yashsingh1/xdaforums huggingface dataset:
[OnePlus 9 Pro] jarettmiller:
Hey Folks,

New to rooting and new to this forum so I apologize ahead of time.

I recently purchased a OnePlus 9 Pro(LE2125) to root and run a custom ROM on.

It quickly became obvious that the current guides don't work for 12 & 13 due to Colors.

The code *#*#5646#*#* no longer works to access the Engineering Mode.

HOWEVER after alot of digging I found that:

Code *#9434# enters an Engineering mode that needs a Token that is generated with a timestamp to be decrypted.

After scouring the different forums and using Google translate alot it seems that OnePlus is using the same system as OPPO and that the Oppo Unlock Tool available by searching is able to unlock/Decrypt the OnePlus Engineering Mode.

I am not a deverloper and have no experience with this..... I'm hoping someone here can point me in the right direction so I can get this darn thing unlocked.

-Cheers
[OnePlus 9 Pro] Steve0007:
Try this module thru Magisk
[Android Q&A, Help & Troubleshooting] Oswald Boelcke:
Hello and good morning, @shadow#

Prior to your next posting please read the guidances that are stuck on top of every forum like

[ATTN] : Read before posting - Any questions posted here will be MOVED or CLOSED

!!! Please pay attention before posting !!! Any question threads posted in this forum will either be closed or moved. Forum Searching | Posting | The Basics: Forum Rules Forum Search Search Forum using Google XDA "Mantra"

xdaforums.com

and the others. I've moved the thread to Android Q&A.

Thanks for your cooperation!

Regards

Oswald Boelcke

Senior Moderator
[Android Q&A, Help & Troubleshooting] silo24:
I've got about as far as you.....although have managed to prove the telnet can be accessed on the 7.2.3.0852 version also.

If you dowwnload the full .ld software, there is a folder in there called Config, with a file called Global.cfg.

Have a look at that file....there are a lot of flags that can be set/unset. Might be a good place to work from.

Note, i'm on 7.2.3.0852, so I have ssh access but not the ability to execute additional code via ";"

My sim is simply to hsve Spotify on the unit!
[Android Q&A, Help & Troubleshooting] shadow#:
Well, this was fast :( I seem to have bricked the device already.

I tried to unpack the boot.img I got from the device, make a very small change with CarlivImageKitchen (starting adbd) and then write the packed image back to the device.

On reboot I now get the first Polycom screen and that's it.

The 4 finger revovery does no longer work, it's just stuck and does not continue.

Lacking any kind of connection to the device I guess it's time to bin it and move on.

That is, unless anyone has any more ideas on what I could try.
[Android Q&A, Help & Troubleshooting] tjump7:
Maybe there's UART lines available?
[Android Q&A, Help & Troubleshooting] silo24:
Will it respond to a ping? May just be the gui/application stack that's crashed.

If so, you may be able to get it to boot from a provisioning server.
[Android Q&A, Help & Troubleshooting] shadow#:
I'd have to figure out how to take it apart for this first and then start from scratch with no knowledge, probably including getting all the tools.

Tempting but not sure it's worth it ;)

It does not even react to the 4 finger recovery method any more.

Pretty sure that's way before there is any network. No link.
[Android Q&A, Help & Troubleshooting] tjump7:
Just a Pi Pico I believe is needed for the hardware aspect, as for the tools, i don't know what you currently have. I'm just trying to come up with ideas for you :)

Quick edit, here's a link if you're curious at all: https://github.com/Noltari/pico-uart-bridge
[Android Q&A, Help & Troubleshooting] silo24:
Try a usb stick. Try with a full zip file first, then try with the 0000000p.cfg and the xxxxx.sip.ld file only.
[Android Q&A, Help & Troubleshooting] shadow#:
It no longer reacts to a USB stick and I cannot trigger the recovery as that is not a real recovery but instead part of the boot image. Which I unfortunately messed up.

The bootloader is u-boot but I cannot access it. Config is:

baudrate=115200bootcmd=if key VOL_UP; then android recovery; else android; fi;bootdelay=1brcm_dt_enable=yesbrcm_dt_size=0x10preboot=vc runwatchdog=off

The volume keys are soft keys, so no luck there either.
[Android Q&A, Help & Troubleshooting] silo24:
Have you tried the micro-usb port to a PC? If it's that screwed it may be in a recovery mode of some sort. Like Qualcomm QFIL for example.

Any ideas what chipset these things run on? They are going so cheap on eBay now that I've just bought another!
[Android Q&A, Help & Troubleshooting] shadow#:
I tried but nothing was detected.

I got stuck half way through my teardown attempt after taking out all visible screws.

View attachment 5836739

I fear the display is glued on with more screws underneath, I have no clue how to remove it.

Any ideas?

There's FCC pictures available of the insides of the 8500 <- that's actually an 8800!

8500 VOIP Conference phone with Bluetooth functionality Teardown Internal Photos report131453884415308571 Polycom .

VOIP Conference phone with Bluetooth functionality Internal photo details for FCC ID M72-8500 made by Polycom Inc.. Document Includes Internal Photos report131453884415308571

fccid.io

I see quite a few unpopulated headers on that board!

If only I could get to them :(
[Android Q&A, Help & Troubleshooting] shadow#:
Alright!

That was some nasty glue, but I finally managed to get it open.

The display is glued on, mostly on the sides. The NFC antenna on the left as well as the soft buttons on the right are glued back and front and need to stay on the display - so currently no idea if they are still ok.

The display connector comes from the back at the top of the display and connects in the lower part. Display needs to be flipped upwards to get to the last screws. As long as any wedging is limited to the left and right sides it is possible to get if off without damaging the display.

I still get the Polycom logo.

Here is some pictures of the bottom of the PCBs.

View attachment 5837545View attachment 5837547View attachment 5837549

The last one has the Wifi Board and a curious little connector that is unused.

Could this be a service port?

View attachment 5837551

Now what should I try next?
[Android Q&A, Help & Troubleshooting] shadow#:
So I found an old FTDI232 that should work on my Macbook and started checking all of the 4 pin headers for potential UART.

View attachment 5837561

I set the terminal to 115200 8-N-1 with no flow control and connected GND and RX.

I tried for a few seconds each after powering the device.

Unfortunately, I got absolutely nothing apart from some noise on some on them as soon as power was provided.

That port in the image above I have no connector for, it's probably something else anyway.

What else could I try?
[Android Q&A, Help & Troubleshooting] tjump7:
J1 indicator....could be for JTAG potentially?

EDIT: After looking again I can see I'm probably wrong, but that may still be your UART interface?
[Android Q&A, Help & Troubleshooting] shadow#:
Could actually be JTAG as it seems to be double sided, 4 more pins at the top.

Three of them measure 1.8V when powered, the rest seems to be at 0V.

But I have no way of properly connecting to it.
[Android Q&A, Help & Troubleshooting] tjump7:
Do you by chance have a logic level converter? Would make talking to 1.8v much easier
[Android Q&A, Help & Troubleshooting] shadow#:
Unfortunately not, not even anything JTAG related.
[Android Q&A, Help & Troubleshooting] tjump7:
How important is this project to you? The logic level is cheap (and that may be I2c as well, no real clue)

4-channel I2C-safe Bi-directional Logic Level Converter

Because the Arduino (and Basic Stamp) are 5V devices, and most modern sensors, displays, flashcards, and modes are 3.3V-only, many makers find that they need to perform level ...

www.adafruit.com
[Android Q&A, Help & Troubleshooting] silo24:
Any chance of identifying the underlying SoC? Obviously it's reporting itself as bcm911130, but I suspect that's a Polycom specific part number....i.e. a Standard cellular Android SoC with elements that aren't utilised blocked out.

Might give more of an idea as to the Bootloader structure.
[Android Q&A, Help & Troubleshooting] silo24:
And I know it's pretty generic, but try this:

How To Flash Stock Firmware Via DFU (Broadcom Download Firmware Utility)

Once you have downloaded the firmware file or stock rom that you wish to flash, follow the instructions below to learn how to use Broadcom Download Firmware utility (DFU) with ease. If you have any issues, post in comments section for assistance. Requirements Broadcom USB Driver – Download...

www.leakite.com

Download DFU Flash Tool (all versions) - Broadcom Flash Tool

Download the latest version of DFU Flash Tool to flash stock firmware on any Broadcom Smartphone and Tablets in few clicks only.

androidmtk.com

I suspect that even though the volume button is a soft button, it may still work.
[Android Q&A, Help & Troubleshooting] shadow#:
To be honest I don't want to get new hardware for this and also have no experience with JTAG.

To figure out more I guess I have to take it apart further and see if I can get the shields off.

Will try that but it might take me a while.

As for the bootloader, it seems to still be doing something as the logo is displayed.

If needed, I pulled all the data off the device.
[Android Q&A, Help & Troubleshooting] silo24:
So i did some further research....

The BCM 911130 sounds like it's a custom version of the BCM111XX family.

BCM11107

Flagship Ethernet Multimedia IP Phone System on a chip (SoC) in the next generation of Broadcom IP communications processors.

www.broadcom.com

The clue is the gigabit interface that most SoC's don't tend to support, as well as the support for the audio capabilities.

And once you get to there......

https://docs.broadcom.com/doc/1211168558409
[Android Q&A, Help & Troubleshooting] shadow#:
That does not work.

Even if it did work, I have nothing compatible I could flash with this software, as far as I can see.

There is however some interesting news:

There is a 2 pin header on the device labeled JP1, so I guess a jumper.

If I short this and power it, the device does not try to boot up (no screen or lights) but instead I get an unknown USB device on my PC!

I had installed those DFU drivers before, so I guess it's not that.

What could it be and could it be of any help?
[Android Q&A, Help & Troubleshooting] silo24:
Have a look in the device manager and see if you can find any unique device identifiers.....it may be that the underlying OS uses a different driver structure.

Crazy thought.....get Windows to try and find a driver for it?
[Android Q&A, Help & Troubleshooting] shadow#:
No luck.

USB ID is 0A5C:E720 and I didn't manage to find any drivers
[Android Q&A, Help & Troubleshooting] silo24:
CCX 400 USB update failed

Was updating CCX 400 via USB and upon reboot 'android failed'. I cannot use volume up/down to move highlight but touch screen scroll up/down works. However there is nothing to use as a 'power button' to accept the choice. Upon cycling 'switch hook' about 10+ times the highlighted choice...

community.poly.com

Try option 1 on the link above......sounds promising!
[Android Q&A, Help & Troubleshooting] shadow#:
Got fastboot to connect to Windows but it would not flash anything.

Trying to erase boot gives me erase command not supported

Trying to flash with fastboot flash boot boot.img also does not work and gives me an error stating boot partition size: 0

Also no luck in U-Boot.

I don't know how I can access the USB stick.

What should be USB on Device 1 gives me

u-boot> mmc part

kona_mmc_send_cmd: waiting for status update

kona_mmc_send_cmd: waiting for status update

kona_mmc_send_cmd: waiting for status update

Card did not respond to voltage select!

## Unknown partition table

(it's FAT32)

Device 0 just get's stuck completely

u-boot> mmc part

Partition Map for MMC device 0 -- Partition Type: EFI

and I have to reboot the device
[Android Q&A, Help & Troubleshooting] shadow#:
Managed to force-boot recovery and can get adb there, but...

$ adb devices

List of devices attached

0123456789ABCDEF recovery

$ adb shell

- exec '/system/bin/sh' failed: No such file or directory (2) -

Any ideas? 🥺
[Android Q&A, Help & Troubleshooting] shadow#:
We know that now, it's a BCM28155 Capri A3 Videocore, seems to be the same as in the FireTV Stick Montoya.

But U-Boot seems to have no TFTP or USB support, Fastboot won't flash anything and Android Recovery doesn't have any /system mounted, hence no shell.

Unless I can figure out how to access a USB stick from U-Boot or transport data over RS232 and write/run things from there, or somehow get Fastboot to work, that's as far as I'll get on my own.
[Android Q&A, Help & Troubleshooting] silo24:
Anything in here help you out?

Lock and unlock the bootloader | Android Open Source Project

source.android.com
[Android Q&A, Help & Troubleshooting] silo24:
I've got a spare 8800 on my desk.....it's fully functional as it stands, but think I'll try and activate ADB via the telnet method.....see if I can boot it into fastboot or bootloader from there.
[Android Q&A, Help & Troubleshooting] shadow#:
Most of the fastboot commands just returned that they are not supported, nothing about it being locked. The flashing just always failed or got stuck and my computer not detecting the device properly during USB handshake gave me the right clue in the end:

It was the bloody USB cable! I replaced it and could flash via fastboot.

I first tried with the image extracted from the Polycom firmware, leading to a rather surprising boot magic not found and then again with the image I originally pulled from the device.

That led to it booting up to a black screen for some reason but enabled me to restore from USB via the 4 corners method.

We are now officially back to "how do I modify a boot.img in a way so actually it loads on this bloody thing"

🥳
[Android Q&A, Help & Troubleshooting] tjump7:
Congrats on the unbrick!
[Android Q&A, Help & Troubleshooting] shadow#:
I am quite confident that that UART connector is a JST GH 4pin 1.25mm pitch.

I just ordered some pre-crimped plugs so I can glue a little connector in the lock receptacle before I attempt to reassemble everything and put all the screws back in.

I am still amazed that my ham-fisted disassembly seems to have left all the electronics intact.
[Android Q&A, Help & Troubleshooting] silo24:
Ok...so that was a fun night.

So I spent a few hours messing around with ADB/ADB Shell & Telnet.

After much fiddling, I managed to enable the inbuilt launcher and disable the Polycom Launcher, Watchdog and Settings apps. ( also disabled Zoom and pinyin input for good measure!)

C:\platform-tools>adb shell pm list packages -d

package:us.zoom.zrc

package:com.polycom.polylauncher

package:com.android.inputmethod.pinyin

package.polycom.home.spipgui

package:com.svox.pico

package:jp.co.omronsoft.openwnn

C:\platform-tools>adb shell pm disable-user --user 0 com.polycom.polysettings

Package com.polycom.polysettings new state: disabled-user

With all the above disabled, and most importantly enabling the standard android launcher, which is disabled by default, I managed to get about 30 mins of continuous use without a reboot.....

Sadly though, when the reboot came, it did a full restore.....

Internal logs show this sequence as it does its reset:

05045.364|app1 |5|00|AppUiC::TimerOut500ms() - Re-initializing GUI after 111 ticks, failure 20 consecutive 1

005046.368|acom |4|00|App "spipgui" has failed to read a message, error number = 104

005046.368|acom |5|00|AppComServer encountered a connection error.

005046.368|acom |4|00|Application spipgui from 127.0.0.1 [37608] has been disconnected.

005046.371|acom |4|00|App "ec" has failed to read a message, error number = 104

005046.371|acom |5|00|AppComServer encountered a connection error.

005046.371|acom |4|00|Application ec from 127.0.0.1 [38376] has been disconnected.

005046.384|acom |4|00|App "dbs" has failed to read a message, error number = 104

005046.384|acom |5|00|AppComServer encountered a connection error.

005046.384|acom |4|00|Application dbs from 127.0.0.1 [37864] has been disconnected.

005046.388|acom |4|00|App "osd" has failed to read a message, error number = 104

005046.388|acom |5|00|AppComServer encountered a connection error.

005046.389|acom |4|00|Application osd from 127.0.0.1 [38120] has been disconnected.

005047.231|pgui |*|00|Initial log entry. Current logging level 4

005047.550|app1 |4|00|UpdateDeviceLanguage: No entry for index 76

005047.550|app1 |4|00|UpdateDeviceLanguage: No entry for index 77

005047.550|app1 |4|00|UpdateDeviceLanguage: No entry for index 78

005047.550|app1 |4|00|UpdateDeviceLanguage: No entry for index 79

005047.550|app1 |4|00|UpdateDeviceLanguage: No entry for index 80

005047.551|app1 |4|00|AppUiC::onConnected - Resetting the previous backlight state.

005048.308|pgui |4|00|CPolyCoreCommunicator::connectNotify - osd - enter

005048.309|pgui |4|00|CPolyCoreCommunicator::connectNotify - osd - exit

005048.310|pgui |4|00|CPolyCoreCommunicator::connectNotify - dbs - enter

005048.310|pgui |4|00|CPolyCoreCommunicator::connectNotify - dbs - exit

005048.339|pgui |4|00|CPolyCoreCommunicator::connectNotify - ec - enter

005048.339|pgui |4|00|CPolyCoreCommunicator::connectNotify - ec - exit

We go again tomorrow......aimiing for Fastboot and OEM Unlock.
[Android Q&A, Help & Troubleshooting] shadow#:
I wasn't quite as busy as you but I messed with the userAllowed setting a bit.

It seems that the one force-rewriting it to false is the PolySettings app. Can't see from where.

The actual removal of the user-installed apps seems to come from the polyapp binary.

I did manage to install something and the good thing is that it survives a reboot.

Next step would be to try and see if a shortcut can be assigned.

The Polycom launcher steals focus after a while, which is already annoying enough when setting up WiFi without any modifications.
[Android Q&A, Help & Troubleshooting] silo24:
I think we need to find out what app is 'receiving' the heartbeat and find a way to disable that too.

All those Polycom apps are disabled on mine, so it can only be something else hidden.

I suppose a forced uninstall may be worth a shot....
[Android Q&A, Help & Troubleshooting] shadow#:
In the meantime, my cable arrived in the mail.

I managed to put everything back together and keep permanent access to UART.

I also got another device (unfortunately damaged) and am now pulling 5.5.4.2255 images off it.

If you have any modified boot images that you would like me to try out, just let me know!
[Android Q&A, Help & Troubleshooting] shadow#:
LOL, I managed to mess it up once again.

I tried updating to v7 and then accidentally wrote a v5 old boot.img, only to realize that I had forgotten to taken a backup of the v7 boot.img before.

I now get to this before it gets stuck, with no working 4-finger-recovery:

Starting kernel ...

Uncompressing Linux... done, booting the kernel.

I also noticed that I can't write a matching system.img via fastboot as this always results in

downloading of 191002212 bytes finished
Flashing Sparse Image
Unknown chunk type

Ideas? (apart from ripping apart a second, still booting device next week)
[Android Q&A, Help & Troubleshooting] tjump7:
Perhaps there's a flashing offset of some kind?
[Android Q&A, Help & Troubleshooting] shadow#:
Wasn't that (I think) but I once again got it to restore from USB via 4 fingers method after trying different boot images I had lying around, also flashing boot2.

Anyway, in newer versions things get even more annoying, can't even start adb, write or pull images:

shell@capri_pl_rocky_proto2:/ $ su
/system/bin/sh: su: not found

shell@capri_pl_rocky_proto2:/ $ dd if=/dev/block/mmcblk0p1 of=/mnt/media_rw/usbdisk/mmcblk0p1.img
/dev/block/mmcblk0p1: cannot open for read: Permission denied

So the ability to edit boot or even system images is definitely required to get any further here.
[Android Q&A, Help & Troubleshooting] silo24:
So.....had some more time to play around today....

Managed to get into the device using ADB via USB and open a shell terminal which gave me root (!!!).

From there, I remounted the /system folder as rw and then deleted the whole plcm folder.

I rebooted the unit and it went into safe mode....crap! I then rebooted and (while it took a long time) it then booted cleanly into Android 4.4.2...

...with NO REBOOTING!

As long as installed Android 4.4.2 based apps, they would generally install, but couldn't get Spotify to work.

Struggled to get Google Play Services on board too, so then decided to play around with the boot image and try and install Magisk....

Extracted boot.img from the .ld file and patched it with Magisk then flashed it to the boot partition....

And now I have a dead unit! Polycom on 5he display and yellow lights on the mute buttons only.

I can reboot into fastboot and ADB, but nothing else!

I think I'll need to flash u-boot into the boot partition, as that seems to be what is needed to flash the contents of the .ld file.....
[Android Q&A, Help & Troubleshooting] silo24:
Ok....got it back......flashed vc-firmware.img into boot partition via fastboot.....
[Android Q&A, Help & Troubleshooting] shadow#:
What exactly did you flash in the end and in what state are you now?

Back to the Polycom firmware?

I unfortunately had no time to play with it further recently.

I now have one on the latest firmware on my desk, used as my daily speaker phone, the UART one on the old, vulnerable firmware and two badly dented ones in a box (that in the end I got for free after the seller didn't pack them properly and the metal pieces all got squished).

My goal would be to have a later Polycom firmware that has adb and root enabled but with extra apps, ideally accessible directly through the Polycom interface.

Would be nice to have my smarthome controls and the app to my video doorbell on there.
[Android Q&A, Help & Troubleshooting] silo24:
That's exactly the sue case i'm looking for.......still work as a speakerphone, but with Home Assistant and Spotify on it too.

I'm now in a 'spinning wheel' state......too busy today to make any more progress unfortunately.

I made the mistake of deleting the PLCM folder completely. Don't do that!!!!!
[Android Q&A, Help & Troubleshooting] silo24:
Right, I'm at a loss......can't get the 4 finger salute to work for a recovery...

@shadow Which images did you flash to recover to that point?
[Android Q&A, Help & Troubleshooting] silo24:
Also have realised I've got a bit of an obsession now.....just bought a Trio C60! 🤣🤣🤣
[Android Q&A, Help & Troubleshooting] shadow#:
Via restore always the old, last vulnerable version.
[Android Q&A, Help & Troubleshooting] shadow#:
Damn! How much did that one set you back?
[Android Q&A, Help & Troubleshooting] silo24:
£249

Think it's faulty though.....so may be going back!
[Android Q&A, Help & Troubleshooting] silo24:
I'm not even able to restore. It won't work with the 4 finger salute and I don't know what to flash to what partition from the .ld file.

Any suggestions?
[Android Q&A, Help & Troubleshooting] shadow#:
What state are you in now and what did you do to get there?

I found the 4 finger restore really hard to trigger at times.

Can you write images? I sometimes had to write both boot and boot2 to at least get things back to where I could trigger the restore.

Partitions are:

/dev/block/mmcblk0p1 #gpt

/dev/block/mmcblk0p2 #fbi

/dev/block/mmcblk0p3 #custom-cert

/dev/block/mmcblk0p4 #boot-parm

/dev/block/mmcblk0p5 #loader

/dev/block/mmcblk0p6 #u-boot

/dev/block/mmcblk0p7 #dt-blob

/dev/block/mmcblk0p8 #u-boot-env

/dev/block/mmcblk0p9 #mobicore

/dev/block/mmcblk0p10 #vc-firmware

/dev/block/mmcblk0p11 #boot

/dev/block/mmcblk0p12 #boot2

/dev/block/mmcblk0p13 #system

/dev/block/mmcblk0p14 #system2

/dev/block/mmcblk0p15 #plcm_cfg

/dev/block/mmcblk0p16 #u-boot2

/dev/block/mmcblk0p17 #vc-recovery

/dev/block/mmcblk0p18 #kpanic

/dev/block/mmcblk0p19 #recovery

/dev/block/mmcblk0p20 #misc

/dev/block/mmcblk0p21 #cache

/dev/block/mmcblk0p22 #userdata