yashsingh1/xdaforums huggingface dataset:
[HTC Desire 526] BigCountry907:
Alright so you want to know what were up to.

Study Here

http://jnisz.blogspot.com/
[HTC Desire 526] BigCountry907:
Kernel source code

Here is my source code for the kernel.

It builds without error.

Still needs some work but not too bad of a start.

Download the zip.

If you clone it the version gets messed up.

https://github.com/Bigcountry907/HTC_a13_vzw_Kernel
[HTC Desire 526] BigCountry907:
Full Unlocked EMMC Backup Image

FULL EMMC BACKUP UNLOCKED / SUPER CID / S-OFF

http://www.mediafire.com/file/n8yaqtacaf3od21/526-DD-EMMC.zip

Removed link to post backup from a fresh install

This is a complete emmc backup of the full 8GB Emmc.

That means it contains the GPT Header and Partition Information.

The GPT Partition Table can be dumped from this file and also directly read from this file.

The GPT Partition Table can be pulled on the device as well.

And by the way. The GPT_Main-8g.img that you see in the Unencrypted Unpacked RUU.

Well that is the GPT Partition Table from the factory. WAHoooooo.

If you look around you will not find much info on generating the Partition.xml

That's why most will never even attempt this. ( I have the method down to a science )

The other thing needed done here is to make a full EMMC backup of a locked device.

Then we can use the diff command to find the differences in the code between a locked device and a fully unlocked device.

Once we know what it takes to flash a fully unlocked device ( Upon Flash Completion ).

We can polish up the partition.xml and generate a full rom flashable in Emergency Download Mode..

Some may fear bricking their device.

The thing you should know is if you are running linux.

We can create the rom package from the partition.xml.

And flash it to a sd card in a card reader for verification.

This way we can evaluate the disk structure and verify that the sd card is an exact clone of the device emmc.

After we achieve that then we can flash a real device with confidence.
[HTC Desire 526] BigCountry907:
Breakdown of the Raw GPT.

We can View the Emmc Backup image in a hex editor and decode the GPT.

There are easier ways but we will start out here. I have tools that aren't doing too bad of a job but when it comes to getting the GPT correct we need to be really really sure.

Here is the Breakdown of the GPT Partition Table.

Have Fun, :good:
[HTC Desire 526] BigCountry907:
Here is the RUU for the 526 Verizon Other Carrier Version.

http://www.mediafire.com/file/5xdb32tpy10x1os/0PM3IMG_VZW_OM_US_1.10.509.4.zip

The rom I am building will be based off of this RUU.

To flash this RUU rename the file to 0PM3IMG.zip

copy it to your external sd card.

Boot the device into download mode.

Hit the volume up key to flash the RUU.

PLEASE NOTE: THIS RUU HAS A DIFFERENT CID.

SO UNLESS YOU ARE SUPER CID YOU CAN NOT FLASH IT.

iT WILL NOT LET YOU.

Which is unfortunate.

Unlocking the boot loader is as simple as loading this RUU.

And then following the normal HTC dev process.

Because of the CID the device will not flash this RUU.

Unless you can change your CID like I Did.

With this RUU loaded the Enable_Oem_unlocking option shows up in the developer options menu.

Turing this on allows you to generate the unlock token.

When submitting the unlock token to htc dev it will pass.

The cid of this ruu is not blocked from being unlocked.

So then you will get the unlockcode.bin from htc dev and easily unlock your bootloader.

The problem is you can't flash this ruu.

So by taking this RUU and making a rom flashable in qdl9008 mode we might be able to get it on your device.

Provided we can flash in QDL9008 mode.

So there you have it.

The answer to unlocking the bootloader.

And with some luck. A way to flash it to locked devices.
[HTC Desire 526] BigCountry907:
Detailed Process

waring-----warning------if not completed properly this COULD turn your device into a paperweight forever

waring-----warning-----by following these steps you agree to assume responsibility for any damage to your device.
[HTC Desire 526] BigCountry907:
Step 1 PREPARE THE DEVICE

Step 1) Preparing the device.

The first thing you need to do is UNLOCK THE BOOT LOADER. ( We need to flash TWRP )

After the boot loader is unlocked we want the freshest EMMC backup we can get.

Here is how we will accomplish that.

#1 ) Flash the RUU----(for non 526 device flash the factory firmware)

#2 ) (IF THE BOOT-LOADER IS LOCKED YOU MUST UNLOCK IT NOW)

#3 ) Flash the RUU AGAIN --->>> WITH THE BOOT LOADER UNLOCKED

#4 ) WHEN THE RUU IS FINISHED HIT THE POWER BUTTON TO POWER OFF THE DEVICE

#5 ) DO NOT POWER THE DEVICE ON. ( DO NOT BOOT IT TO SYSTEM AT ALL )

#6 ) THIS MEANS APPS ARE NOT INITIALIZED AND INITIAL SETUP HAS NOT BEEN COMPLETED

#7) The device is currently in the newly flashed state ( NEVER TURNED ON )

#7) Now we can continue and get a as flashed backup ( NEVER TURNED ON ) :cool:

I cant stress enough the NEVER TURNED ON PART. <<<<------ Must Follow:confused:
[HTC Desire 526] BigCountry907:
Template Rom

Ok so this will be a whole lot easier if we have a template rom to follow as we build our rom. We are creating nearly the same exact thing. The best part about this rom is it is built to flash a few different ways. Including with QDL9008 mode. This rom is specifically for the msm8909 chipset and nearly the exact same release that is currently on our device.

Perfect :D

It gets even better. I guess Longcheer releases all the source files with there updates.

This is exactly what we have here. We have everything you would have after compiling the rom from source.

And everything you would have if you built all the Qualcomm Images as well. This is the full meal deal.

Every last file is there and all of the tools you need to package flashable roms, ota, updates.

Even better this is a user-debug version.

Even More Better its only signed by Qualcomm Test Keys. And the Keys are included. :cowboy:

So this thing is the cream of the crop. And fully compatible with our device.

We can cherry-pick what we want and use it on the Desire 526..

In order to complete our project we need certain qualcomm tools.

They are included in this PUBLICLY RELEASED Official Update From Longcheer.

That means we have a legitimate way of having these tools that is not in violation of any license. (ITS A PUBLIC RELEASE :silly:)

Make sure you look inside every folder and remember where things are.

This is a msm8909 developers goldmine. I will reference this rom a lot in the future.

Unfortunately Need Rom will require you register. But it's free.

I will try to upload this somewhere.

DOWNLOAD PAGE

http://www.needrom.com/download/longcheer-l6350/

Longcheer Website.

http://www.longcheer.net/index_en.aspx

The best place in the world to get Qualcomm Proprietary Manuals and Proprietary Tools Legitimately from Qualcomm.

https://developer.qualcomm.com/hardware/dragonboard-410c/tools

Most all of the msm8916 manuals apply to the MSM8909.

Even some of the source code is the same.

I just wanted to share the LEGITIMATE Public Sources. It is legit to do this and have these tools.
[HTC Desire 526] BigCountry907:
Backups From The backup exercise

Since I know most of you cant flash TWRP and might have a hard time decrypting the RUU.

I am posting the backups that were generated in the instructional post.

This way you can still follow along with this project if you like.

The full EMMC as 1 image.

http://www.mediafire.com/file/8nkk4qw6ymz8p11/526-emmc.zip

The separate partition images.

http://www.mediafire.com/file/5cspbcg6sky6bw9/pull.zip

The decrypted RUU.

http://www.mediafire.com/file/k4w9ya0uli39ky8/ROM-decrypted.zip

Remember to get the template rom posted previously. You need the tools.

Right now I am working on the easiest methods to get the GPT Partition Table and create the partition.xml

On a good note I successfully flashed the Template Rom Image to a SD-Card.:highfive:

This is good because we have the full emmc backup.

We have the ruu and device backup partitions needed to recreate the full EMMC image.

We can now create the FULL EMMC Image using the tools.

Then we can compare the created EMMC image against the Backup EMMC image.

If they are Identical.....were ready to flash the device. :cool:

Soon as we get over the GPT hurdle it's smooth Sailing.:eek:
[HTC Desire 526] BigCountry907:
Getting over the GPT Hurdle

Download the attached pdf presentation for reference. ( or get it from the link below )

Start at slide 26

Complied list of tools/scripts/resources for MBR/GPT analysis

http://www.jonrajewski.com/resources/

In the “Speaker Presentations” folder you will find

Evidence Files

MBR/GPT Resource

Presentation

Review the presentation so you have an Idea of what we are looking at.

This way you will be able to understand what we are doing and how we are doing it.

Then you will be ready. :D
[HTC Desire 526] BigCountry907:
Getting the GPT Table and Translating it.

We have already done a lot of work I know.

But there is much more to come. And unfortunately it's a little deep. :D

If you have the above directory structure just follow my instructions here.

#1 Get the GPT Table

Lucky for us we have 2 places we can get the GPT Table.

Coincidently the gpt table is a part of the ruu if you look here it is.

~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/gpt_main_8g.img

Lets copy that file to the Get-GPT_Info folder.

cp -rf ~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/gpt_main_8g.img ~/Desktop/526-Completed/Get-GPT_Info/gpt_main_8g.img

Cool :cool: That was easy. NO NO unfortunately not.

The question is " IS the gpt_main_8g.img Identical to the GPT on my Device" :confused:

"If you are running the ruu posted before on the device now....Maybe" :good:

Lets find out.

Obviously the best place we can get the GPT info is from the GPT Table on the device.

But...But..... :crying:

The commands we need to use don't work well on the device. So how are we gonna do this?

Use Linux To get the GPT from the EMMC Backup Image File

Yes, the dd copy of the device EMMC that we made is a Block by Block copy.

This means it is a Identical clone of the memory on the device.

Luckily the GPT table is the first 17407 bytes of the image.

Run this command to copy the partition table from the device backup image we created before.

dd if=~/Desktop/526-Completed/A13-Backup/EMMC-Image/526-EMMC-Complete.img of=~/Desktop/526-Completed/Get-GPT_Info/526-EMMC-GPT.bin bs=1 count=17407

Now we have 2 complete partition tables for our device.

You can find them here.

~/Desktop/526-Completed/Get-GPT_Info/gpt_main_8g.img
~/Desktop/526-Completed/Get-GPT_Info/526-EMMC-GPT.bin

:laugh: Now What
[HTC Desire 526] BigCountry907:
Preparing to generate the partition.xml

Download The MAGICK!! :D

I decided the easiest way to make a partition.xml file would be with an Open Office Spreadsheet.

It is easy to edit and you can see everything you have in one place visually. ( Especially nice for comparing the original files and new files)

A very effective way to check your work.

This only requires copy and paste skills.

You all should be able to handle that.

The input required is 2 files that we made.

~/Desktop/526-Completed/Get-GPT_Info/Partitions.txt
~/Desktop/526-Completed/Get-GPT_Info/526-EMMC-GPT-read2.txt

And one file from the ruu which is optional.

~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/partition_info

The spreadsheet for the desire 526 is complete.

Simply copy and paste the partition xml output section to the appropriate place in the partition.xml. :highfive:

There is a blank spreadsheet that you can use as a template.

To do your own work and to check the work we have done.

GPT-Translator is the spreadsheet you want to use.

Example_desire-526_GPT Alternate.ods is another way to do the same thing.

GPT-Translator is tested in action and confirmed working.

If you want to use it for a different device just keep in mind it is configured for the desire 526.

So it is set up to read around 68 partitions.

If your device has less than 68 you will not have to change anything.

If your device is over 68 partitions you will need to add more cells.

Download the spreadsheets and put them into the folder

~/Desktop/526-Completed/Get-GPT_Info

The spreadsheets are attached to this post.

Have fun now that you can make the partition.xml.

I will show you how to use the spreadsheet in the next post.

AWESOME.

PLEASE HIT THE THANK YOU BUTTON. I SPEND HOURS AND HOURS ON THIS STUFF. FREE OF CHARGE :cowboy:
[HTC Desire 526] BigCountry907:
Continuation of last post

Lets finish up here. Im getting anxious.

Take the column AD and click on the side of it wile dragging the mouse to widen it up.

Give the top a name. I called it No. Blocks in kb Cumulative.

In cell AD4 type 16. Thats the block size of the GPT Table.

In cell AD5 put in this formula.

=AF5+AD4

In cell AH6 put this formula.

=(((AD6*1024)/512)+1)

Your generator should now look like this.

All we need to do now is copy the formulas down through the rest of the cells.

Click cell AD5 then right click then copy

Scroll down and hold shift and click cell AD69

Right click PASTE ONLY and pick FORMULAS

Click cell AH6 then right click then copy

Scroll down and hold shift and click cell AH69

Right click PASTE ONLY and pick FORMULAS

Pretty cool how that works. :good:

Your generator should look like this now.

Finally we are done with the data.

All that is left is to double check the boot flags, and readonly flags.

If any are "true" the change it in the area where the size data is at. Top Right Side.

I showed you where they are earlier.

And we need to go over the file names.

This is where we get to cherry pick things in to our new rom.

So now you know. Spreadsheets really can be useful. :cowboy:

I attached a copy of my updated generator.

It is filled in right up to where we are. :laugh::laugh:
[HTC Desire 526] BigCountry907:
Partition No. 2 pg1fs

The pg1fs partition is certainly and important one.

It controls some of the security feastures

Lets take a look.

The partition Attributes is set to all zeros

So we know that the READ ONLY and BOOT FLAG bot will be set to False.

There is no file for it in the RUU.

Lets take a look at our backup.

hexdump -C -v ~/Desktop/526-Completed/A13-Backup/pull/pg1fs.dd > ~/Desktop/526-Completed/Partition-Info/pg1fs.txt

Now open up the text file and take a look.

This partition contains very little data.

Most of it is zeroed out.

We are going to open this partition backup in a hex editor for easier searching. (~/Desktop/526-Completed/A13-Backup/pull/pg1fs.dd)

#1 TOP OF THE FILE

#2 A security flag

#4 The last entry in the file that is not zero

This pg1fs dump is from my s-off device so we want to use these settings

This is going to be another post flash partition.

I need a locked device pg1fs dump and we can compare the difference.

If you pg1fs is different than this you want to edit it to be the same as my s-off dump.

Lets go adjust the Generator Spreadsheet For Partition 2

Set the boot flag ( false )

Set the read only flag ( false )

set the filename to ""

All the cells for pg1fs I have highlighted green.

So I know I checked all that data and set the flags.

A LITTLE MORE ABOUT THE SECURITY FLAGS

https://xdaforums.com/htc-10/help/htc-10-bootloader-lock-flag-t3380245

https://translate.google.com/transl....cc/archive/index.php/t-1276.html&prev=search

A WARNING FOR MTK BASED DEVICES EVEN THOUGH WE ARE USING A QUALCOMM DEVICE SOME INFO MIGHT APPLY.

https://xdaforums.com/one-m9/one-m9-general/beware-htc-one-m9-m9e-e9-e9-users-t3550726

WE NEED TO DO MORE RESEARCH ABOUT PG1FS BEFORE WE FLASH THE DEVICE :mad::mad:

Were about ready for the next partition. :fingers-crossed:
[HTC Desire 526] BigCountry907:
Why these partitions dont get Erased by the RUU

Are wondering why the RUU does not have files for some of these partitions.

Or wondering why these partitions don't get erased.

Lets Take a look at what the RUU is doing.

Open this file that is in the RUU in a text editor and take a look.

~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/android-info.txt

Cool the instructions for the RUU when it loads.

This makes our job easier and answers some questions.

#1 If the partition isn't listed here it's not getting flashed with a file or erased. (IT IS LEFT AS IT WAS BEFORE THE RUU FLASH)

#2 In the RUU this means erase the partition and Flash the file in the RUU. (WE now Know all of these partitions will have a filename.)

eraseonflash: system
eraseonflash: userdata
eraseonflash: aboot
eraseonflash: boot
eraseonflash: hosd
eraseonflash: radio
eraseonflash: recovery
eraseonflash: rpm
eraseonflash: sbl1
eraseonflash: tz
eraseonflash: sp1
eraseonflash: cota

#3 If the device is S-OFF then erase the FRP partition.

eraseonsoff: frp

This partition is what makes you have to enter your google account data after a FACTORY RESET.

In case someone steals your device.

We will just erase it weather you are S-on or S-off.

#3 Erase these partitions no matter what every time you flash a RUU.

erasepartition: cache
erasepartition: extra
erasepartition: ssd
erasepartition: carrier

So now we can quickly set the Read Only / Boot flags and we know that we are erasing the partitions so there will be NO FILENAME.

Here is the breakdown.

Check the partition information in the GENERATOR and look for any read only flags or boot flags for each erased partition.

All READ ONLY flags are "false"

ALL BOOT flags are "false"

frp = NO Filename

cache = NO Filename

extra = NO Filename

ssd = NO Filename

carrier = NO Filename

Cool we figured out why some data never gets Erased by the RUU.

And we now can go set the data in the generator for 5 more partitions.

Lets do that.........

The green highlighted cells have been set and checked. ( WERE DONE WITH THEM ) :laugh:

We are starting to see a lot more green.

But mannnnnnn we have a long way to go. :crying:

Don't worry many will be simple and fast. :cowboy:

The ones that are going to erase the partition then flash a file like SYSTEM we will look at individually. :crying:

At least we just knocked out 5 partitions in one swoop. :eek:
[HTC Desire 526] BigCountry907:
Ok an Important Lesson

Well I have a good example of why we check things so much.

Why we highlight the checked partitions in green.

I was looking for rfg_3 partition so i could check the flags and highlight it in green.

I could not find it anywhere.

Looking at the xml output I found this.

Looking at the calculation section I find.

Cell AO19 needs the formula changed to =AB187

Cell AO20 needs the formula changed to =AB195

That fixes the problem. Your generator should now look like this.

This is exactly why we check each partition. It takes time but it'll save your skin. :rolleyes:
[HTC Desire 526] BigCountry907:
The mfg partition

Next on the list is the mfg partition.

And in the Hex Dump

Because I was curious I pulled out some of my other tools to get some more device info.

This is stuff we need to know as well. I'm not going to go into detail.

Version info :
------------
Compilation date : Jul 7 2015
Compilation time : 16:19:24
Release date : Jun 30 2015
Release time : 11:00:00
Version directory : 8909.gen
SCM : 58
Mobile common air interface revision : 6
Manufacturer's mobile model : 0xFF
Manufacturer's mobile firmware revision (software ver) : 0x64
Slot cycle index : 2
MSM Ver : 9.96
ESN : 80FF8788
IMEI :990006302017289
IMSI: 000000000000000
Public Land Mobile Network (PLMN) :000000
Location Area Code (LAC) :0000
Cell ID :0000
WCDMA
IMEI :990006302017289
IMSI: 311480246275373
Diag Version 8
Mobile Model ID 0000100C
MSM Hardware Version 00009601
MSM Hardware Version Format 1
Version Strings M.JO.1.0.4.2-00008

I would believe you will find some of this data in this partition.

I'm not going to waste a bunch of time finding it right now.

I just need to remember where I can find it.

For now we know what we need to know.

Partition Settings For the Generator

Readonly = false

Boot = false

filename = none

THIS PARTITION WILL NEED FLASHED BACK BEFORE A FULL BOOT

Go set the generator. and set the data.

I have marked a few cells in orange.

Including this one. Because we need to remember to put this data back.

:cowboy:
[HTC Desire 526] BigCountry907:
A quick Leap Forward

I have been pondering the best way to flash our built rom.

I just found a wonderful tool. From Qualcomm 96 boards.

Thanks To this Thread.

https://xdaforums.com/windows-10-mobile/create-rawprogram0-xml-ffu-file-extract-t3385201

We will be using this tool soon.

:cowboy:

:cowboy:
[HTC Desire 526] BigCountry907:
Whats this Hash your talking about

Goodness

Look what it led to already.

c:\>emmcdl -p COM9 -info
Version 2.15
SerialNumber: 0x04465077
MSM_HW_ID: 0x009600e1
OEM_PK_HASH: 0xba2102da99c924058c758fa9f4250847c92cabde17fdcef01d4daff8df5d6753
SBL SW Version: 0x00000000
Status: 0 The operation completed successfully.

:confused::confused:

OEM_PK_HASH: 0xba2102da99c924058c758fa9f4250847c92cabde17fdcef01d4daff8df5d6753

:confused::confused:

I just saw something related to that back a post or two.

Interesting Indded :cowboy:
[HTC Desire 526] BigCountry907:
Getting back on track Partition # 10 SP1

This one is pretty easy.

This should be the splash image.

Both the partition partition backup from our pull and the original splash1.nb0 in the ruu are the same. :laugh:

Heres our data.

Info to set the Generator.

Read Only Flag "false"

Boot Flag "False"

Filename splash1.nb0

Go set the info and highlight the cells green. :cowboy:

We are getting close now. There are not too many partitions left to deal with.

:cowboy:
[HTC Desire 526] BigCountry907:
The leftover RFG Partitions

Lets fill in some white space.

There a 3 rfg partitions left.

rfg_1.img & rfg_2.img are in our RUU.

I checked them for any difference with the pulled data from my device.

Check them like this.

hexdump -C ~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/rfg_1.img > ~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/rfg_1.txt
hexdump -C ~/Desktop/526-Completed/A13-Backup/pull/rfg_1.img > ~/Desktop/526-Completed/A13-Backup/pull/rfg_1.txt
diff ~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/rfg_1.txt ~/Desktop/526-Completed/A13-Backup/pull/rfg_1.txt

hexdump -C ~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/rfg_2.img > ~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/rfg_2.txt
hexdump -C ~/Desktop/526-Completed/A13-Backup/pull/rfg_2.img > ~/Desktop/526-Completed/A13-Backup/pull/rfg_2.txt
diff ~/Desktop/526-Completed/A13-Backup/pull/rfg_2.img ~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/rfg_2.txt

They are the same so we will use the RUU files since they came from the factory.

Pay attention to rfg_0 partition

The partition is not zero.

And It contains NV Items for your specific device. ( Later we will look to see which NV Items it refers to)

You will want to use the rfg_0.dd backup from your device.

hexdump -C ~/Desktop/526-Completed/A13-Backup/pull/Rfg_0.dd

So now we can configure these 3 partitions in the generator.

Filenames will be.

rfg_1.bin

rfg2.bin

Readonly is fasle for all

Boot Flag is False

Remember we will need to flash rfg_0.dd back before we boot.
[HTC Desire 526] BigCountry907:
The WCNSS Partition

I want to try and get us through the rest of the partitions today.

I'm eager to get to the building / flashing part and I'm sure you are too.

So hold on to your hats........lets do this. :cowboy:

WCNSS is pretty easy for now.

This image is supplied by qualcomm compiled so HTC does not compile it.

This means we can simply use the wcnss image from the RUU.

Down the road after we have a booting build we might consider taking a deeper look here.

For now set the generator.

Readonly Flag = false

Boot Flag = false

filename = wcnss.img

You can find the file here.

~/Desktop/526-Completed/A13-Backup/RUU/ROM/firmware/wcnss.img

Last our generator should look like this now.

That was as easy as it gets. Lets move on. :good::cowboy:

Next we are going to review the partitions you see above that are still in white.

fsg

Modem_st1

modem_st2