[Q] zpad BCT and PT borked

Misty soul

Member
Feb 16, 2011
15
2
0
Hello,

After a failed attempt to install VEGAn-TAB GingerEdition on my Malata Zpad, I followed an advice on a thread to reflash the tablet with nvflash.

I made a big mistake at that time and flashed a Gtablet configuration.

This stuck me in APX mode, without anything on screen (for the first flash operation, I get one line telling I was in this mode, but after that I never saw this line again).

I can put the tablet is in APX mode (lsusb gives: Bus 001 Device 110: ID 0955:7820 NVidia Corp.). I can read slowly some elements using nvflash and --rawdeviceread (552 sectors at a time only) from my Linux computer. If I try to read too many byte, I get "data receive failure NvError 0x120000". I also have to switch the tablet on and off one or two times between each read attempt. Patiently reading sectors and assembling them on the computer with commands like cat, dd, od -x and the like, I get the impression that most of the gtablet configuration has been written (including PT but not BCT, or it was overwritten later), but there were some errors (binary files differ after some hundreds of thousands bytes).

However, most of the commands I send with nvflash fail as never completing or sending only the bootloader and not the other files, or sending the bct and stopping ... I also tried to use --rawdevicewrite but was able to overwrite neither BCT nor PT partitions. In fact, after the rawdevicewrite attempt, now rawdeviceread returns lots of alternating series of ffffffff and 000000. It also seem that if I read at the sectors corresponding to partitions BCT and PT, I get the same patterns, but if I do a --getBCP I get "normal" bytes (first line of od -x shows: 0000000 b380 6840 476e 15b9 23f1 5b07 18d2 8a58 ...). I think the fffff and 0000 are really there and correspond to write errors, but cannot be sure.

I also tried using directly --download to put the BCT partition but got another error: "failed executing command 14 NvError 0x120002 / command failure: partition download failed (bad command)". If I try the same command on partition 4 (EBT, with the bootloader) the bytes are sent but the error becomes "failed executing command 25 NvError 0x120000 / command failure: sync failed".

I don't understand what happens and how I can flash a working configuration again.
 

Misty soul

Member
Feb 16, 2011
15
2
0
I have made some very small progress.
I now can see the following line on the tablet when nvflash has sent the appropriate bootloader (the one I used before was corrupted):
Code:
Entering NvFlash recovery mode / Nv3p server
This bootloader however does not support the --getbct command, it replies:

Code:
Failed sending command 2 NvError 1179650command failure: getbct failed (bad data)
bootloader status: operation not implemented (code: 3) message: nverror:0x1 (0x1) flags: 0
So I have to switch to another bootloader (fastboot.bin, retrieved from an ac100 forum) to get the BCT.

I can use --download without errors, so I tried to download recovery.img from cwm 0.8 into partition 9 as a recovery boot, hoping to repartition my tablet from CWM. No error on download, but nothing happens if I try to reboot in recovery mode (I guess this boot image is used when powering up the tablet while Vol+ is pressed. Rereading the first 94MB of the flash memory, I searched for the header bytes of recovery.img but did not found them (the longest match I found were only 8 bytes long), so I think --download did not download anything.

So I am still stuck with an unusable tablet.

Could someone give me some advice ?
 

Misty soul

Member
Feb 16, 2011
15
2
0
Another strange thing I get is when I try to reset the BCT after having sent the bootloder to the tablet in a previous command. I use:

Code:
sudo ../nvflash --bct Malata_a02_12Mhz_H5PS1G83EFR-S6C_333Mhz_1GB_2K8Nand_HY27UF084G2B-TP.bct --setbct --configfile android_fastboot_full.cfg --odmdata 0xbb0c0011 --create --go
Then I get messages about creating BCT, PT and EBT partitions, followed by a message about BCT being full and unable to add a new boot loader. I'm not sure anything has really been written on the tablet.

Does anyone know how to empty the BCT before attempting to relaunch the previous flash operation ?
 

Misty soul

Member
Feb 16, 2011
15
2
0
It seems I am the only one in this thread :( and nobody wants to help me.

Current status is that I am still stuck. I can write at some places using nvflash --rawdevicewrite, but not everywhere. Even in the middle of the memory, I had write operations where the first 64kbytes of the write were replaced by ffff, then the following 64k bytes were written properly, and the rest was again replaced by ffff. Trying to write blocks smaller than 64k did not help, it is as if the target sector was corrupted (depite at the beginning it did not contain ffff, but a part of the initial flash).

Then I tried reformating the partitions. Some succeeded, some didn't.

Then I read in nvflash internal help (using nvflash --cmdhelp --format_all) the --format_all would reformat also the BCT an PT partitions, using the provided configfile. It was exactly what I needed! I tried it:
Code:
sudo ../nvflash --configfile android_fastboot_full.cfg --format_all --bl bootloader.bin --go
and it failed with the error messages
Code:
waiting for bootloader to initialize
bootloader downloaded successfully
Formatting all partitions please wait.. bootloader status: partition table is required for this command (code: 8) message: nverror:0x4 (0x4) flags: 0
FAILED!

formatting failed
format-all failed
 NvError 0x0
It looks as if the --format_all which should create the partition table needs the partition table, and cannot only use the provided configuration file. This seems rather strange to me, so I may miss something obvious.

Please, help me.
 

Misty soul

Member
Feb 16, 2011
15
2
0
unbricked!

I finally got the device unbricked.

Since I always got messages about full BCT, I finally decided to try to reset it with nvflash --rawdeviewrite. The BCT is at the very beginning of the memory (from block 0 included to block 1536 excluded). It starts with 16 bytes of magic numbers: b380 6840 476e 15b9 23f1 5b07 18d2 8a58, followed by 16 bytes set to 0, followed by the 4080 bytes you find in the various bct files lying around these threads. This pattern seems to be repeated several times, each 64k, so I thought it could hold several configuration (1536 blocks of 2048 bytes each can hold a bunch of such 64k sections).

So I forged a first 64k block from the magick numbers, the zeros, my Malata_a02_12Mhz_H5PS1G83EFR-S6C_333Mhz_1GB_2K8Nand_HY27UF084G2B-TP.bct file and filled the rest with ffff. I wrote this to the tablet and ... it did only write a long series of ffff. So I have finally completely overwritten my BCT with garbage :(

After that, almost all nvflash operations failed, even simply downloading the bootloader. Error messages were either bad data, or missing partition table, or BCT related.

I tried several bootloaders, fastboot.bin from an ac100 thread the bootloader from the dropbox link in Roebeet's thread here: http://forum.xda-developers.com/showpost.php?p=9603803&postcount=1, and the one from the Malata image in nvflash_t2_mp_wifi_1202.rar. This last one succeeded. Since I had already used this commands a very large number of times and it always failed before, I think this time it succeeded because I had erased the BCT with my bunch of ffff.

Here are the final command I set and its output:

Code:
sudo ../nvflash --bl bootloader.bin --bct Malata_a02_12Mhz_H5PS1G83EFR-S6C_333Mhz_1GB_2K8Nand_HY27UF084G2B-TP.bct --setbct --configfile an
droid_fastboot_full.cfg --odmdata 0xbb0c0011 --create --go
Nvflash started
rcm version 0X20001
System Information:
   chip name: t20
   chip id: 0x20 major: 1 minor: 3
   chip sku: 0x8
   chip uid: 0x17144040432025d7
   macrovision: disabled
   hdcp: enabled
   sbk burned: false
   dk burned: false
   boot device: nand
   operating mode: 3
   device config strap: 0
   device config fuse: 0
   sdram config strap: 0

sending file: Malata_a02_12Mhz_H5PS1G83EFR-S6C_333Mhz_1GB_2K8Nand_HY27UF084G2B-TP.bct
- 4080/4080 bytes sent
Malata_a02_12Mhz_H5PS1G83EFR-S6C_333Mhz_1GB_2K8Nand_HY27UF084G2B-TP.bct sent successfully
odm data: 0xbb0c0011
downloading bootloader -- load address: 0x108000 entry point: 0x108000
sending file: bootloader.bin
| 928956/928956 bytes sent
bootloader.bin sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
setting device: 1 0
creating partition: BCT
creating partition: PT
creating partition: EBT
creating partition: NVC
creating partition: MBT
creating partition: BLO
creating partition: MSC
creating partition: KLO
creating partition: OGO
creating partition: SOS
creating partition: LNX
creating partition: APP
creating partition: CAC
Formatting partition 2 BCT please wait.. done!
Formatting partition 3 PT please wait.. done!
Formatting partition 4 EBT please wait.. done!
Formatting partition 5 NVC please wait.. done!
Formatting partition 6 MBT please wait.. done!
Formatting partition 7 BLO please wait.. done!
Formatting partition 8 MSC please wait.. done!
Formatting partition 9 KLO please wait.. done!
Formatting partition 10 OGO please wait.. done!
Formatting partition 11 SOS please wait.. done!
Formatting partition 12 LNX please wait.. done!
Formatting partition 13 APP please wait.. done!
Formatting partition 14 CAC please wait.. done!
done!
sending file: bootloader.bin
| 928956/928956 bytes sent
bootloader.bin sent successfully
sending file: bootloader.bin
| 928956/928956 bytes sent
bootloader.bin sent successfully
sending file: mbtdata.img
- 1024/1024 bytes sent
mbtdata.img sent successfully
sending file: boot.bmp
- 1843254/1843254 bytes sent
boot.bmp sent successfully
sending file: boot.bmp
- 1843254/1843254 bytes sent
boot.bmp sent successfully
sending file: logodata.img
| 418176/418176 bytes sent
logodata.img sent successfully
sending file: recovery.img
/ 3362816/3362816 bytes sent
recovery.img sent successfully
sending file: boot.img
| 2758656/2758656 bytes sent
boot.img sent successfully
sending file: system.img
- 152334336/152334336 bytes sent
system.img sent successfully
After that, the tablet rebooted automatically, with the Malata logo.

Last few problems were that it was in chinese and with the touch screen not responding. The touch screen problem was due to not understanding the slider at the bottom of the initialization screen was an unlocking slider and should be moved to activate the touch screen. Then I had to search a little to reset the tablet in english.

The last few days have been tiresome, and I would have appreciated getting some help here ...
 
  • Like
Reactions: jimcpl

jimcpl

Senior Member
Dec 14, 2008
946
96
0
There were probably a few who were following this thread (myself included), but couldn't help, because we have very little info on the BCT.

Plus you have a ztab, rather than a gtablet.

Congratulations on you success and persistence, and thanks for posting this info.

I do have one question: how'd you figure out what to use for the odmdata? That's another piece of the puzzle w little info....

Jim
 

ucsblaw

Senior Member
Apr 12, 2010
61
3
0
I finally got the device unbricked.

Since I always got messages about full BCT, I finally decided to try to reset it with nvflash --rawdeviewrite. The BCT is at the very beginning of the memory (from block 0 included to block 1536 excluded). It starts with 16 bytes of magic numbers: b380 6840 476e 15b9 23f1 5b07 18d2 8a58, followed by 16 bytes set to 0, followed by the 4080 bytes you find in the various bct files lying around these threads. This pattern seems to be repeated several times, each 64k, so I thought it could hold several configuration (1536 blocks of 2048 bytes each can hold a bunch of such 64k sections).

So I forged a first 64k block from the magick numbers, the zeros, my Malata_a02_12Mhz_H5PS1G83EFR-S6C_333Mhz_1GB_2K8Nand_HY27UF084G2B-TP.bct file and filled the rest with ffff. I wrote this to the tablet and ... it did only write a long series of ffff. So I have finally completely overwritten my BCT with garbage :(

After that, almost all nvflash operations failed, even simply downloading the bootloader. Error messages were either bad data, or missing partition table, or BCT related.

I tried several bootloaders, fastboot.bin from an ac100 thread the bootloader from the dropbox link in Roebeet's thread here: http://forum.xda-developers.com/showpost.php?p=9603803&postcount=1, and the one from the Malata image in nvflash_t2_mp_wifi_1202.rar. This last one succeeded. Since I had already used this commands a very large number of times and it always failed before, I think this time it succeeded because I had erased the BCT with my bunch of ffff.

Here are the final command I set and its output:

Code:
sudo ../nvflash --bl bootloader.bin --bct Malata_a02_12Mhz_H5PS1G83EFR-S6C_333Mhz_1GB_2K8Nand_HY27UF084G2B-TP.bct --setbct --configfile an
droid_fastboot_full.cfg --odmdata 0xbb0c0011 --create --go
Nvflash started
rcm version 0X20001
System Information:
   chip name: t20
   chip id: 0x20 major: 1 minor: 3
   chip sku: 0x8
   chip uid: 0x17144040432025d7
   macrovision: disabled
   hdcp: enabled
   sbk burned: false
   dk burned: false
   boot device: nand
   operating mode: 3
   device config strap: 0
   device config fuse: 0
   sdram config strap: 0

sending file: Malata_a02_12Mhz_H5PS1G83EFR-S6C_333Mhz_1GB_2K8Nand_HY27UF084G2B-TP.bct
- 4080/4080 bytes sent
Malata_a02_12Mhz_H5PS1G83EFR-S6C_333Mhz_1GB_2K8Nand_HY27UF084G2B-TP.bct sent successfully
odm data: 0xbb0c0011
downloading bootloader -- load address: 0x108000 entry point: 0x108000
sending file: bootloader.bin
| 928956/928956 bytes sent
bootloader.bin sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
setting device: 1 0
creating partition: BCT
creating partition: PT
creating partition: EBT
creating partition: NVC
creating partition: MBT
creating partition: BLO
creating partition: MSC
creating partition: KLO
creating partition: OGO
creating partition: SOS
creating partition: LNX
creating partition: APP
creating partition: CAC
Formatting partition 2 BCT please wait.. done!
Formatting partition 3 PT please wait.. done!
Formatting partition 4 EBT please wait.. done!
Formatting partition 5 NVC please wait.. done!
Formatting partition 6 MBT please wait.. done!
Formatting partition 7 BLO please wait.. done!
Formatting partition 8 MSC please wait.. done!
Formatting partition 9 KLO please wait.. done!
Formatting partition 10 OGO please wait.. done!
Formatting partition 11 SOS please wait.. done!
Formatting partition 12 LNX please wait.. done!
Formatting partition 13 APP please wait.. done!
Formatting partition 14 CAC please wait.. done!
done!
sending file: bootloader.bin
| 928956/928956 bytes sent
bootloader.bin sent successfully
sending file: bootloader.bin
| 928956/928956 bytes sent
bootloader.bin sent successfully
sending file: mbtdata.img
- 1024/1024 bytes sent
mbtdata.img sent successfully
sending file: boot.bmp
- 1843254/1843254 bytes sent
boot.bmp sent successfully
sending file: boot.bmp
- 1843254/1843254 bytes sent
boot.bmp sent successfully
sending file: logodata.img
| 418176/418176 bytes sent
logodata.img sent successfully
sending file: recovery.img
/ 3362816/3362816 bytes sent
recovery.img sent successfully
sending file: boot.img
| 2758656/2758656 bytes sent
boot.img sent successfully
sending file: system.img
- 152334336/152334336 bytes sent
system.img sent successfully
After that, the tablet rebooted automatically, with the Malata logo.

Last few problems were that it was in chinese and with the touch screen not responding. The touch screen problem was due to not understanding the slider at the bottom of the initialization screen was an unlocking slider and should be moved to activate the touch screen. Then I had to search a little to reset the tablet in english.

The last few days have been tiresome, and I would have appreciated getting some help here ...
Hi, how did you manage to restore "nvflash_t2_mp_wifi_1202.rar"...I restored my malata smb-a1011 with the nvflash tutorial posted here: http://forum.xda-developers.com/showthread.php?t=861950 but I'm having major problems and I can't use my hardware keys (i.e. Home, Back, Menu)

any help would be appreciated. Thank you!
 

Misty soul

Member
Feb 16, 2011
15
2
0
I do have one question: how'd you figure out what to use for the odmdata?
I found a link to a Malata image named nvflash_t2_mp_wifi_1202.rar. the file itself can be found using a web search engine, it seems to be available at several places. In this file, the download.bat script reads:

Code:
"nvflash.exe" --bct Malata_a02_12Mhz_H5PS1G83EFR-S6C_333Mhz_1GB_2K8Nand_HY27UF084G2B-TP.bct --setbct --bl bootloader.bin --configfile android_fastboot_full.cfg --odmdata 0xbb0c0011 --create --go
I also read in this post about using 0xba0c0011 and somewhere else about 0xbc0c0011. However if now I search for this I find a reference to an Adam, not a Zpad.
 

Misty soul

Member
Feb 16, 2011
15
2
0
I do have one question: how'd you figure out what to use for the odmdata? That's another piece of the puzzle w little info....

Jim
Hi Jim,

Following an idea from one of your posts on another thread, I looked at the binary structure of the BCT as it is retrieved using nvflash --read 2 02-BCT.img.

The partition is composed of 24 exact copies of the same 128 kibibytes block. In this block, bytes 4068, 4069, 4070 and 4071 (counting from 0) are 0x11, 0x00, 0x0c, 0xbb, which appear to be the omddata I set, in reversed order.

So it may be easy to recover the good omddata from any working tablet by dumping its BCT partition and looking at these bytes. It would probably be good to gather this information for all tablets in some reference thread.
 
Our Apps
Get our official app!
The best way to access XDA on your phone
Nav Gestures
Add swipe gestures to any Android
One Handed Mode
Eases uses one hand with your phone