• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

Kill the kill switch - "ST - yy"

Search This thread
By:
Advanced…
xabat

xabat

Senior Member
Apr 6, 2014
128
54
Nvidia Shield Tablet
Huawei MediaPad M5
Just install twrp and then flash the zip. it much easier.

Jeśli masz jeszcze jakieś pytania to pytaj. Postaram się pomóc.
IMysliwiec said:
Wake up thread:

I have nVidia Shield LTE 32GB - it's gonna be in progress of bricking pretty soon.

I have a problem when flashing the no-more-ota zip.
I'm using the PowerShell instead of cmd (couldn't overrun Windows in terms of turning off PowerShell).

After using command "adb reboot bootloader" it's shown that the device is unlocked. All debugging options are unlocked on the device, as well.
I can choose from 5 options:
1. Continue - cold linux boot - device normally booting
2. Fastboot Protocol - rebooting the same screen
3. Recovery Mode - doesn't work, shows the android sign with "no command" written on it.
4. Reboot - normal booting
5. Poweroff - turning off the device

After that I'm using the command "fastboot flash recovery MY FILE NAME.img" PowerShell shows:
"< waiting for device >"

the device is still the same, nothing is happening.
Whichever option I choose, doesn't work for the PowerShell commands.

What is it about?

Sorry if this question came out before but I'm a n00b in this and just trying to rescue my Shield from being bricked.

Help?
Click to expand...
Click to collapse

Sent from my ONEPLUS A6003 using Tapatalk
 
  • Like
Reactions: IMysliwiec
D

dvalmansa

New member
Apr 2, 2017
1
1
xabat said:
Just install twrp and then flash the zip. it much easier.

Jeśli masz jeszcze jakieś pytania to pytaj. Postaram się pomóc.
Click to expand...
Click to collapse


Wake up thread:

I have nVidia Shield LTE 32GB - it's gonna be in progress of bricking pretty soon.

I have a problem when flashing the no-more-ota zip.

I'm using the PowerShell instead of cmd (couldn't overrun Windows in terms of turning off PowerShell).

After using command "adb reboot bootloader" it's shown that the device is unlocked. All debugging options are unlocked on the device, as well.

I can choose from 5 options:

1. Continue - cold linux boot - device normally booting

2. Fastboot Protocol - rebooting the same screen

3. Recovery Mode - doesn't work, shows the android sign with "no command" written on it.

4. Reboot - normal booting

5. Poweroff - turning off the device

After that I'm using the command "fastboot flash recovery MY FILE NAME.img" PowerShell shows:

"< waiting for device >"

the device is still the same, nothing is happening.

Whichever option I choose, doesn't work for the PowerShell commands.

What is it about?

Sorry if this question came out before but I'm a n00b in this and just trying to rescue my Shield from being bricked.

Help?



Your shield is not blocked. As you described, once the original firmware was loaded, according to nvidia instructions, without connecting to the internet !! You put the computer in debug usb mode, in developer options. After installing the latest version TWRP, you will see how the recovery mode works.
 
Last edited:
  • Like
Reactions: ikszero
T

thriceless

New member
Nov 1, 2013
3
0
How goes it guys, first off thanks to all the help in this thread from all the members here! Now I'm still able get into recovery on my original shield 16gb wifi and have been able to flash the nomoreota.zip and lineageOS successfully, however my tablet just hangs on the shield loading screen when I try and load the system. I'm wondering if replacing the battery (since it's still the original Y0) would resolve the issue maybe? Thanks!
 
K

kanekanekane

Member
Jun 3, 2014
29
3
A long while ago I carried out the kill switch fix, but it was so long ago I have forgotten the details. I am sure I used this thread as a guide.

All is well with the tablet, but I have a question.

Can I update to a custom Ron with having to worry about the kill switch?

Can someone please refer me to a guidalsobwhats a decent room. I am not to interested in gaming just good tablet features and good performance.

Thanks in advance.
 
P00r

P00r

Senior Member
Apr 11, 2010
545
93
Montreal
Samsung Galaxy Note 9
Nvidia Shield TV & TV Pro (2019)
kanekanekane said:
A long while ago I carried out the kill switch fix, but it was so long ago I have forgotten the details. I am sure I used this thread as a guide.

All is well with the tablet, but I have a question.

Can I update to a custom Ron with having to worry about the kill switch?

Can someone please refer me to a guidalsobwhats a decent room. I am not to interested in gaming just good tablet features and good performance.

Thanks in advance.
Click to expand...
Click to collapse

yes custom rom normaly do not have the kill swith installed but better be safe than sorry do that the first post tell you to do

If you're on stock, delete TegraOTA (/system/app/TegraOTA or /system/priv-app/TegraOTA if you're on 5.0 or newer, or /system/app/TegraOTA.apk if you're still on 4.4) before booting into Android (the attached ZIP file does this for you, but please check with the file manager in recovery before rebooting and let me know if it didn't work), then reboot

Note: you also will need to delete TegraOTA again if you ever install an OTA from Nvidia or a recovery image
If you're not on stock, you're probably safe
 
  • Like
Reactions: ikszero
K

kanekanekane

Member
Jun 3, 2014
29
3
P00r said:
yes custom rom normaly do not have the kill swith installed but better be safe than sorry do that the first post tell you to do

If you're on stock, delete TegraOTA (/system/app/TegraOTA or /system/priv-app/TegraOTA if you're on 5.0 or newer, or /system/app/TegraOTA.apk if you're still on 4.4) before booting into Android (the attached ZIP file does this for you, but please check with the file manager in recovery before rebooting and let me know if it didn't work), then reboot

Note: you also will need to delete TegraOTA again if you ever install an OTA from Nvidia or a recovery image
If you're not on stock, you're probably safe
Click to expand...
Click to collapse
Do I run the nomoreota.zip via recovery mode.

I tried this and saw an arrow related to no E mapping.
 
T

Titaen

New member
May 4, 2018
2
0
Checks for updates with no TegraOTA folder; am I safe?

@Bogdacutu You could possibly answer this.

I am on 5.4, flashed the nomoreOTA.zip in TWRP (latest), also sideloaded it through TWRP because under the about phone the "check for updates" seemed to be actually *checking*
I have not received kill code, but I never went through the recall process yet. Only now doing it for various reasons.

The folders within the system folder that you mention, and everyone else has mentioned, are not existent on the partition. TegraOTA does not exist under /app or /priv-app -

Is it possible it is located in a different folder in 5.4? OR is it just a remnant of the system that is not really functioning?

Each time I ran nomoreOTA it said it was deleted and successful and I cleared cache and dalvnik as well.

Please advise if you think I am safe at this point?

Thanks!!!
 
P

p3dboard

Senior Member
Oct 20, 2013
1,003
616
Titaen said:
@Bogdacutu You could possibly answer this.

I am on 5.4, flashed the nomoreOTA.zip in TWRP (latest), also sideloaded it through TWRP because under the about phone the "check for updates" seemed to be actually *checking*
I have not received kill code, but I never went through the recall process yet. Only now doing it for various reasons.

The folders within the system folder that you mention, and everyone else has mentioned, are not existent on the partition. TegraOTA does not exist under /app or /priv-app -

Is it possible it is located in a different folder in 5.4? OR is it just a remnant of the system that is not really functioning?

Each time I ran nomoreOTA it said it was deleted and successful and I cleared cache and dalvnik as well.

Please advise if you think I am safe at this point?

Thanks!!!
Click to expand...
Click to collapse
If it's not in those locations you should be safe. This is an nvidia update check, if you have booted and connected to the internet, and it was still installed and your device was marked for disabling, then your device would have been disabled by now
 
  • Like
Reactions: Titaen
T

Titaen

New member
May 4, 2018
2
0
Double check on nomoreOTA in 5.4 on 32GB US LTE

p3dboard said:
If it's not in those locations you should be safe. This is an nvidia update check, if you have booted and connected to the internet, and it was still installed and your device was marked for disabling, then your device would have been disabled by now
Click to expand...
Click to collapse

@Bogdacutu I do want to say thank you for all your hard work on this project. I am needing to make sure they didn't move the folder or apk in the final 5.4 update, and that your patch was still effective in 5.4 (details why follow).

@p3dboard I really appreciate the reply. I didn't mention a few parts to this, to clarify.

The tablet is the 32GB LTE US version. I updated all the way to 5.4 because my tablet was not flagged, and there are no future releases. I received the OTAs then flashed latest TWRP 3.3.1.0 custom recovery.

First, I didn't complete the recall yet, for various reasons, so I don't have the new tablet, etc. I did submit the claim, so I have limited time to triple check the tablet is safe.
So, I do not think that the kill code is pushed to my S/N as of yet, and the S/N check page returns an error, so I can't check *safely*
So, if somehow the TegraOTA.apk folder and app exist elsewhere in 5.4, I could still get the kill code.

Second, I read 95% of thread, and 2-3 people previously noted that the "system update" option under tablet status disappeared once they had applied the nomoreOTA.zip file.
Under settings>about tablet> they stated that their first option was "SEnd feedback to NVIDIA" and the "system update" was gone.

That is not the case for me; what is more, when I enter that option (no kill code pushed yet), and click check for update, it outputs: "Your system is up to date" "Last successful check for update at [LOCAL TIME]" BUT if I disconnect from WIFI, and run the check, it outputs "Can't check for update"

Both the update screen and the "Check for update" link are blue.

This is why I am unsure as to whether or not the patch applied.

I will say that I realized later I needed to mount system in TWRP and then located those folders that way. With the system mounted, I sideloaded the nomoreOTA.zip file which returned an error that it could not find the file (which is good) with a successful message after that.

I don't recall where, but in another shield post, someone was mentioning data/data/com.nvidia???? folder and asking about that as another means to check, and it made me question if I missed something there.

The fact that the app folders in both locations are missing is good, but the ghost function of "check updates" when others stated they didn't have that anymore is what raises a red flag for me.
However, those who posted about not having that function anymore, I believe were NOT on 5.4, so that could be why?

If anyone on 5.4 with a successful nomoreOTA flash (with root file manager check to verify) could speak to whether or not they still have the same "system update">"check for update" features, and have confirmed they are safe without the TegraOTA folder, or .apk, that would definitely answer the question for me as to if the file is successfully deleted or not.

Note: I did also clear the dalvnik and cache through TWRP after sideloading nomoreOTA.zip and before booting to system.

Thanks in advance for any replies! :good:

Update: Relying on @topcat36 's post (thanks), Check updates screen is blue and not green. I checked every location I believe the TegraOTA files could possibly be, including data and cache, and it is not listed. I should be good. Thanks to everyone on this thread for your input.

https://forum.xda-developers.com/showpost.php?p=73608071&postcount=1751
 
Last edited:
TheKicKer69

TheKicKer69

Senior Member
Aug 12, 2011
210
23
Dubai
www.i-buzz.com
K bought 2 new batteries 1 for my shield tablet that's working and 1 for my dead shield (kill switch got to it). I can only charge it. I don't mind opening it and dissecting it if I can get it to work. Can we change the drive? SD card or wotever it is? My shield is on LOS and working damn well. Getting the other one to work would be great. Any help would b appreciated.
Cheers,
Roger
 
You must log in or register to reply here.

Similar threads

N
How to finally kill the kill switch?
Replies
0
Views
5K
N
Nikownzyu
B
Shield Kill Switch
Replies
240
Views
95K
B
bladow75
N
[BUSTED] Pyro got killed after flashing recovery Image!
Replies
38
Views
5K
P
Paharsahath JG
T
Whats's the best ROM for stability?
Replies
1
Views
2K
L
lost2
A
Is the Shield Tablet still worth buying?
Replies
17
Views
4K
guily6669
guily6669

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 410
    Bogdacutu
    Bogdacutu
    < include generic disclaimer here >

    TL;DR

    Since update 3.1, Nvidia can force updates (such as the one that bricks your tablet) to be downloaded and installed silently. No guarantees, but:
    • If you're on stock, delete TegraOTA (/system/app/TegraOTA or /system/priv-app/TegraOTA if you're on 5.0 or newer, or /system/app/TegraOTA.apk if you're still on 4.4) before booting into Android (the attached ZIP file does this for you, but please check with the file manager in recovery before rebooting and let me know if it didn't work), then reboot
      Note: you also will need to delete TegraOTA again if you ever install an OTA from Nvidia or a recovery image
    • If you're not on stock, you're probably safe
    EDIT: The urgent OTA is currently not getting sent out to any devices anymore, not even to those who have been getting it before.
    EDIT 2: The urgent OTA is now being delivered again, this time named "ST - yy"!

    What if my tablet is already deactivated?

    Unless you can still boot into fastboot mode (in which case your tablet isn't really deactivated yet), your tablet is probably gone for good. The only way to fix this would be through nvflash, and using it requires the SBK that is unique to each device and that only Nvidia knows, so it's pretty unlikely that we'll ever be able to fix these deactivated tablets.

    What/why/how?

    In the last OTA (Update 3.1), Nvidia has made some changes to their TegraOTA application. The most important/interesting/suspicious of which is the ability for them to mark OTAs as "urgent". What this means is that these updates will be downloaded without ever notifying the user, and they will be installed without asking the user for permission first. If this is how the kill switch is delivered, all users will see is the tablet randomly rebooting and installing an update, then the tablet would never boot again. As some of you might notice, this would match what has been happening to a few users already, both here and on reddit.

    But that's not all. I've been connecting to the OTA servers using various serial numbers (both found and provided to me by a few people) in hopes of actually finding the update that bricks the device. The first serial number I've tried that wasn't mine was the serial number from the screenshot on the recall page. It revealed an interesting "urgent" OTA, named "SHIELD Tablet xx - LTE", which does nothing but flash a blob (which, among other things, contains the bootloader). Many more questions appear now, but the main one is: if this is nothing but a routine bootloader update, why is it marked urgent? And why is it not attached to any Android update? But this by itself is not enough to prove anything, as I could only obtain it with one serial number, so as far as I could have known, it might had just been an internal update or something similar. (update is linked and analysed in the second post below)

    Today, however, one of the serial numbers I've been given by some of the people here (thanks for the help guys!) turned out to have the same update waiting for it the next time it connected to the Internet. This rules out the possibility of an internal update, so the next somewhat obvious possibility is that this is the kill switch. Mind you, I still have no direct way of proving this without flashing the ZIP to see what happens (which I'm not planning to do myself), but I will keep checking on the other serial numbers I've gotten to see if this update turns up for them too.

    The same person who has given me this serial number has also tested running the old tablet on the latest stock Android version but with TegraOTA removed, and, as expected, the tablet is still working perfectly fine now. Your mileage may vary.

    How can I know if the kill switch has been triggered for my tablet?

    Go to http://shield.bogdacutu.me/ and enter the full serial number of your old tablet. If the next OTA returned is "SHIELD Tablet xx" "ST - yy", the kill switch has been triggered for your tablet.
    Warning: the serial number from the box of the tablet and the one etched on the side of the tablet are not complete, as they only contain the first 13 characters of the full (20 characters) serial number. You can get the full serial number from Android (Settings -> About -> Status), from the bootloader (it will be on the screen when you boot into bootloader mode), or from your computer if the tablet is or (in some cases) if it was previously connected, using various tools such as USBDeview. Example: 0413714803249000a4cf (you can try this on the page and it will return that the kill switch is activated).

    Why would I want to also do the fix on my new tablet too?

    The update is signed by Nvidia, and communication with the OTA server does not use HTTPS, so, for example, a malicious WiFi network could MITM your connection and cause this update (as well as any other signed update) to be flashed to your new tablet without your permission, thus permanently disabling it too. If you have the stock recovery, only updates signed by Nvidia can run. The story might be slightly different if your recovery doesn't enforce signature verification (such as TWRP and CWM by default).

    Can I still get updates from Nvidia after doing this?

    Not directly, but people will post OTA download links here on xda when new updates get released. I'd personally recommend that you wait before flashing though until someone here checks the new update to confirm that there's no new way for Nvidia to kill your tablet.


    Many hours of work have gone into investigating this. Even if it doesn't help your specific scenario, consider hitting that Thanks button, so that I can at least know it wasn't for nothing. :)
    I'd also like to thank the people who have given me their serial numbers to use for testing again, this wouldn't have been possible without their help: @Beauenheim, @Jackill, and @runandhide05 (who has even volunteered to test removing TegraOTA with the latest update on his old tablet :highfive:)
    View
    19
    Bogdacutu
    Bogdacutu
    Fragments of code from TegraOTA.apk

    < screenshots temporarily removed >

    Also, from what I've seen so far, the update isn't delivered instantly after activating the new tablet. I don't know exactly what the rule is, but out of the 4 serial numbers that I have, only 2 have this update waiting for them.

    EDIT: One more serial number from the ones I have has gotten the xx update. Only one left...

    EDIT 2: All the serial numbers I have have the urgent OTA waiting for them now.
    View
    18
    Bogdacutu
    Bogdacutu
    "SHIELD Tablet xx" - Update Analysis

    OTA URL: http://ota.nvidia.com/ota/data/post...wf-full_ota-32256_554.0168.20150624152335.zip
    yy OTA URL: http://ota.nvidia.com/ota/data/posted-roms/uploaded/st---yy--092704233775---7294.20150819152732.zip (if you don't know what you're doing, DO NOT DOWNLOAD THIS, it's very likely that this will permanently brick your device upon flashing it!!!) - also attached to this post in case this link becomes invalid

    updater-script is the first file we check:
    Code: 
    getprop("ro.product.device") == "shieldtablet" || abort("This package is for \"shieldtablet\" devices; this is a \"" + getprop("ro.product.device") + "\".");
nv_copy_blob_file("blob", "/staging");
reboot_now("/dev/block/platform/sdhci-tegra.3/by-name/MSC", "");

    Suspiciously enough, this only flashes a blob to the staging partition. But what exactly does this blob do, you might ask? Well, the blob actually contains data for 9 partitions, which are automatically replaced during the next boot (before the bootloader does anything else at all, so once you've rebooted, there's no going back) with the contents present in this blob. The 9 partitions are as follows (also detailing comparison with files from update 3.1):

    • BCT (Boot Configuration Table) - stores some information that is needed for the device to find the bootloader stored on the other partitions, initialize the RAM and some other stuff
      Status after update: probably corrupted - the previous OTAs have binary BCTs, but this update replaces it with a text file (which, while it does contain somewhat relevant information, is likely not a valid format). If this is corrupted, it's enough for the device not to be able to boot anymore.
    • BMP (boot logo) - intact
    • DTB - intact
    • EBT (part of the bootloader) - has a zeroed out region
    • NVC (part of the bootloader) - intact
    • RBL (part of the bootloader) - has a zeroed out region
    • RP4 (landscape boot logo) - intact
    • TOS (Trusted OS - probably part of the bootloader too) - has a zeroed out region
    • WB0 (related to the boot process, source file is named "nvbootwb0.bin") - has a zeroed out region
    The update also contains a few other files, but those are not used at all (probably leftovers from the 5.1 AOSP update template that they are using).

    DO NOT DOWNLOAD THE ATTACHMENT IF YOU DON'T KNOW WHAT YOU'RE DOING. THIS IS THE XX OTA, NOT THE ZIP THAT REMOVES TEGRAOTA!
    View
    10
    romracer
    romracer
    I don't mind the OTA app on my new tablet, but I don't like the ability to just download silent updates. That concerns me, especially considering legitimate tablets getting nuked.

    I made the attached Xposed module if you're running 5.1.1 that will disable the silent download method. It will also mark "urgent" updates as no longer urgent (thus they will show a notification instead). This means you can theoretically have the OTA app installed on your terminated tablet. But you will have a persistent notification for an OTA available. Screenshot of this on my terminated tablet is also attached (for fun, don't do it on yours, I can't/won't be responsible).

    So if you'd like the peace of mind of not having silent updates snuck past you even on your perfectly good tablet, install this Xposed module. I only tested on 5.1.1 by the way.

    Code: 
    package biz.underpants_gnomes.android.xposed.mods.nvsilentupdatekiller;

import android.content.Context;

import java.lang.reflect.Array;

import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XC_MethodReplacement;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage;

public class NVSilentUpdateKiller implements IXposedHookLoadPackage {

    @Override
    public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam lpparam) {
        if (!lpparam.packageName.equals("com.nvidia.ota"))
            return;

        try {
            final Class<?> mClsRomInfo = XposedHelpers.findClass("com.nvidia.ota.utils.RomInfo", lpparam.classLoader);
            XposedHelpers.findAndHookMethod("com.nvidia.ota.UpdateCheckService", lpparam.classLoader, "silentDownloadUpdate",
                    Context.class, mClsRomInfo, XC_MethodReplacement.returnConstant(null));

            final Class mClsArrOfRomInfo = Array.newInstance(mClsRomInfo, 0).getClass();
            XposedHelpers.findAndHookMethod("com.nvidia.ota.utils.RomInfo.FetchInfoTask", lpparam.classLoader, "onPostExecute",
                    mClsArrOfRomInfo, new XC_MethodHook() {

                        @Override
                        protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                            if ((param.args[0] == null) || (Array.getLength(param.args[0]) == 0)) { return; }

                            Object mRomInfo = Array.get(param.args[0], 0);
                            XposedHelpers.setBooleanField(mRomInfo, "urgent", false);
                        }
                    });
        } catch (Throwable t) { XposedBridge.log(t); }
    }
}
    View
    8
    K
    K1llSh0T
    Got The Urgent one of my my Tablets

    First of all, would like to thank Bogdacutu for all the research and work done.:good::good::good: Never rooted or flashed anything Android, the last experience I had with any type of root/jailbreak was with an Iphone 4 - redsn0w (no longer an Apple user). Anyway, I have 2 Shield Tablets, so did the whole recall process, got my replacements in the mail and left them untouched. I'm not anywhere near developer or programmer level, but I can work my way around PC's (built 5 desktops), but figured someone would figure out how to bypass this killswitch. Honestly I've had my original tablets since last November, and never really had a problem of them getting super hot, so definitely did not want to send these back. Followed Bogdacutu's instructions and with some simple research (Not asking on this thread) I first had to root, flash TWRP, flash 3.1 OTA, then flash nomoreota.zip to remove the TegraOTA folder and TegraOTA.apk, and today, via Bogdacutu's link, noticed one of them is pending the "Urgent update of Death!" So. out of curiosity..just restarted the tablet with the killswitch and booted up fine. :victory:. Been reading this thread since it was only 1 page and haven't really found stating if this actually worked after following Bogdacutu's instructions and then activating the new tablet. Well, so far my tablet restarted and all is well, i'll try again and restart tomorrow to see what happens. And guys, stop asking Bogdacutu how to root, flash, etc. Youtube is an amazing thing nowadays. Follow these links for those instructions and lets keep focused on results! Again, thank you Bogdacutu. Here's youtube links to root, flash, etc. and of course DON'T forget to flash nomoreota.zip (download link via OP) , literally this is all you need.

    https://www.youtube.com/watch?v=Ocar8LJZlt0
    https://www.youtube.com/watch?v=5BZGleRdqPk

    3.1 OTA, click on Download>OTA>Full, pick your model ...
    http://forum.xda-developers.com/shi...k-recovery-images-ota-library-guides-t2988881
    View

New posts