[Android Q&A, Help & Troubleshooting] BigCountry907:
Excellent Found Info on recovery

Ive been plugging away hard at this phone. Like you said there aren't tutorials for this phone. The other all seem to be MTK and this phone is Qualcom. So we need qualcom tools or qualcom compatible tools.

Heres a good link showing alot of specific info for our device.

http://www.androiddevice.info/submission/17460/show

I came across a file in my backup that is an actual log of the phone update.

I think it gives some clues as to whats going on.

In your phone under /cache/recovery you will see some last log files.

Most are small and only show the phone booting to the recovery screen.

But 1 of my logs shows a complete update.

Im gonna go over a few items here from this file.

Its pretty long all in all but theres good stuff in there.

recovery filesystem table

=========================

0 /system ext4 /dev/block/platform/msm_sdcc.1/by-name/system 0

1 /cache ext4 /dev/block/platform/msm_sdcc.1/by-name/cache 0

2 /data ext4 /dev/block/platform/msm_sdcc.1/by-name/userdata -1048576

3 /storage/sdcard1 vfat /dev/block/mmcblk1p1 0

4 /boot emmc /dev/block/platform/msm_sdcc.1/by-name/boot 0

5 /recovery emmc /dev/block/platform/msm_sdcc.1/by-name/recovery 0

6 /misc emmc /dev/block/platform/msm_sdcc.1/by-name/misc 0

7 /custpack ext4 /dev/block/platform/msm_sdcc.1/by-name/custpack 0

8 /aboot emmc /dev/block/platform/msm_sdcc.1/by-name/aboot 0

9 /firmware vfat /dev/block/platform/msm_sdcc.1/by-name/modem 0

10 /tz emmc /dev/block/platform/msm_sdcc.1/by-name/tz 0

11 /rpm emmc /dev/block/platform/msm_sdcc.1/by-name/rpm 0

12 /sbl1 emmc /dev/block/platform/msm_sdcc.1/by-name/sbl1 0

13 /abootbk emmc /dev/block/platform/msm_sdcc.1/by-name/abootbk 0

14 /fota emmc /dev/block/platform/msm_sdcc.1/by-name/fota 0

15 /tzbk emmc /dev/block/platform/msm_sdcc.1/by-name/tzbk 0

16 /rpmbk emmc /dev/block/platform/msm_sdcc.1/by-name/rpmbk 0

17 /study emmc /dev/block/platform/msm_sdcc.1/by-name/fsg 0

18 /splash emmc /dev/block/platform/msm_sdcc.1/by-name/splash 0

19 /sdi emmc /dev/block/platform/msm_sdcc.1/by-name/sdi 0

20 /persist ext4 /dev/block/platform/msm_sdcc.1/by-name/persist 0

21 /tmp ramdisk ramdisk 0

I also have all the mount points pulled from ADB but im going to post them in another thread.

Heres where the fun starts.

I:Got arguments from /cache/recovery/command

locale is [en_US]

Left Split=0

Right Split=0

framebuffer: fd 4 (540 x 960)

***sizeof(g_pgm_font)=4800

***sizeof(tar_len)=286720

installing_text: en (324 x 38 @ 411)

erasing_text: en (109 x 38 @ 312)

no_command_text: en (172 x 38 @ 312)

error_text: en (64 x 38 @ 312)

Command: "/sbin/recovery" "--update_package=/storage/sdcard0/.downloaded/update.zip" "--locale=en_US" "--swap=1"

(replacing path "/storage/sdcard0/.downloaded/update.zip" with "/storage/sdcard1/.downloaded/update.zip")

Here we can see the recovery starting up. it runs /sbin/recovery

We also see the file name Update.zip

We see it moves the update.zip to the SD card with SWAP.

So we know the sd card directory to put an update.zip in is /.downloaded

Im thinking if you put update.zip there it will see it. but it still wont load.

Opening update package...

I:read key e=3 hash=20

I:1 key(s) loaded from /res/keys

Verifying update package...

I:comment is 1550 bytes; signature 1532 bytes from end

I:whole-file signature verified against key 0

I:verify_file returned 0

Installing update...

Here we see the recovery checking the file to see if it is valid OTA update.

Heres the key location om the phone. I:1 key(s) loaded from /res/keys

Heres the location of the keys in the update.zip

I:comment is 1550 bytes; signature 1532 bytes from end

So basically if someone has a phone that is not updated yet to the latest firmware.

They need to download the OTA update on the phone and pull the battery after its done downloading.

Then go get the update.zip from "--update_package=/storage/sdcard0/.downloaded/update.zip

and make a copy to post up here.

If we had that update i think most of the phones that wont boot could be easily fixed by it.

Put on sd card here "/storage/sdcard1/.downloaded/update.zip"

Boot into recovery and run update from SD Card.

Or possibly just sideload the update zip from ADB.

Next thing is if we had this update.zip that passes the signature verification process. Im guessing its in the Updater script or maybe a part of the binary for loading the updater script.

But anyway we can mount the separate .img files using linux and modify the files to our own cooked rom and repack it and still pass verification.

In doing that we could maybe update the bootloader or make a hole to get around it. IDK.

Other than that if you turn your phone off. Even if its in bootloop. Hold the Vol down button and then plug the computer usb cable in you get the qualcomm service ports.

Qualcom HS-USB QDLoader 9008

And it is in download mode.

So now if we have the right tools we should be able to flash any partition of the phone we want.

Somebody with more knowledge of what tools to use and what images we need to flash needs to take over and help out here.