The potential joys of Nvflash (Dead in the water?)

[sifon187]

Ends up being the same thing. Running sudo cat on the file prints nothing. That was one of the first things tried, even before copying the file.

Ill do some digging around tonight I got a back up phone now in case I bonk my atrix.

 

[agrabren]

The SBK fuse information is protected from both read and write by the time the kernel is loaded.

 

[sipjca]

Send a command to it before it's loaded... I know this probably wont work and would be hard to execute but if it did work it would be awesome

Sent From My Gingerblurred Phone

 

[briggie108]

The SBK fuse information is protected from both read and write by the time the kernel is loaded.

Has anyone tried getting it through fastboot, or will that not work? Someone must have thought of that already.

 

[PAulyhoffman]

It appears that a few things are missing when attempting to get NVFlash to work. I recall a few days ago TBH was Tweeting about a cable they are planning on selling.

The thread is here

now this is a cable that adds power by changing the pins on a normal cable. It would (in theory) power the device with no battery.

Using this cable it might just force NVFlash to yield results. I recall from a purchase I made on the marketplace for a developers atrix that it was shipped with a cable unique to the device.

If NVFlash can be triggered with this cable we can look at the flash script in the device

#!/bin/bash

#
# Flash the target board.
#
# Usage:
# Before running, please set
#   TARGET_BOARD to the board's name (olympus or whistler) and
#   KERNEL_IMAGE to the location of your zImage file.
# Optionally set:
#   BOOTLOADER to the location of your fastboot.bin bootloader
#   FASTBOOT to the location of your Android Fastboot application
#
# Place the board in recovery mode and run:
# flash.sh <root_device>
#
# Where root_device is one of:
# - sda1: USB disk or SDCard
# - usb0: NFS share mounted through interface usb0 (Harmony only)
#
TARGET_BOARD=$1
GIG=0
GRFS=0
PORTABLE=0
BOOTLOADER=fastboot.bin

if [ "$UID" == "0" ]
then
    echo "Please don't run this as root or sudo"
    exit 1
fi

if [ $TARGET_BOARD == olympus_1gig ]
then
    GIG=1
    TARGET_BOARD=olympus
fi

if [ $TARGET_BOARD == olympus_portable ]
then
    PORTABLE=1
    TARGET_BOARD=olympus
fi

if [ $TARGET_BOARD == grfs ]
then
    GRFS=1
    TARGET_BOARD=olympus
fi

if [ "$TARGET_BOARD" != olympus -a "$TARGET_BOARD" != whistler ]
then
    echo "TARGET_BOARD invalid. Should be set to olympus or whistler."
    exit 1
fi

if [ $# -eq 2 ]
then
    echo "Extracting " $2
    tar xzf $2
elif [ $# -eq 1 ]
then
    echo ""
else
    echo "This script should be called with one argument: flash.sh <target board>"
    exit 1
fi

if [ ! -f $TARGET_BOARD/system.img ]
then
    echo "Failed to find $TARGET_BOARD/system.img"
    exit 1
fi

if [ ! -f $TARGET_BOARD/boot.img ]
then
    echo "Failed to find $TARGET_BOARD/boot.img"
    exit 1
fi

bootloader=$TARGET_BOARD/bootloader.bin
if [ ! -f $bootloader ]
then
    echo "Bootloader file $bootloader does not exist."
    exit 1
fi

if [ ! -f nvflash/grfs.img ]
then
    echo "Failed to find nvflash/grfs.img"
    exit 1
fi

nvflashfolder=nvflash

if [ $TARGET_BOARD == whistler ]
then
    bctfile=whistler_12Mhz_H5PS1G63EFR_333Mhz_512MB_emmc_THGBM1G6D4EBAI4.bct
    cfgfile=whistler_fastboot_emmc_full_webtop.cfg
    odmdata=0x800c0105
else
    if [ $GIG == 1 ]
    then
        bctfile=../$TARGET_BOARD/flash_1g.bct
#        odmdata=0x300c8105
#128         odmdata=0xBB0C8105
        odmdata=0
        cfgfile=flash_webtop.cfg
    elif  [ $PORTABLE == 1 ]
    then
        bctfile=../$TARGET_BOARD/flash_1g.bct
        odmdata=0
        cfgfile=flash_webtop16g.cfg
    else
        bctfile=../$TARGET_BOARD/flash.bct
#        odmdata=0x800c8105
        odmdata=0
        cfgfile=flash_webtop.cfg
    fi
fi

#Copy bootloader and then change to flash directory
cp $bootloader $nvflashfolder/bootloader.bin
pushd $nvflashfolder

if [ $GRFS == 1 ]
then
    sudo LD_LIBRARY_PATH=. ./nvflash --download 21 grfs.img --bl bootloader.bin --go
fi

if [ $PORTABLE == 1 ]
then
    echo "Backing up pds.."
    sudo LD_LIBRARY_PATH=. ./nvflash --read 11 pds.uid --bl bootloader.bin --go
    if [ $? -ne 0 ]
    then
        echo "PDS backup failed, exiting"
        exit 2
    fi
    echo "pds.uid backup has been created in current directory"
    echo ""
    echo "Un-plug phone and put into nvflash mode again"
    echo "Press Enter to continue"
    read cont
fi

echo "Running NvFlash"
if [ $odmdata == 0 ]
then
sudo LD_LIBRARY_PATH=. ./nvflash --bct $bctfile --setbct \
    --configfile $cfgfile --create --bl bootloader.bin --go
else
sudo LD_LIBRARY_PATH=. ./nvflash --bct $bctfile --setbct \
    --configfile $cfgfile --create --bl bootloader.bin --odmdata $odmdata --go
fi

if [ $? -ne 0 ]
then
    echo "Failed to flash."
    exit 2
fi
popd

echo "Flashing completed."
echo "Make the target filesystem available to the device and reset the board to boot."

It is commented out to not run as root

If this is tried you may get a result like trying to adb shell a device with no root
no permission error or similar.

in the script it is running commands using sudo.
it may be worth a try to use sudo or even attempt NVFlash as root

I neither have a cable or the tools to NVFlash.
im sure we will still run into the error from op

Nvflash started
rcm version 0X4
Command send failed (usb write failed)

I imagine that some of the functionality may end up requiring the --sbk flag (and we don't know the SBK right now), but I'm hoping that we can at least backup and restore /system, /data, and /osh.

Update: Information I've obtained indicates that this is the error you get when the SBK you pass in doesn't match the SBK on the system. So, no luck until we get that SBK.

no SBK no fully functioning NVFlash, but i too am hoping this will help at least with backup and restore.

 

[oTToToTenTanz]

Sorry for this noob question, I read the whole thread but I couldn't answer it myself: is this finding of this file as hopeful as it was stated on xda's main webpage: i.e. it's only a matter of time till the bootloader is cracked?

 

[yungboss22]

You need the nvflash driver. Without this, youll not able to communicate with the hardware.

Interestingly enough (I don't know the reasons), it looks like Motorola left a copy of Nvflash and Atrix-specific bootloader.bin for it on the Atrix. What's interesting about Nvflash is that it allows for targeted backup and restore of partitions (i.e. something along the lines of what Nandroid allows for, except at a lower level), which decreases recovery time when developers do something that ends up soft-bricking their phone. It should also break us free of our dependence on SBFs because we'll be able to create our own backups.

Anyways, the Nvflash on the phone is the Linux i386 binary. The bootloader.bin isn't platform specific, as it's meant for the target, rather than the host. THe archive is available in /usr/local/share/motorola/fireboxmake/OSH_tools.tgz.

Unfortunately, this is where we get stuck, because we don't currently know how to get a connection to the phone. And that's where all of you come in! Can you get further? I've gotten this far:

Nvflash started
rcm version 0X4
Command send failed (usb write failed)

I imagine that some of the functionality may end up requiring the --sbk flag (and we don't know the SBK right now), but I'm hoping that we can at least backup and restore /system, /data, and /osh.

Update: Information I've obtained indicates that this is the error you get when the SBK you pass in doesn't match the SBK on the system. So, no luck until we get that SBK.

Update 2: Additional links from dasmoover:

• Tegra crypto engine source snapshot
• /osh/usr/local/share/motorola/fireboxmake

Credit to dasmoover for the find.

 

[JdeFalconr]

It appears that a few things are missing when attempting to get NVFlash to work. I recall a few days ago TBH was Tweeting about a cable they are planning on selling.

The thread is here

now this is a cable that adds power by changing the pins on a normal cable. It would (in theory) power the device with no battery.

Using this cable it might just force NVFlash to yield results. I recall from a purchase I made on the marketplace for a developers atrix that it was shipped with a cable unique to the device.

If NVFlash can be triggered with this cable we can look at the flash script in the device

#!/bin/bash

#
# Flash the target board.
#
# Usage:
# Before running, please set
#   TARGET_BOARD to the board's name (olympus or whistler) and
#   KERNEL_IMAGE to the location of your zImage file.
# Optionally set:
#   BOOTLOADER to the location of your fastboot.bin bootloader
#   FASTBOOT to the location of your Android Fastboot application
#
# Place the board in recovery mode and run:
# flash.sh <root_device>
#
# Where root_device is one of:
# - sda1: USB disk or SDCard
# - usb0: NFS share mounted through interface usb0 (Harmony only)
#
TARGET_BOARD=$1
GIG=0
GRFS=0
PORTABLE=0
BOOTLOADER=fastboot.bin

if [ "$UID" == "0" ]
then
    echo "Please don't run this as root or sudo"
    exit 1
fi

if [ $TARGET_BOARD == olympus_1gig ]
then
    GIG=1
    TARGET_BOARD=olympus
fi

if [ $TARGET_BOARD == olympus_portable ]
then
    PORTABLE=1
    TARGET_BOARD=olympus
fi

if [ $TARGET_BOARD == grfs ]
then
    GRFS=1
    TARGET_BOARD=olympus
fi

if [ "$TARGET_BOARD" != olympus -a "$TARGET_BOARD" != whistler ]
then
    echo "TARGET_BOARD invalid. Should be set to olympus or whistler."
    exit 1
fi

if [ $# -eq 2 ]
then
    echo "Extracting " $2
    tar xzf $2
elif [ $# -eq 1 ]
then
    echo ""
else
    echo "This script should be called with one argument: flash.sh <target board>"
    exit 1
fi

if [ ! -f $TARGET_BOARD/system.img ]
then
    echo "Failed to find $TARGET_BOARD/system.img"
    exit 1
fi

if [ ! -f $TARGET_BOARD/boot.img ]
then
    echo "Failed to find $TARGET_BOARD/boot.img"
    exit 1
fi

bootloader=$TARGET_BOARD/bootloader.bin
if [ ! -f $bootloader ]
then
    echo "Bootloader file $bootloader does not exist."
    exit 1
fi

if [ ! -f nvflash/grfs.img ]
then
    echo "Failed to find nvflash/grfs.img"
    exit 1
fi

nvflashfolder=nvflash

if [ $TARGET_BOARD == whistler ]
then
    bctfile=whistler_12Mhz_H5PS1G63EFR_333Mhz_512MB_emmc_THGBM1G6D4EBAI4.bct
    cfgfile=whistler_fastboot_emmc_full_webtop.cfg
    odmdata=0x800c0105
else
    if [ $GIG == 1 ]
    then
        bctfile=../$TARGET_BOARD/flash_1g.bct
#        odmdata=0x300c8105
#128         odmdata=0xBB0C8105
        odmdata=0
        cfgfile=flash_webtop.cfg
    elif  [ $PORTABLE == 1 ]
    then
        bctfile=../$TARGET_BOARD/flash_1g.bct
        odmdata=0
        cfgfile=flash_webtop16g.cfg
    else
        bctfile=../$TARGET_BOARD/flash.bct
#        odmdata=0x800c8105
        odmdata=0
        cfgfile=flash_webtop.cfg
    fi
fi

#Copy bootloader and then change to flash directory
cp $bootloader $nvflashfolder/bootloader.bin
pushd $nvflashfolder

if [ $GRFS == 1 ]
then
    sudo LD_LIBRARY_PATH=. ./nvflash --download 21 grfs.img --bl bootloader.bin --go
fi

if [ $PORTABLE == 1 ]
then
    echo "Backing up pds.."
    sudo LD_LIBRARY_PATH=. ./nvflash --read 11 pds.uid --bl bootloader.bin --go
    if [ $? -ne 0 ]
    then
        echo "PDS backup failed, exiting"
        exit 2
    fi
    echo "pds.uid backup has been created in current directory"
    echo ""
    echo "Un-plug phone and put into nvflash mode again"
    echo "Press Enter to continue"
    read cont
fi

echo "Running NvFlash"
if [ $odmdata == 0 ]
then
sudo LD_LIBRARY_PATH=. ./nvflash --bct $bctfile --setbct \
    --configfile $cfgfile --create --bl bootloader.bin --go
else
sudo LD_LIBRARY_PATH=. ./nvflash --bct $bctfile --setbct \
    --configfile $cfgfile --create --bl bootloader.bin --odmdata $odmdata --go
fi

if [ $? -ne 0 ]
then
    echo "Failed to flash."
    exit 2
fi
popd

echo "Flashing completed."
echo "Make the target filesystem available to the device and reset the board to boot."

It is commented out to not run as root

If this is tried you may get a result like trying to adb shell a device with no root
no permission error or similar.

in the script it is running commands using sudo.
it may be worth a try to use sudo or even attempt NVFlash as root

I neither have a cable or the tools to NVFlash.
im sure we will still run into the error from op

Nvflash started
rcm version 0X4
Command send failed (usb write failed)

no SBK no fully functioning NVFlash, but i too am hoping this will help at least with backup and restore.

So correct me if I'm wrong, but this fancy cable is just a different pinout than the standard one, right? If so then why a whole new cable? Can't we just use an adapter on one end? I saw this cable that's being produced (a non-OEM job) is going to be $50 but I'd think an adapter (if possible) would be much cheaper.

 

[jiggytom]

You need the nvflash driver. Without this, youll not able to communicate with the hardware.

Obviously he already has the driver as he is able to send a command.


Sent from my MB860 using XDA App

 

[seven2099]

there is a separate dev forum that we can't access for DEVs only that that information is being used on. it being in the open here might hurt our chances of being able to exploit anything as moto might find it and patch it before the devs have a chance to get at it.

thank you for explaining that.

very kind of you..

 

[PAulyhoffman]

Obviously he already has the driver as he is able to send a command.


Sent from my MB860 using XDA App

You need the nvflash driver. Without this, youll not able to communicate with the hardware.

The first problem its that someone would listen to yungboss22

The second is not a driver issue. Especially if you are using the linux binaries. I followed some tweets back and forth about the cable TBH was going to sell. If memories serves it was also tweeted how to make it. The dev atrix comes with a different cable and needed no "drivers" which goes to the last problem

No SBK. A dev atrix is unlocked and needs no SBK. NVFlash can write. On retail atrix when NVFlash is envoked you should see an error as posted in op.

 

[jdrials]

Be ready for a surge of silly questions... This was posted as a xda news article saying "atrix bootloader soon to be unlocked"... Not so sure that was a good idea... LOL

 

[vista1984]

Be ready for a surge of silly questions... This was posted as a xda news article saying "atrix bootloader soon to be unlocked"... Not so sure that was a good idea... LOL

well, i was thinking the news was according to some inside sources...
anyway,, shut my mouth from now on as i can not help on the unlock process.

 

[P00r]

Anyways, the Nvflash on the phone is the Linux i386 binary. The bootloader.bin isn't platform specific, as it's meant for the target, rather than the host. THe archive is available in /usr/local/share/motorola/fireboxmake/OSH_tools.tgz.

Actually AFAIK it is specific, as you can see this is extracted from an update for a viewsonic tablet

assert(package_extract_file("bootloader.bin", "/tmp/bootloader.bin"), write_bootloader_image("/tmp/bootloader.bin", "EBT"));

The second line was not included in older rom, but a newer bootloader apeared and it was writen in the device actually preventing an easy restore and breaking Clockwork recovery.

Also if you want to play with your unit I sugest a full partition backup with this set of command (same command under linux just make it a .sh script and edit a bit) keep in mind nvflash usually backup a part of the phone, it is not a full backup but a low level backup of the boot/hardware config

http://forum.xda-developers.com/showthread.php?t=1010659

 

[zanzee]

It appears that a few things are missing when attempting to get NVFlash to work. I recall a few days ago TBH was Tweeting about a cable they are planning on selling.

The thread is here

now this is a cable that adds power by changing the pins on a normal cable. It would (in theory) power the device with no battery.

Using this cable it might just force NVFlash to yield results. I recall from a purchase I made on the marketplace for a developers atrix that it was shipped with a cable unique to the device.

If NVFlash can be triggered with this cable we can look at the flash script in the device

#!/bin/bash

#
# Flash the target board.
#
# Usage:
# Before running, please set
#   TARGET_BOARD to the board's name (olympus or whistler) and
#   KERNEL_IMAGE to the location of your zImage file.
# Optionally set:
#   BOOTLOADER to the location of your fastboot.bin bootloader
#   FASTBOOT to the location of your Android Fastboot application
#
# Place the board in recovery mode and run:
# flash.sh <root_device>
#
# Where root_device is one of:
# - sda1: USB disk or SDCard
# - usb0: NFS share mounted through interface usb0 (Harmony only)
#
TARGET_BOARD=$1
GIG=0
GRFS=0
PORTABLE=0
BOOTLOADER=fastboot.bin

if [ "$UID" == "0" ]
then
    echo "Please don't run this as root or sudo"
    exit 1
fi

if [ $TARGET_BOARD == olympus_1gig ]
then
    GIG=1
    TARGET_BOARD=olympus
fi

if [ $TARGET_BOARD == olympus_portable ]
then
    PORTABLE=1
    TARGET_BOARD=olympus
fi

if [ $TARGET_BOARD == grfs ]
then
    GRFS=1
    TARGET_BOARD=olympus
fi

if [ "$TARGET_BOARD" != olympus -a "$TARGET_BOARD" != whistler ]
then
    echo "TARGET_BOARD invalid. Should be set to olympus or whistler."
    exit 1
fi

if [ $# -eq 2 ]
then
    echo "Extracting " $2
    tar xzf $2
elif [ $# -eq 1 ]
then
    echo ""
else
    echo "This script should be called with one argument: flash.sh <target board>"
    exit 1
fi

if [ ! -f $TARGET_BOARD/system.img ]
then
    echo "Failed to find $TARGET_BOARD/system.img"
    exit 1
fi

if [ ! -f $TARGET_BOARD/boot.img ]
then
    echo "Failed to find $TARGET_BOARD/boot.img"
    exit 1
fi

bootloader=$TARGET_BOARD/bootloader.bin
if [ ! -f $bootloader ]
then
    echo "Bootloader file $bootloader does not exist."
    exit 1
fi

if [ ! -f nvflash/grfs.img ]
then
    echo "Failed to find nvflash/grfs.img"
    exit 1
fi

nvflashfolder=nvflash

if [ $TARGET_BOARD == whistler ]
then
    bctfile=whistler_12Mhz_H5PS1G63EFR_333Mhz_512MB_emmc_THGBM1G6D4EBAI4.bct
    cfgfile=whistler_fastboot_emmc_full_webtop.cfg
    odmdata=0x800c0105
else
    if [ $GIG == 1 ]
    then
        bctfile=../$TARGET_BOARD/flash_1g.bct
#        odmdata=0x300c8105
#128         odmdata=0xBB0C8105
        odmdata=0
        cfgfile=flash_webtop.cfg
    elif  [ $PORTABLE == 1 ]
    then
        bctfile=../$TARGET_BOARD/flash_1g.bct
        odmdata=0
        cfgfile=flash_webtop16g.cfg
    else
        bctfile=../$TARGET_BOARD/flash.bct
#        odmdata=0x800c8105
        odmdata=0
        cfgfile=flash_webtop.cfg
    fi
fi

#Copy bootloader and then change to flash directory
cp $bootloader $nvflashfolder/bootloader.bin
pushd $nvflashfolder

if [ $GRFS == 1 ]
then
    sudo LD_LIBRARY_PATH=. ./nvflash --download 21 grfs.img --bl bootloader.bin --go
fi

if [ $PORTABLE == 1 ]
then
    echo "Backing up pds.."
    sudo LD_LIBRARY_PATH=. ./nvflash --read 11 pds.uid --bl bootloader.bin --go
    if [ $? -ne 0 ]
    then
        echo "PDS backup failed, exiting"
        exit 2
    fi
    echo "pds.uid backup has been created in current directory"
    echo ""
    echo "Un-plug phone and put into nvflash mode again"
    echo "Press Enter to continue"
    read cont
fi

echo "Running NvFlash"
if [ $odmdata == 0 ]
then
sudo LD_LIBRARY_PATH=. ./nvflash --bct $bctfile --setbct \
    --configfile $cfgfile --create --bl bootloader.bin --go
else
sudo LD_LIBRARY_PATH=. ./nvflash --bct $bctfile --setbct \
    --configfile $cfgfile --create --bl bootloader.bin --odmdata $odmdata --go
fi

if [ $? -ne 0 ]
then
    echo "Failed to flash."
    exit 2
fi
popd

echo "Flashing completed."
echo "Make the target filesystem available to the device and reset the board to boot."

It is commented out to not run as root

If this is tried you may get a result like trying to adb shell a device with no root
no permission error or similar.

in the script it is running commands using sudo.
it may be worth a try to use sudo or even attempt NVFlash as root

I neither have a cable or the tools to NVFlash.
im sure we will still run into the error from op

Nvflash started
rcm version 0X4
Command send failed (usb write failed)

no SBK no fully functioning NVFlash, but i too am hoping this will help at least with backup and restore.

Not sure if this has much to do with the SBK cable but I have noticed that the Atrix will power on and enter the bootloader using the stock charger without a battery and Tenfar’s CWM recovery installed(won’t happen with a 3rd party or pc usb). This might mean nothing or it might be possible to splice into the data lines on the charge cable. I know to enter SBK and to power up the phone without a battery you need a dev cable. So hopefully this leads somewhere.

 

[cellzealot]

If a factory cable is required for NVflash then we may be able to help you folks. We are getting a very small number (25) made for us for a steep price but I will see if MotoCache1 will post the pin out map he made so you can make your own. His prototpe was pretty messy and its a pain in the ass to do all the fine soldering needed, so most people are willing to pay the price for a pre made cable that they can trust for flashing their expensive phone, especially attempting unknown procedures.

 

[Bumble-Bee]

some devices seem to need bct + odmdate + configfile set while initialising nvflash ..... try a command like

nvflash --bct flash.bct --bl bootloader.bin --odmdata 0xADD_DDRESS_HERE --configfile flash.cfg --go

odmdata=0x300c8105
odmdata=0xBB0C8105
odmdata=0x800c8105
odmdata=0x800c0105

THIS COULD BE DANGEROUS SO DOING THIS MEANS U ACCEPT THIS RISK

there are also 2 bct files in there so all combinations should be tested

are all mentioned so try them all

Im a dev for the vega tegra 2 tablet so im sharing as much info as i have SBK being burned should not stop you from getting an 0x4 error

 

[agrabren]

SBK being burned WILL result in a failure to connect. Burn the prod fuse and an sbk, and you'll find you can't connect at all. And when you fail the secure handshake, the device will fall off the USB buys and require a reset to try again.

Sent from my MB860 using Tapatalk

 

[jiggytom]

some devices seem to need bct + odmdate + configfile set while initialising nvflash ..... try a command like

nvflash --bct flash.bct --bl bootloader.bin --odmdata 0xADD_DDRESS_HERE --configfile flash.cfg --go

odmdata=0x300c8105
odmdata=0xBB0C8105
odmdata=0x800c8105
odmdata=0x800c0105

THIS COULD BE DANGEROUS SO DOING THIS MEANS U ACCEPT THIS RISK

there are also 2 bct files in there so all combinations should be tested

are all mentioned so try them all

Im a dev for the vega tegra 2 tablet so im sharing as much info as i have SBK being burned should not stop you from getting an 0x4 error

Sogarth, are you willing to try this? If you do let us know the results.

Sent from my MB860 using XDA App

 

[Bumble-Bee]

SBK being burned WILL result in a failure to connect. Burn the prod fuse and an sbk, and you'll find you can't connect at all. And when you fail the secure handshake, the device will fall off the USB buys and require a reset to try again.

Sent from my MB860 using Tapatalk

Well even if u cant do anything in nvflash without the correct SBK u should still get a response from nvflash (iv seen a few examples of this)