[Nexus 7 General] Jirmd:
So many Thank for : Android Root Team

https://github.com/AndroidRoot

So many Thank for: Jevinskie

https://github.com/jevinskie

My github

https://github.com/GeorgeMato4/nvcrypttools/tree/forN7

required: Use linux based OS.!!!!

First time:

To make your encrypted blob for your Tegra3 Device ( Nexus7/tf201/tf300/tf700) you need another working tegra3 Device.

I am sorry for that, but i was going with easys possible way. I will solve this, but not now.

But, when you give me information (sbk and cpuid) , i will try create blob for you. And , if will be your device restored, please, help others with same problem.

How get sbk from your bricked device?

Download from Jevinskie Github page source code.

https://github.com/jevinskie/fusee-launcher

Unzip and make it. (Open in folder with source code command line and type “make” )

It is need install pyusb with command “pip install pyusb”.

It is need connected device to usb v3.

Check if is device in apx mode with command “lsusb”. In list must be Nvidia corp.

Run Command on sudo “./fusee-launcher.py –tty dump-sbk-via-usb.bin”

You get something like this:

05f4a5d01'
Stack snapshot: b'0000000000000000100000003c9f0040'
EndpointStatus_stack_addr: 0x40009f3c
ProcessSetupPacket SP: 0x40009f30
InnerMemcpy LR stack addr: 0x40009f20
overwrite_len: 0x00004f20
overwrite_payload_off: 0x00004de0
payload_first_length: 0x00004de0
overwrite_payload_off: 0x00004de0
payload_second_length: 0x0000c7b0
b'00a0004000300040e04d0000b0c70000'
Setting rcm msg size to 0x00030064
RCM payload (len_insecure): b'64000300'

Setting ourselves up to smash the stack...
Payload offset of intermezzo: 0x00000074
overwrite_payload_off: 0x00004de0
overwrite_len: 0x00004f20
payload_overwrite_len: 0x00004e5c
overwrite_payload_off: 0x00004de0
smash_padding: 0x00000000
overwrite_payload_off: 0x00004de0
Uploading payload...
txing 73728 bytes total
txing 4096 bytes (0 already sent) to buf[0] 0x40003000
txing 4096 bytes (4096 already sent) to buf[1] 0x40005000
txing 4096 bytes (8192 already sent) to buf[0] 0x40003000
txing 4096 bytes (12288 already sent) to buf[1] 0x40005000
txing 4096 bytes (16384 already sent) to buf[0] 0x40003000
txing 4096 bytes (20480 already sent) to buf[1] 0x40005000
txing 4096 bytes (24576 already sent) to buf[0] 0x40003000
txing 4096 bytes (28672 already sent) to buf[1] 0x40005000
txing 4096 bytes (32768 already sent) to buf[0] 0x40003000
txing 4096 bytes (36864 already sent) to buf[1] 0x40005000
txing 4096 bytes (40960 already sent) to buf[0] 0x40003000
txing 4096 bytes (45056 already sent) to buf[1] 0x40005000
txing 4096 bytes (49152 already sent) to buf[0] 0x40003000
txing 4096 bytes (53248 already sent) to buf[1] 0x40005000
txing 4096 bytes (57344 already sent) to buf[0] 0x40003000
txing 4096 bytes (61440 already sent) to buf[1] 0x40005000
txing 4096 bytes (65536 already sent) to buf[0] 0x40003000
txing 4096 bytes (69632 already sent) to buf[1] 0x40005000
txing 4096 bytes total
txing 4096 bytes (0 already sent) to buf[0] 0x40003000
Smashing the stack...
sending status request with length 0x00004f20
The USB device stopped responding-- sure smells like we've smashed its stack. :)
Launch complete!
b'4445414442454546'
DEADBEEF
b'3030303030303030'
00000000
b'3030303030303030'
00000000
b'3034303030303930'
04000090
b'4634314330433241'
F41C0C2A
b'3133333731333337'
13371337
b'3535353535353535'
55555555
b'3430303033303030'
40003000
b'3430303035303030'
40005000
b'4141414141414141'
AAAAAAAA
b'3131313131313131'
11111111
b'3030303030303236'
00000026
b'3232323232323232'
22222222
b'68656c6c6f2c20776f726c640a00'
hello, world
b'e57de3bab6cb499d874d5772cb219f0101042c20' (This is SBK)

Traceback (most recent call last):
File "./fusee-launcher.py", line 823, in <module>
buf = switch.read(USB_XFER_MAX)
File "./fusee-launcher.py", line 530, in read
return self.backend.read(length)
File "./fusee-launcher.py", line 134, in read
return bytes(self.dev.read(0x81, length, 3000))
File "/usr/local/lib/python3.6/dist-packages/usb/core.py", line 988, in read
self.__get_timeout(timeout))
File "/usr/local/lib/python3.6/dist-packages/usb/_debug.py", line 60, in do_trace
return f(*args, **named_args)
File "/usr/local/lib/python3.6/dist-packages/usb/backend/libusb1.py", line 833, in bulk_read
timeout)
File "/usr/local/lib/python3.6/dist-packages/usb/backend/libusb1.py", line 936, in __read
_check(retval)
File "/usr/local/lib/python3.6/dist-packages/usb/backend/libusb1.py", line 595, in _check
raise USBError(_strerror(ret), ret, _libusb_errno[ret])
usb.core.USBError: [Errno 110] Operation timed out

You need this two number: Tegra with Device ID: b'01042c205f4a5d01

and

hello, world

b'e57de3bab6cb499d874d5772cb219f0101042c20'. This is not real sbk.

Sbk have only 32 number. Your sbk is only “e57de3bab6cb499d874d5772cb219f” and after this number is first 8 number from tegra device id.

Congratulation, you get sbk.

I test dump-sbk-via-usb on nexus 7 and on asus TF300. I thing this will work on other device.

How get chip id?

Download wheelei from this page:

https://github.com/AndroidRoot/androidroot.github.io/tree/master/download

and download some bad blob.bin or my blank blob.bin

Reboot your device and connect to your pc. Check if is this on apx mode with command “lsusb”.

With sudo run “./wheelie --blob blob.bin ”

You get cpu id and 0x4 error (bad blob format).

Format cpu id for grouper is like this 0x15d4a5f202c0401

Chip id is 015d4a5f202c0401.

Tegra Id from dump-sbk-via-usb is cpu id, but on bad format. 01042c205f4a5d01 vs 015d4a5f202c0401.

I have another Tegra3 device: How build blob?

Try my precompiled mknvfblob. Download from :

https://github.com/GeorgeMato4/nvcrypttools/tree/forN7/precompiled

precompiledN7 is for Nexus,

precompiledCardhu is for other device.

Type:

mkdir /AndroidRoot

cat /proc/cpuinfo > /AndroidRoot/cpuinfo

Cpuinfo file look like this:

Processor	: ARMv7 Processor rev 9 (v7l)
processor	: 0
BogoMIPS	: 1993.93

processor	: 1
BogoMIPS	: 1993.93

processor	: 2
BogoMIPS	: 1993.93

processor	: 3
BogoMIPS	: 1993.93

Features	: swp half thumb fastmult vfp edsp neon vfpv3 tls
CPU implementer	: 0x41
CPU architecture: 7
CPU variant	: 0x2
CPU part	: 0xc09
CPU revision	: 9

Hardware	: grouper
Revision	: 0000
Serial	: 015d4a5f202c0401

Where Hardware is type of chip-set, can be grouper (for Nexus 7 2012) or cardhu (for TF 201/300/700) and serial is chip id. Change this number with your chip id.

Now, untar my precompilated mknvfblob.

From

https://github.com/GeorgeMato4/nvcrypttools/tree/forN7/bct

download btc file for your device

https://github.com/GeorgeMato4/nvcrypttools/tree/forN7/bootloaders

download bootloader.xbt for your device

and take this files to AndroidRoot folder.

If you have on your device working linux, type :

./mknvfblob -W -K e57de3bab6cb499d874d5772cb219f01 --blob /AndroidRoot/test.blob --bctin /AndroidRoot/testa.bct --bctr /AndroidRoot/testr.bct --bctc /AndroidRoot/testc.bct --blin /AndroidRoot/bootloader.blob.XBT --blout /AndroidRoot/test.ebt

Where: e57de3bab6cb499d874d5772cb219f01 is your bsk

testa.bct is your bct.

bootloader.blob.XBT is your bootloader bct.

If you have android, use adb shell command.

how this work?

When you use blob.bin (test.blob) with “./wheelie --blob blob.bin ”

You get error 3 reciever.

But this is not problem.

Run command with sudo:

./nvflash --btc testr.bct --ebt test.ebt --blob test.blob --go

after run this, restore bootloader.

./nvflash --resrore --download 4 bootloader.img --go

Where number 4 is partition with bootloader and bootloadr.img is bootloader for your device.