M2 with Fastboot BL

Search This thread

DreadPirateDan

Senior Member
Oct 16, 2011
471
112
Queensland
True! but in the original thread we've just about exhausted ideas.. figure it's worth a shot anyways.

I just wonder if it was some mad-sciencetist's phone and he was trying all sorts of kooky attempts to unlock the bootloader or something (ie, it's not actually a dev phone and just a partially unlocked but perma-bricked phone). Of course the more logical explaintion would be he dropped it in the loo and fried some memory though


ALSO, have you been flashing these SBF's while in normal bootloader mode or fastboot?
According to Murphey's Law, your phone should start working any day now (now that you have a new one coming;))
 
Last edited:

r2beta0

Senior Member
Nov 8, 2010
482
121
Rio de Janeiro
I think he could try to flash an official Retail GB SBF and do a data wipe through stock recovery. Also note that there is a thread saying GB SBF requires RSD Lite 5.0. It should be done on normal bootloader mode.

If it doesn't work just try to unpack the SBF (with moto depacker) and flash system/recovery/cdt/boot/devtree using fastboot commands.
 
  • Like
Reactions: Lutis and MKSilver

MKSilver

Member
Apr 27, 2008
33
11
can I just rename the depacked CG31.smg into cdt.img?

Don't know so much about depacking and rebuilding.

When I depack for example a 2.3.4 DE retail, there is a boot.img/recovery.img/system.img but no cdt or devtree img, only the CG31 and CG61 files in smg.

greetz

Just flashed those files u suggest:
boot, recovery and devtree went fine.
got errors in system and cdt

cdt:
sending 'cdt' <18 KB>...
OKAY [0.004s]
writing 'cdt'...
<bootloader> no such partition
FAILED <remote failure>
finished. total time: 0.795s

system:
sending 'system' <334594 KB>
OKAY [21.498s]
writing 'system'...
<bootloader> image bigger than partition
FAILED <remote failure>
finished. total time 21.821s


So it seems that my system partition is to small and cdt has no partition defined.
How do I make/change partitions with bootloader...hahaha.

Next questions are,

which vars are defined in the bootloader (gevar command in fastboot)

how do I use flashall command, fastboot asks about -p option (error: neither -p product specified nor ANDROID_PRODUCT_OUT set), may be I use it not correct.

In which files of android is the kernel stored? boot.img isn't it? Could start kernel (M Logo) but don't had luck access it with adb. May be ssh would work?

Are the kernel base adress and the page size known and what does that mean?

Will go on, just finished the defy thread, but now I have to learn a lot more about fastboot, builds and how android is working and with which adresses which partition is starting. So may u devs help me with information and may be even files. singed or unsigned doesn't matter for me right now. the bootloader eats all files and it goes fine oder it throwes errors, but the phone doesn't brick.

greetz
 
Last edited:
  • Like
Reactions: Lutis

thmedia

Member
Jan 10, 2010
12
0
I think you can't flash system becouse the file is to big for fastboot. Try the special moto version "moto-fastboot", look in the atrix forum. I am not sure about this but I had an error when I tried to flash system to my atrix with normal fastboot, using moto-fastboot worked. Hope I cloud help.

Sent from my MotoA953 using Tapatalk
 
Last edited:

t0desicy

Senior Member
Mar 29, 2011
65
78
Hi Guys,

a new challanger appears.

would the OP please be so kind to make a full dump of his phone?

also tell me the OMAPInfo please.

I just got my Milestone 2 (I bricked my Defy trying to unlock the BL and told the vendor RSDLite failed, they had no Defys left and gave me a MS2...)

Will continue trying around on the Milestone2 now.

If the locked MS2's and the unlocked one are sharing the same PKEYs, we may have a chance unlocking our phones.
 
  • Like
Reactions: djlooka and Lutis

Lutis

Senior Member
May 13, 2011
71
7
can I just rename the depacked CG31.smg into cdt.img?

Don't know so much about depacking and rebuilding.

When I depack for example a 2.3.4 DE retail, there is a boot.img/recovery.img/system.img but no cdt or devtree img, only the CG31 and CG61 files in smg.

greetz

cg31 is cdt and cg61 is devtree
 
  • Like
Reactions: MKSilver

r2beta0

Senior Member
Nov 8, 2010
482
121
Rio de Janeiro
can I just rename the depacked CG31.smg into cdt.img?

Don't know so much about depacking and rebuilding.

When I depack for example a 2.3.4 DE retail, there is a boot.img/recovery.img/system.img but no cdt or devtree img, only the CG31 and CG61 files in smg.

greetz

Just flashed those files u suggest:
boot, recovery and devtree went fine.
got errors in system and cdt

cdt:
sending 'cdt' <18 KB>...
OKAY [0.004s]
writing 'cdt'...
<bootloader> no such partition
FAILED <remote failure>
finished. total time: 0.795s

system:
sending 'system' <334594 KB>
OKAY [21.498s]
writing 'system'...
<bootloader> image bigger than partition
FAILED <remote failure>
finished. total time 21.821s


So it seems that my system partition is to small and cdt has no partition defined.
How do I make/change partitions with bootloader...hahaha.

Next questions are,

which vars are defined in the bootloader (gevar command in fastboot)

how do I use flashall command, fastboot asks about -p option (error: neither -p product specified nor ANDROID_PRODUCT_OUT set), may be I use it not correct.

In which files of android is the kernel stored? boot.img isn't it? Could start kernel (M Logo) but don't had luck access it with adb. May be ssh would work?

Are the kernel base adress and the page size known and what does that mean?

Will go on, just finished the defy thread, but now I have to learn a lot more about fastboot, builds and how android is working and with which adresses which partition is starting. So may u devs help me with information and may be even files. singed or unsigned doesn't matter for me right now. the bootloader eats all files and it goes fine oder it throwes errors, but the phone doesn't brick.

greetz

Yes, you can rename the CG*.smg files to the corresponding image names. Take a look here to guide you through the names:
http://and-developers.com/partitions:cdt

You can try different SBF files to see if you have different results. Download versions from here:
http://and-developers.com/sbf:milestone2
 
  • Like
Reactions: MKSilver

MKSilver

Member
Apr 27, 2008
33
11
Hey,

just tried to flash system and cdt partition with moto-fastboot... same result: errors.

So at the moment I can't flash system or cdt with fastboot.
Will go on reading about usage of fastboot.

Do someone of u know how I can set partitions, partitionadresses or log into the phone via ssh.
The ssh idea is because it seems, that I can start the kernel via fastboot using:
fastboot boot <kernel> [ <ramdisk>]

greetz
 

t0desicy

Senior Member
Mar 29, 2011
65
78
You might try to build that special cable (actually it's just a modded micro-usb cable) which seems to have resurrected a Moto Zoom tablet...

I soldered it for my old defy.

  1. you can flash SBFs without battery inside
  2. works on the Milestone 2
  3. can't do anything else!
 

r2beta0

Senior Member
Nov 8, 2010
482
121
Rio de Janeiro
Hey,

just tried to flash system and cdt partition with moto-fastboot... same result: errors.

So at the moment I can't flash system or cdt with fastboot.
Will go on reading about usage of fastboot.

Do someone of u know how I can set partitions, partitionadresses or log into the phone via ssh.
The ssh idea is because it seems, that I can start the kernel via fastboot using:
fastboot boot <kernel> [ <ramdisk>]

greetz

Sorry, I don't have much expertise with fastboot. As I'm not as lucky as you, my phone doesn't support that premium feature :) I wish you good luck in your quest!
 
  • Like
Reactions: Lutis

MKSilver

Member
Apr 27, 2008
33
11
So some more "new" information.
I managed to flash all files but system and bpsw.
I used moto-fastboot and in both files it comes the error: unknown command, what seems a little strange.
Does any of u have the idea, how we could dump the bootloader or get the needed information from the phone to open the bl without adb shell or working android?

still it would be great to get a full dump of an android system with all image files. coz what i start to flash is based on the known SBF dumps.

The second idea is still not tested: i can boot a kernel from fastboot. but how to get on the phone and this hopefully working kernel, to command it through terminal from my pc.

greetz
 
  • Like
Reactions: djlooka and Lutis

Amir4Life

Member
Mar 9, 2011
42
3
ben arous
First things first:

at any RSD lite Version my phone is recognized as: "NS Flash OMAP 3630"

I saw, that the behavior of the phone while flashing is different in how i access the bootloader.
I can go into BL through:
A) "X"+"arrow up"
or also
B) "vol+" + "vol-"

while using A) I got a normal bootloader modus.
while using B) I got fastboot modus bootloader.

may someone test this with his phone and post it here?

another special thing: I can only access recovery while pluging the phone into a wallloader and pressing x, with or without the battery.
without the loader pluged in, recovery is not coming.

While access with fastboot and using it:
Code:
C:\where\my\sdk\is> fastboot devices
################   fastboot

-> the # means each a hex sign.

Code:
C:\where\my\sdk\is> fastboot oem unlock 
...
FAILED <remote failure>
finished total time: 0.03s

next point while flashing my phone with a SBF_Flash under linux, there was an error with a SBF File, which doesn't throw errors under Windows and RSD.

About the defy forum: still reading, cause i don't want to brick the phone more than it already is, while haven't read all the knowledge.
greetz

Finally... lol

Yes I have same, exactly the same problem as you : i can access to fastboot, i can access android recovery only when plugged to wall, and it happened right after official update with motorola update tool...
Won't discourage you but my phone is in bootloop mode since 1 year, i did surrender 3 months after many tries.

I convinced myself it was hardware problem ( memory ), better luck to you bro.
 
  • Like
Reactions: Lutis

Skrilax_CZ

Inactive Recognized Developer
Dec 20, 2009
1,240
2,398
"NS Flash OMAP 3630" means engineering device (NS = Not Secure => no signatures enforced). DON'T flash regular bootloader (it won't work, you have a special BL with fastboot support) and NEVER use any kind of official update tools, always update manually via custom recovery or RSD Lite.
 
Last edited:
  • Like
Reactions: Amir4Life and Lutis

Amir4Life

Member
Mar 9, 2011
42
3
ben arous
"NS Flash OMAP 3630" means engineering device (NS = Not Secure => no signatures enforced). DON'T flash regular bootloader (it won't work, you have a special BL with fastboot support) and NEVER use any kind of official update tools, always update manually via custom recovery or RSD Lite.

Thx , but too late for me, unless you can tell me where to find that "special BL with fastboot support" SBF?
 

MKSilver

Member
Apr 27, 2008
33
11
true,

such a special SBF would be my lucky shot for the phone. it is a little sad, that we've had no luck to find some help here. seems that i need to get a new mainboard or sell the phone.
 

Skrilax_CZ

Inactive Recognized Developer
Dec 20, 2009
1,240
2,398
I have ones only for Defy and MS1 :p
I'll ask about it - don't flash anything!
 
Last edited:
  • Like
Reactions: Amir4Life

MKSilver

Member
Apr 27, 2008
33
11
@ Skrilax_CZ: It would be great, if u could take a look.

Another nice feature was: Power up while holding D-Key.
Full diagnosis of the phones CPCAP. Just started to read, what all this data means.

@ Amir4Life: What happens when u start up your phone while holding D-Key?

It seems a little, that the community has no real interest free the MS2 - a working engineering phone should be a great opportunity for that.
We'll see the next step with the help of Skrilax_CZ :) I hope so ;)
 

Amir4Life

Member
Mar 9, 2011
42
3
ben arous
@ Skrilax_CZ: It would be great, if u could take a look.

Another nice feature was: Power up while holding D-Key.
Full diagnosis of the phones CPCAP. Just started to read, what all this data means.

@ Amir4Life: What happens when u start up your phone while holding D-Key?

It seems a little, that the community has no real interest free the MS2 - a working engineering phone should be a great opportunity for that.
We'll see the next step with the help of Skrilax_CZ :) I hope so ;)

Hi,

It s been over 1 year that my MS2 was brick'd, never noticed what D-key would do,
I confirm it does the same diagnosis as you MKSilver...
lots of infos, did not understand a lot of that infos, it even diagnose the battery!

OK now wait and see, you giving me hope again...
 

Top Liked Posts

  • There are no posts matching your filters.
  • 2
    Hey guys,

    i just started with falshing and those things. So i'm not so familiar with building and unlocking.

    I bought a M2 with QUWERTY. I had and still has bootloop problems according to: http://xdaforums.com/showthread.php?t=1457373

    While analysing my bootproblem, i just realized, that i have a Fastboot Bootloader installed on this phone, what seems a little special.

    Next step may be, to use the fastboot get this phone work, step after, use fastboot for improve this forum ;). But as i said, i'm new in this deep hardware near software-things, so need all your help for that :).
    greetz
    2
    Hi Guys,

    a new challanger appears.

    would the OP please be so kind to make a full dump of his phone?

    also tell me the OMAPInfo please.

    I just got my Milestone 2 (I bricked my Defy trying to unlock the BL and told the vendor RSDLite failed, they had no Defys left and gave me a MS2...)

    Will continue trying around on the Milestone2 now.

    If the locked MS2's and the unlocked one are sharing the same PKEYs, we may have a chance unlocking our phones.
    2
    So some more "new" information.
    I managed to flash all files but system and bpsw.
    I used moto-fastboot and in both files it comes the error: unknown command, what seems a little strange.
    Does any of u have the idea, how we could dump the bootloader or get the needed information from the phone to open the bl without adb shell or working android?

    still it would be great to get a full dump of an android system with all image files. coz what i start to flash is based on the known SBF dumps.

    The second idea is still not tested: i can boot a kernel from fastboot. but how to get on the phone and this hopefully working kernel, to command it through terminal from my pc.

    greetz
    2
    Hey there,

    well I just started to read the experimental thread of the defy section.
    Problem may of course be, that my phone here is in bootloop and at the moment I'm back at my old Nokia 6230i :)
    If new Information comes arround I will report it here.
    2
    I think he could try to flash an official Retail GB SBF and do a data wipe through stock recovery. Also note that there is a thread saying GB SBF requires RSD Lite 5.0. It should be done on normal bootloader mode.

    If it doesn't work just try to unpack the SBF (with moto depacker) and flash system/recovery/cdt/boot/devtree using fastboot commands.