yashsingh1/xdaforums huggingface dataset:
[P3600 Software Upgrading] Des:
Good question indeed. Radio unit is somewhat independed subsystem, so it may be or may be not depending on speciefic design. Can't tell you anything 'bout triniti now, but there is a simple way to find it out. However patching radio rom is not the only way to victory: wouldn't it be enough to flash pathced bootloader with no signature checking ? But there is another vital question - does bl contain self integrity check ? Very brief examenation of triniti spl make me think that this is rather unlikely, but who knows. Is there any experimental proof of presence or absence of it ?

what make you think so ? correct me if i am wrong, but while we keep bl & radio virginal we have no chances to brick device in any case. And flasher could be debugged on less critical parts of rom. Certainly if we flash wrong code or device power unexpectedly goes down during flashing process we'l got a brick. But flashing with botloader have same vulnerability.

I do. Can't say same thing about free time unfortunately, but sometimes i have it too.

I doubt.

how deep customisations were ? just patching couple of conditional branches with nops or patching init code too ? spl at least contain tons of hardcoded absolute addresses, and do mmu setup. it is necessary either patch em, or maybe do initial setup by yourself and after that jump to spl code that do actual job. Quite doubtful that this is easier than writing simple standalone flasher.
[P3600 Software Upgrading] pof:
That would be enough to flash any ROM (bypass CID checking), but not to have security level=0 or remove the SimLock.

No, it does not.

For IPL you can see the photo I attached in my previous comment. For SPL there's no proof of concept on Trinity, but I can show you for Artemis... will explain later ;)

That's right, I have no idea on how to do low-level access to physical NAND from CE. I said you can brick it while programming the flasher because I guess if you do something wrong in your code you can produce permanent failures on NAND (ie:a write operation which is not performed block-wise would certainly damage the NAND flash, isn't it?).

Well for me writing a standalone flasher seems more risky that doing all the stuff in RAM :)

I started this project with a couple of people, we have Hermes, Trinity, Artemis and Herald devices. We have successfully started an Artemis & Herald SPL using a modified version of psetmem (from itsutils) which places the splitted spl.nb file at memory address 0x10000000, then we use a modified gnuharet to disable DMA and jump into this address, and the code is executed successfully: we can start for example bootloader version 1.11 while having 1.25 on the device. We have not yet modified the SPL to accept custom certificates or unsigned dbh files, but one of us is working on this right now.

On Hermes & Trinity it is a bit more difficult, we are not 100% sure yet of what the problem is: We can jump successfully to IPL address, but then IPL reads SPL from NAND and executes it, so even if we previously place a SPL on memory it is overwritten by IPL. If we jump to SPL address device just hangs and we have no way of debugging it (having the jtag points for these devices would be amazing, but no one knows them as far as I'm concerned), we know it is copying the SPL correctly because we print a red line on video ram after copying it, but it just hangs after this. Our strongest bet at the moment is that SPL is not able to run standalone in Hermes & Trinity, it has some interaction with IPL and IPL code needs to be run first to setup the proper environment for it.

Anyway, if you want more details or want join us in this project you are more than welcome to participate, or if you want to take the other approach and start developing a custom flasher it would be good too, we'll certainly learn something and have some fun with it! PM me and I will send you my IM contact details :)
[P3600 Software Upgrading] rdkay:
Me too have paid for the unlock, have just bought the p3600 to flash the gps firmware but the unlocker never succeeds, have not yet tried to get in touch with imei unlock support... @MATTERHORN: Can you give me a hint at whom you directed the complaint at IMEI UNLOCK?

Cheers
[P3600 Software Upgrading] Des:
wich would be enough to do everything you want :)

start from ce, pre-setup enviropment (memory mappings, load data from files, etc), disable interrupts and say ce bye-bye.

good question contain at least half of the answer - patch the IPL and you'll got the result.

I've tried to jump to IPL, but machine hangs on it execution (debuging scren-drawing code placed at 0x00000000 works just fine) - shurely I need to shutdown hardware more accurately, but no time for it :( So if you do have working code, than look at this (trinity 0.50 IPL):

ROM:00000380 STMIA R0!, {R1-R8} ; here RAM at 0x3000000-0x30080000 get zeroed
ROM:00000384 SUBS R9, R9, #0x20
ROM:00000388 BNE loc_380

ROM:00000904 LDRB R1, [R6,#0x10] ; here we read byte from NAND
ROM:00000908 ADD R0, R0, #1
ROM:0000090C CMP R0, #0x800
ROM:00000910 STRB R1, [R4],#1 ; And here we store it to RAM
ROM:00000914 BLT loc_904

I'm shure that you know how to replace couple of str's with mov r0, r0 :)
[P3600 Software Upgrading] Matterhorn:
Look for a Private message. I sent them a screen shot of the dos window of the unlock process. Then they had me run a trace file. I sent it to them, they said that there is a problem with some roms...what luck. Anyway, they sent me a refund.

The good news is that I just read in another thread that the official HTC rom could be coming as early as the 4th of February!
[P3600 Software Upgrading] Des:
Good news - with patched IPL i was able to run SPL from RAM.

and yes, with patched SPL i've got SuperCID and security level=0

now my loader code is one big quick'n'dirty hack backed in half an hour, so it is quite unstable (i mean it does not start IPL every time it run) and i have no time to debug it now. But all principial problems are solved, and if i have a bit of freetime on weekend you'll get the "softspl" for flashing your trinity with everything you want.
[P3600 Software Upgrading] dersvenni:
Great News mate
[P3600 Software Upgrading] mdacfan:
@Des

Sounds great !! Hope you will have some free time for developement before weekend ;-)
[P3600 Software Upgrading] pof:
damn! :eek: :D

I've been fighting to get that done on hermes for ages! You're the best!
[P3600 Software Upgrading] pof:
@Des: Again I am so impressed on how you managed to do this in such little time, you should be very well versed in these matters... i'm just a newbie :)

We have modified the IPL and substituted the part where the RAM is zeroed by nop (MOV R0, R0) and the "STRB R1, [R4],#1" by "ADD R4, R4, #1" and it does not boot on Hermes. But if we leave the STRB on place, it boots with our "modified" IPL (but getting SPL from NAND :().

Attached is original hermes IPL-1.01 and two different unsuccessful attempts to make it not read SPL from flash.

Any clues on what is wrong here?
[P3600 Software Upgrading] machinagod:
Amazing work Des.

Been working on the same thing, but still not the point where you are.

Keep up with it!
[P3600 Software Upgrading] Des:
put some debug code in memory instead of SPL (like this one - it paints screen white. it's in M$ armasm, may not be direct compatible with gnu, but the idea is simple)

psphys
MOV	R0, #0x10800000	; framebuffer physical address
MOV	R1, #0xFFFFFFFF	; tho white pixels
MOV	R2, #0x12C00	; 320*240
psloop
STR	R1, [R0], #4
SUBS	R2, R2, #2
BNE	psloop
B	psphys	; prevent future code execution

does it get there ? If no thing got much easier - IPL is less than 4k in size so it is pretty possible to reverse it instruction by instruction. If yes than we must find out where SPL halts, not too simple but still possible. But before debugging SPL may i ask you what steps do you perform before saying "mov pc, #0" ?
[P3600 Software Upgrading] Des:
I'm rather far away from htc rom formats and not very keen on look into em, so if you want to be able to flash unsigned code - please cook me rom with invalid signature but correct in all other aspects (format, crc's, etc).
[P3600 Software Upgrading] sasta:
Great solution and very fast

I hoped there would be a free one but as someone else said I paid 600E for the trinity I might as well pay 28 for having the GPS on board.

Now I am a very happy trinity gps owner
[P3600 Software Upgrading] tower5:
sorry for my question

my HTC p3600 , TIM branded , shows these values in bootloader:

TRIN 100

IPL-0.50

TRIN100

SPL-1.07.000

does it mean anything special ? can I proceed with cid-unlock procedure using the link of the first post or it is better to wait?

these values indicate any "special risk" doing this unlocking procedure?

Please let me understand what could happen... using simple explaination

Thanks for any help !!
[P3600 Software Upgrading] pof:
No :(

The IPL is hanging when I patch it to not copy the SPL contents from NAND.

Yes, I can make the IPL paint the screen right before it starts reading SPL from NAND, but not after that, so I think it's halting right after it, at offset 0x934.

First I use machinagod's modified psetmem.exe to place the files in memory:

psetmem.exe -f -p 0x00000000 IPL.nb

psetmem.exe -f -p 0x30000000 SPL.nb

Then I use a modified haret version to jump to physical address 0, which I know is working because I can place a modified IPL (for example only version numer hex edited) and jump into it. I can provide the source if you are interested.

Take any NBH file and modify the Header (for example the CID) this will make the signature invalid. You can also remove the signatures with nbh2dbh.pl and sign the file again with your custom certificate using ImageHash.exe (from .NET Compact Framework).
[P3600 Software Upgrading] Des:
As I've said before this is more likely good than bad: the IPL is realy small. I'l shurely take look at this as soon as i have time for.

One possible reason may be that nand contain some configuration data (for example KernelIoControl() used to jump to service mode just set some flags in nand and make reset after that), but however i havn't noticed any usage of this data by trinity IPL.

Quite a dirty way indeed. You have OS running (and possibly accessing memory) when you are writing to mem and before you jump to it. I'm not shure if memory occupied by ipl and spl is used by os (and for ipl i'm almost shure that it isn't) but disabling interrupts (=> stopping os task scheduler) before placing ipl and spl on their places is a good idea: maybe this is unnecessary but it cost nothing, do no harm and eliminates any possible problems from that side.

Doesn't this ruin the crc/checksum too or data integrity in signed roms protected only by signatures (wich of course is more than enough, but for compatibility reasons conventional (non cryptographic) cs may be still in use as i guess).[/quote]

thanks, I'l try this.
[P3600 Software Upgrading] asci:
Please can someone answer to this question:

- unlocking CID (superCID), after installing TEST ROM, will I be able to upgrade to official HTC ROM, whatever bootloader will it has?
[P3600 Software Upgrading] copycat:
HTC P3600 CID Unlock

I have this HTC P3600 with a Portuguese ROM on it.

If i do this unlock, will i be able to replace it with an English ROM...? Or will i still be obliged to put a Portuguese ROM as the original one...?

Can anybody help me...?

Thanx in advance!
[P3600 Software Upgrading] btprice2001:
I asked that same question here:

http://xdaforums.com/showthread.php?t=293182&page=6

I was told that you can only install a rom with the same or higher version bootloader, so if the test rom has 1.07 boot and you install it and the official HTC rom has 1.06 boot, you would not be able to install the official HTC rom. That's why I'm still waiting.
[P3600 Software Upgrading] Wire64:
yes you can.
[P3600 Software Upgrading] anonimo:
Third time the same message. All your questions are already answered if you can read. Be warned the HTC P3600 will be very hard to use whatever language you install IF YOU DON'T READ.
[P3600 Software Upgrading] Matterhorn:
I wonder if you run the imei-check unlocker on the device again if it doesn't change the bootloader back to 1.01. Imei-check didn't work on my Trinity but it now has a 1.01 MFG bootloader. I'll have to wait for an official HTC WWE rom to get my GPS activated :mad: .
[P3600 Software Upgrading] Des:
On last weekend I was too busy with skiing and was too far away from pc to keep my promise and code a bit. Hope that this would be more then enough compensation for that :)
[P3600 Software Upgrading] Wire64:
think everyone will be gratefull
[Xperia Z2 Q&A, Help & Troubleshooting] kolipko:
Hi!

I'm kind-of new to kernels and rom making but I am experienced in flashing , here's the deal though.... I want to know what in the stock kernel that makes it no boot on aosp roms.
[Xperia Z2 Q&A, Help & Troubleshooting] Envious_Data:
With kernels, most of the time its mismach configs, missing patches, VM stuff or even the xperia features
[Xperia Z2 Q&A, Help & Troubleshooting] kolipko:
Ok... So even by using the Sony aosp github it will boot on a locked bootloader. That kinda sucks since I wanted to try and make myself a z2 gpe while still having the drm keys
[Xperia Z2 Q&A, Help & Troubleshooting] Envious_Data:
The only way to currently have aosp on a locked bootloader is to have sony compile a rom and kernel

Or to create a specalized kernel that sits in your /system/ as oposed to your boot partition
[T-Mobile Galaxy Note 4 Q&A, Help & Troubleshooting] xoxo_xdagirl91:
I'm not sure what's considered high android system but mine is at 29% and looks like it's taking a toll on my battery. When I check the battery usage it's the highest thing listed. How can I lower this or fix this? Any help is greatly appreciated! I love this phone! :D
[T-Mobile Galaxy Note 4 Q&A, Help & Troubleshooting] Mr.37:
:( same problem here ... android system is at 24% with 59 minutes of CPU usage while screen was about 20% with more than 2 hours of screen on time !?! Why system is killing the cpu so much ? ... TouchWiz !!! *SMH*
[T-Mobile Galaxy Note 4 Q&A, Help & Troubleshooting] dkb218:
Give it a week or so to even out.
[T-Mobile Galaxy Note 4 Q&A, Help & Troubleshooting] xxsxx:
This could be any app that is pulling your location. Most pull through your location through google play services, part of the android system. Not defending touchwiz usage but most likely the fault lies elsewhere.
[T-Mobile Galaxy Note 4 Q&A, Help & Troubleshooting] capecubano:
I dont think so my location its off and still takes 29%, maybe a kernel issue. I heard they did the update we just got cause battery draining issues. maybe not fixed 100%
[T-Mobile Galaxy Note 4 Q&A, Help & Troubleshooting] btort1:
I get the same thing and I made sure to turn off notifications and apps that "push" and set em all to manual. I use the same apps and settings on my S5, and LG G3 and would be able to get around 6 hour screen time and total of 17-20 hours per charge. AND on those devices, the screen is usually the highest % and the android system is not even near that %

Right now I'm getting almost about the same as my S5 battery life, maybe a bit shorter...
[T-Mobile Galaxy Note 4 Q&A, Help & Troubleshooting] stephvez:
Same problem here, about 42% on a normal usage. I did not have this problem before, on stock Rom but since I switched to cynanogenmod, my phone can't make it through the day.

What's more, I'd like to know if any of you know an xposed module or an app which can automatically turn switches on/off when starting/closing an app. Like turning GPS on when starting Google Maps and turning it back off when closing the app, for instance.
[T-Mobile Galaxy Note 4 Q&A, Help & Troubleshooting] charmartist:
Good queetion, I'd be interested in that as well
[T-Mobile Galaxy Note 4 Q&A, Help & Troubleshooting] tauzins:
mines also like this
[T-Mobile Galaxy Note 4 Q&A, Help & Troubleshooting] mrja22:
I found this was related to location services and / or google now.

I found these worked for me:

1. Turning GPS location to GPS only (i.e. not using wifi). I believe this stops passive location tracking, which in turns stops the other services always running

2. Turning off location tracking / history. As above, no detailed location, no other fancy things running all the time.

3. Turning off Google Now.

I listed the above in the order I would do it. Using just item one, you still get most of Google Now's functionality.

End of the day, what I found was there was a lot of "smart" stuff going on in the background around your location, and this is what caused most of the CPU time. If you look at your wake locks, you will see it drop off dramatically once you do the above steps.

Some people have reported turning location services back on after a while didn't result in a spike in CPU time.

This isn't a Note 4 thing, more a Android / Google Now thing in my opinion,.

Hope it helps.
[T-Mobile Galaxy Note 4 Q&A, Help & Troubleshooting] MMakoto:
thanks for the advice and suggestions, but my s4 and s5 did not have the "android system" so high in usage. i've tried the turning off gps, then back on, and then restart phone thingy, but same results. i just hope sammy would address this issue as it seem pretty widespread.
[T-Mobile Galaxy Note 4 Q&A, Help & Troubleshooting] mrja22:
Just to clarify,Ii suggest turning location to GPS only. And leaving it off.

Turn off location reporting and history also. Then see what results you get and go from there
[T-Mobile Galaxy Note 4 Q&A, Help & Troubleshooting] xxjrsmith3xx:
I'm having the same thing ...
[T-Mobile Galaxy Note 4 Q&A, Help & Troubleshooting] railslave:
I just received a update that is supposed to fix the battery drain issue. We shall see if it works.
[T-Mobile Galaxy Note 4 Q&A, Help & Troubleshooting] HtcOnekid:
The update that came out this week or a different one.
[T-Mobile Galaxy Note 4 Q&A, Help & Troubleshooting] Mr.37:
Thanks a lot ...

Location tracking off made a big difference ... Things are already looking good. I will only turn on the GPS when need be.
[T-Mobile Galaxy Note 4 Q&A, Help & Troubleshooting] mrja22:
Good to hear.

I found I can have GPS on without any issues, as long as either Google Now or location tracking was off.
[T-Mobile Galaxy Note 4 Q&A, Help & Troubleshooting] xxjrsmith3xx:
Any more info ?
[T-Mobile Galaxy Note 4 Q&A, Help & Troubleshooting] nviz22:
I am having the same issue in tandem with weak battery signal. Do I wait for Lollipop or do I just sell my N4 and get an S6?
[Sprint HTC One (M8)] AlexanderX:
Today I unrooted my phone and relocked it so I could update my phone to 4.4.3 but every time I try to update it the phone will boot into fastboot mode and it reads "security warning" under where it says "Relocked". It does that every time I want to go to recovery.
[Sprint HTC One (M8)] Sloth:
You need a stock rom and stock recovery for the OTA to work.
[Sprint HTC One (M8)] AlexanderX:
I'm using both a stock rom and a stock recovery.
[Sprint HTC One (M8)] Magnum_Enforcer:
Why are you trying to boot into recovery if you have the stock recovery installed?
[Sprint HTC One (M8)] AlexanderX:
The screen will read "Entering Recovery" for 1 second then goes into fastboot mode.
[Sprint HTC One (M8)] Magnum_Enforcer:
Might want to try installing the stock Android system recovery again (doesn't sound like you have a recovery installed at this point). Sounds like that's what your issue is. You can also use a RUU to get back to stock and then take the OTA update.
[Sprint HTC One (M8)] AlexanderX:
To run a RUU, would I need to unlock my bootloader again?
[Sprint HTC One (M8)] AlexanderX:
Well, I tried to run RUU and FUU and both of them failed. I can't get passed step 1. Can I install a custom recovery and try again?
[Sprint HTC One (M8)] Magnum_Enforcer:
Make sure the firmware version of the RUU matches what you have installed. If you need a reference hit the second link in my sig and scroll down to the section regarding Hboot versions.
[Sprint HTC One (M8)] AlexanderX:
It does.
[Sprint HTC One (M8)] totoakarocky:
ota update

i am on stock rom 4.4.2 with twrp. s-off sim unlocked the system has automatically downloaded the new firmware 4.4.3. when i tap isntall phone turns on in twrp. there when i choose to install update the error flashes

checking for md5 file..

skipping md5 check: no md5 file found.

error: executing update binary in zip

error flashing zip.

can anyone suggest how can i update. pardon for silly questions i m new to this android thing.
[Sprint HTC One (M8)] Magnum_Enforcer:
You need to reinstall the stock Android system recovery to take the OTA update. Also need to be on a relatively stock ROM to take the update.
[Sprint HTC One (M8)] totoakarocky:
How can i reinstall stock recovery rom. Is tbere any option to keep twrp and install new software version
[Sprint HTC One (M8)] djjozo:
I just got my sprint m8 hk edition 2 days ago, after which I htcdev unlocked, rooted, s-off'd(tried firewater got whelped) used sunshine successfully, flashed captain throwbacks latest twrp, then proceeded to debloat. After I got the notification for the 1.54.654.13 update I fastboot flashed back to stock hk recovery 1.54.654.9, and got that ota installed and only had to reroot was still s-off and unlocked. Fastboot flashed cap's twrp again, then I got the ota update for 1.54.654.15(didn't realize this thing needed so many updates, I now know I still have 2 or 3 more to go) So I flashed back to stock hk 1.54.654.13 recovery, tried installing 1.54.654.15 and it reboots and tries to install it makes it to about 25% then the pic of the phone gets a red triangle and I have to hold pwr and volume up to reboot. I've redownloaded and reflashed the stock hk 1.54.654.13 recovery multiple times as well as deleting the ota update and redownloading it 3 times to no avail same result every time. Soooo, my question is do I even need to update step by step? Or should I just download the latest firmware 2.16.654.4 from here http://xdaforums.com/showthread.php?t=2729173 and install thru my pc. If so, I believe I need to relock my bootloader then ruu to 2.16.654.4. And last question, do I lose s-off by ruu'ing?
[Sprint HTC One (M8)] exSD:
You do not lose S-OFF ever. Only way to go back to S-ON is by doing is manually.

I believe it was the first or second OTA but you had to be completely on the stock ROM (the OTA looked for certain .apks in folders and if you didn't have them [ie. you debloated] you can't OTA).

Since you're S-OFF just go flash the latest firmware (no need to relock and RUU).
[Sprint HTC One (M8)] djjozo:
Nice, I didn't know u could never lose s-off!! I kinda thought it was something I had removed. So just flash the latest(for now at least, until the "eye" is ready) from omj's link I posted above? And thanks for the advice!!

Scratch that, just saw that is the ruu in his thread

---------- Post added at 01:22 PM ---------- Previous post was at 01:09 PM ----------

Ok so feeling like a fool, down further I found the 2.16.654.4_firmware.zip. what is the fastboot command to flash that. Sorry for the noobish questions
[Sprint HTC One (M8)] exSD:
You can get the firmware zip that doesn't have the new recovery so you don't have to reinstall recovery again either. If you don't have the H/K version it is this one you should download from OMJ's thread:

2.16.651.4 Modified Firmware w/ modified hboot (no red text)....removed boot & recovery (fastboot flashable): [url]http://www.androidfilehost.com/?fid=23578570567714842[/url] credit to @nfinitefx45 for the edited hboot, thx!

If you have the H/K version download:

2.16.654.4 Modified Firmware w/ modified hboot (no red text)....removed boot & recovery (fastboot flashable): [url]http://www.androidfilehost.com/?fid=23578570567715031[/url] credit to @nfinitefx45 for the edited hboot, thx!

Command is: fastboot flash zip zipName.zip