yashsingh1/xdaforums huggingface dataset:
[Android Q&A, Help & Troubleshooting] minotauri:
I was successful in creating a recovery (twrp) for this device.

https://www.antdroid.net/2019/02/pioneer-xdp-300r-root-twrp-recovery.html?m=1

also created a XDA thread here: https://xdaforums.com/android/development/pioneer-xdp-300r-digital-audio-player-t3902949

Feel free to PM me if you have questions or we can work it through here
[Android Q&A, Help & Troubleshooting] mythunit:
Hi,

I have the same problem. I am able to get qdload 9008 state from here now. However, after unplug and followed grogcw's hints, the device is not recognized again. Also, the device hasn't ennobled debug mode before too. All the adb and fastboot commands return no device.

Hopefully can get more help here.

---------- Post added 28th February 2019 at 12:16 AM ---------- Previous post was 27th February 2019 at 11:58 PM ----------

Is there anyway to flash TWRP and so with QDLoader?
[Android Q&A, Help & Troubleshooting] minotauri:
I believe he is on vacation for another week and half. If you haven't enabled the bootloader unlock option within Android, then my recovery method may not work since it may not let you flash the recovery.

You can try to fastboot boot recovery.img though
[Android Q&A, Help & Troubleshooting] grogcw:
Hi ! I'm back from vacation, but I still haven't my device around.

Any user willing to test are welcome to reply or PM me !

Let's have all the bricked units working, shall we :)
[Android Q&A, Help & Troubleshooting] mythunit:
How can we get started? :)
[Android Q&A, Help & Troubleshooting] grogcw:
We actually did start probing stuff around, and we are missing something in the "full restoration process", so we're stuck for now.

Sahara protocol still is a mystery for us, and we can't get pass an error.

I think we don't actually have the right programmer_firehose.mbn for our device, but if it's not this, I'm basically out of ideas. (we might need an "QFIL expert" on this)

I still don't have my device around and feeling dumb about this.

Anyway, all the files and tools required to try probing around are in my gdrive and I can PM the link (as I still can't post it right away) if anyone is interested.

Thanks for trying to help or actually help everyone !

Cheers !
[Android Q&A, Help & Troubleshooting] ralf05:
Hello,

I try to root my xdp-300r,after reboot have bootloop result.

I don't know how to reflash systme.img.

can suggest any repair plan,thank you~
[Android Q&A, Help & Troubleshooting] dantuko:
Was able to unbrick device. Here are the steps TO DO IT

i was able to unbrick my device
[Android Q&A, Help & Troubleshooting] dantuko:
I have a rooted xdp300r rooted

It was bricked and I was able to fix it and root it
[Android Q&A, Help & Troubleshooting] stefan999:
Help !!!

Hello

Gentlemen, help me! I've broken my device

I hit the whole system on my xdp300r. What can I do in this case ??? Only I can turn on TWRP and nothing more.

leszekm216@wp.pl

---------- Post added at 05:55 PM ---------- Previous post was at 05:51 PM ----------
[Android Q&A, Help & Troubleshooting] stefan999:
Help !!!

Hello

Could I ask you for a backup file? Unfortunately, I lost the system:(Thank you very much.

Greetings.

leszekm216@wp.pl
[Android Q&A, Help & Troubleshooting] dantuko:
I UPLOADED THE BACKUP FILE TO MY GOOGLE DRIVE

https://drive.google.com/drive/folders/1vM7Z12w3CsbutSr54lY4tTdzyN1jurpp?usp=sharing
[Android Q&A, Help & Troubleshooting] dantuko:
Here is a few items to note about the image:

You must have twrp installed and accessible in order to restore this image.

First time booting after the restore will take a long time, so have a cup of coffee and let it do it's thing.

Every time you boot the OS will perform application optimization, it doesn't bother me so I have not even looked into it.

After you boot connect to your WIFI and open Google Play to set up your account

If you want to use Viper4Android, download and install busybox, then open settings, go to apps and disable Musicfx, then reboot and turn Viper4Android on.

Good luck
[Android Q&A, Help & Troubleshooting] stefan999:
Thanks for answer and sharing your files. Unfortunately, there is some error when trying to restore in TWRP.

I packed all the items from your disk in ZIP and downloaded to the SD card .

I'm getting an error about the content: no MD5 file found Failed to map file'/external_sdxxxxxx-Full BACKUP.zip'

Error instaling zip file

. Do you have an idea why this is happening?
[Android Q&A, Help & Troubleshooting] dantuko:
twrp settings

You need to change settings in twrp not to check md5 checksum, if it doesn't work then i'll create one with checksum.
[Android Q&A, Help & Troubleshooting] stefan999:
I've done this before and unfortunately it also did not help, I still get the installation error
[Android Q&A, Help & Troubleshooting] stefan999:
Onkyo dp-x1 rom on Pioneer xdp300r.

Hello

I found on the Chinese site an older version of software for onkyo dp-x1 reworked by someone from root and I managed to upload it. It worked my dap came back to life. Then the system automatically downloaded the latest software version, I made root again and everything works as it should. the difference is now the yellow font color, the onkyo player and the name in the system call dp-x1. The rest is exactly the same as the pioneer.

If someone wants I can insert a link to the page with this software. There are two versions of this software 1.26 and 1.28.

I installed the first one and everything worked without a problem.

Then you can automatically download the latest version.

greetings
[Android Q&A, Help & Troubleshooting] KWOKSFUNG:
Hi, could u give me a link to download this?

And in what method u flashed the original firmware?

Thanks
[Android Q&A, Help & Troubleshooting] grogcw:
Hi !

Links are probably these ones, but they're not tested, so be "careful" here.

Onkyo DP-X1 Rom v1.26 OTA

Onkyo DP-X1 Rom v1.28 OTA

Onkyo DP-X1 Rom v1.37 OTA

Too bad we don't have at least the last official OTA update for the XDP-300R...

Edit : a dumb URL format for the XDP-300R would be

https://android.googleapis.com/packages/ota/pioneer_fuzin2r32_fuzin2r32/<hash>.signed-Pioneer_32G-ota_update.zip

...so, maybe we're only missing the hash here...?
[Android Q&A, Help & Troubleshooting] grogcw:
Hi ! I managed to snatch a Service Manual for the DP-X1, and some fastboot commands are interesting :

fastboot oem data:r DestID

To which my XDP-300R answered " 1 ", and

fastboot oem data:r ModelID

... to which my XDP-300R also answered " 1 ".

(Region code is 1 for Japan, 2 for US, 3 for Europe, and I suppose that model ID is 1 for XDP-300R and 2 for XD-P1 for my original Pioneer ROM, so the good parameter could be 2 for a Onkyo ROM)

You can try to read them by using the same commands, and if values differ, change them by :

fastboot oem data:w DestID:1

and of course,

fastboot oem data:w ModelID:1

...thus maybe changing your region to japan, and model to XDP-300R

Hope this is going to be helpful in any way.
[Android Q&A, Help & Troubleshooting] grogcw:
Hi all !

After some digging around, I've found other fastboot commands, and I will try to explain how they work.

(note that all commands are issued with this fashion : fastboot <command>)

boot <boot/recovery> <file>

Boot the device to a locally stored image. (eg : fastboot boot recovery.img)​

boot-recovery

Boot the device's recovery image.​

flash <image> <file>

Writes the specified image to the specified destination. (eg : fastboot flash recovery recovery.img)​

erase <image>

Erases the specified destination. (eg : fastboot erase userdata)

CAUTION !! There's no do overs if your bootloader is locked.​

continue

Resumes booting processus, exits fastboot mode.​

reboot

Self explainatory...​

reboot-bootloader

Reboot device to Bootloader (fastboot).​

oem unlock <force>

Unlocks Bootloader for flashing purposes.

NOTE : this command is "locked" by default and won't actually work unless you unlock your bootloader while the device is still working properly thru Developper Options. If you're in a bootloop state, you HAVE to force it.​

oem lock

Locks Bootloader for flashing purposes.

NOTE : this command works, you may NEVER type this !​

oem device-info

Outputs bootloader state.

Typical Ouput of an unlocked device :

(bootloader) Device tampered: false
(bootloader) Device unlocked: true
(bootloader) FRP unlock: true
(bootloader) Charger screen enabled: true
OKAY [ 0.006s]

getvar <argument>

Displays bootloader variables. (eg : fastboot getvar all)​

download <argument>

I'm not sure right now, maybe kindo adb push file ?​

dump <argument>

Not sure either, maybe kindo adb pull, but for system images ?​

read <argument>

Last command where I'm not sure...​

oem adb_enable <1/0>

(Volatile) Switches ADB on or off (I don't know how to access it yet)​

oem oemdata

Displays infos about the model. You can read/write specific values with others commands, see below.

Typical ouptut :

(bootloader) ModelID: 1
(bootloader) DestID: 1
(bootloader) PSN: UB7ZM4XXXX
(bootloader) SSN: QLCI0000XXXX
(bootloader) BTAddr: 7C:D3:0A:0F:XX:XX
(bootloader) WIFIAddr: 7C:D3:0A:0F:XX:XX
OKAY [ 0.009s]

oem data:r <argument>

Read OEM specific data.

Arguments list :​

ModelID : Switch between Onkyo and Pioneer brands (On Pioneer ROM, 1 is for Pioneer, 2 is for Onkyo)

DestID : Switch between different regions. Region coding is : 1 - Japan, 2 - USA, 3 - Europe)

PSN : Production Serial Number

SSN : Series Serial Number

BTAddr : Bluetooth MAC Address

WIFIAddr : Wifi MAC Address

AdbEnable (read-only via oem data:w) : Is ADB enabled (I didn't figured when ADB enables, maybe while charging ?)

DebugLevel_Eng : Debug level for engineers, I don't know where logs are shown / saved

DebugLevel_Usr : Debug level for users, I don't know where logs are shown / saved

oem data:w <argument>:<value>

Writes a a value based on a specific argument, see above.

Note that there's a colon and no space between the argument and the value.​

I hope all of this makes sense and will help debunking things so anyone can at last debrick a bootlocked, non booting device.
[Android Q&A, Help & Troubleshooting] Yuhma_Seo2203:
regards, what method did you use to install the dp-x1 firmware on the xdp300, thanks in advance
[Android Q&A, Help & Troubleshooting] grogcw:
Damn, I've lost my unlocked bit by tampering my device testing things (don't know exactly what ?).

(bootloader)	Device tampered: true
(bootloader)	Device unlocked: false
(bootloader)	FRP unlock: true
(bootloader)	Charger screen enabled: true

Hopefully, I'm still able to start it via fastboot boot original_boot.img, but this is getting bad....

We need dev/hacker help here !
[Android Q&A, Help & Troubleshooting] ineedroot69:
wait you bootloop without unlocking bootloader? thats amazing hahaha
[Android Q&A, Help & Troubleshooting] flwjyq:
Now I can only access port 9008. Is there any help?

Now I can only access port 9008. Is there any help?
[Android Q&A, Help & Troubleshooting] grogcw:
At this stage, we're currently stuck unfortunately.

We don't have any help from the QPST community, we lack some informations, and mostly we lack Pioneer / Onkyo's support, while we know they have the rom bundled in a zip file with adb-fastboot tools.

Sorry for carrying such bad news for the moment...

Can you elaborate why you can only boot in EDL mode ? Maybe there's another fix ?

You can PM me if you want.

Cheers !
[Android Q&A, Help & Troubleshooting] grogcw:
Some news :

After leaving the device as a bootlooping paperweight for 2-3 months, I picked it up, plugged it with usb, fastboot mode, and did a :

fastboot boot boot.img

... resulting the device powering up in charge mode. I've let it charge all the way, then booted it up once again with the same command : it worked just fine (boot needed to be tethered tho).

(I think the tamperer device bit is held in RAM, so as my device was fully discharged, maybe the bit got lost. It's only an assumption there.)

I then disabled and re-enabled the Unlock OEM in the dev menu, rebooted the device and successfully flashed it by :

fastboot oem unlock
fastboot flash boot boot.img

Now my device is fixed.

If anyone wants to try this to hopefully fix a bootlooping device, you can by grabbing the boot.img of a working device via the Gdrive link.

Don't hesitate to reply, this might be something.

Cheers !
[Android Q&A, Help & Troubleshooting] Alexsampayo:
Any help

Hello, first an apology since English is not my mother tongue, I have a problem with an xdp 300 r that I acquired used, one day when turning it on I no longer pass the screen of powered by Android, reading its very useful post try to bring it to life, however, I cannot do it because I never remove the oem lock, I would like to know if they have managed to solve a situation like this or if I can resign myself to having a paperweight
[Android Q&A, Help & Troubleshooting] grogcw:
"Powered by android" screen could be either be a faulty boot.img or a faulty non-hlos.img.

You can try to fastboot boot good_boot.img (file linked in my google drive, a few pages before this post), and if succes, oem unlock, then fastboot flash boot.img.

Keep me posted :)
[Android Q&A, Help & Troubleshooting] Alexsampayo:
Fail try

when trying to make the flash bootloader it says "FAILED (remote: device is locked. Cannot flash images) my problem at the beginning was very similar to what you put in your original post, with the difference that my dap brick alone, and it was done a brick that was not responding when connected to the computer, following the steps they have put in this post I managed to make the bootloader recognize it but when trying to reset the operating system it always sends me that message
[Android Q&A, Help & Troubleshooting] grogcw:
Do NOT do fastboot flash, but fastboot BOOT :)
[Android Q&A, Help & Troubleshooting] Alexsampayo:
Continuo

ready, I made the boot but now the fastboot stopped recognizing the device again, however the pc does recognize it as an android device, from here I don't know what else to do, sorry if I ask obvious questions but I'm totally new to this
[Android Q&A, Help & Troubleshooting] grogcw:
So, your device booted, right ?

If so, yes, it's normal for your pc not to see it as a fastboot device because it lefted that mode.

So, now, you have to enable developper mode (google how to), and inside it, enable oem unlock.

Once done, power off your device, then power it on in fastboot mode and make :

Fastboot oem unlock

(Should return ok, then...)

Fastboot flash boot good_boot.img

Reboot the device and it should be fixed !
[Android Q&A, Help & Troubleshooting] Alexsampayo:
some detail is wrong

the device does not start, although in theory the boot was done correctly according to fastboot, the dap remains with the penguin symbol and if I restart it manually it simply stays on the Android screen
[Android Q&A, Help & Troubleshooting] grogcw:
Damn. Ok. Did you try multiples times or just once ?

What did you do to have it in this state (possibly nothing as I had this bug...) ?
[Android Q&A, Help & Troubleshooting] Alexsampayo:
I have tried several times and the result does not change, I will tell you roughly what happened with this dap, I acquired it at a fairly low price still being used (now I am beginning to suspect) and it worked well for months, however months ago and a half when I started the quarantine I had a very hectic week and I forgot to charge it for several days until it completely drains the battery, I put it to charge and when I try to turn it on I no longer pass the Android screen, my first instinct was to connect it to the pc but did not recognize it and panic, however I had already had a small lock on a cell phone and decided to access the recovery mode and did not succeed either, I followed part of your thread to download the processor drivers and little by little I have brought it to the point where it already allows me to enter fastboot mode and recovery, however this mode does not perform any action, the recovery mode shows me the message: "E: cant Open / dev / block / platform / msm_sdcc.1 / by-name / m isc (permission denied) I don't know if that can tell you what happens to my dap
[Android Q&A, Help & Troubleshooting] grogcw:
Ok. If you can enter recovery, did you try to clear user data and cache ? (Just ignore the warning, it's normal)
[Android Q&A, Help & Troubleshooting] Alexsampayo:
I already tried it and according to the dap it does it however in the end it launches the message that I told you and when you restart the device it is as if you had not done anything
[Android Q&A, Help & Troubleshooting] grogcw:
I'm confident that it does what it's told, it's just that there's a problem occuring during boot phase.

Well, unless you get the oem to unlock and re-flash boot / aboot, you're basically stuck (welcome to the community).

Keep expecting, there might be a solution, I (or any hacker with will and free time) just have to figure it out.
[Android Q&A, Help & Troubleshooting] Alexsampayo:
Thank you very much for your time, and the help you gave me will be pending in case someone manages to solve the problem, I hope I do not have to resort to Pioneer technical service because at least here in Mexico City the quarantine will be very long and i wish i could get my dap back sooner.

regards
[Android Q&A, Help & Troubleshooting] grogcw:
....and not to brag about it, but I already contacted every pioneer support, even at high level in japan's headquarters, and either they don't know the product (or third party repair company doesn't), or they don't want to upload the original rom, so....you can relax on this particular subject, job has already been done, no-one will help.
[Android Q&A, Help & Troubleshooting] gavroche33:
hi there,

I have 300R locked and when I try unlock oem I got DENIED error message.

Is there any way to unlock my player?

Daniel
[Android Q&A, Help & Troubleshooting] grogcw:
Hi !

The only way to unlock OEM that I know (at that time) is by accessing the developper's settings in Android, so if your device is bootable, you can proceed there.

We don't have the magic key to enable it via fastboot as for now, and probably never will unless we fully reverse engineer the whole aboot/boot.img.

You can try to do as #32 and boot from a "distant" know good boot.img and then unlock your bootloader if your device won't start.

Hope that helps ! :)

Cheers !

Edit : You can unlock it by force, see #51
[Android Q&A, Help & Troubleshooting] grogcw:
I write this post as I'm currently investigating this path...

I recently banged my head against my device and by decompiling/extracting stuff I've found that one of the device's recovery key is also in the aboot.img as a certificate.

That means that if I don't mis-read everything and that this theory is right, I COULD be able to make a recovery flashable zip, signed by the original certificate, thus being able to write to /cache, /data, /sdcard, /boot and /recovey.

/system is read-only according to the recovery fstab file, but if I can write to boot and recovery, it's a little step to have a flashable TWRP recovery, which can write to /system, and we already have stock images of it.

The procedure for a bricked device could then be :

- Boot to Recovey (Power + Next Track)
- Flash the signed Boot+TWRP signed zip
- Reboot to TWRP
- Write a stock System backup
- Reboot to System
- Use developers options to unlock the Bootloader
- Fastboot flash sotck recovery.img

...resulting a stock and OEM unlocked device.

If anyone is willing to assist me, I'd be glad as I quite don't fully understand how to make a flashable zip at this time.

Don't loose hope, and wish me luck !

Cheers !

-----------------------------------------------------------------------

Edit : the key is 2048 bits long, so no-one at the moment can crack it. Back to square 1.
[Android Q&A, Help & Troubleshooting] grogcw:
After yesterday fails on certificate's path, and with some more research, I've found that there's an adb enable command accessible via fastboot.

fastboot oem adb_enable 1
fastboot oem data:r AdbEnable //to chack that the variable is set (should be 1)

Now, I don't know how adb is accessible, we'll have to figure this out, but if/when the device is accessible, it's also opened to privilege escalation via dirtycow (CVE-2016-5195).

I successfully built, run and escalated on my device while having adb enabled in system.

Now for the fun part : I'm looking a way to get SELinux to enforce or permissive and/or have a fully functional root in order to patch the aboot's partition bits to force OEM unlock (I already have the bits' address).

It may be a few days until I achieve this.

Cheers !
[Android Q&A, Help & Troubleshooting] grogcw:
Guys, I have THE SOLUTION (which is outrageously simple), 3 years after, even if I'm quite sure I tested this a long time ago...oh well...

In order to unlock your bootloader....YOU HAVE TO FORCE IT !

fastboot oem unlock force

then you can

fastboot oem device-info

to check if your device is unlocked.

The reply SHOULD be

(bootloader) Device unlocked: true
(bootloader) FRP unlock: false

...then...all you have to do is....

fastboot flash <partition> <image>

You might want to flash ABOOT, BOOT, SYSTEM and RECOVERY (STOCK or TWRP) partitions in order to recover the full usage of your device.

Examples :

Windows : fastboot.exe flash aboot C:\Users\<myname>\Desktop\aboot-dev_true-frp_true
MacOS : fastboot flash boot /Users/<myname>/Downloads/good_boot.img
Linux : fastboot flash system /home/<myname>/Downloads/system.ext4.win

That's it.

In order to have a fully unlocked device, when your device is repaired, GO to developper's options, enable OEM unlocking, reboot to fastboot mode and ask nicely...

fastboot oem unlock

Unless it doesn't work for you, I'm retiring of this thread and I'll try in a near future to port LineageOS with DACs support (don't quote me on that).

F to Pioneer and Onkyo for their ****ty support and policy on not releasing ROMs.

Cheers !

​
[Android Q&A, Help & Troubleshooting] lycailu:
Would you post your mod firmware for the XDP-300R?
[Android Q&A, Help & Troubleshooting] Xrev Undetect:
Need link carbon rom xperia go
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] zbanu:
anyone has the 6.0 ROM for Kaiser TYTNII so I can downgrade it to unlock SIM? I can't seem to find it...

many thanks
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] rdy2go:
Read xda-wiki for keiser - there are links to original WM 6.0 ROMs. You may also try Sleuth 1.2 (very good WM6 ROM).

Remember to flash radio.
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] zbanu:
Thanks, I'm searching for it on the forum but cannot seem to find a download link to the 6.0 rom
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] jarek91:
You didn't look at the Wiki then. I personally reworked the Cooked ROMs page and there is also the Stock ROMs page with links to all sorts of WM6.0 and WM6.1 ROMs.

There's my spoon feeding for today. Remember...the Wiki knows all...
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] zbanu:
lol many thanks man
[Xiaomi Poco F1 Questions & Answers] Ossmaradny:
Hey all

I have an issue with voice calls and top mic with Custom roms

I wish someone can help me

Thanks
[LG V40 Questions & Answers] Nelthalin:
I switched from my LG V30 to a V40 about 3 day's ago.

I like the things they improved on the phone like the camera's and the reflectiveness of the screen / min brightness.

The thing that i dont like is the color reproduction i just cant get it right. Web gives the best colors but they are washed out compared to the V30 on Cinema. Moving to Cinema colors are blown out of proportion.

Manual settings have the same issue. Saturation neutral is still to much. One step lower is slightly washed out.

When i think i got red on the right value for pictures compared to the V30 a white screen looks red. If i fix that pictures look to green.

What settings do you guy's use?
[LG V40 Questions & Answers] Einsteindks:
Left it on 'Auto'. Never one to over-obsess with minor issues. The display is good enough to do colors on its own.
[LG V40 Questions & Answers] twoxa:
Tried different ones Auto has been the best. It's a bit oversaturated but white point is good.