[General Topics] karwos:
Hello!

View attachment 5313235​

Yesterday friend of mine brought N960F to my hands which was stuck in bootloop asking for help. He bricked phone by some flashing, but don't know details at all.

Phone was launching flashing mode normally, I was able to flash it through ODIN but it stuck on vendor.img.

I have tried to re-flash BL, then CSC only, but phone was in bootloop all-the-time.

I though that there is some problem with partitions, but CSC was about to flash after AP which stuck, so partitions couldn't be restored/repaired.

Went with flashing CSC only to force repartition phone, and then again AP package - same results, stuck into vendor.img.

I have got message on phone screen that flashing failed and asked to use Device Firmware Restore using Smart Switch. Installed SmartSwitch but Emergency Flashign haven't found any device. Reinstalled USB drivers from SmartSwitch. Appearantly, it detected USB device correctly after plugging in. But still Emergency Flashing detected no phone.

I have tried to flash firmware parts using fastboot. No fastboot device found. Tried adb reboot to bootloader. Still fastboot found nothing.

So completly stucked at bootloop at this stage. No any solutions found searching for keywords ODIN stuck vendor.img, ODIN stuck, bootloop, etc.

Decided to not look anything more online and try to develop solution straightly.

I have flashed TWRP, which worked.

How to force phone to enter twrp? Press VolUp, Bixby and PowerOn and HOLD for 20-30 seconds.

TWRP launched.

I have backed up everything before any further move.

I have got some files backed up, but vendor was empty.

Backed-up vendor image was EMPTY. Zero bytes.

In recovery.log:

Why ODIN couldn't flash it? Perhaps ODIN bug, or bootloader bug, or ... who knows.

I have tried to install some CustomROM to see if VENDOR partition could be written using installation of custom rom.

I have installed NOBLEROM1.3_N9_S9_S9P. Installation went OK, without any problems.

After reboot, phone was still in BOOTLOOP.

I have forced to launch TWRP again and backed up VENDOR partition to see if it was actually written:

Yes, vendor partition is actually low-level writeable.

I have tried at this stage to reflash AP package to see if low-level write of VENDOR partition repaired problem and allowed to flash VENDOR normally through ODIN.

But no, still stucked at VENDOR.

I have readen that TWRP have no capability to flash original custom ROM. Only .zip packages with custom images.

So I have prepared following solution to repair this phone and restore latest stock ROM:

1. Download and extract firmware TARs: AP, BL, CP, CSC.

2. Analyze which files was actually successfully flashed using Odin in AP tars:

<ID:0/008> boot.img

<ID:0/008> recovery.img

<ID:0/008> system.img

<ID:0/008> vendor.img < -- odin hangs here

3. AP actually contained: boot.img, dqmdbg.img, recovery.img, sytem.img, userdata.img, vendor.img

4. I have marked non-flashed files: userdata.img and vendor.img to be flashed OutOfBand

5. I have flashed AP package again using ODIN. After hangup, restarted ODIN pressed Vol-Down + Power for 7 seconds.

6. Phone displayed: Flash failed, please use flash emergency recovery using Smart Switch (but actually still USB bootloader was running).

7. Restarted ODIN and flashed rest of firmware packages successfully: CP, CSC. Also added as USERDATA TWRP package (to install TWRP previously overwritten by AP package, so TWRP could fire-up). It is important to add TWRP at userdata - so it is flashed at the end.

8. Phone was in bootloop again, forced to enter TWRP (volup, bixby, power for 20-30 seconds)

9. Missing vendor.img and userdata.img was lz4 unpacked, and converted to RAW images.

10. Vendor.img was pushed using ADB to /tmp folder

11. dd if=/tmp/vendor.raw of=/dev/block/platform/11120000.ufs/by-name/VENDOR

12. rm /tmp/vendor.raw

13. Userdata.raw was pushed into /tmp

14. dd if=/tmp/userdata.raw of=/dev/block/platform/11120000.ufs/by-name/USERDATA

Why tmp was selected?

We got ~4GB free in TMP (ramdisk?), in meanwhile I have lost access to internal memory through TWRP (0bytes) so i had to pick /tmp to rewrite image.

Also note that userdata.raw after conversion had 16GB, but was truncated to 4GB because of not enough free space in tmp.

This is not a problem, because userdata.img have actual payload of 1.6GB. I have checked raw file after truncated offset, and it was zeroed, so no problem.

At last It was stupid because we can push image directly to /dev/block ;-) Need to sleep a little more to avoid brainfogging.

REBOOTED and phone worked OK - UNBRICKED! Finally escaped from bootloop and back to life.

So I have decided to write software to easily flash and unbrick Your phones out-of-band using USB and TWRP easily.

Nothing hi-tech, but should be helpful as last-resort attempt to unbrick your phones.

I have also reworked solution that way to push converted files directly to /dev/block, skipping tmp.

You can flash all packages, or just those missing ones (as in my cases) to unbrick phone. It is all up to you.

Note that unbricking using NIDOO is actually limited to existing TWRP (or any other ADB capable recovery). Phone I got was in such state that TWRP was already installed.

HOW TO USE SOFTWARE:

First, decicde which parts of firmware You want to flash out-of-band. You can flash all of firmware parts, or just those failed and missing one.

Also, TWRP (or any ADB capable recovery) should be flashed and running at this stage. (read points 1-7 of previous listing)

Flashing target may be also adjusted for other phones, for my N960F that was "/dev/block/platform/11120000.ufs/by-name/", just place other target in app editbox. I guess it will be same for Galaxys using UFS.

Acceptable fileformat to OutOfBand USB flashing is lz4.

It is recommended to backup all avaiable phone partitions (incl. efs) before OOB flashing.

1. Download latest stock firmware package.

2. Rename firmware parts from: AP_N960FXXS8FUC4_CL19869079_QB38960104_REV00_user_low_ship_meta_OS10.tar.md5, to AP_N960FXXS8FUC4_CL19869079_QB38960104_REV00_user_low_ship_meta_OS10.tar

(cut md5)

3. Unpack each part to its subdirectory (WINRAR is ok for that, or any TAR unpacker, including tar)

4. Add LZ4 files to be OOB flashed to Flashing Queue.

5. Click FLASH and wait for results.

6. After flashing all files, phone will be rebooted.

TODO:

Software might be developed in future to add more features. I just had no time to implement TAR autoextraction of firmware package, MD5 verification, etc etc.

Had not so much free time, so wanted to make solution avaiable.

So any futher developments depends on my free time and laziness ;-)

Converted RAW images might be also flashed to memory chip directly.... for that need parse partition PIT table to obtain offsets and of course direct flashing method ;-)

REMEMBER:

While bootloop, to enter download mode keep VolDown+Bixby.

While bootloop, to force TWRP keep VolUp+Bixby+Power.

CREDITS:

Software pack contain Tiny ADB portable, posted by @K3V1991

Software pack contain lz4 binary implementation, credits to all contributors https://github.com/lz4/lz4

Software pack contain simg2img, credits to all contributors https://github.com/anestisb/android-simg2img

App Icon made by Smashicons from www.flaticon.com

CONTACT:

WhatsApp +48 503552016

EMail piotr [ at ] karwos.hk

ABOUT AUTHOR:

Former GSM Business developer between 2005 and 2014, one and only developer of Cyclone Box Device for Nokia Mobile Phones.

DOWNLOAD LINK:

http://www.karwosgsm.pl/nidoo.rar