Tell you what... Read the thread, then post what you want to do verbatim word for word step by step and I'll let you know if it's correct.
Kill the kill switch - "ST - yy"
- Thread starter Bogdacutu
- Start date
I'd like to report my unexpected mishap with my Shield:
I followed the procedure for the exchange of the tablet (battery) mid-september: the replacement is expected after 4-6 weeks, I guess around november.
During this period, I experimented with various ROM on that tablet, thinking that I was safe from the kill switch, until I activate the replacement shield.
Thus, I installed ROM 3.1.1, upgraded OTA to 4.1, then 4.4, installing TWRP and magisk each time.
Last time (4.4), I installed magisk, on the next reboot, the screen stayed frightfully black.
After checking, the tablet is now detected as APX by Windows :/
Obviously, NVidia anticipated the kill before I receive and activate the replacement.
I hope to receive the new tablet soon, I had also planned to keep the 'old' after nomoreOTA They were too quick
I followed the procedure for the exchange of the tablet (battery) mid-september: the replacement is expected after 4-6 weeks, I guess around november.
During this period, I experimented with various ROM on that tablet, thinking that I was safe from the kill switch, until I activate the replacement shield.
Thus, I installed ROM 3.1.1, upgraded OTA to 4.1, then 4.4, installing TWRP and magisk each time.
Last time (4.4), I installed magisk, on the next reboot, the screen stayed frightfully black.
After checking, the tablet is now detected as APX by Windows :/
Obviously, NVidia anticipated the kill before I receive and activate the replacement.
I hope to receive the new tablet soon, I had also planned to keep the 'old' after nomoreOTA They were too quick
It sounds strange. I am not sure the Nvidia killswitch was to blame.
Check you tablet's Sn on Bogdacutu's website, if it has the killing update waiting.
Address is: http://shield.bogdacutu.me
Sent from my old SHIELD Tablet.
Check you tablet's Sn on Bogdacutu's website, if it has the killing update waiting.
Address is: http://shield.bogdacutu.me
Sent from my old SHIELD Tablet.
Hello, I don't think I can check the SN anymore: the tablet won't boot, and adb doesn't recognize it anymore. Is the S/N printed somewhere on the tablet ?
As a side note, I just received the information from NVidia that the tablet has been shipped and should arrive tomorrow, maybe that triggered the kill switch yesterday.
---------- Post added at 08:41 AM ---------- Previous post was at 08:14 AM ----------
Ah! I kept the power button pressed for a long time (30-40 seconds), and then powered it to bootloader: success ! I probably entered the APX mode without knowing and confused it with the kill switch.
I'm not reflashing to 5.2.2 and will nomoreOTA ASAP.
My day is better now
BTW, the SN check says that next OTA is 3.1.1, which is odd because the last OTA I received was 4.4.
As a side note, I just received the information from NVidia that the tablet has been shipped and should arrive tomorrow, maybe that triggered the kill switch yesterday.
---------- Post added at 08:41 AM ---------- Previous post was at 08:14 AM ----------
Ah! I kept the power button pressed for a long time (30-40 seconds), and then powered it to bootloader: success ! I probably entered the APX mode without knowing and confused it with the kill switch.
I'm not reflashing to 5.2.2 and will nomoreOTA ASAP.
My day is better now
BTW, the SN check says that next OTA is 3.1.1, which is odd because the last OTA I received was 4.4.
Flash whatever you want. Just keep data off until you verify that it's safe.Hello, I don't think I can check the SN anymore: the tablet won't boot, and adb doesn't recognize it anymore. Is the S/N printed somewhere on the tablet ?
As a side note, I just received the information from NVidia that the tablet has been shipped and should arrive tomorrow, maybe that triggered the kill switch yesterday.
---------- Post added at 08:41 AM ---------- Previous post was at 08:14 AM ----------
Ah! I kept the power button pressed for a long time (30-40 seconds), and then powered it to bootloader: success ! I probably entered the APX mode without knowing and confused it with the kill switch.
I'm not reflashing to 5.2.2 and will nomoreOTA ASAP.
My day is better now
BTW, the SN check says that next OTA is 3.1.1, which is odd because the last OTA I received was 4.4.
Hi there. I applied the kill switch killer on my replacement tablet by mistake. Yeah, I know, pretty dumb of me. Both tabs are so identical...
So now I can't do OTA updates on my replacement tablet. Is there a way of reversing this kill switch killer? Or am I stuck to manually flashing updates from now on?
So now I can't do OTA updates on my replacement tablet. Is there a way of reversing this kill switch killer? Or am I stuck to manually flashing updates from now on?
For some reason i cannot find the folder to delete in system/apps/ I cant findt TegraOTA at all?!
So when I use the Shield Tablet OTA Check, I get : Next OTA: SHIELD Tablet Software Upgrade 3.1.1 - WiFi - FULL
On my Old Tablet with android 7.0 stock but rooted tablet I could not find any TegraOTA.
Not in
System/apps
System/prv aps
The Update Service is available when i click "About Tablet / Check for Update" and says i have the newest.
I then opend my replacement Tablet "New" for the first time, started it and updated + rooted it.
In there I found the TegraOTA in prv app . I deleted it.
So when I now go to "About Tablet" there is com.nvidia.ota.ui.Launcher.Activity where the "Check for update" was.
I rechecked my old tablet there is still no TegraOTA to find but in About Tablet I can start the "Check for Update" Service
I flashed the zip with flashify
Im confused about all this ,Please help
EDIT: Now the "Next OTA: ST - yy (urgent)" has been activated. OH MY!
Thank you for all the work
So when I use the Shield Tablet OTA Check, I get : Next OTA: SHIELD Tablet Software Upgrade 3.1.1 - WiFi - FULL
On my Old Tablet with android 7.0 stock but rooted tablet I could not find any TegraOTA.
Not in
System/apps
System/prv aps
The Update Service is available when i click "About Tablet / Check for Update" and says i have the newest.
I then opend my replacement Tablet "New" for the first time, started it and updated + rooted it.
In there I found the TegraOTA in prv app . I deleted it.
So when I now go to "About Tablet" there is com.nvidia.ota.ui.Launcher.Activity where the "Check for update" was.
I rechecked my old tablet there is still no TegraOTA to find but in About Tablet I can start the "Check for Update" Service
I flashed the zip with flashify
Im confused about all this ,Please help
EDIT: Now the "Next OTA: ST - yy (urgent)" has been activated. OH MY!
Thank you for all the work
Last edited:
hello guys,
I know i'm jumping in the post really hard. But I have a question that maybe has an easy answer.
I have a "ST-yy" tablet, last software situation in the first solution on august 2015 for kill the switch kill, with NOMOREOTA.
So I'm on android 5.1.1.
Is there any solution to update to 6.0 without "any" risk???
thanks guys.
P.s. the only reason I want update is to get the HDMI CEC function. If there is any other way, better.
I know i'm jumping in the post really hard. But I have a question that maybe has an easy answer.
I have a "ST-yy" tablet, last software situation in the first solution on august 2015 for kill the switch kill, with NOMOREOTA.
So I'm on android 5.1.1.
Is there any solution to update to 6.0 without "any" risk???
thanks guys.
P.s. the only reason I want update is to get the HDMI CEC function. If there is any other way, better.
@#7*#$%, it tricked me,
Before OAT updates I deactivated Wifi & activated Airplane mode.
Did the Full OTA update's Flashed SU & the nomoreota.zip
TWRP told me everything was fine so stupid me trusted on that and didn't double check if the files were gone.
After booting the tablet back up it had wifi activated by him self, downloaded the update in a flash, rebooted, and killed my tablet.
So as a litte extra safety, remove your nearby wifi networks before starting the updates and do double double double check the file is gone.
Before OAT updates I deactivated Wifi & activated Airplane mode.
Did the Full OTA update's Flashed SU & the nomoreota.zip
TWRP told me everything was fine so stupid me trusted on that and didn't double check if the files were gone.
After booting the tablet back up it had wifi activated by him self, downloaded the update in a flash, rebooted, and killed my tablet.
So as a litte extra safety, remove your nearby wifi networks before starting the updates and do double double double check the file is gone.
Nomoreota.zip does not remove tegraota from /system/app-private on 5.3 update. You have to manually do it or you will hard brick your pyro tab! It's very simple, just mount system in TWRP, go to advanced/-file manager. Navigate to /system/app-private/tegraOTA and DELETE the whole folder. Reboot and done and done.
Last edited:
Would have been nice if this info was on the first page with the propper versions it worked with and from witch it doesn't annymore
At first please forgive me for my trivial questions but i'm a beginner.
I've got Nvidia Shiled LTE and after istalled AICP rom my tablet stack on logo aicp. But before that I used the tablet normally on AICP rom.
Now my problem is that I can do nothinthg with it.
I can't flash any rom via sd card (unable to mount storage)
I can't even do the same via adb/fastboot.
When I flash the recovery, system, boot, data via fastboot and it goes right, i mean after this commands apper status OK!. but there is no changes in my tablet, there is still old system and recovery.
I can load the latest TWRP via command fastboot boot twrpXXXX and it runs. By this twrp I wipe data, system, cache but I still get the "unable to mount partition/storage"
Is there any solution for this? Is my tablet bricked?
Please tell me was my tablet kill switched?
Please tell me what really is this "kill switch"? Deactivated means can't turn on, black screen?
Thanks everybody for answer.
I've got Nvidia Shiled LTE and after istalled AICP rom my tablet stack on logo aicp. But before that I used the tablet normally on AICP rom.
Now my problem is that I can do nothinthg with it.
I can't flash any rom via sd card (unable to mount storage)
I can't even do the same via adb/fastboot.
When I flash the recovery, system, boot, data via fastboot and it goes right, i mean after this commands apper status OK!. but there is no changes in my tablet, there is still old system and recovery.
I can load the latest TWRP via command fastboot boot twrpXXXX and it runs. By this twrp I wipe data, system, cache but I still get the "unable to mount partition/storage"
Is there any solution for this? Is my tablet bricked?
Please tell me was my tablet kill switched?
Please tell me what really is this "kill switch"? Deactivated means can't turn on, black screen?
Thanks everybody for answer.
Somebody else had that problem... Read through the q&a forum. I don't think he ever fixed it. You can try to format data in twrp and see if it helps.
Similar threads
Top Liked Posts
-
There are no posts matching your filters.
-
410< include generic disclaimer here >
TL;DR
Since update 3.1, Nvidia can force updates (such as the one that bricks your tablet) to be downloaded and installed silently. No guarantees, but:
- If you're on stock, delete TegraOTA (/system/app/TegraOTA or /system/priv-app/TegraOTA if you're on 5.0 or newer, or /system/app/TegraOTA.apk if you're still on 4.4) before booting into Android (the attached ZIP file does this for you, but please check with the file manager in recovery before rebooting and let me know if it didn't work), then reboot
Note: you also will need to delete TegraOTA again if you ever install an OTA from Nvidia or a recovery image - If you're not on stock, you're probably safe
EDIT: The urgent OTA is currently not getting sent out to any devices anymore, not even to those who have been getting it before.
EDIT 2: The urgent OTA is now being delivered again, this time named "ST - yy"!
What if my tablet is already deactivated?
Unless you can still boot into fastboot mode (in which case your tablet isn't really deactivated yet), your tablet is probably gone for good. The only way to fix this would be through nvflash, and using it requires the SBK that is unique to each device and that only Nvidia knows, so it's pretty unlikely that we'll ever be able to fix these deactivated tablets.
What/why/how?
In the last OTA (Update 3.1), Nvidia has made some changes to their TegraOTA application. The most important/interesting/suspicious of which is the ability for them to mark OTAs as "urgent". What this means is that these updates will be downloaded without ever notifying the user, and they will be installed without asking the user for permission first. If this is how the kill switch is delivered, all users will see is the tablet randomly rebooting and installing an update, then the tablet would never boot again. As some of you might notice, this would match what has been happening to a few users already, both here and on reddit.
But that's not all. I've been connecting to the OTA servers using various serial numbers (both found and provided to me by a few people) in hopes of actually finding the update that bricks the device. The first serial number I've tried that wasn't mine was the serial number from the screenshot on the recall page. It revealed an interesting "urgent" OTA, named "SHIELD Tablet xx - LTE", which does nothing but flash a blob (which, among other things, contains the bootloader). Many more questions appear now, but the main one is: if this is nothing but a routine bootloader update, why is it marked urgent? And why is it not attached to any Android update? But this by itself is not enough to prove anything, as I could only obtain it with one serial number, so as far as I could have known, it might had just been an internal update or something similar. (update is linked and analysed in the second post below)
Today, however, one of the serial numbers I've been given by some of the people here (thanks for the help guys!) turned out to have the same update waiting for it the next time it connected to the Internet. This rules out the possibility of an internal update, so the next somewhat obvious possibility is that this is the kill switch. Mind you, I still have no direct way of proving this without flashing the ZIP to see what happens (which I'm not planning to do myself), but I will keep checking on the other serial numbers I've gotten to see if this update turns up for them too.
The same person who has given me this serial number has also tested running the old tablet on the latest stock Android version but with TegraOTA removed, and, as expected, the tablet is still working perfectly fine now. Your mileage may vary.
How can I know if the kill switch has been triggered for my tablet?
Go to http://shield.bogdacutu.me/ and enter the full serial number of your old tablet. If the next OTA returned is"SHIELD Tablet xx""ST - yy", the kill switch has been triggered for your tablet.
Warning: the serial number from the box of the tablet and the one etched on the side of the tablet are not complete, as they only contain the first 13 characters of the full (20 characters) serial number. You can get the full serial number from Android (Settings -> About -> Status), from the bootloader (it will be on the screen when you boot into bootloader mode), or from your computer if the tablet is or (in some cases) if it was previously connected, using various tools such as USBDeview. Example: 0413714803249000a4cf (you can try this on the page and it will return that the kill switch is activated).
Why would I want to also do the fix on my new tablet too?
The update is signed by Nvidia, and communication with the OTA server does not use HTTPS, so, for example, a malicious WiFi network could MITM your connection and cause this update (as well as any other signed update) to be flashed to your new tablet without your permission, thus permanently disabling it too. If you have the stock recovery, only updates signed by Nvidia can run. The story might be slightly different if your recovery doesn't enforce signature verification (such as TWRP and CWM by default).
Can I still get updates from Nvidia after doing this?
Not directly, but people will post OTA download links here on xda when new updates get released. I'd personally recommend that you wait before flashing though until someone here checks the new update to confirm that there's no new way for Nvidia to kill your tablet.
Many hours of work have gone into investigating this. Even if it doesn't help your specific scenario, consider hitting that Thanks button, so that I can at least know it wasn't for nothing.
I'd also like to thank the people who have given me their serial numbers to use for testing again, this wouldn't have been possible without their help: @Beauenheim, @Jackill, and @runandhide05 (who has even volunteered to test removing TegraOTA with the latest update on his old tablet :highfive19Fragments of code from TegraOTA.apk
< screenshots temporarily removed >
Also, from what I've seen so far, the update isn't delivered instantly after activating the new tablet. I don't know exactly what the rule is, but out of the 4 serial numbers that I have, only 2 have this update waiting for them.
EDIT: One more serial number from the ones I have has gotten the xx update. Only one left...
EDIT 2: All the serial numbers I have have the urgent OTA waiting for them now.18"SHIELD Tablet xx" - Update Analysis
OTA URL: http://ota.nvidia.com/ota/data/post...wf-full_ota-32256_554.0168.20150624152335.zip
yy OTA URL: http://ota.nvidia.com/ota/data/posted-roms/uploaded/st---yy--092704233775---7294.20150819152732.zip (if you don't know what you're doing, DO NOT DOWNLOAD THIS, it's very likely that this will permanently brick your device upon flashing it!!!) - also attached to this post in case this link becomes invalid
updater-script is the first file we check:
Code:getprop("ro.product.device") == "shieldtablet" || abort("This package is for \"shieldtablet\" devices; this is a \"" + getprop("ro.product.device") + "\"."); nv_copy_blob_file("blob", "/staging"); reboot_now("/dev/block/platform/sdhci-tegra.3/by-name/MSC", "");
Suspiciously enough, this only flashes a blob to the staging partition. But what exactly does this blob do, you might ask? Well, the blob actually contains data for 9 partitions, which are automatically replaced during the next boot (before the bootloader does anything else at all, so once you've rebooted, there's no going back) with the contents present in this blob. The 9 partitions are as follows (also detailing comparison with files from update 3.1):
- BCT (Boot Configuration Table) - stores some information that is needed for the device to find the bootloader stored on the other partitions, initialize the RAM and some other stuff
Status after update: probably corrupted - the previous OTAs have binary BCTs, but this update replaces it with a text file (which, while it does contain somewhat relevant information, is likely not a valid format). If this is corrupted, it's enough for the device not to be able to boot anymore. - BMP (boot logo) - intact
- DTB - intact
- EBT (part of the bootloader) - has a zeroed out region
- NVC (part of the bootloader) - intact
- RBL (part of the bootloader) - has a zeroed out region
- RP4 (landscape boot logo) - intact
- TOS (Trusted OS - probably part of the bootloader too) - has a zeroed out region
- WB0 (related to the boot process, source file is named "nvbootwb0.bin") - has a zeroed out region
DO NOT DOWNLOAD THE ATTACHMENT IF YOU DON'T KNOW WHAT YOU'RE DOING. THIS IS THE XX OTA, NOT THE ZIP THAT REMOVES TEGRAOTA!10I don't mind the OTA app on my new tablet, but I don't like the ability to just download silent updates. That concerns me, especially considering legitimate tablets getting nuked.
I made the attached Xposed module if you're running 5.1.1 that will disable the silent download method. It will also mark "urgent" updates as no longer urgent (thus they will show a notification instead). This means you can theoretically have the OTA app installed on your terminated tablet. But you will have a persistent notification for an OTA available. Screenshot of this on my terminated tablet is also attached (for fun, don't do it on yours, I can't/won't be responsible).
So if you'd like the peace of mind of not having silent updates snuck past you even on your perfectly good tablet, install this Xposed module. I only tested on 5.1.1 by the way.
Code:package biz.underpants_gnomes.android.xposed.mods.nvsilentupdatekiller; import android.content.Context; import java.lang.reflect.Array; import de.robv.android.xposed.IXposedHookLoadPackage; import de.robv.android.xposed.XC_MethodHook; import de.robv.android.xposed.XC_MethodReplacement; import de.robv.android.xposed.XposedBridge; import de.robv.android.xposed.XposedHelpers; import de.robv.android.xposed.callbacks.XC_LoadPackage; public class NVSilentUpdateKiller implements IXposedHookLoadPackage { @Override public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam lpparam) { if (!lpparam.packageName.equals("com.nvidia.ota")) return; try { final Class<?> mClsRomInfo = XposedHelpers.findClass("com.nvidia.ota.utils.RomInfo", lpparam.classLoader); XposedHelpers.findAndHookMethod("com.nvidia.ota.UpdateCheckService", lpparam.classLoader, "silentDownloadUpdate", Context.class, mClsRomInfo, XC_MethodReplacement.returnConstant(null)); final Class mClsArrOfRomInfo = Array.newInstance(mClsRomInfo, 0).getClass(); XposedHelpers.findAndHookMethod("com.nvidia.ota.utils.RomInfo.FetchInfoTask", lpparam.classLoader, "onPostExecute", mClsArrOfRomInfo, new XC_MethodHook() { @Override protected void beforeHookedMethod(MethodHookParam param) throws Throwable { if ((param.args[0] == null) || (Array.getLength(param.args[0]) == 0)) { return; } Object mRomInfo = Array.get(param.args[0], 0); XposedHelpers.setBooleanField(mRomInfo, "urgent", false); } }); } catch (Throwable t) { XposedBridge.log(t); } } }8Got The Urgent one of my my Tablets
First of all, would like to thank Bogdacutu for all the research and work done.:good::good::good: Never rooted or flashed anything Android, the last experience I had with any type of root/jailbreak was with an Iphone 4 - redsn0w (no longer an Apple user). Anyway, I have 2 Shield Tablets, so did the whole recall process, got my replacements in the mail and left them untouched. I'm not anywhere near developer or programmer level, but I can work my way around PC's (built 5 desktops), but figured someone would figure out how to bypass this killswitch. Honestly I've had my original tablets since last November, and never really had a problem of them getting super hot, so definitely did not want to send these back. Followed Bogdacutu's instructions and with some simple research (Not asking on this thread) I first had to root, flash TWRP, flash 3.1 OTA, then flash nomoreota.zip to remove the TegraOTA folder and TegraOTA.apk, and today, via Bogdacutu's link, noticed one of them is pending the "Urgent update of Death!" So. out of curiosity..just restarted the tablet with the killswitch and booted up fine. :victory:. Been reading this thread since it was only 1 page and haven't really found stating if this actually worked after following Bogdacutu's instructions and then activating the new tablet. Well, so far my tablet restarted and all is well, i'll try again and restart tomorrow to see what happens. And guys, stop asking Bogdacutu how to root, flash, etc. Youtube is an amazing thing nowadays. Follow these links for those instructions and lets keep focused on results! Again, thank you Bogdacutu. Here's youtube links to root, flash, etc. and of course DON'T forget to flash nomoreota.zip (download link via OP) , literally this is all you need.
https://www.youtube.com/watch?v=Ocar8LJZlt0
https://www.youtube.com/watch?v=5BZGleRdqPk
3.1 OTA, click on Download>OTA>Full, pick your model ...
http://forum.xda-developers.com/shi...k-recovery-images-ota-library-guides-t2988881 - If you're on stock, delete TegraOTA (/system/app/TegraOTA or /system/priv-app/TegraOTA if you're on 5.0 or newer, or /system/app/TegraOTA.apk if you're still on 4.4) before booting into Android (the attached ZIP file does this for you, but please check with the file manager in recovery before rebooting and let me know if it didn't work), then reboot
