[Nexus 7 General] enderzip:
Thanks to @Jirmd for letting me use his post as a reference.

Original post: https://xdaforums.com/nexus-7/general/unbrick-nexus-7-tegra-3-device-t4078627

Alternative Method:

1. https://github.com/tofurky/tegra30_debrick

2. https://xdaforums.com/t/tutorial-ge...-without-another-n7-or-tegra30-device.4305955

(Both methods do not require another Nexus 7)

Requirements:

1. Linux-based OS (I use Ubuntu 18.04)

2. NvFlash and Wheelie (You can download the Linux version down below)

3. A USB cable (A good and sturdy one)

4. Nerve of steel lol

5. Must have APX driver installed.

6. Another Nexus 7 (Ask someone that have it or ask me)(MUST BE ROOTED AND HAVE TWRP RECOVERY INSTALLED)

7. ADB (platform-tools)

1. DUMP SBK VIA USB

Step 1: Download fusee-launcher for Nexus 7 from this link and extract it to a folder:

http://www.mediafire.com/file/sgwsa79idk24z8u/fusee-launcher-n7.zip/file

Step 2: Open a terminal inside of the folder then type:

sudo apt-get install python-usb python3-usb

Wait for it to complete. After that, type:

pip install pyusb

Step 3: Connect your device to a USB 3.0 port (REQUIRED). You can check for connection using "lsusb". There must be a "NVidia Corp" in the list.

Step 4: Type:

sudo ./fusee-launcher.py –tty dump-sbk-via-usb.bin

Something like this should appear:

05f4a5d01'
Stack snapshot: b'0000000000000000100000003c9f0040'
EndpointStatus_stack_addr: 0x40009f3c
ProcessSetupPacket SP: 0x40009f30
InnerMemcpy LR stack addr: 0x40009f20
overwrite_len: 0x00004f20
overwrite_payload_off: 0x00004de0
payload_first_length: 0x00004de0
overwrite_payload_off: 0x00004de0
payload_second_length: 0x0000c7b0
b'00a0004000300040e04d0000b0c70000'
Setting rcm msg size to 0x00030064
RCM payload (len_insecure): b'64000300'

Setting ourselves up to smash the stack...
Payload offset of intermezzo: 0x00000074
overwrite_payload_off: 0x00004de0
overwrite_len: 0x00004f20
payload_overwrite_len: 0x00004e5c
overwrite_payload_off: 0x00004de0
smash_padding: 0x00000000
overwrite_payload_off: 0x00004de0
Uploading payload...
txing 73728 bytes total
txing 4096 bytes (0 already sent) to buf[0] 0x40003000
txing 4096 bytes (4096 already sent) to buf[1] 0x40005000
txing 4096 bytes (8192 already sent) to buf[0] 0x40003000
txing 4096 bytes (12288 already sent) to buf[1] 0x40005000
txing 4096 bytes (16384 already sent) to buf[0] 0x40003000
txing 4096 bytes (20480 already sent) to buf[1] 0x40005000
txing 4096 bytes (24576 already sent) to buf[0] 0x40003000
txing 4096 bytes (28672 already sent) to buf[1] 0x40005000
txing 4096 bytes (32768 already sent) to buf[0] 0x40003000
txing 4096 bytes (36864 already sent) to buf[1] 0x40005000
txing 4096 bytes (40960 already sent) to buf[0] 0x40003000
txing 4096 bytes (45056 already sent) to buf[1] 0x40005000
txing 4096 bytes (49152 already sent) to buf[0] 0x40003000
txing 4096 bytes (53248 already sent) to buf[1] 0x40005000
txing 4096 bytes (57344 already sent) to buf[0] 0x40003000
txing 4096 bytes (61440 already sent) to buf[1] 0x40005000
txing 4096 bytes (65536 already sent) to buf[0] 0x40003000
txing 4096 bytes (69632 already sent) to buf[1] 0x40005000
txing 4096 bytes total
txing 4096 bytes (0 already sent) to buf[0] 0x40003000
Smashing the stack...
sending status request with length 0x00004f20
The USB device stopped responding-- sure smells like we've smashed its stack. :)
Launch complete!
b'4445414442454546'
DEADBEEF
b'3030303030303030'
00000000
b'3030303030303030'
00000000
b'3034303030303930'
04000090
b'4634314330433241'
F41C0C2A
b'3133333731333337'
13371337
b'3535353535353535'
55555555
b'3430303033303030'
40003000
b'3430303035303030'
40005000
b'4141414141414141'
AAAAAAAA
b'3131313131313131'
11111111
b'3030303030303236'
00000026
b'3232323232323232'
22222222
b'68656c6c6f2c20776f726c640a00'
hello, world
b'e57de3bab6cb499d874d5772cb219f0101042c20'

Traceback (most recent call last):
File "./fusee-launcher.py", line 823, in <module>
buf = switch.read(USB_XFER_MAX)
File "./fusee-launcher.py", line 530, in read
return self.backend.read(length)
File "./fusee-launcher.py", line 134, in read
return bytes(self.dev.read(0x81, length, 3000))
File "/usr/local/lib/python3.6/dist-packages/usb/core.py", line 988, in read
self.__get_timeout(timeout))
File "/usr/local/lib/python3.6/dist-packages/usb/_debug.py", line 60, in do_trace
return f(*args, **named_args)
File "/usr/local/lib/python3.6/dist-packages/usb/backend/libusb1.py", line 833, in bulk_read
timeout)
File "/usr/local/lib/python3.6/dist-packages/usb/backend/libusb1.py", line 936, in __read
_check(retval)
File "/usr/local/lib/python3.6/dist-packages/usb/backend/libusb1.py", line 595, in _check
raise USBError(_strerror(ret), ret, _libusb_errno[ret])
usb.core.USBError: [Errno 110] Operation timed out

Search for the line "hello, world" inside of your log. It looks like this in this example:

hello, world
b'e57de3bab6cb499d874d5772cb219f0101042c20'

The last 8 characters are not your SBK. This is the first 8 numbers of your Device ID. Delete this and delete the b' at the start and also the ' at the end.

The result should look like this:

e57de3bab6cb499d874d5772cb219f01

Congratulation, you have successfully dump your device SBK via USB.

2. GETTING YOUR CPU UID

Step 1: Download Wheelie and NvFlash then extract it to a folder.

Step 2: Download this broken blob.bin file (REQUIRE)

http://www.mediafire.com/file/32cxvjv2wajokqf/blob.bin/file

Then place it inside of the Wheelie and NvFlash folder.

Step 3: Open a terminal inside of the folder then type:

./wheelie --blob blob.bin

After that, something like this should appear:

Wheelie 0.1 - Preflight for nvflash.
Copyright (c) 2011-2012 androidroot.mobi
========================================
[=] Chip UID: 0x98254853062001158
[-] Incorrect SBK or SBK type selected. nverror: 0x4.

Search for "Chip UID", remove the "0x" at the beginning. The result should look like this:

98254853062001158

Congratulation, you got your chip UID

3. GENERATE BLOB FILES USING ANOTHER NEXUS 7

Step 1: Download MkNvfBlob from this link:

https://github.com/GeorgeMato4/nvcrypttools/blob/forN7/precompiled/precompiledN7.tar.xz

Note: Extract this to your Nexus 7.

Step 1.1: Reboot into TWRP recovery.

Step 2: Open a terminal inside of you ADB folder then type:

adb shell

After that:

su

Type this command after that:

mkdir /AndroidRoot

Last one:

cat /proc/cpuinfo > /AndroidRoot/cpuinfo

Pull the cpuinfo file using this command:

adb pull /AndroidRoot

Note: You could copy your cpuinfo file to your PC using MTP (IDK how to do this so search Google lol)

Open your ADB folder and there should be a AndroidRoot folder with a cpuinfo file inside of it.

Open cpuinfo using a Text Editor. Something like this should be inside:

Processor : ARMv7 Processor rev 9 (v7l)
processor : 0
BogoMIPS : 1993.93

processor : 1
BogoMIPS : 1993.93

processor : 2
BogoMIPS : 1993.93

processor : 3
BogoMIPS : 1993.93

Features : swp half thumb fastmult vfp edsp neon vfpv3 tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x2
CPU part : 0xc09
CPU revision : 9

Hardware : grouper
Revision : 0000
Serial : 015d4a5f202c0401

Replace the Serial line with your Chip UID.

After that, place the cpuinfo file back to the /AndroidRoot folder on your device using this command:

adb push AndroidRoot /

After you are done, don't close the ADB windows.

Step 3: Download bootloader.xbt:

https://github.com/GeorgeMato4/nvcrypttools/blob/forN7/bootloaders/bootloader.grouper.XBT

And BCT for your device:

https://github.com/GeorgeMato4/nvcrypttools/blob/forN7/bct/n7.bct

And copy these two files to the /AndroidRoot folder on your device.

Step 4: Type this command on the ADB windows:

cd /AndroidRoot

After that, type:

chmod 777 ./mknvfblob

After that, type:

./mknvfblob -W -K <your SBK> --blob /AndroidRoot/test.blob --bctin /AndroidRoot/n7.bct --bctr /AndroidRoot/testr.bct --bctc /AndroidRoot/testc.bct --blin /AndroidRoot/bootloader.grouper.XBT --blout /AndroidRoot/test.ebt

Wait for it to do its job.

After that, go to your /AndroidRoot folder and copy all the file that just got generated (testr.bct, testc.bct. test.ebt, test.blob) to your PC using the adb pull command on Step 2

Congratulation, you have successfully generate blob for your bricked device.

4. UNBRICK YOUR DEVICE (The fun part :D )

Step 1: Boot your bricked device into APX mode either using Power button or Power + Vol UP.

Step 2: Open a terminal inside of the folder where you place your NvFlash folder (move the blob file inside of that folder, all of them)

Step 3: Open a terminal inside of your Wheelie and NvFlash folder. Type:

sudo ./nvflash --bl test.ebt --bct testr.bct --blob test.blob

If you got this command:

command error: no command found

Then try this one instead:

./nvflash --setbct --create --configfile <your flash.cfg> --bl test.ebt --bct testr.bct --blob test.blob

If you got the NvError, its fine.

Something like this should appear (the first command):

Nvflash v1.13.87205 started
Using blob v1.13.00000
chip uid from BR is: 0x0000000000000000015d2bc285340e0f
rcm version 0X30001
System Information:
chip name: unknown
chip id: 0x30 major: 1 minor: 3
chip sku: 0x83
chip uid: 0x0000000000000000015d2bc285340e0f
macrovision: disabled
hdcp: enabled
jtag: disabled
sbk burned: true
dk burned: true
boot device: emmc
operating mode: 4
device config strap: 1
device config fuse: 17
sdram config strap: 0

sending file: recovery.bct
- 6128/6128 bytes sent
recovery.bct sent successfully
downloading bootloader -- load address: 0x80108000 entry point: 0x80108000
sending file: bootloader.ebt
- 2146912/2146912 bytes sent
bootloader.ebt sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully

A Google Logo should appear on your device screen with the text "Battery is too low" on the upper left corner. Unplug the battery and replug it. After that, plug it into a wall charger for atleast 4 hour.

Step 4: Unplug the battery and boot into APX mode again using the button combination.

Step 5: Type this command while holding down the Vol DOWN button:

sudo ./nvflash --resume --download 8 boot.img

Replace "boot.img" with your ROM boot.img file. If you download another boot.img that isn't for your ROM, your device will bootloop.

Step 6:

Type:

sudo ./nvflash --resume --download 4 bootloader.img

Replace "bootloader.img" with your bootloader.img file name (You could get it inside of the Factory Image)

And after its done, your device should technically unbrick now. But I still recommend you re-flash stock ROM.

Step 7: The final step

Boot into your OS using the command below:

sudo ./nvflash --resume --go

If your device boot back into APX mode, maybe you have done something wrong. Try again.

If you got a Google logo on your device then congratulation! Your device is now unbricked.

Note: If step 7 didn't work, try booting this recovery image using this command:

fastboot boot flatline_grouper.img

Link for the recovery image is in the "Links" section.

Note: To get into Fastboot, add the "--go" line at the end of the command in Step 5

sudo ./nvflash --resume --download 8 boot.img --go

HOLD DOWN VOL DOWN while doing this command, you should get into fastboot at

After you are in the Flatline recovery, navigate to the "Advanced" section using the VOL buttons. Select it using the POWER button.

Select the "wheelie" at the end of the list.

Select "I agree".

After that, select "Step 1: Flash AndroidRoot.mobi custom bootloader." IGNORE Step 2 because it won't gonna work anyways.

Your device should reboot and the Google logo should appear, that means that your device is unbricked.

Note: If you wanted to flash stock ROM, open the "image-*******.zip" inside of the factory image and open the android-info.txt file. Edit the "require-bootloader" line to "4.13". After that, it should work.

Links:

flash.cfg: http://www.mediafire.com/file/j90hc1dfz58aytq/flashcfg.zip/file

flatline_grouper.img: https://www.mediafire.com/file/z1jvgy6km33f7bf/flatline_grouper.img/file

Wheelie, NvFlash and platform-tools (For ADB) (Works for both Linux and Windows): https://www.mediafire.com/file/0nuy4indgvagq3v/nvflash-and-platformtool.zip/file

Download the Factory Image for your Nexus 7 incase you want to re-flash stock ROM (nakasi or nakasig): https://developers.google.com/android/images#nakasi

That is. If you need any help, message me.

Update: After a few days of troubleshooting, fixing and updating my post, it seems like the step to unbrick your Nexus 7 2012 may depends on how did you brick it, what OS version you are running or the condition of your device. So you may have to "think outside the box" sometimes in this guide.

Update #2: Some helpful advice from @Jirmd with some minor change:

In my case, this command also gives me the nverror 0x4 but it also did something to my Nexus 7 as it was required for the next step.

Update #3: Updated the guide and removed some unessacery steps.

Update #4: Updated.