F(x)tec Pro1X (fxtec-qx1050)/Hacking

== Hacking the F(x)tec Pro1 ==
Both QX1000 and QX1050 are hacker-friendly devices as:
* It comes unfused from the factory, meaning user can boot whatever they like without needing the binary to be signed by the vendor.
* bkerler's fantastic EDL tool contains the firehose binary for the device, you can use this to flash individual partitions or completely switch up the partition table.
* It works with EDL Deep Flash cable which is disabled on most retail devices.
QX1050 bootloader logs
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.XF.4.1-00327-KAMORTALAZ-1
S - IMAGE_VARIANT_STRING=KamortaPkgLAA
S - OEM_IMAGE_VERSION_STRING=server
S - Boot Interface: UFS
S - Secure Boot: Off
S - Boot Config @ 0x01b46070 = 0x00000049
S - JTAG ID @ 0x01b46130 = 0x0014d0e1
S - OEM ID @ 0x01b46138 = 0x00000000
S - Serial Number @ 0x01b46134 = 0xffffffff
S - OEM Config Row 0 @ 0x01b441b8 = 0x0000000000000000
S - OEM Config Row 1 @ 0x01b441c0 = 0x0000000000000000
S - Feature Config Row 0 @ 0x01b441d0 = 0x0050200019010000
S - Feature Config Row 1 @ 0x01b441d8 = 0x0014000000008000
S - Core 0 Frequency, 1305 MHz
S - PBL Patch Ver: 1
S - PBL freq: 600 MHZ
D - 4943 - pbl_apps_init_timestamp
D - 31453 - bootable_media_detect_timestamp
D - 1146 - bl_elf_metadata_loading_timestamp
D - 681 - bl_hash_seg_auth_timestamp
D - 6218 - bl_elf_loadable_segment_loading_timestamp
D - 5656 - bl_elf_segs_hash_verify_timestamp
D - 7222 - bl_sec_hash_seg_auth_timestamp
D - 1168 - bl_sec_segs_hash_verify_timestamp
D - 28 - pbl_populate_shared_data_and_exit_timestamp
S - 58515 - PBL, End
B - 75045 - SBL1, Start (MPM timestamp = 80703)
B - 77065 - SBL1 BUILD @ 14:55:18 on Jun 16 2022
B - 78032 - usb: hs_phy_nondrive_start
B - 78339 - str_overflow
B - 78379 - usb: hs_phy_nondrive_finish
D - 1313 - sbl1_hw_init
D - 12 - boot_flash_init
B - 197946 - UFS INQUIRY ID: SAMSUNG KM2V8001CM-B707 1900
B - 199361 - UFS Boot LUN: 1
D - 856 - Auth Metadata
D - 138782 - sbl1_xblconfig_init
D - 4 - sbl1_feature_config_init
D - 3 - boot_config_data_table_default_init
D - 17 - sbl1_ddr_set_default_params
B - 217315 - Using default CDT
D - 98 - boot_config_data_table_init
B - 217332 - CDT Version:3,Platform ID:34,Major ID:1,Minor ID:0,Subtype:0
D - 18 - sbl1_hw_platform_pre_ddr
D - 1650 - devcfg init
B - 222685 - PM: PM 0=0x8000028000000041:0x800 
B - 222734 - PM: PM 1=0x8000018000000040:0x800800 
B - 222768 - PM: HARD_RESET by PS_HOLD
B - 278283 - PM: SET_VAL:Skip
B - 278516 - PM: PSI: b0x10_v0x17
B - 282060 - PM: Device Init # SPMI Transn: 4521
B - 286467 - PM: Driver Init # SPMI Transn: 303
B - 286576 - PM: APSD re-run
B - 289233 - PM: battery Id: 10094
B - 789791 - PM: CHG Init # SPMI Transn: 56
D - 570793 - pmic XBL init
D - 5825 - vsense_railway_cpr init
D - 578367 - sbl1_hw_pre_ddr_init
D - 4 - boot_dload_handle_forced_dload_timeout
D - 321 - sbl1_load_ddr_training_data
D - 447 - sbl1_ddr_set_params
B - 799469 - DSF version = 20.0, DSF RPM version = 9.0
B - 799475 - Manufacturer ID = 1, Device Type = 7
B - 799480 - Rank 0 size = 2048 MB, Rank 1 size = 4096 MB
B - 799485 - Max Frequency = 1804 MHz
B - 799501 - Row Hammer Check : DRAM supports unlimited MAC Value : MR24[OP2:0 = 0] & MR24[OP3 = 1] for CH0 & CS0
B - 799514 - Row Hammer Check : DRAM supports unlimited MAC Value : MR24[OP2:0 = 0] & MR24[OP3 = 1] for CH0 & CS1
D - 3482 - sbl1_ddr_init
B - 799662 - do_ddr_training, Start
B - 805059 - Bootup frequency set to 1555200
D - 5445 - do_ddr_training, Delta
D - 5455 - sbl1_do_ddr_training
D - 2 - sbl1_hand_control_to_devprog_ddr_or_ddi
B - 805126 - Pimem init cmd, entry
D - 9917 - Pimem init cmd, exit
D - 10680 - sbl1_post_ddr_init
D - 19 - sbl1_hw_init_secondary
B - 816039 - APDP Image Loaded, Start
D - 1031 - Auth Metadata
D - 569 - Segments hash check
D - 2430 - APDP Image Loaded, Delta - (8204 Bytes)
D - 3 - boot_dload_dump_security_regions
B - 818584 - usb: UFS Serial - ffffffff
B - 1321623 - usb: chgr - SDP_CHARGER
D - 503940 - boot_dload_check
D - 2 - boot_cache_set_memory_barrier
D - 4 - boot_smem_debug_init
D - 333 - boot_smem_init
D - 4 - boot_smem_alloc_for_minidump
B - 1322830 - PM: SMEM Chgr Info Write Success
D - 61 - boot_smem_store_pon_status
D - 14 - sbl1_hw_platform_smem
D - 108 - boot_clock_init_rpm
D - 2 - boot_vsense_copy_to_smem
D - 2 - boot_share_flash_data
D - 11 - boot_populate_ram_partition_table
D - 8 - boot_populate_ddr_details_shared_table
D - 4 - sbl1_tlmm_init
D - 2 - sbl1_efs_handle_cookies
D - 2 - boot_apt_test
B - 1323203 - OEM_MISC Image Loaded, Start
D - 968 - Auth Metadata
D - 328 - Segments hash check
D - 2205 - OEM_MISC Image Loaded, Delta - (8136 Bytes)
B - 1325639 - QTI_MISC Image Loaded, Start
D - 8 - QTI_MISC Image Loaded, Delta - (0 Bytes)
B - 1328380 - PM: PM Total Mem Allocated: 1493 
D - 2736 - sbl1_pm_aop_pre_init_wrapper
B - 1328391 - RPM Image Loaded, Start
D - 1045 - Auth Metadata
D - 1703 - Segments hash check
D - 8153 - RPM Image Loaded, Delta - (220740 Bytes)
B - 1336552 - QSEE Dev Config Image Loaded, Start
D - 1046 - Auth Metadata
D - 558 - Segments hash check
D - 2946 - QSEE Dev Config Image Loaded, Delta - (35884 Bytes)
B - 1339501 - QSEE Image Loaded, Start
D - 5006 - Auth Metadata
D - 22552 - Segments hash check
D - 78132 - QSEE Image Loaded, Delta - (3343657 Bytes)
D - 52 - sbl1_hw_play_vibr
B - 1417873 - SEC Image Loaded, Start
D - 10 - SEC Image Loaded, Delta - (0 Bytes)
B - 1417888 - QHEE Image Loaded, Start
D - 999 - Auth Metadata
D - 3160 - Segments hash check
D - 7065 - QHEE Image Loaded, Delta - (387768 Bytes)
B - 1425173 - STI Image Loaded, Start
D - 10 - STI Image Loaded, Delta - (0 Bytes)
B - 1425942 - APPSBL Image Loaded, Start
D - 1025 - Auth Metadata
D - 11420 - Segments hash check
D - 18144 - APPSBL Image Loaded, Delta - (2229248 Bytes)
D - 6 - sbl1_appsbl_arch_determination
B - 1444907 - SBL1, End
D - 1369872 - SBL1, Delta
S - Flash Throughput, 181000 KB/s (6278471 Bytes, 34654 us)
S - DDR Frequency, 1555 MHz
UEFI Start [ 1644]
 - 0x05FC01000 [ 1650] Sec.efi
ASLR : ON
DEP : ON (RTB)
Timer Delta : +6 mS
RAM Entry 0 : Base 0x0000000040000000 Size 0x000000003C900000
RAM Entry 1 : Base 0x00000000C0000000 Size 0x0000000100000000
RAM Entry 2 : Base 0x0000000080000000 Size 0x0000000040000000
UART Buffer size set to 0x8000 
Wrong CPU core 4
Wrong CPU core 5
Wrong CPU core 6
Wrong CPU core 7
UEFI Ver : 5.0.220616.BOOT.XF.4.1-00327-KAMORTALAZ-1
Build Info : 64b Jun 16 2022 14:56:08
Boot Device : UFS
PROD Mode : TRUE
Retail : TRUE
Module cannot re-initialize DAL module environment
UFS INQUIRY ID: SAMSUNG KM2V8001CM-B707 1900
UFS Boot LUN: 1
Embedded Images Supported and Commonlibs loaded
Read: NumHalfSectors 0x1, ReliableWriteCount 0x0 
Read: NumHalfSectors 0x1, ReliableWriteCount 0x0 
Read: NumHalfSectors 0x8, ReliableWriteCount 0x0 
HW Wdog Setting from PCD : Disabled
PM0: 45, PM1: 37, 
MDPPlatformConfigure 10
MDPPlatformConfigure 6
DisplayDxe: SetupPlatformPanelConfig 33 uHardwareVersionSubtype 0
DisplayDxe: SetupPlatformPanelConfig 44 uPanelCnt 1
DisplayDxe: SetupPlatformPanelConfig 55 pDetectPanel 1
DisplayDxe: SetupPlatformPanelConfig 66 uPanelId 0 eSelectedPanel 35
MDPPlatformConfigure 5
MDPPlatformConfigure 1
Panel power up sequence for default platform:Panel_Default_PowerUp ,by eric.wang.
mask Panel_Default_PowerUp:reset,by eric.wang.
Panel_Default_Peripheral_Power.
GetPmicIBBLABMode.
MDPPlatformConfigure 0
Display: MDP_DISPLAY_PRIMARY
MDPPlatformConfigure 7
Panel_Default_Reset.
Panel power up sequence for default platform:Panel_ResetStateExec.reset pin: 82,by eric.wang
state0:=1,state1:=0,state2:=1,by eric.wang
Display: DynamicDSIPanelDetection
uPanelIndex:0
Detected panel id:00880000
DisplayDxe: Resolution 1080x2160 (1 intf)
MDPPlatformConfigure 5
MDPPlatformConfigure 6
MDPPlatformConfigure 11
UsbConfigPortsQueryConnectionChange: UFP and Type-C
UsbConfigPortsQueryConnectionChange: usbport->connectstate: ATT
[Haptics] Install EFI_QCOM_I2C_HAPTICS_PROTOCOL Success. - Success
EFI_I2cHapticsInit device 3
haptic_nv: uefi driver version is v1.2.0
haptic_nv_hw_init: enter!
haptic_nv_parse_chipid enter
haptic_nv_hw_reset enter
haptic_nv_parse_chipid aw86224_5 detected
haptic_nv_sw_reset enter
haptic_nv_func_init: enter!
haptic_nv_init: enter!
aw8622x_haptic_stop enter
aw8622x_haptic_stop entered standby! glb_state=0x00
haptic_nv_ram_init: enter!
haptic_nv_haptic_play: enter!
haptic_nv_haptic_play: enter! wav_index = 3 
haptic_nv_haptic_play: enter! wav_loop = 0 
EFI_I2cHapticsInit Success
MinidumpTADxe: Minidump TA loading not enabled.
Disp init wait [ 2329] 
MDPPlatformConfigure 8
MDPPlatformConfigure 8
MDPPlatformConfigure 7
Panel_Default_Reset.
Panel power up sequence for default platform:Panel_ResetStateExec.reset pin: 82,by eric.wang
state0:=1,state1:=0,state2:=1,by eric.wang
MDPPlatformConfigure 4
Panel_Default_Brightness_Enable.
GetPmicIBBLABMode.
Panel_Default_Brightness_Level. 3
Panel_Default_Brightness_Level uNumBits 8 uLevel 50
Panel_Default_Brightness_Level command 0x51 0x80 0x0
MDPPlatformConfigure 5
-----------------------------
Platform Init [ 2597] BDS
UEFI Ver : 5.0.220616.BOOT.XF.4.1-00327-KAMORTALAZ-1
Platform : IDP
Chip Name : SM_KAMORTA_H
Chip Ver : 1.0
Chip Serial Number : 0xFFFFFFFF
-----------------------------
UEFI Total : 970 ms
POST Time [ 2614] OS Loader
Loader Build Info: Jul 7 2022 14:40:36
VB: Non-secure device: Security State: (0xF3F)
VB: RWDeviceState: Succeed using devinfo!
GetKeyPress Success
Total DDR Size: 0x000000017C900000 
KeyPress:0, BootReason:0
Fastboot=0, Recovery:0
GetVmData: No Vm data present! Status = (0x3)
VM Hyp calls not present
Active Slot _a is bootable, retry count 6
Booting from slot (_a)
Booting Into Mission Mode
Loading Image Start : 2643 ms
Loading Image Done : 2644 ms
Total Image Read size : 4096 Bytes
Invalid vendor_boot partition. Skipping
Load Image vbmeta_a total time: 1 ms 
Load Image vbmeta_system_a total time: 1 ms 
Load Image boot_a total time: 191 ms 
avb_slot_verify.c:256: ERROR: boot_a: Hash of data does not match digest in descriptor.
Load Image dtbo_a total time: 49 ms 
avb_slot_verify.c:256: ERROR: dtbo_a: Hash of data does not match digest in descriptor.
VB2: Authenticate complete! boot state is: orange
VB2: boot state: orange(1)
Memory Base Address: 0x40000000
Decompressing kernel image total time: 191 ms
Dtbo hdr magic mismatch 0, with D7B7AB1E
qcom, msm-id in device tree is (8) not a multiple of (12)
DTB offset is incorrect, kernel image does not have appended DTB
VB: Non-secure device: Security State: (0xF3F)
VB: RWDeviceState: Succeed using devinfo!
Cmdline: PMOS_NO_OUTPUT_REDIRECT pmos_boot_uuid=7048704a-ced5-492f-a66c-a5227e912da9 pmos_root_uuid=096655cd-19ae-461c-8534-a5ca9009d295 androidboot.verifiedbootstate=orange androidboot.keymaster=1 androidboot.vbmeta.device=PARTUUID=b6221cbc-a067-5d87-50
RAM Partitions
Add Base: 0x0000000040000000 Available Length: 0x000000003C900000 
Add Base: 0x00000000C0000000 Available Length: 0x0000000100000000 
Add Base: 0x0000000080000000 Available Length: 0x0000000040000000 
ERROR: Could not get splash memory region node
Update Device Tree total time: 12 ms 
Shutting Down UEFI Boot Services: 3239 ms
Start EBS [ 3239] 
BDS: LogFs sync skipped, Unsupported
App Log Flush : 50 ms
Exit EBS [ 3307] UEFI End