yashsingh1/xdaforums huggingface dataset:
[Android Q&A, Help & Troubleshooting] Renate:
Well, we don't have to be truly blind.

This is my proof of concept. I just added freeform touch. This doesn't use ADB.

The image on the eink tablet is not live from the phone, just a grabbed reference template.
[Android Q&A, Help & Troubleshooting] alecxs:
so he can record input on working phone, then replay on broken phone?
[Android Q&A, Help & Troubleshooting] WoKoschekk:
Xiaomi... EDL... Don't you need a certified Xiaomi account for that?

9T Pro is TOTALLY dead, can it be saved?

Long story short: my Mi 9T Pro never "woke up" after restart. The most irritating part is, it happened three weeks after the warranty period ended, almost as it was programmed! Though, I'm not a conspiracy theorist and I quite simply believe I have had very bad luck. Or, do others have the same...

xiaomi.eu

There's no benefit for you using EDL. Your data is encrypted and every relevant partition of your device gets verified during the boot process. Changing only one of them makes your device unbootable.
[Android Q&A, Help & Troubleshooting] Renate:
Well, recorded input would be a little bit different.

I just meant getting some screenshots from somebody with the same device.

Aren't people using Magisk with this?
[Android Q&A, Help & Troubleshooting] WoKoschekk:
Of course they do! But they also have an unlocked bootloader. In this state dm-verity is disabled due to verified bootstate = orange (indicates an unlocked device).
[Android Q&A, Help & Troubleshooting] Renate:
So you're saying that the absolutely only way to get stuff off this is by enabling ADB with (semi-blind) touch?
[Android Q&A, Help & Troubleshooting] alecxs:
@WoKoschekk the loader is patched to bypass the authentication.
[Android Q&A, Help & Troubleshooting] WoKoschekk:
correct

Access should be possible with that. But it's still not possible to flash any patched images on a locked device without making the device unbootable.

The only way to grant access without a prompt is to copy

C:\Users\USER_NAME\.android\adbkey.pub

to

/data/misc/adb/adb_keys

0640 system:shell
[Android Q&A, Help & Troubleshooting] Renate:
I just added to my little app keyboard input.

Now you can connect a Bluetooth keyboard (because you're using USB already) to the master Android and it types on the slave Android.

Ok, you could unplug the slave from the master and plug in a wired USB keyboard too.
[Android Q&A, Help & Troubleshooting] Renate:
New video. With selectable templates.
[Android Q&A, Help & Troubleshooting] Tamagnun:
Sorry, but I'm not able to follow you... I try to summarize:

- the best way to access my dato should be to grant the abd access by copying the adbkey file inside the phone, but this operation is not possible, is it correct?

- erven if I 'll be able to set the phone in EDL mode and run the loader (iI'll try in the next hours), I can download the userdata partition, but it'll be useless because it is encrypted

- if I would try to fflash a partition with bootlosked locked, the phone will became unbootable

- on MI 9T Pro the conversion from USB-C to HDMI is not available (version 2.0), I've talready ried this operation with a small docking station and the monitor screen was always black

- with a wired keyboard I can probably unlock the smartphone (can you suggest me a way to check if it is unlocked without accessing the display ?) but I haven't understood how this operation could help me, because it won't possible to connect a dtaa cable and an OTG cable at the same time, I have already tried to do this with an USB hub

@Renate: what does your software can do?

In other words, there is nothing to do, data are definitively lost ??

To avoid similar problems in the future, I have yet granted the new Xiaomi 12 Pro to be accessed via adb from my laptop and I'll pair it with my BT keyboard+touchpad, but it remains the needs to access the old (and broken) MI 9T Pro....

Many thanks to everybody for your help and answer
[Android Q&A, Help & Troubleshooting] alecxs:
connect wired keyboard to your Xiaomi 12 Pro. now use only the keyboard to pass the lock screen credentials, enable bluetooth and connect bluetooth keyboard.

now disconnect the wired keyboard and connect PC. type 'adb devices' and use the bluetooth keyboard to confirm.

if you find a way to do this, write down the keys pressed and timing between the keys. so you can reproduce the steps on Xiaomi MI 9T Pro with black screen.

The program from Renate can be used to emulate wired keyboard. This could help to simplify the first part of procedure.

if boot.img is signed with google test keys, another attempt is to flash modified boot.img on locked bootloader. the tool from post #13 can tell you if google test keys are valid. you can dump boot.img off device with

python3 edl r boot_a boot.img --loader="path\to\prog_ufs_firehouse_sm8150_ddr.elf" --memory=ufs

I can assist patching the boot.img with Magisk.

https://xdaforums.com/t/accessing-my-phone-with-a-dead-screen.4542763/post-88016019
[Android Q&A, Help & Troubleshooting] WoKoschekk:
That's all correct.

The boot.img gets also verified through AVB against a SHA256 digest:

--------------------------
/sdcard/vbmeta.img
--------------------------

Minimum libavb version: 1.0
Header Block: 256 bytes
Authentication Block: 320 bytes
Auxiliary Block: 2752 bytes
Public key (sha1): b2a02f1e56e366d727a1a8e089762fe0b91bbc84
Algorithm: SHA256_RSA2048
Rollback Index: 0
Flags: 0
Rollback Index Location: 0
Release String: 'avbtool 1.1.0'
Descriptors:
Chain Partition descriptor:
Partition Name: system
Rollback Index Location: 1
Public key (sha1): b2a02f1e56e366d727a1a8e089762fe0b91bbc84
Prop: com.android.build.vendor.fingerprint -> 'Xiaomi/raphael_eea/raphael:11/RKQ1.200826.002/V12.5.1.0.RFKEUXM:user/release-keys'
Prop: com.android.build.vendor.os_version -> '11'
Prop: com.android.build.vendor.security_patch -> '2021-06-01'
Prop: com.android.build.vendor.security_patch -> '2021-06-01'
Prop: com.android.build.dtbo.fingerprint -> 'Xiaomi/raphael_eea/raphael:11/RKQ1.200826.002/V12.5.1.0.RFKEUXM:user/release-keys'
Prop: com.android.build.boot.fingerprint -> 'Xiaomi/raphael_eea/raphael:11/RKQ1.200826.002/V12.5.1.0.RFKEUXM:user/release-keys'
Prop: com.android.build.boot.os_version -> '11'
Prop: com.android.build.boot.security_patch -> '2021-06-01'
Prop: com.android.build.boot.security_patch -> '2021-06-01'
Hash descriptor:
Image Size: 43966464 bytes
Hash Algorithm: sha256
Partition Name: boot
Salt: 8d176e7fc77498663ebe977ef9d9924dc56f5ebd54de4710a61ba2c217d29cd4
Digest: 9ea98aee9b51923c17a6192e4b5f07a549ef5c3a578bb375cd4087cba9045e57
Flags: 0
Hash descriptor:
Image Size: 5087449 bytes
Hash Algorithm: sha256
Partition Name: dtbo
Salt: 59fd220112abeb96030a0345517d46f7518c88636377519f083eb98d96967e74
Digest: 30943b3a10ff9bc1b1647c41bd96364b49b3f04f5a02ac331bc36365caaff4c9
Flags: 0
Hashtree descriptor:
Version of dm-verity: 1
Image Size: 1585115136 bytes
Tree Offset: 1585115136
Tree Size: 12488704 bytes
Data Block Size: 4096 bytes
Hash Block Size: 4096 bytes
FEC num roots: 2
FEC offset: 1597603840
FEC size: 12632064 bytes
Hash Algorithm: sha1
Partition Name: vendor
Salt: 4f9035d0cb60cb72bd4841f2e44bc29810f73358490392cbd2a20c0fac652ceb
Root Digest: b140cb8a05102d2f786b91285289b6aa5bd0550e
Flags: 0

--------------------------
[Android Q&A, Help & Troubleshooting] alecxs:
I don't know. I have flashed magisk patched boot.img AVBv1-signed on locked bootloader and booted successfully, but never tested AVBv2.
[Android Q&A, Help & Troubleshooting] Tamagnun:
Hi guys,

I switched on the phone in fastboot mode, the devices cmd lists the serial number followed by fastboot, but there is no way to switch it in EDL:

- fastboot oem edl returns FAILED (remote: 'Error Invalid Parameter')

- $ ./fastpwn oem edl under Ubuntu from https://github.com/bkerler/edl gets the same remote error like the previous message

- reboot.bat from https://xdaforums.com/t/...boot-no-more-test-point-method-kenzo.3398718/ under Win reboots the phone in default mode (I can find it's IP address on wifi client's list and adb returns its serial followed by unauthorized)

Any another method to switch this piece of hardware in EDL mode?

I'm very angry thinking to that stupid movies where any hacker is capable to hack all the smartphones accessing them via remote/bluetooth/network/any air connections, switching them on from remote, stole data, etc.etc....

And I cannot access MY data from MY phone using the USB cable because I cannot grant it... gggrrrrrr!!!
[Android Q&A, Help & Troubleshooting] Tamagnun:
I connected the wired keyboard to the new 12 Pro, I unlocked it simply using the keyboard only, but I hadn't find a way to open the settings menu.

Fortunately I found a special keystroke to activate the Google assistant and telling "Bluetooth" the X12Pro opens the BT configuration menu.

Because the BT keyboard was in pairing mode, the phone found it, I pressed several time the down arrow key (and the number of times depends on the list of devices already paired to the phone, not simple to replicate on the old phone without seeing the number of paired devices...), but the main issue is that selecting the BT keyboard in order to pair it I got a six-digit number (on the display) that must be typed on the keyboard in order to pair it to the phone: even if I would be able to replicate the previous command sequence to the broken phone, how could I read the pairing code on a black screen?

You had a good idea, but it isn't possible to follow it... unfortunately!

No EDL mode activated, please read my previous post (****!)

Anyway, many thanks to you (and Renate and WoKoschekk) for your help and suggestions, but it seems there isn't a way to "access" data inside this phone... sigh!
[Android Q&A, Help & Troubleshooting] Tamagnun:
Sorry for the stupid question, but I read I-don't-remember-where that (maybe) it's possible to execute a custom recovery like TWRP without flashing it on the phone, is it true ?

This operation could help me?

TWRP is capable to decrypt the userdata partition, isn't it?

Many thanks
[Android Q&A, Help & Troubleshooting] alecxs:
you are right, forgot about the pairing code. you could take screenshot with vol dn + pwr but I believe they aren't stored at MicroSD card, so first you need to enable MTP from developer options. then check the pairing code from Internal Storage.

TWRP is no option on locked bootloader, same as modified boot.img. However you can enter EDL mode with deep flash cable or test point method.

But I believe the fastpwn method will work, just run with prefix sudo
[Android Q&A, Help & Troubleshooting] Tamagnun:
Hi Alecxs,

the MI 9T PRO doesn't have a slot for MicroSD so it is not an option.

If MTP should be enabled when the data cable is connected I had solved all my problems: as you know, when the data cable is connected to the phone (if it is unlocked), an option window is opened and the second option is the MTP authorization... more or less the same than adb access, impossible ti grant without the keyboard.

OK, I'll study how to obtain a deep flash cable and the TP method.

I'll try, in effect I hadn't tried with sudo...
[Android Q&A, Help & Troubleshooting] alecxs:
I believe MTP doesn't ask for authorization, so no problem with unplugging keyboard. you just have to enable it once. you can shortcut with - settings - search (or maybe voice)
[Android Q&A, Help & Troubleshooting] WoKoschekk:
Due to AVB2.0 it's impossible to patch and boot your device successfully. You can't fake a SHA256 checksum. The propability of a collision (finding two files with different content and same hash value) is

4.3*10^-60

!!! (source)

It would be more functional to buy a new panel, connect it (without installing), backup your data and then make use of the return policy.

Regarding the steps to open your device and find the test points, it only takes a few more steps to change the panel. I would.
[Android Q&A, Help & Troubleshooting] alecxs:
you are right, I misread that for AVBv2

https://github.com/bkerler/android_universal/blob/master/root/scripts/makeramdisk.py#L641
[Android Q&A, Help & Troubleshooting] Tamagnun:
You're right, alecxs, NOW I have set the MTP as default on the new phone, but on the old (and crashed) MI 9T Pro it is not, so when the USB cable is connected a user prompt input is displayed and another time I cannot answer to it.
[Android Q&A, Help & Troubleshooting] Tamagnun:
I've already substitued the AMOLED panel!

The (second) problem has been occurred during a new repair operation: a very tiny metallic piece is fallen into the small squared display connector, causing a shortage that (probably) burnt the display controller inside the motherboard (normally a shortage burns the "driver", not the "driven").

Anyway, I had the same idea you're suggesting and I can try to do it: on Amazon very poor TFT displays are available for 30-40 EUR, if one of these will solve the issue I can also decide to keep it: they have a very poor quality, but enough to use the smathphone as a backup device or for tethering only.

Really I didn't think it was so difficult to access my data on the phone, really...

The phone is opened since two months: I used it without sticking the AMOLED and the back cover, so I need only to know where are the TPs on the motherboard... I'll look around on the forum for them, any idea?

Many thanks for everything
[Android Q&A, Help & Troubleshooting] Tamagnun:
Many thanks WoKoschekk, but I need a magnifier in order to operate on the TPs!! :D

Following your previuos idea, I'm ordering a new display on Amazon: even if I think the hw issue is on the motherboard, I'll try to change it and, in case it will work, I'll be able to access my data in a simply way.

Otherwise I'll return it to the vendor...

Nothing to do, alecxs: I tried to prefix the fastpwn with sudo (I had to reset the user root pwd from the Ubuntu recovery before to do it!! 🤦‍♂️🤦‍♂️) but I received always the same error from remote, the oem edl is not supported on this phone/os version.
[Android Q&A, Help & Troubleshooting] Tamagnun:
Update:... I have tried to replace the AMOLED display and the flat cable that connect the mainboard to it but the result it's the same: the phone switches on (it's IP address appears in the wifi clients list), it is recognized by the laptop when connected thorugh USB cable, but the display is always black. and dead.

Next step: I'll try to switch on it in EDL mode, despite if I haven't understood the proper way to do it...

1) installation of Qualcomm drivers

2) shortage of test points

3) USB cable connection to the laptop

4) switch on the phone

Is this process correct?

Many thanks
[Android Q&A, Help & Troubleshooting] WoKoschekk:
You have to shorten the TP while switching on the phone. Then it boots into EDL mode.
[Android Head-Units] Anton TNT:
Hi, ask your seller to give you files (for factory settings) needed to import physical buttons into device again.

Minute of work and then restart.
[Android Head-Units] nnexuss:
Oh... Really... It need some files? 😵‍💫 Hope the seller send it to me.

I completely noob on this time on rádios... Android
[Android Head-Units] Anton TNT:
I have those files but model of your device must be close to mine - 8227L ALPS FF5000
[Android Head-Units] nnexuss:
I'll reply as soon as possible.

This files how do we use it? Thanks.
[Android Head-Units] Anton TNT:
Please take picture of your device externaly with all buttons visible.

Then I will see if it is a match for this device.
[Android Head-Units] nnexuss:
Photos added.

Any suggestions?

Thanks 👌
[Android Head-Units] nnexuss:
Hi Anton :)

Can you hel me please? :)
[Android Head-Units] Anton TNT:
By the photos you posted this device is similar that I'm using in my car, TS10 or TS18 topway branded, it must have option to update system and MCU online, so do an update online (car settings/factory settings/update).

If updating does not help try calibration of screen (activated by pressing all five fingers on screen I think). There is no physical buttons on this device and it must have canbus box right ?
[Android Head-Units] nnexuss:
Everything it's working now... 👍👍👍 Except the remap of the steering wheel... I can't config which function will do each button 😔😔😔

This is the main objective 4 me.

When I go to the config menu, press start the config and when press the button on steering wheel nothing happened.

Only volume works and the doors too... If I open a door a imagem pop up on the screen
[Android Head-Units] Anton TNT:
Wrong settings in canbus software - go to factory settings and download/load correct software for canbus device (your car model) and restart, it should work
[Android Head-Units] nnexuss:
Now ... other problem :/ some how the app as gone.
[Android Head-Units] Anton TNT:
cant see the video
[Android Head-Units] nnexuss:
Try it now please :)
[Android Head-Units] Anton TNT:
which canbus settings was prior of changing ? SIMPLE or RAISE or HIWORLD ?

I think this wrong settings caused this. Rerturn old state but do not change first option , If canbus sticker on the box is simple then it is simple in first option - get it ? If it is something else choose this one and then choose software for device and model.
[Android Head-Units] cl3884:
I have same problem but my unit is V1c 1G - after activating can bus it made APK installation and then the side buttons doesn't work. Here is a photo of unit which is for a Ford Focus MK2.5

Any help much appreciated

Chris
[Android Head-Units] Anton TNT:
Choose right software for your device and canbus (read which canbus is from sticker on canbus box and then choose from list like if it is RAISE canbus in first section choose RAISE, then in second choose car model and then on next PUBLIC)
[Android Head-Units] cl3884:
This is my can bus box - doesn´t tell anything about type of can bus. But is it related to can bus? My steering wheel buttons work but not the buttons on the head. I would imagine that it is something else.

Regards Chris
[Android Head-Units] cl3884:
Here is a photo of the set up. Steering wheel buttons work, center console info works. Side buttons on head unit doesn't work.
[Android Head-Units] Anton TNT:
Ths is ok, but must ask your seller for update of files for physical buttons, they only have it. You will not find this on net.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] default_user8:
Could someone please give me a heads up on why Hard-spl won't load on my att 8525. I am using the Hard-spl-v7 utility and it won't load onto my phone.

It keeps stopping after it goes into the bootloader and telling me my phone isn't connected to my laptop(running Vista home premium). Any help would be appreciated. I took a chance and used the original cingular WM6 upgrade, and ran the hermes SIM/CID unlock v3a(unlocked both). But Hard-spl still won't load. Any help would be appreciated greatly.

Thanks
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Hyden121:
I had the same issue but was unable to correct it. I still have Oli 1.1 instead of the 2.0 although I was using an ATT Tilt... Try using an older version of Hard SPL or make sure you phone is unlocked. Sorry if this doe snot help.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] ultramag69:
Use the sd card method found on page 116, post 1160 of this thread -

http://xdaforums.com/showthread.php?t=296722

Just remember the sd card must be 2Gb or less and you have to have a charged battery..

Cheers...:D
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] default_user8:
UR da bomb

Thank you so much i knew i had seen it somewhere that this could be done, and i searched for it for 2 hours last night to no avail. I'll try it ASAP and see if it'll work.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] default_user8:
Didn't Work

Went back and checked my work. It didn't work because i have a 4gb sd card. I'll see what i can do about that.

I found the thread on partitioning an SD card. If i make 2 2gb partitions will that work?
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] ultramag69:
No, it has to be a 2Gb or less... 4Gb is sdhc and the bootloader doesn't recognise it. Even partitioned it is still sdhc.

Should be able pick up a 1Gb sd card for less than $10.

Cheers...:D
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] default_user8:
WORKED

Ok i bought a 1gb card from Waly world this morning and it worked. On to a radio update and maybe a cooked rom. Thanks for all the help.
[General Questions and Answers] alexknight004:
thank you
[Windows 10 Mobile] hikari_calyx:
I decided to release HP Elite x3 android OS dump here, but how to utilize it is up to you.

GUIDE: https://xdaforums.com/t/guide-how-to-install-android-to-hp-elite-x3.4565837/

Here're some useful informations.

- Android version is 7.1.2 and no further updates due to the Android transition plan is scrapped anyway. Since it was unreleased officially, don't think about kernel sources.

- With RKHReader I've confirmed it shares same Root Key Hash as Windows Phone variant HP Elite x3. Technically it will work on retail unit.

- It's possible to flash it into another HP Elite x3 prototype under EDL mode, and it can boot into Android successfully, but you'll lose telephony function (cannot recognize SIM and make telephone calls). I don't know how to enable Qualcomm debug port anyway (already tried setprop command under root).

- Unlocking the bootloader under Android is possible - if you'd like to root this phone with Magisk, use 7-Zip to extract stock boot image from the dump.

- Fastboot driver needs to be installed manually under Windows since I cannot find fastboot driver under HP vendor - you'll have to force install fastboot drivers for other OEMs.

To those who come from another forum, download it here:

https://api.hikaricalyx.com/FileDownload/MegaNz?FileID=vxcERC4J

You can download it here: https://api.hikaricalyx.com/FileDownload/MegaNz?FileID=24kRyATJ

Chinese readers can download it here: https://pan.baidu.com/s/1wkr80UbcElLqbE5tKYeJAA?pwd=l1ut

SHA256 checksum: a96b6f4d9ef1df9f308333b58713ea2dc129dac4e957f4e04215d0b6d420c822
[Windows 10 Mobile] a_petrov303:
I have limited knowledge of the subject, but I guess this is great news for us who can barely use their Hp phones due to Windows and HP discontinuing support for this phone. thank you!!!
[Windows 10 Mobile] abc145:
hikari_calyx​

Thank you so much for this article.​

I have a retail HP Elite x3.

And I wanted to ask you, for the retail HP Elite x3, only the mass storage mode is required to install an Android dump or something else? You don't need to unlock the bootloader?

And is this Win32DiskImager program suitable for Android dump firmware on retail HP Elite x3 from under the masstorage mode?

On retail HP Elite x3 you can enter EDL mode via a modified cable, but unfortunately the fire hose from ZUK Z2 refuses to flash it.
[Windows 10 Mobile] hikari_calyx:
Technically it will work. I don't have retail unit to prove my theory.
[Windows 10 Mobile] abc145:
As you already know, your theory was confirmed and the Android dump from the HP prototype (with a lot of help and valuable advice from the respected Hikari Calyx) was successfully installed on the retail HP Elite x3. It's fantastic! I'm just happy. Thank you very much for your great help in installing the Android dump on retail HP.

Dual SIM cards, mobile communication and data transmission work fine for me, you can call, receive and send SMS, use the mobile Internet, everything is the same as on a full-fledged phone.

Wi-Fi and Bluetooth works well.

The fingerprint scanner and infrared sensor do not work, there is also no sound from the upper speaker when watching videos and listening to music (in W10M there is sound from there), the sound in Android on HP comes only from the lower speaker.
[Windows 10 Mobile] sev7en:
Hello,

I have the X3 Elite and thank you for the guide. I am wondering if any update has been available about the restore operation to revert back.
[Windows 10 Mobile] Computershik:
what is the new decryption key for the file on mega?
[Windows 10 Mobile] #MEMSKEY:
that makes 2 of us. Im stuck on the last step i cant download the android file on the mega website
[Windows 10 Mobile] Computershik:
Uploaded the dump here, while we are waiting for the author to update his link:

Google Drive
[Windows 10 Mobile] hikari_calyx:
Fixed