• XDA Forums have been migrated to XenForo. We are aware of several issues including missing threads, logins not working, and more. To discuss, use this thread.

new palm phone - pvg 100 temp root guide

StormSeeker1

New member
Sep 22, 2019
74
8
0
That is used fairly often normally it's a setup exe to install them. Which depending on if it contains a driver for the mode your in it would override the Alcatel branded one which in reality is just there because both Alcatel and palm are TCL brands now.
Very informative, thanks.
Anyway...is anyone of you guys attempting anything on this phone or have all of you given up?
 

freezex

New member
Mar 17, 2011
5
3
0
Yeah I just ordered a used one got a few things to try. I think I have the firehose for the device but will see once mine arrives next week.
I grab the two programmers from github, and both of them get stuck, does it mean they are not fit verizon pvg100 ?

info
Code:
PS C:\Users\x61\Desktop\platform-tools> .\emmcdl.exe -p COM3 -info
Version 2.15
SerialNumber: 0x8decbxxx
MSM_HW_ID: 0x0006b0e1
OEM_PK_HASH: 0x073e81231dae45ba5575083feeccbaf85323b393e43e029e8ea5a683ecc3b6c6
SBL SW Version: 0x00000000
Status: 0 The operation completed successfully.
PEPITO.bin
Code:
PS C:\Users\x61\Desktop\platform-tools> .\emmcdl.exe -p COM3 -f .\PEPITO.bin -d devinfo -o devinfo.img
Version 2.15
Downloading flash programmer: .\PEPITO.bin
Successfully open flash programmer to write: .\PEPITO.bin
Waiting for flash programmer to boot
Dumping data to file devinfo.img
Dumping at start sector: 0 for sectors: 0 to file: devinfo.img

Programming device using SECTOR_SIZE=512

<?xml version = "1.0" ?><data><configure MemoryName="emmc" ZLPAwareHost="1" SkipStorageInit="0" SkipWrite="0" MaxPayloadSizeToTargetInBytes="1048576"/></data>
<?xml version="1.0" encoding="UTF-8" ?><data><log value="[email protected] [email protected]" /></data>
<?xml version="1.0" encoding="UTF-8" ?><data><response value="ACK" MinVersionSupported="1" MemoryName="eMMC" MaxPayloadSizeFromTargetInBytes="4096" MaxPayloadSizeToTargetInBytes="1048576" MaxPayloadSizeToTargetInBytesSupported="1048576" MaxXMLSizeInBytes="4096" Version="1" TargetName="8937" /></data>
Using 99 bytes from mbuffer
<?xml version="1.0" encoding="UTF-8" ?><data><log value="[email protected] [email protected]" /></data>me="eMMC" MaxPayloadSizeFromTargetInBytes="4096" MaxPayloadSizeToTargetInBytes="1048576" MaxPayloadSizeToTargetInBytesSupported="1048576" MaxXMLSizeInBytes="4096" Version="1" TargetName="8937" /></data>
Connected to flash programmer, starting dump
<?xml version="1.0" ?><data>
<read SECTOR_SIZE_IN_BYTES="512" num_partition_sectors="1" physical_partition_number="0" start_sector="1"/>
</data>
EFI PART
<?xml version="1.0" encoding="UTF-8" ?><data><response value="ACK" rawmode="false" /></data>
Pepito_VDF_NPRG.bin
Code:
PS C:\Users\x61\Desktop\platform-tools> .\emmcdl.exe -p COM3 -f .\Pepito_VDF_NPRG.bin -d devinfo -o devinfo.img
Version 2.15
Downloading flash programmer: .\Pepito_VDF_NPRG.bin
Successfully open flash programmer to write: .\Pepito_VDF_NPRG.bin
Expecting SAHARA_END_TRANSFER but found: 0

!!!!!!!! WARNING: Flash programmer failed to load trying to continue !!!!!!!!!

Dumping data to file devinfo.img
Dumping at start sector: 0 for sectors: 0 to file: devinfo.img

Programming device using SECTOR_SIZE=512

<?xml version = "1.0" ?><data><configure MemoryName="emmc" ZLPAwareHost="1" SkipStorageInit="0" SkipWrite="0" MaxPayloadSizeToTargetInBytes="1048576"/></data>
 

StormSeeker1

New member
Sep 22, 2019
74
8
0
I grab the two programmers from github, and both of them get stuck, does it mean they are not fit verizon pvg100 ?

info
Code:
PS C:\Users\x61\Desktop\platform-tools> .\emmcdl.exe -p COM3 -info
Version 2.15
SerialNumber: 0x8decbxxx
MSM_HW_ID: 0x0006b0e1
OEM_PK_HASH: 0x073e81231dae45ba5575083feeccbaf85323b393e43e029e8ea5a683ecc3b6c6
SBL SW Version: 0x00000000
Status: 0 The operation completed successfully.
PEPITO.bin
Code:
PS C:\Users\x61\Desktop\platform-tools> .\emmcdl.exe -p COM3 -f .\PEPITO.bin -d devinfo -o devinfo.img
Version 2.15
Downloading flash programmer: .\PEPITO.bin
Successfully open flash programmer to write: .\PEPITO.bin
Waiting for flash programmer to boot
Dumping data to file devinfo.img
Dumping at start sector: 0 for sectors: 0 to file: devinfo.img

Programming device using SECTOR_SIZE=512

<?xml version = "1.0" ?><data><configure MemoryName="emmc" ZLPAwareHost="1" SkipStorageInit="0" SkipWrite="0" MaxPayloadSizeToTargetInBytes="1048576"/></data>
<?xml version="1.0" encoding="UTF-8" ?><data><log value="[email protected] [email protected]" /></data>
<?xml version="1.0" encoding="UTF-8" ?><data><response value="ACK" MinVersionSupported="1" MemoryName="eMMC" MaxPayloadSizeFromTargetInBytes="4096" MaxPayloadSizeToTargetInBytes="1048576" MaxPayloadSizeToTargetInBytesSupported="1048576" MaxXMLSizeInBytes="4096" Version="1" TargetName="8937" /></data>
Using 99 bytes from mbuffer
<?xml version="1.0" encoding="UTF-8" ?><data><log value="[email protected] [email protected]" /></data>me="eMMC" MaxPayloadSizeFromTargetInBytes="4096" MaxPayloadSizeToTargetInBytes="1048576" MaxPayloadSizeToTargetInBytesSupported="1048576" MaxXMLSizeInBytes="4096" Version="1" TargetName="8937" /></data>
Connected to flash programmer, starting dump
<?xml version="1.0" ?><data>
<read SECTOR_SIZE_IN_BYTES="512" num_partition_sectors="1" physical_partition_number="0" start_sector="1"/>
</data>
EFI PART
<?xml version="1.0" encoding="UTF-8" ?><data><response value="ACK" rawmode="false" /></data>
Pepito_VDF_NPRG.bin
Code:
PS C:\Users\x61\Desktop\platform-tools> .\emmcdl.exe -p COM3 -f .\Pepito_VDF_NPRG.bin -d devinfo -o devinfo.img
Version 2.15
Downloading flash programmer: .\Pepito_VDF_NPRG.bin
Successfully open flash programmer to write: .\Pepito_VDF_NPRG.bin
Expecting SAHARA_END_TRANSFER but found: 0

!!!!!!!! WARNING: Flash programmer failed to load trying to continue !!!!!!!!!

Dumping data to file devinfo.img
Dumping at start sector: 0 for sectors: 0 to file: devinfo.img

Programming device using SECTOR_SIZE=512

<?xml version = "1.0" ?><data><configure MemoryName="emmc" ZLPAwareHost="1" SkipStorageInit="0" SkipWrite="0" MaxPayloadSizeToTargetInBytes="1048576"/></data>
Hi, freezex, can you please point me to where to download those two programmers? I've failed finding them for pretty long

---------- Post added at 08:06 AM ---------- Previous post was at 08:04 AM ----------

Yeah I just ordered a used one got a few things to try. I think I have the firehose for the device but will see once mine arrives next week.
Great news!

Oh, guys, can you lend me a hand? I've just managed to install Android Studio, SDK, NDK, Cygwin, JDK and Gradle and I've managed to create a first hello world project in native code (C/C++) please have a look at the attached picture. The project is able to install on the Palm PVG100 and to display the Hello World message.
Now, what should I do to compile arpruss's files? How do I get the "root" executable file provided by greatjack1 if I want to compile it on my own?
 

Attachments

Last edited:

deadman96385

Retired Forum Moderator / Recognized Developer
Aug 19, 2011
2,219
7,750
113
Saint Paul, Minnesota
I grab the two programmers from github, and both of them get stuck, does it mean they are not fit verizon pvg100 ?

info
Code:
PS C:\Users\x61\Desktop\platform-tools> .\emmcdl.exe -p COM3 -info
Version 2.15
SerialNumber: 0x8decbxxx
MSM_HW_ID: 0x0006b0e1
OEM_PK_HASH: 0x073e81231dae45ba5575083feeccbaf85323b393e43e029e8ea5a683ecc3b6c6
SBL SW Version: 0x00000000
Status: 0 The operation completed successfully.
PEPITO.bin
Code:
PS C:\Users\x61\Desktop\platform-tools> .\emmcdl.exe -p COM3 -f .\PEPITO.bin -d devinfo -o devinfo.img
Version 2.15
Downloading flash programmer: .\PEPITO.bin
Successfully open flash programmer to write: .\PEPITO.bin
Waiting for flash programmer to boot
Dumping data to file devinfo.img
Dumping at start sector: 0 for sectors: 0 to file: devinfo.img

Programming device using SECTOR_SIZE=512

<?xml version = "1.0" ?><data><configure MemoryName="emmc" ZLPAwareHost="1" SkipStorageInit="0" SkipWrite="0" MaxPayloadSizeToTargetInBytes="1048576"/></data>
<?xml version="1.0" encoding="UTF-8" ?><data><log value="[email protected] [email protected]" /></data>
<?xml version="1.0" encoding="UTF-8" ?><data><response value="ACK" MinVersionSupported="1" MemoryName="eMMC" MaxPayloadSizeFromTargetInBytes="4096" MaxPayloadSizeToTargetInBytes="1048576" MaxPayloadSizeToTargetInBytesSupported="1048576" MaxXMLSizeInBytes="4096" Version="1" TargetName="8937" /></data>
Using 99 bytes from mbuffer
<?xml version="1.0" encoding="UTF-8" ?><data><log value="[email protected] [email protected]" /></data>me="eMMC" MaxPayloadSizeFromTargetInBytes="4096" MaxPayloadSizeToTargetInBytes="1048576" MaxPayloadSizeToTargetInBytesSupported="1048576" MaxXMLSizeInBytes="4096" Version="1" TargetName="8937" /></data>
Connected to flash programmer, starting dump
<?xml version="1.0" ?><data>
<read SECTOR_SIZE_IN_BYTES="512" num_partition_sectors="1" physical_partition_number="0" start_sector="1"/>
</data>
EFI PART
<?xml version="1.0" encoding="UTF-8" ?><data><response value="ACK" rawmode="false" /></data>
Pepito_VDF_NPRG.bin
Code:
PS C:\Users\x61\Desktop\platform-tools> .\emmcdl.exe -p COM3 -f .\Pepito_VDF_NPRG.bin -d devinfo -o devinfo.img
Version 2.15
Downloading flash programmer: .\Pepito_VDF_NPRG.bin
Successfully open flash programmer to write: .\Pepito_VDF_NPRG.bin
Expecting SAHARA_END_TRANSFER but found: 0

!!!!!!!! WARNING: Flash programmer failed to load trying to continue !!!!!!!!!

Dumping data to file devinfo.img
Dumping at start sector: 0 for sectors: 0 to file: devinfo.img

Programming device using SECTOR_SIZE=512

<?xml version = "1.0" ?><data><configure MemoryName="emmc" ZLPAwareHost="1" SkipStorageInit="0" SkipWrite="0" MaxPayloadSizeToTargetInBytes="1048576"/></data>
The VDF one is designed for the vodafone variant so that one will not work for you, the first one looks like the phone accepted it. I haven't used that tool before so not sure why it isn't working.

Hi, freezex, can you please point me to where to download those two programmers? I've failed finding them for pretty long


He got them from my firehose collection org

https://github.com/programmer-collection/alcatel/tree/master/Pepito
 

StormSeeker1

New member
Sep 22, 2019
74
8
0
The VDF one is designed for the vodafone variant so that one will not work for you, the first one looks like the phone accepted it. I haven't used that tool before so not sure why it isn't working.



He got them from my firehose collection org

https://github.com/programmer-collection/alcatel/tree/master/Pepito
OK, deadman, I tried to do the following:
download EDLBackupRestoreTool
extract it
set the config.ini file content to the following (see attached screenshot for reference):

# Set QDLoader COM port here, as retreived from Device Manager
COMPort=com4

# Set Firehose loader here. Can be a path relative to the BackupRestoreTool script.
# This is taken from Mi A1 Fastboot package.
FirehoseLoader=bin\PEPITO.bin

# Set maximum transfer speed.
# Default of 16384 is the highest possible.
# Lowest possible is 4096 (I think).
# Be sure to use multiples of 1024 for best results.
# Reducing this may help with reliability and prevent freezing during transfer,
# at the expense of taking longer.
TransferSpeed=16384

set the partition_list.devinfo.txt file content to the following:
# Only devinfo partition
devinfo
modem
fsc
ssd
sbll
sbllbak
rpm
rpmbak
tz
tzbak
devcfg
devcfgbak
dsp
modemstl
modemst2
DDR
fsg
sec
tunning
traceability
simlock
redbend
splash
aboot
abootbak
boot
recovery
system
vendor
cache
persist
devinfo
mise
keystore
config
oem
limits
mota
dip
mdtp
sysefg
mefg
cmnlib
cmnlibbak
cmnlib64
cmnlib64bak
keymaster
keymasterbak
apdp
msadp
dpo
logdump
fotadata
userdata

cmd to the extraction folder
run BackupRestoreTool_debug.cmd
choose 1) Set partition list file [list of partitions to backup]
I get this: Current = partition_list.devinfo.txt

choose 2) Backup all partitions from partition list file
I get this: [#] Enter folder name or full/relative path to store the backup [must not already exist]:

I enter this:
C:\Q

I get this:
[#] Dumping "devinfo" to "C:\Q\devinfo.img"...

[!] An error occured. BACKUP IS INCOMPLETE.. Check device connection and COM port is correct.
See log.txt for details.

The log.txt files has this content:
Version 2.15
Failed to write hello response back to device
Did not receive Sahara hello packet from device

!!!!!!!! WARNING: Flash programmer failed to load trying to continue !!!!!!!!!

Dumping data to file C:\Q\devinfo.img
Dumping at start sector: 0 for sectors: 0 to file: C:\Q\devinfo.img

Programming device using SECTOR_SIZE=512

<?xml version = "1.0" ?><data><configure MemoryName="emmc" ZLPAwareHost="1" SkipStorageInit="0" SkipWrite="0" MaxPayloadSizeToTargetInBytes="16384"/></data>

Status: 6 The handle is invalid.


OK, I HAVE SOME NEWS:
I closed all QPST and eMMC Software Download programs and this time I didn't use eMMC Software Download to put the phone into download mode, BUT I set it to EDL from the recovery option.
This time, when I use BackupRestoreTool_debug.cmd to try to backup a partition (I chose a small one, "fsc", which is 1024 Bytes), The BackupRestoreTool_debug.cmd tool does not exit, BUT it hangs for a lot of time, saying "[#] Dumping "fsc" to "C:\Z\fsc.img"..."

What do you think?
 

Attachments

Last edited:

tc.chen

New member
Nov 1, 2019
2
0
0
seeking methods to open other lte bands from taiwan

Hi, bensdeals
The root.zip file contains a file with no extension, which is not an apk package, but an executable compiled for the architecture of the CPU and for the operating system that PVG100 has.
Here's how to run the "root" file inside the package:
hello stormseeker & guys,

i'm a new user of xda and pvg100(us unlocked version)/pvg100e(hk version) from taiwan.
also need to open other lte bands of pvg100 to suit 4g bands in taiwan, or it only stays in 3g signal..
could i shyly ask that if anybody succeeds in the "root.zip" version on pvg100?
and anyone opens lte bands other than default ones and works well after rooting?

in return of your replies, i would like to provide a tool for changing lte bands in apac area:
search "qtrun technologies" on google play (xda doesn't allow new users to post url)
many ppl have changed lte bands on different phones. (read from many blogs)

many thanks for your reply, seeking the method to open other lte bands.....
 

StormSeeker1

New member
Sep 22, 2019
74
8
0
hello stormseeker & guys,

i'm a new user of xda and pvg100(us unlocked version)/pvg100e(hk version) from taiwan.
also need to open other lte bands of pvg100 to suit 4g bands in taiwan, or it only stays in 3g signal..
could i shyly ask that if anybody succeeds in the "root.zip" version on pvg100?
and anyone opens lte bands other than default ones and works well after rooting?

in return of your replies, i would like to provide a tool for changing lte bands in apac area:
search "qtrun technologies" on google play (xda doesn't allow new users to post url)
many ppl have changed lte bands on different phones. (read from many blogs)

many thanks for your reply, seeking the method to open other lte bands.....
Hi, buddy, welcome to XDA :) I can confirm the TEMPORARY root method enabled by "root.zip" works, but I don't know how to enable new LTE bands; I've changed them in the NonVolatile memory via QXDM, but I still see only 3G icon...
About the tool you mentioned (is it Network Signal Guru?), in this page (https://m.qtrun.com/en/product.html) it clearly states:

Q: Can you changed the band capacities of my cell phone. My cell phones are from other countries and the band capabilities are not so good, and I want more band support. Could NSG do that?
A: NSG cannot provide this kind of feature and we don't change the band capabilities. It's different among different phones, so it's dangerous and once failed, you will lose all of the band capabilities of certain radio technology. And it's very difficult to recover.

So I don't understand what you mean when you say "i would like to provide a tool for changing lte bands in apac area"...this looks false, no?
 

tc.chen

New member
Nov 1, 2019
2
0
0
So I don't understand what you mean when you say "i would like to provide a tool for changing lte bands in apac area"...this looks false, no?
now i know that the two apps are the same.
i'm sorry to provide a useless information.
i'll keep searching the method of changing lte bands and following your work.
hope you find new methods.
 

j.bruha

New member
Jan 15, 2010
400
30
0
With all this in mind, it sounds like at the very least ADB commands will work with the temporary root. Would it be possible to enable tethering by pulling the build.prop, modifying the entitlement line, and then pushing it back to the device? This is going back several years in Android's modding history, so I'm not even sure if this is still viable.

When I activated my Palm with Verizon, I was advised the provisioning was active for hotspot, but the phone itself seems to lack the software feature to do it, and 3rd party apps do not work in enabling it with their settings shortcuts.
 

deadman96385

Retired Forum Moderator / Recognized Developer
Aug 19, 2011
2,219
7,750
113
Saint Paul, Minnesota
With all this in mind, it sounds like at the very least ADB commands will work with the temporary root. Would it be possible to enable tethering by pulling the build.prop, modifying the entitlement line, and then pushing it back to the device? This is going back several years in Android's modding history, so I'm not even sure if this is still viable.

When I activated my Palm with Verizon, I was advised the provisioning was active for hotspot, but the phone itself seems to lack the software feature to do it, and 3rd party apps do not work in enabling it with their settings shortcuts.


From reading what others have said and my experience dm-verity is on so if you modify system then that will cause the system to stop booting with a dm-verity red error that can only be fixed by flashing stock system which as of right now isn't possible.
 

StormSeeker1

New member
Sep 22, 2019
74
8
0
From reading what others have said and my experience dm-verity is on so if you modify system then that will cause the system to stop booting with a dm-verity red error that can only be fixed by flashing stock system which as of right now isn't possible.
Can you please explain exactly what is "a modification of the system" from verity point of view and where to look to understand without any doubt if verity is on?

Also, is this doable:
https://forum.xda-developers.com/android/software/universal-dm-verity-forceencrypt-t3817389
 
Last edited:

StormSeeker1

New member
Sep 22, 2019
74
8
0
I took a full live backup of the 32gb phone internal memory

Hi, guys, I TOOK A FULL LIVE BACKUP OF THE 32GB PHONE INTERNAL MEMORY.
There is a free software (and other paid ones) to mount the partitions on Windows; please have a look:
https://www.osforensics.com/tools/mount-disk-images.html

Anyway, I'm unable to explore most of them, maybe because they don't have a specific filesystem type or they have ext4 filesystems which windows doesn't support.
BUT there is a FAT16 partition, called "modem". I mounted it and I've accessed it. It has .mbn files inside!
Maybe some of those .mbn file or inside other partitions can be used for flash programmers, no?
Anyway, in that modem partition there are also folders with details for many phone provider companies, so maybe there is info for using other 2G or 3G or 4G bands...please have a look at the attached screenshots.
Folks, do you know of a way to explore all the other non-FAT non-NTFS partitions?

PS: if you are interested in how I was able to take the full memory backup, I can explain (no problem, just let me know).
To make it short, I used netcat in client/server mode to pipe linux "dd" command "block0" output to a file on the PC (I had tried with an OTG adapter and issuing the commands directly on a terminal emulator on the phone touchscreen, but then the phone doesn't recognize NTFS nor exFAT nor ext4 partitions, which are the only ones able to contain a 32GB image file; I had also tried splitting the file on the fly with gzip piping, it worked, but then the process was too slow and the 800mAh battery of the PVG100 drained faster than the backup process and if you connect a pendrive with an OTG adapter to the phone, then it cannot stay connected to a power source).
This method and a lot of interesting phone hacking ("forensics") stuff is contained in this book:
https://books.google.ru/books?id=9oVcDgAAQBAJ
Some pages are accessible on this google link, or you can buy it, but there are places on the web where the file is available ;)
https://1337x.bypassed.life/torrent...sics-Advanced-Investigative-Strategies-gnv64/

OK, THIS DID THE TRICK TO BROWSE PARTITIONS ON WINDOWS:
https://www.diskinternals.com/linux-reader/
Well...at least that software browses ext4 partitions, but how can I browse files inside the other partitions (which the "parted" command shows with no type of filesystem formatting)?
 

Attachments

Last edited:

StormSeeker1

New member
Sep 22, 2019
74
8
0
What does temp-root actually mean?

Hi, guys, I see that nobody is writing anything here, I hope deadman will let us know as soon as the phone gets delivered to him...
In the meanwhile, can anybody please let me know how to really get TEMPORARY ROOT ON THIS PHONE?
I DONT'T MEAN SPAWNING A SHELL WITH ROOT PRIVILEGES, I ACTUALLY MEAN "TEMP-ROOTING" THE PHONE AND BEING ABLE TO USE APPS LIKE TITANIUM BACKUP, SuperSU and BusyBox!

At this point I can even afford risking to brick my second PVG100, since I have two of them, but, please, clarify this, thanks!
 

StormSeeker1

New member
Sep 22, 2019
74
8
0
Guys, I've tried retrieving all Android properties via commands:
adb shell
getprop

This is very strange:
The phone is supposed to have a Qualcomm MSM8940 Snapdragon 435 (28 nm) processor, see here:
https://www.gsmarena.com/palm_palm-9290.php

BUY THEN WHY DO I FIND THIS PROPERTY?
[ro.board.platform]: [msm8937]

What does this mean?
Can this help us finding a working programmer file for QPST and similar physical access software?
 
  • Like
Reactions: Mattzees

1806

New member
Oct 6, 2009
68
19
0
PALM RU forum
in Russia sell Palm PVG100E_RU with different firmware and different LTE band
this is latest RU firmware info, I dont have this phone and this firmware, I have Palm PVG100 from Verizon...


 
Last edited:
  • Like
Reactions: Mattzees

StormSeeker1

New member
Sep 22, 2019
74
8
0
PALM RU forum
in Russia sell Palm PVG100E_RU with different firmware and different LTE band


Great, 1806 member!
Do you know of a way to flash the firmware?
Can we mix/match the different baseband versions between PVG100 and PVG100E?
Is the firmware you posted a reference to complete or is it just a delta for an update?

Thanks for clarifying
 

StormSeeker1

New member
Sep 22, 2019
74
8
0
Well, I have succeeded! I will write up what all I did I am hoping I can simplify it.
Deadman, I knew you were the right person to count on! That's a great news! I will try your procedure as soon as you post it! Please, also let us know if there's a way to have TWRP and a way to switch LTE bands ;)
 

bensdeals

New member
Jan 25, 2007
135
70
0
Nice job. Did you use the temp root method from before to get started? Also does the is boot warning come up on each reboot or just once?

Great progress