yashsingh1/xdaforums huggingface dataset:
[OnePlus 6T  Questions & Answers] FiWe20:
I tried "fastboot boot twrp.img" before but then the next issue comes up...

Sending 'boot.img' (31136 KB) OKAY [ 0.667s]

Booting FAILED (remote: 'unknown command')
[OnePlus 6T  Questions & Answers] Timmmmaaahh!:
Are you on Android 10? Because in that case this is expected behaviour or in sweet dev terms: by design. OOS Android 10 Beta 1 doesn't allow TWRP for some reason. You can only get it by fastboot flashing a patched boot image or via a Magisk flash. You also need some luck because in both cases it can fail miserably. On top of that, you need some old keymaster to be able to access any files. It's all a true joyride for now, lol...

---------- Post added at 02:18 PM ---------- Previous post was at 02:14 PM ----------

Wait, "fastboot boot twrp.img" gives you "Sending 'boot.img'"? That can't be. Enlighten us on version numbers first please.
[OnePlus 6T  Questions & Answers] FiWe20:
Its interesting because I managed to get TWRP working the first time and if I remember correctly it was via the "flash boot_a" command. And yes it was through the Open Beta version of Android 10. I think this whole "bootloader is unlocked" problem was caused after rebooting from twrp.

How do you fastboot flash a patched boot image if flashing a normal boot image cause errors? I really appreciate you taking your time on this.

---------

Fastboot version 29.0.4-587166
[OnePlus 6T  Questions & Answers] Timmmmaaahh!:
There could be many reasons; Android works in mysterious ways. The "bootloader is unlocked" screen shows the minute you.. well, unlock your bootloader (fastboot oem unlock) :p

The fact that it freezes is simply because it finds something to boot but it fails to do so, which could be either an OS or a recovery. I've been there as well but forcing a restart with power+volume buttons did fix it for me (different situation of course, it was months ago).

Trust me, experiencing these annoying situations is the best way to learn more about your device. Before you know it you'll be playing around with fastboot, adb, recoveries, ROMs, kernels and mods like a pro.
[OnePlus 6T  Questions & Answers] FiWe20:
Booting OS doesn't work(-> "freeze screen"), recovery mode doesn't work(-> also freeze) and installing new recovery files won't work either because it's in the beta version of android 10. So my 6t is completely broken unless twrp releases an open beta android 10 version of their recovery file?
[OnePlus 6T  Questions & Answers] Timmmmaaahh!:
Great. What did you do this time? lol. I thought you had it working. Not to worry, you can always resort to the MSMtool (found here). But before you do, there's a few 'softer' methods you can try. I advise reading the first post of this thread.

One piece of advice: if at all possible, try avoiding locking the bootloader again. It serves no purpose and can only create more problems. I have to admit that I haven't used MSMtool myself (been quite lucky so far) but I'm guessing it locks the bootloader in its automated process. If there's a switch to prevent that, use it! If not, ah well...
[OnePlus 6T  Questions & Answers] Deleted member 8892904:
Nah. It locks the Bootloader. Meaning if something went wrong you can't do anything. Happened to one guy here but I guess that was cause he erased persist. Another thing about MSM is that it only flashes One Slot.
[OnePlus 6T  Questions & Answers] Timmmmaaahh!:
That's why I referred to the 'softer' methods, sometimes just switching partition slots can solve all your problems.
[OnePlus 6T  Questions & Answers] imrock666:
MSM tool and stop suffering
[OnePlus 6T  Questions & Answers] jamescable:
Msm tool dude
[Xiaomi Redmi Note 5 / 5 Plus Questions & Answers] Noexcusses:
Does anyone has tested

Pixel experience android 10 on redmi5+ with 7.2, version pixel 2 Google camera?

Thanks
[Xiaomi Redmi Note 5 / 5 Plus Questions & Answers] pedio:
No but if u have the link can test

Redmi 5 Plus cihazımdan Tapatalk kullanılarak gönderildi
[Xiaomi Redmi Note 5 / 5 Plus Questions & Answers] Noexcusses:
There is no pixel experience android 10, Rom.on XDA yet?
[Xiaomi Redmi Note 5 / 5 Plus Questions & Answers] pbk14:
I am using pixel experience android 10 on Vince I had to say that it's the perfect rom we can get now everything works fine for me,even Volte
[Xiaomi Redmi Note 5 / 5 Plus Questions & Answers] Noexcusses:
https://www.apkmirror.com/apk/googl...amera-7-1-019-274654914-android-apk-download/

Delete your g cam and download this one.. tell me if it works!
[Xiaomi Redmi Note 5 / 5 Plus Questions & Answers] vinardi32:
Pixel Experience Android 10 for Vince link? Thanks

Enviado desde mi Redmi 5 Plus mediante Tapatalk
[Xiaomi Redmi Note 5 / 5 Plus Questions & Answers] ZEbbEDY:
download.pixelexperience.org/vince/
[Xiaomi Redmi Note 5 / 5 Plus Questions & Answers] Liron123:
GCAM on Android 10+ beta is bad. HDR takes longer to process (and the notification is buggy AF) and versions 7.1+ don't even work. It's not worth upgrading till a stable version comes. Because there are a lot more of minor bugs.
[Xiaomi Redmi Note 5 / 5 Plus Questions & Answers] pbk14:
https://download.pixelexperience.or...e_vince-10.0-20191008-2026-BETA-OFFICIAL.zip/
[Xiaomi Redmi Note 5 / 5 Plus Questions & Answers] Kkshii:
What version do you use? It works well for me.
[Xiaomi Redmi Note 5 / 5 Plus Questions & Answers] Liron123:
I use this https://f.celsoazevedo.com/file/cfiles/gcm1/GCam_6.2.030_N7P_test1.3a.apk

And notification for HDR process is just stuck in the status bar till I force close the app.
[Xiaomi Redmi Note 5 / 5 Plus Questions & Answers] Kkshii:
I use this version

mega.nz /#!jTpFRQYR!x34KwbcPlJ-GNIZNxSBEtygpnM-xOhF7NZMZL5ni-yE

remove the spaces in the link

It's the only one that works correctly, other versions do not work
[Xiaomi Redmi Note 5 / 5 Plus Questions & Answers] Nguyengk:
Update Pe Vince

I wonder if the PE 10 for vince is dropped because there hasnt been any updates for a month now :(
[Xiaomi Redmi Note 5 / 5 Plus Questions & Answers] Kkshii:
Try i.on 2.1, it's a Pixel exprecience but with more functions, the battery is excellent.
[Xiaomi Redmi Note 5 / 5 Plus Questions & Answers] Arpit4411:
Gcam not working.

It crashes every time i open. I'm using latest pixel experience rom
[Xiaomi Redmi Note 5 / 5 Plus Questions & Answers] H@fizZ:
How to install pixel experience 10 on a pixel experience 9.0caf already installed mob

Broo how can I rollback from pixel experience pie to miui 10 or 11 to install pixel experience 10 version Redmi 5 plus (Vince)
[Android Q&A, Help & Troubleshooting] markjsherrell:
Is there an external Windows utility I can use to flash the stock rom back on this? All I can get it to do is power up with the volume down/power button combo, the menu scrolls but pressing power on "Recovery Mode" does nothing except lock the menu and then you have to hold down the power to shut it off.

I am a novice, I just wanna save the phone, thanks.
[Android Q&A, Help & Troubleshooting] laugeek57:
https://www.hardreset.info/devices/motorola/motorola-moto-e5-play/faq/firmware-flash/
[Android Q&A, Help & Troubleshooting] markjsherrell:
OK, got to this command: "HardReset.info: mfastboot.exe flash partition gpt.bin" and got this result:

Tried with RSD Lite too, no go, is it hopeless?
[Google Pixel 4 XL Questions & Answers] wyelkins:
I used gesture navigation since the early previews on my old 2XL. I finally got used to it and continued using it when I got the 4XL.

Today I switched back to 3 button navigation. I like it a LOT better.

And... The Pixel 4XL is a great phone. Face unlock seems to be getting better. The extra 2GB of internal storage makes a big difference in multitasking.

Which navigation system do you prefer?
[Google Pixel 4 XL Questions & Answers] wolfeyes30:
Neither lol. I use Vivid navigation gestures.
[Google Pixel 4 XL Questions & Answers] techrider6262:
I'm starting to get used to it and I like the nice clean look. I don't understand people get new technology and software and going backwards.:confused:
[Google Pixel 4 XL Questions & Answers] brandon5491:
It took me a day or two before I got comfortable with the gesture navigation... Also I didn't realize initially there was a setting to revert it back to the three button navigation. I'm glad I didn't know I could switch back though because I have to say I'm liking the gesture navigation better now that I've used it for a few days.
[Google Pixel 4 XL Questions & Answers] EeZeEpEe:
Android 10 gestures all the way. I used Fluid Navigation for a little while and yes it's more customizable but I don't need all that.
[Google Pixel 4 XL Questions & Answers] wyelkins:
I gave gestures a few months on both pixels and I got used to them. I just like the buttons better.
[Google Pixel 4 XL Questions & Answers] dmarden:
The gestures aren't bad... but I wish I could use the stock Google gestures but disable the back button slide in from the left thing. It's a hassle to get the app/side menu. Slide in from the right for back is enough, why both left and right? Or at least an option would be nice.

Maybe I will check out Vivid. Couldn't find much in the way of example videos.
[Google Pixel 4 XL Questions & Answers] EeZeEpEe:
Slide diagonally up [emoji3486] or diagonally down [emoji3487] to get the side menu. Works every time for me. The sharper the angle, the better.
[Google Pixel 4 XL Questions & Answers] dmarden:
I did see that suggestion, I guess it takes practice since it hardly ever works for me. I'll keep practicing, lol.
[Google Pixel 4 XL Questions & Answers] EeZeEpEe:
I edited my post to include "The sharper the angle, the better". You can actually even do it if you partially scroll up or down.
[Google Pixel 4 XL Questions & Answers] wolfeyes30:
Exactly. Should be options to either have both, left only or right only.
[Google Pixel 4 XL Questions & Answers] krabman:
Should be options period, a lot of waste going on with the stock home gestures and launcher setup. You have 5 ways to get to the assistant when you only need one jumps out as the largest piece of stupidity in the gesture/launcher setup. Thankfully you don't have to put up with it: I also use NV for gestures and Action Launcher to handle the launcher duties. Stupidity is gone and corporate boy wonders who think 5 shortcuts to the assistant (among other stupidity) in the space of a few inches on the bottom half of the home screen is a good idea were thwarted. Life is good.
[Google Pixel 4 XL Questions & Answers] hokiealumnus:
I used gestures starting on on Pixel XL and kept using it on the P4 XL. I just like the bit of extra screen real estate at the bottom. It's also nice going back without moving a thumb to the bottom of the phone. That drove me crazy when I used my old phone (gave it to my kid, who uses the buttons) again.
[OnePlus 7 Pro Questions & Answers] JohnnyGuitar7:
Does anyone know of a way to increase the number of call volume steps? I can change the number of media volume steps in the build prop, however I don't know the what the name of the variable is that corresponds to call volume steps. ro.config.vc_call_vol_steps does not work. Also, the xposed module that has this functionality has not been updated in years and doesn't work on Android ten.
[OnePlus 7 Pro Questions & Answers] Dogstarlooma:
IDK but there is a Free app on play store

https://play.google.com/store/apps/details?id=catchpower.gogo.mediavolumeonly
[OnePlus 7 Pro Questions & Answers] JohnnyGuitar7:
I'm not sure what benefit that app gives.
[OnePlus 7 Pro Questions & Answers] Dogstarlooma:
Gives 30 vol steps instead of 15
[Upgrading, Modifying and Unlocking] misterjp:
Hi there,

I've done some reverse engineering on the LG DZ files, and here is the layout of these files.

DZ File Format

Offset	Length (bytes)	Description
0x0	0x8	Magic code "MSTXMETX"
0x8	0x2	Unknown, same value in all files (value 0x01)
0xA	0x2	Separator ? (value 0x0)
0xC	0x2	Unknown, same value in all files (value 0x0B)
0xE	0x2	Separator ? (value 0x0)
0x10	0x6	Unknow, value differs from file to file
0x16	0x2	Unknown, same value in all files (value0x01C8)
0x18	0x8	String, phone model ? (value "KS20")
0x20	0x50	String, file title ?
0x70	0x1C	Two null terminated string concatened ("[chipmodel]\0[osname]\0")
0x8C	0x80	String, DZ filename
0x10C	0x20	Separator (filled with 0xFF)
0x12C	0x10	Header MD5 hash
0x13C	Variable	Concatened subfiles (see Subfile format)
--	0x78	Offset Table, unknown useage (see OffsetTable format)
--	--	Optionnal data, present in some DZ file (unknown)

Subfile format

Offset	Length (bytes)	Description
0x0	0x4	Magic code "SSTX"
0x4	0x2	Unknown, same value for all subheaders (value 0x01)
0x6	0x2	Separator ? (value 0x0)
0x8	0x2	File Type ?
0xA	0x6	Separator ? (filled with 0x0)
0x10	0x4	Data length
0x14	0x80	Filename, null terminated string
0x94	0x10	Separator (filled with 0xFF)
0xA4	0x10	Uncompressed data MD5 hash
0xB4	0x10	Subheader MD5 Hash
0xC4	Data length	Gzip compressed data

File type (in subheader)

Type	Filename	Description
0x3	amss.mbn	AMSS modem
0x8	partition.mbn	Partition table
0xA	qcsblhd_cfgdata.mbn	QCSBL header
0xB	qcsbl.mbn	QCSBL
0xC	oemsblhd.mbn	OEM boot header
0xD	oemsbl.mbn	OEM boot
0xE	amsshd.mbn	AMSS modem header
0x13	appsboothd.mbn	APPS boot loader header
0x14	appsboot.mbn	APPS boot loader
0x15	FLASH.bin
0x16	apps.mbn	APPS

It's not complete, but that's a start.

I also made a tool to extract the subfiles contained in the DZ file (see attached file).

Hope this helps,

JP.

Check also the tool to extract the content of the Flash.Bin file : LGFlashParser
[Upgrading, Modifying and Unlocking] spocky12:
Great news ! :cool:

I tested your soft with different lg ks20 dz files downloaded on the web and files seem to be extracted as they should. I didn't try to flash though, as I'm at work and I don't have usb cable here.

Now we still need to find how to edit those files (*.mbn and especially flash.bin which contains windows file system). Anyway, it's a great step towards lg rom cooking. Thanks again!
[Upgrading, Modifying and Unlocking] misterjp:
I have updated the DZExtract tool...

It now checks all the known MD5 hash, so the extracted files can be considered valid.

Here are the command line options :

dzextract.exe [options] path [outputpath]
options : default -p
-p Print and check header information
-x extract subfiles
path : path to dz file
outputpath : path to output directory (must exists)

Hope this helps,

JP.
[Upgrading, Modifying and Unlocking] paxman:
Wow, sounds great!
[Upgrading, Modifying and Unlocking] rickou26:
Thank you very much for this excellent work.

it's possible to extract also the files of .mbn or FLASH.bin ?
[Upgrading, Modifying and Unlocking] DomZ:
For mbn files you can try with this soft :

http://forum.modopo.com/diskussionen-rund-ums-modding/t-19197-qc-bqs-firmware-analyzer.html
[Upgrading, Modifying and Unlocking] dcoloane:
Great.....a good start............
[Upgrading, Modifying and Unlocking] raykisi:
How does it work? Can it work in vista? Coz i double click the DZextract.exe, a dos window came out for 1 sec then closed and nothing happen.
[Upgrading, Modifying and Unlocking] misterjp:
This is a command line tool, so you need to open a command window and follow the instructions.

About the contained files :

The flash.bin seems to be the windows image (found old infos here : Rom file format)

The mbn files reflect the firmware structure :

- QCSBL = QC Secondary Boot Loader

- OEMSBL = OEM Secondary Boot Loader

- AMSS = Advanced Mobile Subscriber Software

...

(infos from the link posted by DomZ)

JP.
[Upgrading, Modifying and Unlocking] mathieulh:
Great application !

Files identical (same CRC) from unbranded to branded roms:

apps.mbn

appsboothd.mbn

oemsbl.mbn

oemsblhd.mbn

partition.mbn

qcsbl.mbn

qcsblhd_cfgdata.mbn

All the remaining files are different, inclueding the flash but that is obvious.

(amss.mbn, amsshd.mbn, appsboot.mbn, Flash.bin)

I guess we have to compare the unidentical mbn files to find out what prevents the unbranded roms to work in phones with branded NVs.

Then if nothing is conclusive we will have to check the flash itself.

mbn files seem plain/uncompressed binaries.

In fact I believe the CID checks are performed by amss.mbn which seems to be somehow the true bootloader (It is a true ELF binary and likely the very first to be running)
[Upgrading, Modifying and Unlocking] misterjp:
This is just a guess based on my todays reading and disassembling: the msm7200 has two processor, and one is dedicated to the radio functions. This processor actually runs the AMSS file which is an arm elf executable (you can to disassemble this file with IDA).

Apparently, the AMSS part is based on an L4 microkernel, and running iguana embedded os (see here).

On the QC BQS analyzer page, the boot process is explained (it's for another phone, but I think it's the same). The QCSBL (Qualcomm secondary boot loader) load the OEMSBL (probably on the first processor) and then also load the AMSS Elf.

Both the oemsbl and the amss run in parrallel (i guess they communicate with some kind of IPC mechanism).

After that, the oemsbl start the windows kernel.

I think, we should concentrate on the flash.bin file, as i think the other files are either encrypted or at least signed.

My post is just a guess as it's very hard to find information on the msm7200 processor and as I do not have a KS20 phone (nor a qualcomm based phone) to check all these informations.

JP.
[Upgrading, Modifying and Unlocking] mathieulh:
The other files are plain text. They may however indeed be signed although this is not sure, since they did not bother to add any kind of encryption (at least not that I could spot) , perhaps they did not bother adding a signature either. I think LG did not expect us to access these files/ressources from the phone, I do not expect them to be accessible through software (running on the phone that is) we can actually access it thanks to the leaked service tools from LG using their recovery mode.
[Upgrading, Modifying and Unlocking] misterjp:
I think you are right about LG as I found that the files contained in the DZ file were supposed to be crypted : when disassembling the LG sofware, I found that the fonction that extracts the subfiles could also decrypt the files, however none of the DZ files I have are encrypted.

But regarding the qcsbl file for example, I'm not so sure : this file is certainly built (or at least coded) by Qualcomm and is probably part of the SDK they send to their customers.

I've seen posts about similar phone using qualcomm chipset reporting that some of the bootloaders were signed.

JP.
[Upgrading, Modifying and Unlocking] dussel:
Spend money...

Hi,

its cool what you have find out about the DZ Format. But the problem is that misterjp has no KS20. What do you think if we all spend a little money, so that misterjp can buy a KS20 because with this he can find more about the DZ Format? If we know a lot of the DZ format in the future someone will release new Windows Mobile Version.

Dear Dussel
[Upgrading, Modifying and Unlocking] DaLiV:
in fact need to knew more about .mbn file format ... not .dz (that is simpliest pack method /container for multiple .mbn /)

on net i'm saw .mbn extractor ... but not .mbn creator ... that format more complicated than .dz - so better to spend money for that, who can work with .mbn - it's more perspectivelly, or anybosy, who can find alternate way to flash (without .mbn)

so firstly take a look to :

1. MBN-Resourcer = Qualcomm firmware resource viewer

2. QPST - Qualcomm Product Support Tools

3. QXDM - Qualcomm eXtensible Diagnostic Monitor

4. QC BS analizer - similar to mbn-resourcer, but other maintainers

5. BREW Resource editor - it's more for high level programming ...

that will be primarilly tools for decryting ... but crypting - possible need signing key for creating .mbn and that key must be trusted by device ...
[Upgrading, Modifying and Unlocking] adfree:
@ DomZ

Thanx for info. ;)

@ misterjp

Nice work.

@ all

Like DaLiV said. I think also. It is an good idea to collect more infos about Qualcomm. Many manufacturer use Qualcomm Hardware...

Samsung, LG, Motorola, Huawei... many more.

AMSS is ever used. If Qualcomm MSMxxxx works as heart of mobile.

Best Regards

Edit...

1. I have looked into QPST 2.7 Build 264 (good Description in Manual) See Screenshot...

2. It looks that RSA2048 Signature at End of AMSS is not used.

Check amssHD.mbn

First 2 adresses the same and means End of AMSS... And 0x1D is 00 instead 01

Why the other 2 adresses exceed AMSS? I don't know...

So in theory Manipulation of AMSS seems possible.

3. BREW is "obsolete". Not an part of AMSS. Because the WM OS is used as an "Layer"...

4. NVM folder I can see... So I think also NV items are used...

5. Funny GZIP is used also from BenQ for EF91... :) To hide AMSS... :D
[Upgrading, Modifying and Unlocking] spocky12:
I agree with you. Now that misterjp has partially reversed dz format, we need to concentrate on files contained inside it (as you may all know, lgmdp can actually flash firmware from a directory containing mbn+bin files, not only dz, so there is no point in trying to reassemble a dz from a list of mbn files (at least, it's not a priority).

On the other side, misterjp has proved to be a good reverser on a format for which he doesn't even own a phone. To be totaly honest, (and as I already said on a french forum), he did this on my demand because I was not really efficient in reversing lgmdp. I'm pretty sure he could go further (and with no doubt could cook an english firmware, for those of you waiting for this). I think the least thing would be for him to have a phone to test his development. So misterjp, if you're ok to continue your work and would like some donations, don't hesitate to update your first post with a paypal link, at least til you get a phone. ;)
[Upgrading, Modifying and Unlocking] misterjp:
Hi there,

Thanks for the support ! I did not have many time this week end, so I do not have many informations today : the flash.bin is using a Windows flash format, very easy to extract :

Offset Length (bytes) Description
0x0 0x7 Magic code "B000FF\n"
0x7 0x4 Image start adresse
0xB 0x4 Image Length
0xF --- List of memory block
-- 0x4 Always zero
-- 0x4 Image entry point
-- 0x4 Always zero

Each memory block is composed of

Offset Length (bytes) Description
0x0 0x4 Memory destination of block
0x4 0x4 Block size
0x8 0x4 Block checksum (sum32)
0xC --- Data

JP.
[Upgrading, Modifying and Unlocking] misterjp:
So,

I have sucessfully extracted the imgfs from the flash file. So here is the tool to do it.

It's a bit late, so I'm not giving explanation now, but I will !

To use the tool, just run

LGFlashParser.exe FLASH.bin

It will generate 3 files (BOOT, RAW and IMGFS), then you can use ImgfsToDump to extract the content of the IMGFS file.

At the moment, ImgFsToDump crash at the end of the processing (but the content is extracted), this is probably due to an invalid char in my generated imgfs, but it's too late to investigate.
[Upgrading, Modifying and Unlocking] misterjp:
Apparently, some files extracted from the imgfs part have no data. It could be related to the problem exposed before. I am working on this problem.

I have also checked the part_2_RAWFS : for this file, you can use the dumprom utility to extract it's content :

dumprom.exe part_2_RAWFS.bin -5 -d dump-xip
[Upgrading, Modifying and Unlocking] misterjp:
I have updated the LGFlashParser file attached to my previous post : it now extracts the data properly.

After using this tool, you can extract the complete content of the IMGFS partition : there is no more error message.
[Upgrading, Modifying and Unlocking] mathieulh:
Great tool :) Thanks. I will check it out :)
[Upgrading, Modifying and Unlocking] DaLiV:
please check sizes ... and compare to that i've posted before from english rom ... if it's comparable - then for peoples only needed tool for packing that back ... and they will get english as they wanted /sorry also have no many time and device/

sizes was

1*306*624 Part00.raw /think boot/

4*325*376 Part01.raw /xip/

67*764*224 Part02.raw /imgfs/