[Transformer TF300T Q&A, Help & Troubleshooting] usbrelic:
NvFlash, the missing manual v1

The following is a rough guide, this is where I am at, in regards to recovering my device. Please, anyone that has experience with NvFlash, can you please reply to the problem at the end. tobdaryl, thank you for helping, I appreciate the fact that you put this useful tread up. I am going to add myTF300T Nvflash instructions. I am looking at two possible ways to proceed, install Linux and run NvFlash from there, also, I need to check the syntax for --sync and add it into my command.

START DIRECTIONS

================================================== ================================================== =========

How to recover a TF300T with Nvflash

These directions will assume you have backed up your files before you bricked your device. It will explain the switches and what changes does this do to your system.

Prerequisites:

1. your before-brick, blob and recovery files

2. a TF300T that was bricked after these files were created

If you have your Nvflash files, then you know how to get into APX. Getting the device into APX mode is necessary to perform any of the Nvflash commands. As a reminder, I will put the directions:

1. Plug your device in

2. Boot in APX

3. run wheelie --blob blob.bin (this will “bootstrap” into nvflash)

4. The screen should read:

Entering NvFlash recovery mode / Nv3p Server

Chip Id: XXXXXXXXXXXXXXXX

!!!!!device update success!!!!!

When you created your backup files, you ran a command in NvFlash. Lets examine what this command did:

“nvflash --resume --rawdeviceread 0 2944 bricksafe.img”

--resume or -r send the following commands to an already-running bootloader

--rawdeviceread S N filename reads back N sectors starting from sector S into filename

So we are reading 2944 sectors, starting from sector 0. This alone doesn't make any sense so I decided to run this command:

--getpartitiontable filename reads back the partition table into filename, I chose “partition_table.txt”

Opening “partition_table.txt,” revealed a bunch of partition information such as:

PartitionId=2

Name=BCT

DeviceId=18

StartSector=0

NumSectors=768

BytesPerSector=4096

PartitionId=3

Name=PT

DeviceId=18

StartSector=768

NumSectors=128

BytesPerSector=4096

PartitionId=4

Name=EBT

DeviceId=18

StartSector=896

NumSectors=2048

BytesPerSector=4096

PartitionId=5

Name=SOS

DeviceId=18

StartSector=2944

NumSectors=2048

BytesPerSector=4096

PartitionId=6

Name=LNX

DeviceId=18

StartSector=4992

NumSectors=2048

BytesPerSector=4096

PartitionId=7

Name=CER

DeviceId=18

StartSector=7040

NumSectors=2048

BytesPerSector=4096

PartitionId=8

Name=IMG

DeviceId=18

StartSector=9088

NumSectors=2048

BytesPerSector=4096

PartitionId=9

Name=GP1

DeviceId=18

StartSector=11136

NumSectors=256

BytesPerSector=4096

PartitionId=10

Name=APP

DeviceId=18

StartSector=11392

NumSectors=196608

BytesPerSector=4096

PartitionId=11

Name=CAC

DeviceId=18

StartSector=208000

NumSectors=109568

BytesPerSector=4096

PartitionId=12

Name=MSC

DeviceId=18

StartSector=317568

NumSectors=512

BytesPerSector=4096

PartitionId=13

Name=USP

DeviceId=18

StartSector=318080

NumSectors=208896

BytesPerSector=4096

PartitionId=14

Name=PER

DeviceId=18

StartSector=526976

NumSectors=1280

BytesPerSector=4096

PartitionId=15

Name=YTU

DeviceId=18

StartSector=528256

NumSectors=128

BytesPerSector=4096

PartitionId=16

Name=CRA

DeviceId=18

StartSector=528384

NumSectors=1280

BytesPerSector=4096

PartitionId=17

Name=UDA

DeviceId=18

StartSector=529664

NumSectors=3352192

BytesPerSector=4096

PartitionId=18

Name=GPT

DeviceId=18

StartSector=3881856

NumSectors=128

BytesPerSector=4096

Notice “StartSector=0” for Partition Id=2 and StartSector=2944 for Partition Id=5. This correlates with the same sectors from rawdeviceread. Those sectors are named: BCT, PT, EBT and SOS respectively. So based on the information I gathered, the bricksafe.img” file includes the information from those original partitions.

By looking at the table named: “Typical Partition Layout” from http://wiki.cyanogenmod.org/wiki/fastboot, I was able to find out information about some typical partitions. Some typical partitions that you should be worried about are: recovery, boot, system and userdata. There are other partitions, but I don't know what they do or if we even need to worry about them.

Here is more information about the partitions:

header is info used to pack the blob and is not seen in the partitions

PT is the partition table

kernel is EBT/bootloader

recovery is SOS

system is APP (everything in /system)

10_CAC I think is /cache

12_USP is userspace or everything in /data

15_UDA I think is the internal sdcard

Taken from:

http://xdaforums.com/show...1129308&page=3

Post#30 gee one

OK GREAT, now I can brick or play with my tablet, right??!?!!!??? WRONG

While its safe to load images, if you do not know exactly what the command is doing, do not try to modify the command to try and “make” it work. Ex:

Before I bricked it, just like everyone else, my tablet worked perfectly. I unlocked the bootloader, created the NvFlash files and installed TWRP 2.3. I was able to boot into TWRP and create a complete backup of my tablet. After that was done, I restarted the tablet in Fastboot and performed this command:

fastboot flash boot boot.img

But instead of flashing a boot image onto the boot partition, I flashed a system partition onto the boot partition. Now every time I boot my device, it does not give me the RCK option and it does not boot into android. When I start the tablet with vol down + power, it only has two options: wipe data and the USB icon (fastboot).

I assume I screwed up the partitions. Now I cant boot the tablet into android anymore. I can get it into both fastboot and APX mode, I am going to assume it is softbricked. What do to???? KEEP READING

Here is how I solved it:

bootstrap into NvFlash

APX mode

wheelie --blob blob.bin

Flash your bricked device with bricksafe.img

nvflash --rawdevicewrite 0 2944 bricksafe.img

Whoa, what did that command do? It writes back 2944 sectors from bricksafe.img to device starting from sector 0

OK GREAT, now I can brick or play with my tablet, right??!?!!!??? WRONG

The previous commands could have accidentally flashed over some other partitions, unintentionally. I am guessing, if I tried to flash a 700mb system blob, into an 8mb root partition, something is not going to function properly. You have the ability to restore partitions 2-5 with bricksafe.img, how about partitions 6-18? How do you know that those partitions are working perfectly? Well, I don't know. What I do know is the tablet boots as it used to, except for the first few sectors. Here is a command from: http://tosh-ac100.wetpaint.com/page/...ternal+Storage

I did some searching and came to this page:

http://tosh-ac100.wetpaint.com/page/...ternal+Storage

Which had this command:

nvflash --bct orginal.bct --setbct --bl fastboot.bin --configfile altered.cfg --create --verifypart -1 –go

will restore the partitions on a Toshiba AC100

I also found this page:

http://xdaforums.com/showthread.php?t=861950

With this command:

nvflash --bct gtablet.bct --setbct --bl bootloader.bin --configfile gtablet.cfg --create --go

will restore the partitions on a gtablet

Another one here:

http://www.tabletroms.com/forums/tra...er-root-7.html

With this command:

nvflash --bct transformer.bct --setbct --configfile flash.cfg --bl bootloader.bin --odmdata 0x300d8011 --sbk 0x1682CCD8 0x8A1A43EA 0xA532EEB6 0xECFE1D98 --sync

Yet another page:

http://xdaforums.com/show....php?t=1129308

With these commands:

./nvflash --bct transformer.bct --setbct --configfile flash.cfg --bl bootloader.bin --odmdata 0x300d8011 --sbk 0x1682CCD8 0x8A1A43EA 0xA532EEB6 0xECFE1D98 --sync

./nvflash --resume --download 5 <path-to-your-backup-dir>/05_SOS_raw.img

[…]

./nvflash --resume --download 16 <path-to-your-backup-dir>/16_GPT_raw.img

./nvflash --resume --sync

Found another one here:

http://forum.tegraowners.com/viewtopic.php?t=517

With this command:

nvflash --bct flash.bct --setbct --odmdata 0x100c0105 --configfile flash.cfg --create --bl bootloader.bin --sbk 0xXXXXXXXX 0xXXXXXXXX 0xXXXXXXXX 0xXXXXXXXX --go

Last but not least, this page:

http://xdaforums.com/show....php?t=1010659

had this command:

nvflash --bl bootloader.bin --download X partX.img

To Restore individual partitions for the gtab. X is the partition number you wish to flash and this will not work for partition below 4

Ok, well that is nice and all, but as we learn with flashing and rooting, each device is different. We can't very well use this command on our TF300T, so I have to alter it to work with my restore files. Here is the command I will use:

nvflash --bct create.bct --setbct --bl blob.bin --configfile factory-config.img --create --verifypart -1 –go

before I go bricking/flashing my device, let me dig around nvflash for some more help:

nvflash –cmdhelp --create

Shows this:

C:\Android\platform-tools>nvflash --cmdhelp --create

Nvflash started

--create command usage

-----------------------------------------------------------------------

description:full initialization of the target device using the config file

usage: nvflash --bct ./<filename>.bct --setbct --configfile ./<configname> --create

--bl ./<bootloader> --odmdata <data> --go

note: failed to create the partition (code: 10) may be expected even for

sec. storage device improper connection/not present at all

-----------------------------------------------------------------------

Notice the description: “full initialization of the target device using the config file???” So which is the bct config file: “Recovery.bct” or “create.bct”?

================================================== ================================================== =========

END instructions