yashsingh1/xdaforums huggingface dataset:
[Google Pixel 6 Pro] mohamed_emad10:
you can make the device still be recognized NOT just seconds (will NOT unplug) by frequently clicks on the power button NOT pressing like that :

1- plugin the device into your computer and open device manager in windows

2- pressing on power button (keep holding on the button)

3- after you see the device detected and undetected like device is restarting while you keep holding on the power button

Catch that !! The device is detected -> You heard the sound of detected (new device is attached)

you should immediately click on the power button frequently (many times) like in normal way -> turn the screen on and off (lock/unlock)

(keep your clicks on the power till you went to close the connection)

i have tried the solution that's mentioned in the post (multidownloader) but unfortunately i got timeout Error in the tool
[Google Pixel 6 Pro] mohamed_emad10:
You need somebody have experience in embedded systems
[Google Pixel 6 Pro] Lunarixus:
Hey everyone, I respect there are some of you trying to figure out how to unbrick the Pixel 6/6 Pro and I like the progress done so far, however I don't think this forum topic is looking in the correct place

So far I seem to have figured out part of the solution we're looking for here, after some research I've noticed that we're dealing with a bog standard CDC-ACM serial port that allows for reading and writing, armed with this information I seem to have gotten my Pixel 6 Pro to boot into at least bl1, this gets us only 1% closer to unbricking but maybe the smart peeps here can help.

So forget all about using the leaked tools to write data, all you need is a Linux machine and sudo

If you simply run cat bl1 > /dev/ttyACM0 whilst holding down the power button you will begin to get no serial output from the device as it has booted into bl1 at this point however now we have another issue on our hands, getting into bl2, this is a shot in the dark as I would assume the bootloader wants this at a specific offset, thus sending bl2 using the same method results in irom_booting_failure::00000001e0000080e0000080e000008000000000a0031111a0031112a012111300000800b4e0108d00003000000215a8000000000000000000000000

For those wondering why we can't just reverse engineer the bootROM to figure out what to do; we can't just dump the bootROM on these devices as it is located at 0x0 in the TrustZone region thus we can't access it from anything in userspace without a TrustZone exploit.

I hope you guys figure out some more information based on this, for those still trying to use exynos-usbdl there is a fork on my GitHub at https://github.com/Lunarixus/exynos-usbdl which has full Linux support and debug mode enabled.

Have a great day.
[Google Pixel 6 Pro] mohamed_emad10:
is there any update, have anyone resolved this issue?
[Google Pixel 6 Pro] uukelele:
Hi,

Does this work with the pixel 6a? It has the same google tensor processor so I was wondering
[Google Pixel 6 Pro] ok6669:
Hello friend,do you know how to unbrick the hardware pixel6 pro ?
[Google Pixel 6 Pro] Healing_tea_:
Has anyone managed to revive the Pixel?
[Google Pixel 6 Pro] dkadds2:
@pierre383, would you mind please make suggestion if P6p in bootloader (locked) mode could be revived back to live?

Recovery/restore doesn't work and it claims

No valid operating system could be found.
The device will not boot.

ID: 42ed1bca
Code:3

It is more described here

https://xdaforums.com/t/pixel-6-pro-soft-brick-or-hard-brick.4568341/

and more from this post too:

https://xdaforums.com/t/discussion-...third-party-magisk-fork.4460555/post-88323311

Thanks a lot! Maybe I don't need to go that low level if bootloader works? With that said I don't know what else can be done (bootloader locked, can't change slot, etc.) hence I think it is a hard-brick.
[Google Pixel 6 Pro] yuuou:
如何下载此附件？
[Google Pixel 6 Pro] yuuou:
Has this problem been solved?
[Google Pixel 6 Pro] IIJIALLL:
Hello!

Doing everything according to your instructions, an error occurred: Timeout Error! What could be the problem? Did everything work out for you? Can you post your .bin files?
[Google Pixel 6 Pro] IIJIALLL:
Download tools: http://www.mediafire.com/file/sg5m2ti3k6a63z5/USB_Down_Load_32bit.zip

In folder USB_DownLoad_Tool there is a folder Disk1

Connect phone and hold power button.

Windows will detect exynos7420 device, install Driver:

click manually,

com and lpt ports,

have disk,

point to data1 folder.

Don't run setup from Data1 folder!!!

Now we have to copy

WinDNWApi.dll

WinDNWApi.lib

in:

c:\Program Files\SAMSUNG\Exynos USB Driver\Drivers\

Probably there is no this folder, just create it and copy 2 files.

Don't copy WinDNWApi.dat as it is written in original manual, this file is for older exynos chip and procedure will not work, everything works without this file (it only has maps for 5250 and some other cpu)
[Google Pixel 6 Pro] 2Wires:
I'm also stuck with

[COM3]Write thread Start##################

[COM3]Write Fail

[COM3]Write thread Exit##################

Do we know the format of the .cfg files? Maybe it has to be changed a bit so it flashes quicker?
[Google Pixel 6 Pro] ntfs from 4pda:
Hi!

Anybody posted pack of *.bin files for Pixel 6/Pixel 6Pro?
[Google Pixel 6 Pro] ntfs from 4pda:
Please, could you write manual how to separate boot.bin file on necessary parts for multidownloader software.
[Google Pixel 6 Pro] ok6669:
come on
[Google Pixel 6 Pro] mark332:
assuming you guys using it only on a hard bricked device
[Google Pixel 6 Pro] ntfs from 4pda:
I have unpacked your archive, but It's the usual set of utilities. Do you know for what device (Pixel 6 or Pixel 6 Pro or any) the split boot files in directory?
[Google Pixel 6 Pro] ok6669:
the hard brick always flash when link to the WINDOWS,I can't find the esynos USB/COM3.what should I do
[Google Pixel 6 Pro] ntfs from 4pda:
Hold 20-30 sec three button and plug typeC connector at phone. Traying repeat this procedure more time for the time being the device switchON in stable state.

And trying any combs of holding buttons

But I have any question Who has separated boot files for Pixel 6?
[Google Pixel 6 Pro] abrmbaloch:
oh I see it ! it means I need split bootloader.img to 4 bin files .

so it we can get 64bit drivers , it means newly computer and windows is useable?
[Google Pixel 6 Pro] yonaikymatos:
THERE IS STILL NO WAY TO REVIVE THE PIXEL ?,

I HAVE BEEN TRYING FOR DAYS
[Google Pixel 6 Pro] amaroney55:
https://eshard.com/posts/pixel6_bootloader hey this article is based on the pixel 6. but maybe this can complete the puzzle in restoringf our dead devices.
[Google Pixel 6 Pro] dima424658:
I've extracted the bootloader (1.3-10362403 from Android 14 Beta) with imjtool. Here's the list of entries:

0: ufs (0xc5 bytes [USER=4224642]@offset[/USER]: 0x800)
1: partition:0 (0xe98 bytes [USER=4224642]@offset[/USER]: 0xa00)
2: partition:1 (0x590 bytes [USER=4224642]@offset[/USER]: 0x1a00)
3: partition:2 (0x590 bytes [USER=4224642]@offset[/USER]: 0x2000)
4: partition:3 (0x150 bytes [USER=4224642]@offset[/USER]: 0x2600)
5: bl1 (0x3000 bytes [USER=4224642]@offset[/USER]: 0x2800)
6: pbl (0xc000 bytes [USER=4224642]@offset[/USER]: 0x5800)
7: bl2 (0x85000 bytes [USER=4224642]@offset[/USER]: 0x11800)
8: abl (0x1d2000 bytes [USER=4224642]@offset[/USER]: 0x96800)
9: bl31 (0x16000 bytes [USER=4224642]@offset[/USER]: 0x268800)
10: tzsw (0x6e2000 bytes [USER=4224642]@offset[/USER]: 0x27e800)
11: gsa (0x43000 bytes [USER=4224642]@offset[/USER]: 0x960800)
12: ldfw (0x3e8000 bytes [USER=4224642]@offset[/USER]: 0x9a3800)
13: ufsfwupdate (0x54 bytes [USER=4224642]@offset[/USER]: 0xd8b800)

But there's no elr_el3.bin and lastly.bin
[Google Pixel 6 Pro] ntfs from 4pda:
Are you tried to unpacked more older build of Android like is A13 for this device by this tool?
[Google Pixel 6 Pro] dima424658:
Android 13 has two ufs entries at the beginning

0: ufs (0xc5 bytes @offset: 0x800)
1: ufs (0xc5 bytes @offset: 0xa00)
2: partition:0 (0xe98 bytes @offset: 0xc00)
3: partition:1 (0x590 bytes @offset: 0x1c00)
4: partition:2 (0x590 bytes @offset: 0x2200)
5: partition:3 (0x150 bytes @offset: 0x2800)
6: bl1 (0x3000 bytes @offset: 0x2a00)
7: pbl (0xc000 bytes @offset: 0x5a00)
8: bl2 (0x85000 bytes @offset: 0x11a00)
9: abl (0x1bf000 bytes @offset: 0x96a00)
10: bl31 (0x16000 bytes @offset: 0x255a00)
11: tzsw (0x534000 bytes @offset: 0x26ba00)
12: gsa (0x44000 bytes @offset: 0x79fa00)
13: ldfw (0x3e8000 bytes @offset: 0x7e3a00)
14: ufsfwupdate (0x54 bytes @offset: 0xbcba00
[Google Pixel 6 Pro] Ziauddin_Sameer:
@pierre383

I got this output.

[COM3]Write thread Start##################

[COM3]Write thread Exit##################

I got this output. Maybe it flashed. If it did what's the next step? Thanks.
[Google Pixel 6 Pro] VorticityFlux:
Thanks man!

I've managed to recover my 'Hard bricked' Pixel 6 by exploiting CVE-20220-20120 mentioned in the blog post you shared. Took me a whole 4 days of work to get there, but I've gained much more than just a fixed phone, the experience is priceless.

This method works if all of the following is true:

1. Bootloader was not updated with CVE-20220-20120 mitigation (~June 2022, i.e. if you had an Android 13 installed at some point, you are most probably out of luck)

2. You can enter bootloader fastboot mode (Holding 'Vol Down' while powering up would show 'Fastboot mode' with phone details)

3. Bootloader responds to fastboot commands (replies do not matter, 'You are not allowed to do that, your phone is locked' is perfectly fine)

Adding further hint to what is already disclosed in that blog post (without setting myself up): "68 is a truly magical number ;)"
[Google Pixel 6 Pro] HtcDesire2:
I bricked my device while flashing android 14 b5.1 using Platform tools 34.0.4 :(

Now no way to recover it. I am in an unsupported country and device is no longer under 3rd party warranty.
[Google Pixel 6 Pro] HtcDesire2:
If you can enter bootloader fastboot mode - then its not hard-brick
[Google Pixel 6 Pro] adbbula:
Please, can you explain the method step by step :(
[Google Pixel 6 Pro] HtcDesire2:
Did someone try to disconnect and reconnect the battery and try to boot into fastboot?

I had a similar issue on my pixel 2 and this step helped me once.
[Google Pixel 6 Pro] VorticityFlux:
Well, it is, if your gsa1 partition is damaged and bootloader simply refuse to execute any command as it is unable to check if it locked or not.
[Google Pixel 6 Pro] VorticityFlux:
It's not exactly user-friendly method. There's no ready-made tool. It involves poking around your firmware in IDA to find offsets etc. I can give further pointers in PM but none of it will work if you had Android 13 installed on your phone in any point of its life.
[Google Pixel 6 Pro] VorticityFlux:
How did you manage to boot to bl1?

I've tried sending both real bl1 and just random garbage, I get 'irom_booting_failure::...' for both, so I don't think it's booting bl1.

I did get 'bl1 header error/mismatch' (not exact quote) a couple of times, but that's not reproducible (I've played around with cat'ing bl1 with random delays).
[Google Pixel 6 Pro] VorticityFlux:
I have the same behavior. If I hold all 3 buttons I can enter "Pixel ROM Recovery" for about 30 seconds. If I let go any of the buttons it disconnects immediately. 'exynos_usb_booting' is a marker for, you guessed it, USB booting for exynos SoCs. Unfortunately I was not able to find protocol description in public domain.

We can't reverse engineer to protocol either as we don't have the bootROM dump. There seems to be two roads from here:

a) Difficult one. The address bootROM is known (0x0, mirrored to 0x2000000) but I wasn't able to dump it from code injected into bootloader (running at EL1/EL2). I might be wrong here, but it seems to need EL3 in order to access those addresses. So we'd need to find yet another exploit (vulns are there, the exploits are not public) to access EL3, dump the bootROM and reverse it.

b) Less reliable but probably easier. Recent versions of Chimera tool introduced support for "Samsung Exynos boot repair". So if we find someone with a recent Samsung phone and a Chimera tool and make a USB dump of what's going on on the wire during 'exynos_usb_booting'. Protocol supposedly should be similar enough to make sense of how we should send parts of the bootloader in the "Pixel ROM Recovery" mode.
[Google Pixel 6 Pro] VorticityFlux:
More info on EUB (Exynos USB Booting) and Chimera tool.

Exynos TP collection for EUB mode - GSM-Forum

Exynos TP collection for EUB mode We created this thread as a help for our new update: First of all, what is the EUB? Exynos USB Booting (EUB) mode is

forum.gsmhosting.com

Samsung Exynos Boot repair - ChimeraTool help

In this document, we are going to show you how to perform a Boot repair procedure on Samsung Exynos devices in EUB (Exynos USB Booting) mode.

chimeratool.cn

(I hope these links are allowed, I have no affiliation to that at all)
[Google Pixel 6 Pro] Deadlykitten23:
Hey,

I can help with this as I have got access to Chimera. I do not have a Samsung phone so:

I will consider buying a 2nd hand phone if you or someone commits to works on your proposed solution.

Alternatively if someone can temporally send me a Samsung device, i can generate the required dumps.
[Google Pixel 6 Pro] hi_s10e:
is there anyone recovering their pixel 6 pro? i bricked my pixel and i have no idea how to unbrick it...
[Google Pixel 6 Pro] satapreda518:
No luck yet for hardbricks
[Google Pixel 6 Pro] HtcDesire2:
Finally bought a new motherboard from AliExpress as there is no way to revive from EDL mode. Installed and all good, my pixel 6 is alive again.

Typed from pixel 6 :)
[Google Pixel 6 Pro] GohanBurner:
This seems like a nightmare.
[Google Pixel 6 Pro] 0V3Rlord:
Anyone solved this problem? I have the same issue with 7 Pro model
[Google Pixel 6 Pro] rhcp011235:
Anyone able to get this compiled on OSX (M1/M2/M3) hardware?

Been playing around for awhile, I cant seem to get libusb to link properly
[Google Pixel 6 Pro] mumaren:
I have the same issue with pixel 6 model
[Google Pixel 6 Pro] ominiscience:
Hi folks, I made the com port stable.

But that software still doesn't do the job.
[Google Pixel 6 Pro] kennedytruong:
I just wondering if it could work with Pixel 7, please have instruction also, @pierre383, thanks so much !
[Google Pixel 6 Pro] marinora:
Hi guys, so I tried it and cannot get it working, just ended up grabbing a new one, for the future, use: https://flash.android.com to flash roms, sad my white phone had to die(
[Google Pixel 6 Pro] samsnorlax:
I'm currently facing a similar challenge with my Pixel 7 Pro, where I locked the bootloader before making sure everything was back to stock and now its just giving me "No valid operating system could be found". Could you share more details about how you managed to establish communication with the phone and any code you used in this process? would love to try it out on my end.
[Google Pixel 6 Pro] ActuallyJammy:
DPM is probably the Dynamic Partition Management. This allows system partitions to grow or shrink in size depending on usage. Just used to house resizable system partitions. Probably empty cause pixel phones don't use them anymore, since A/B updates eliminate the need to dynamically resize partitions as DPM does. I'll research a bit more about "EPBL" and see what I can find. I'm so interested cause I bricked my Pixel 6a about 4 months ago, while manually flashing the partitions, instead of the Google Flash website, and had to send it to Google Repair. It was the CDC-ACM interface/and also identified as "Google Pixel ROM Recovery.". I expected the diagnostic to say it was a "software issue", but I got this instead.

Weird, right? Well, I'll keep on researching. Good luck to you all!

Edit: I'd love to get a bricked Pixel 6/7 series to try and fix it, but I'm not willing to brick my p6a.
[Google Pixel 6 Pro] lakhwani009:
can you please share more info on this, my pixel 6 died yesterday and i have no clue what to do , please share the link of aliexpress and how di you replace it yourself
[Google Pixel 6 Pro] hbiel:
Do you still have the same IMEI as before?

I am wondering If they just swapped the mainboard.

I have a similar case with a Pixel 8 Pro and they Just diagnosed "Screen - display problem" today.

Such a shame that they don't just provide low level tools to reflash the device in these rare cases.
[Google Pixel 6 Pro] ActuallyJammy:
Yeah, the IMEI is different... I guess they don't have the tools THEMSELVES to unbrick their devices? At this point that is so ****ing stupid. Just cause they use a weird processor doesn't mean they can't make their tools unbrick them, or else that weird EDL interface wouldn't have been created. There are a lot of odd things, but maybe I'll try to unlock with Chimera next time.
[Google Pixel 6 Pro] cmcb1245:
Hi I have a pixel 7 that's currently in the EUB type state right now, it's been bricked for about 2 weeks now but I did have an Idea.

Since normal patched odin doesn't detect the device and needs tar.md5/tar files I was pretty sure that sometimes them tar files contain ext4 and bin files (for example system.ext4 and up_param.bin) so I was wondering if you could get any type of bin variants of these bootloader files to be compressed/compiled into the tar format as there is a BL Tab for Odin and modify either the driver information or odins detection or whatever it uses to detect deviced to allow the "PIXEL ROM RECOVERY" or "USB Serial Device" To be detected as a device in odin and flash the the compiled/compressed tar file through the BL Tab

Just a suggestion, I don't know how I would do it but since my device can be detected through serial com ports kind of like what comes up when you enter download mode in Odin (COM1 etc) if that would have the necessary capability to flash the bl files, I would try to do this myself but sadly my laptop hasn't powered on since last week,

(When I say odin I'm talking about patched odin)

Sorry if this is a dumb idea or has already been tried but just thought I'd contribute a bit as I do need this phone
[Google Pixel 6 Pro] badabing2003:
Is odin able to detect your device and connect to it?

I know that if you extract boot.img, (in Samsung's case boot.lz4) and tar it without compression and flash it as AP, it works, this is how I root.

So perhaps you can do the same trick with other images.

Something to try, assuming that odin detects your device.
[Google Pixel 6 Pro] r4dsl4x:
Hi, has anyone had success with this yet? I bought a pixel yesterday and today I bricked it. I'm f' depressed
[Google Pixel 6 Pro] r4dsl4x:
hello, nice to meet you pierre

when extracting the bootloader image, I get several files, should I install all of them? I need your help comrade, I attach the image. My phone is a pixel 8, if pixel 6 has a tensor and it works, it should work on mine too... (hope so)
[Google Pixel 6 Pro] ActuallyJammy:
theres a reply between the first pages that explains these files
[Google Pixel 6 Pro] Sash52:
I stumbled across Google's debugging tool "usb-cereal" which connects to serial TX/RX lines on SBU1/2 pins: https://github.com/google/usb-cereal

Not sure if debug serial is enabled in EDL mode, but at least there is a chance to get additional debug output.

It is reported to work on Pixel 6 (by a postmarketOS dev), so it might be worth a try. Ready-to-use versions can be obtained via Mouser or Crowdsupply.
[Google Pixel 6 Pro] cmcb1245:
I have a pixel 7 that's in the mode you need it to be in when you hold the power button but I don't have to hold it so would it work for me?
[Google Pixel 6 Pro] cmcb1245:
FOUND SOMETHING REALLY WEIRD,

USED A ROOTED ANDROID DEVICE TO LOOK AT THE BINARY OF THE CONNECTED DEVICE AND IT JUST REPEATS THE SAME THING OVER AND OVER IN THE FILE
[Google Pixel 6 Pro] bangprovn:
Any update on this thread, have a Pixel 8 Pro having the same problem. Trying to replicate the XMODEM method and I got at the same situation as described on the post above. (except I can't consistently enter the BL1 req)

There are some thoughts that maybe worth reading.

From what I observed, seems like all the Google Tensor are using the same Bootrom code, if we somehow do an exploit chain to dump the bootrom of any of the Google Tensor device, it could be used on all Tensor devices exist.

There could be a structured header for the XMODEM protocol to read (apart from the BL1 header itself, which may contains some kind of magic header for the device to work, my best guess is that we can only figure it out if we somehow manage to dump the bootrom, again. At this state, performance is critical, so any kind of encryption or anything should obviously not implemented (IMO) so best interest is a magic header for it to recognize the correct tool.

The exynos bootrom exploit reveals that they also apply the same structured data for data sent to the bootrom. It would be awesome if someone can attach full bootrom so I could research more on the 32bit unknown integer this article refers to (could be some kind of reserved magic header that Samsung didn't use, but maybe Google implemented it).

To sum it up, any exploit on the Google Titan M2 could potentially shed a light into this problem. Other than that, I think just trying our luck would not be the best thing to do now. I'll temporarily stop working on this matter and suggest anyone who are still trying to do this get a better approach.
[Galaxy Tab 2 Q&A, Help & Troubleshooting] fabulas_:
On a tablet Samsung Galaxy tab 2 10.1 (3G) I installed Lineage OS 14.1, then after I installed the PICO Gapps I realized that the settings screen of the tablet was completely white without any writing .. At this point I tried to reflash from TWRP Lineage but it gave me an error, I then tried to do a factory reset wipe but the automatic startup configuration of lineage crashed, I then tried to make a format given by TWRP and this once android started but I found the gapps and the white screen on settings, how should I do so that I cleanly install the rom in order to solve the problem of the white screen in settings, then trying to install the gapps avoiding that it recurs the white screen problem in settings? Thanks a lot to those who want to help me, I don't know how to solve it.
[Galaxy Tab 2 Q&A, Help & Troubleshooting] fabulas_:
I tried to do an advance wipe (Davilk, System, Cache, data and internal storage) and then I made a format data, doing so I flashed the rom correctly without errors, immediately after I also installed the pico gapps, thinking that maybe installing them at the same time as the rom that problem of the white screen on settings would not have arisen, while instead nothing has changed unfortunately .. so now I wanted to reflect the rom and try to solve differently with the gapps, but it always gives me error 7 as you can see from screen, the first time it worked facendadvance wipe and formed date now even doing this I always get this error ... the strange thing is that it worked before and now it doesn't ... someone can help me to solve it please?

read here in the post I wrote, practically the first time it worked by reading the guide you gave me and I managed to flash the rom, then I immediately put the gapps back thinking that maybe installing them together with the rom they worked while I always have the problem of the screen white ... so I wanted to reflect the rom without putting the gapps back and then maybe try to install them differently but it gives me the usual error and it does it even if I delete everything as the guide you sent me that the first time had worked ...someone can help me to solve it please?