Does it mean,
that it was bootable when you've started all this stuff with booting from SD-card?
My phone doesn't have "completely" dead eMMC. Booting process works up to bootloader (aboot) and it's related partitions. So fastboot works (as it's managed by bootloader). But after that, bootloader can't load boot image (kernel) from boot partition. Neither recovery partition is readable. Thus I have to do it manually using fastboot. And the remaining OS related partitions are read from SD card.
 
Last edited:

igorbounov

Member
Jun 18, 2018
9
1
0
My phone doesn't have "completely" dead eMMC..
Now I get the idea... Nevertheless it looks like now I should stop attempts recovering smartphone because while trying I've turned
(somehow) my available 64Gb Samsung SD-card to a write-protected state (while partitioning). So my further experiments seem
not worth it - now it looks like buying a new Galaxy Note with a new SD-card is more cost-effective. :confused:
 

igorbounov

Member
Jun 18, 2018
9
1
0
Are you unable to create a new partition table using parted/fdisk/gdisk?
No, I've used everything - even Windows-oriented utilities for low level formatting. All of them complain that
this SD card is write-protected. It has stuck in a strange state - a gpt table created, but no partitions.
And some programs (sfdisk or sgdisk, and even diskpart from Windows) find there some inconsistences.
Perhaps the inner electronics thinks that this errors correspond to a worn state - and sets this read-only attribute.
When I partitioned this sd-card, I've first created the new gpt table, then for a long time speculated about which
partition of what type and size should be created. In this process I've opened two or maybe more parted and
gparted sessions, and then I've saved partitions from one session, then maybe from other... and now this
memory card is in read-only state. Perhaps it has decided that this is the most safe way.:eek:
 

mirfatif

Senior Member
Oct 18, 2016
645
371
63
t.me
No, I've used everything - even Windows-oriented utilities for low level formatting....
How did you connect SD card to PC? I mean USB card reader, SD card slot etc. Sometimes card reader drivers are causing the problems. Are you using Linux / Windows natively or on a VM? Did you try creating partition table on Android phone? Usually phones can handle SD cards better. Try card slot or OTG, in TWRP or from ROM, using arm or aarch64 binaries of parted, fdisk and gdisk. Command line tools are preferable for troubleshooting than GUI tools.
 
Last edited:

igorbounov

Member
Jun 18, 2018
9
1
0
How did you connect SD card to PC? I mean USB card reader, ...
I've used a chip USB card reader. Linux and Windows natively and Windows in a VM (QEMU/KVM). I haven't yet found some other volunteer with Android phone to put my SD card there. My old faithfull Nokia 6131 just don't see this card (and shouldn't, there are no partitions and Nokia 6131 cannot handle sd cards of such size). Yesterday I've used an old card reader, that is built in my daughter's PC, I've used for that purpose a special SD casing for microSD - Windows disk management confirmed that this SD card is read-only.
May be some embedded device could help in this situation - some AVR- or STM32-based device via SPI (than it doesn't matter wether there is some protection or no).