yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] lbcoder:
Here's the thing:

DO NOT make any step by step. The purpose of this thread is to UNDERSTAND, not to blindly follow a set of instructions.

If you UNDERSTAND things, then steps are NOT REQUIRED.

The only thing that STEPS accomplish is to lead newbs into danger.

One should NOT attempt ANYTHING with potential danger withOUT a FULL understanding of what is going on.
[G1 Android Development] scholbert:
@kwanbis:

I think you still mix up the modes... or i'm getting confused as well :confused:

I'm refering to the first command in this list:

usage: fastboot [ <option> ] <command>

commands:
update <filename> reflash device from update.zip
flashall 'flash boot' + 'flash system'
flash <partition> [ <filename> ] write a file to a flash partition
erase <partition> erase a flash partition
getvar <variable> display a bootloader variable
boot <kernel> [ <ramdisk> ] download and boot kernel
flash:raw boot <kernel> [ <ramdisk> ] create bootimage and flash it
devices list all connected devices
reboot reboot device normally
reboot-bootloader reboot device into bootloader

options:
-w erase userdata and cache
-s <serial number> specify device serial number
-p <product> specify product name
-c <cmdline> override kernel commandline
-i <vendor id> specify a custom USB vendor id

AFAIK there's no need for moving files to the sdcard or similar.

Just boot your device into fastboot mode connect to your host using the USB connection and use fastboot (on your host)...

As i said, i did not use this command to update the SPL on my device.

:confused:

@lbcoder:

Well said!!!

BTW... do you know if the fastboot update command is working on Dream ?

scholbert
[G1 Android Development] alapapa:
this thread is a good read...thx lb

also, "Brick Theory" would make a pretty good band name :)
[G1 Android Development] kwanbis:
I think i understand many of the things, while still having some doubts. I'm trying to confirm that my understanding is correct, by writing it down the best I can. What I do not understand why you are so negative about my post.

Anyway, maybe somebody else would care to confirm. This is how I understand it now:

ROOT AS NORMAL

Downgrade to RC29 (US) or RC7 (Europe).

Root the phone.

Flash Recovery Image (AMON RA, Cyanogen, or Clockwork recommended)

FLASH ENGINEERING SPL 0.95.3000

1. Download the Engineering SPL 0.95.3000 zip file EngBootloader_v2_NoSigCheck.zip.

2. Place EngBootloader_v2_NoSigCheck.zip on the root of your SD card.

3. Power off your phone.

4. Press and hold Home and then press Power to boot into recovery mode.

5. Once in recovery mode, select "apply any zip from SD" (or similar and) select EngBootloader_v2_NoSigCheck.zip

6. After the update is complete, hold Home + Back to restart.

7. Once your phone has booted up, turn your phone off so that we can make sure the update worked.

8. Press and hold the Camera and Power buttons to boot into your SPL. It should have three androids on skateboards at the bottom, with a white background.

9. Press Action. Press Call, Menu and End at the same time to reboot.

REBOOT IN FASTBOOT MODE

1. Turn off your phone and hold down the "camera" button while powering it back on.

2. You will see a white screen with skateboarding bugdroids.

3. Plug your phone into the usb and if you see "serial0" hit the "back" key. You should now see "fastboot" on the screen.

FASTBOOT FLASH THE DESIRED SPL AND/OR RADIO IMAGE

1. Execute the following commands, one after the other.

2. fastboot devices <enter> (your device should be listed)

3. fastboot shell (You should see a # in the next line)

4. fastboot flash radio radio.img

5. fastboot flash hboot hboot.img

7. fastboot reboot

On the last step, LBCODER suggested "completing this step with a "fastboot reboot-bootloader"", but then he says to use only "fastboot reboot". Which is it?

Also, previous knowledge suggested that "If the Death SPL is flashed over a radio version prior to "2.22.19.26I" or on a DVT board it will cause a brick". But then LBCODER said that "There IS NO DIFFERENCE BETWEEN PVT and DVT" and that "The RADIO itself is NOT RESPONSIBLE for bricks." So, would that mean that I can ignore the RADIO and BOARD version?

Also, previously the recommendation was to "DO NOT INSTALL A CUSTOM SPL UNLESS YOU HAVE MANUALLY FLASHED THE LATEST RADIO TO YOUR PHONE OR YOU WILL BRICK YOUR PHONE", but I assume it does not applies to ENGINEER SPLs? And what about the suggestion to use Hard SPL? How it relates to this?

And last, does all this aplies to the DREA210? (Rogers)

The only file I move to the SD Card is the ENGINEER SPL, which is flashed from RECOVERY.
[G1 Android Development] lbcoder:
I have no idea about update, but if I were to guess, it would probably do a reboot-recovery type flash. The interpreter for the update-script is within recovery.
[G1 Android Development] pistolazzi:
It doesn't work also with hard-spl... I've just tryed it... :(

fastboot flash hboot hboot.img
writing 'hboot'... FAILED (remote: partition does not exist)
[G1 Android Development] lbcoder:
Ok, looks like fastboot won't cut it from 0.95.x000 because the hboot partition isn't defined.

The good news is that it is being looked into and a "totally safe" method is currently in the brains of those who hack ;)

From the looks of it, 1.33.2003 is compatible with 0.95.x000.

IF you have 0.95.x000, you can recovery update to 1.33.2003.

When you have 1.33.2003, you can fastboot flash hboot *literally anything*.img (engineering).

If you already have a 1.33.0xxx SPL, you must find ITS corresponding 1.33.2xxx SPL and flip to it via RECOVERY.

If you have a 0.95.x000 SPL, you must recovery to 1.33.2003.

** once you have 1.33.2003, you may fastboot flash hboot *anything*.img. I suggest only fastboot flash hboot'ing to another ENGINEERING SPL. NEVER to a regular SPL since you could end up in a limbo mode where you don't have fastboot and your recovery won't boot.

** DO NOT flash to 1.33.2003 from ANYTHING BESIDES 0.95.x000 or 1.33.0003.

** WARNING: Your mileage may vary. IF you brick going from 0.95.x000->1.33.2003, ***I AM NOT RESPONSIBLE***. I only suggest doing this IF you are otherwise going to try 1.33.2005 *anyways*.
[G1 Android Development] kwanbis:
So, you are saying that, if already on ENGINEERING SPL 0.95.3000:

RECOVERY FLASH TAMERLAN311 SPL 1.33.2003

FASTBOOT FLASH THE DESIRED SPL AND/OR RADIO IMAGE

If starting from downgrade/root, should i be able to recovery flash SPL 1.33.2003, or should i recovery flash 0.95.3000 first?

ROOT AS NORMAL

RECOVERY FLASH ENGINEERING SPL 0.95.3000 (can i skip it?)

RECOVERY FLASH TAMERLAN311 SPL 1.33.2003

FASTBOOT FLASH THE DESIRED SPL AND/OR RADIO IMAGE

Thanks.
[G1 Android Development] lbcoder:
You should probably go to another thread as you're obviously not reading/listening.

As far as this "tamerlan311" thing goes, NO. I had to google search to realize that you are talking about a HACKED UP SPL from some russian forum. NO. I said 1.33.2003. I did NOT EVER say install a hacked up anything.
[G1 Android Development] ezterry:
No that is a hacked version 1.33.2003AF (I'm not fond of it; I feel it just fragments the community without improvement over 1.33.2005 but I don't think it will harm your phone if its properly installed.. he only changed the partition table and added an androidfan.ru image to replace the dancing androids on the hboot/fastboot screen)

-------

Here is a set of useful files (NOT FOR HTC MAGIC)

http://rapidshare.com/files/388568285/g1boot.zip MD5: 5cf401e6f1294917047205bd483e0c74 mirror

(Please mirror -- note I did not create any of these I'm just collecting them in one place)

hboot: 1.33.2003 - SPL both in update.zip and img format

hboot: 1.33.2005 - in img format

radio: 2_22_23_02 in img format

See the notes file for information on what and how the SPLs boot roms

(please consider the following a work in progress.. I am not responsible if you don't understand what you are doing and brick your device.. I already have too many people wanting me to de-brick their phones)

== Installing 1.33.2003 from stock RC29** SPL: ==

> From RC29 telnetd to root as usual

> install ra recovery

> flash the spl_1_33_2003.zip

> reboot system when prompted

This is just a full bootloader using stock partition layout.. so from here you can still boot into your current stock system

** Yes I use rogers.. However this SPL [1.33.2003] is not to be used on a 3x (stock rogers radio) so don't flash the zip file with the 3x radio unless you want a death SPL type brick..

== Installing danger SPL form 1.33.2003 SPL ==

Here you can enter fastboot and run the following

If you do not have a 2.x radio run:

fastboot flash radio radio-2_22_23_02.img

Then run:

fastboot flash hboot hboot-1_33_2005.img

== Returning to stock partition layout ==

(aka installing 1.33.2003 from dangerSPL)

Enter fastboot then:

If you do not have a 2.x radio run:

fastboot flash radio radio-2_22_23_02.img

then run:

fastboot flash hboot hboot-1_33_2003.img

== Why use this ==

well it seems 1.33.2003 which runs roms on both 1x [ebi0] and 2x [ebi0] radios is a good full engeniering SPL.. while eng2/hard SPL are lacking a little.

1.33.2005 (aka danger SPL) is also a full SPL but only runs roms on the 2x [ebi0] and 3x [ebi1] radios

Both SPLs if you flash via fastboot will prevent bricks switching between 1x 2x and 3x radios. As you will still be able to enter fastboot.. even if the rom wont start.

== Most important ==

Both SPLs provide very low level access to the device; which if mis-used can certainly brick your device. But can also allow you to recover from most problems

However if you decide to flash an SPL or RADIO via recovery; you need to make sure the recovery on flash is compatible with the SPL/Radio combination that will be installed after the flash is complete..

Also avoid flashing other things while flashing a radio or spl

(The content of this post may be considered in the public domain; or licensed to you with full permissions to use it as you will)
[G1 Android Development] kwanbis:
You mentioned 1.33.2003, so I simple googled it, and it came to that forum link. Just that. If it was another ROM you could have say that.

Anyway, I have tried to reply to your aggressions the more polite way i can, but you keep being very harsh to me without any apparent reason.

So I would only say that after your horrible misinterpretation of my first post here, where you misread it, replied incoherent things, contradicted yourself, etc, you sure have some balls to tell me that i "should probably go to another thread as [i'm] obviously not reading/listening".

And i would not reply to you anymore. You are not worth it.

Thank you very much ezterry, for a very nice and clear explanation.

I mirrored it here: http://www.mediafire.com/?jmt4nnzttnm
[G1 Android Development] ezterry:
My opinion on the SPL aside.. I wouldn't have know about the 1.33.2003 SPL unless it was for the hacked one.. to verify the changes where safe (as I indicated) I needed to compare it with the original..

Its interesting 1.33.2005/1.33.2009/1.33.2010 SPLs all use a virtual base addreess of 0x98000000 .. 1.33.2003 and stock G1 SPLs use 0x88000000;

Obviously 1.33.2003 and 1.33.2005 are mostly the same code.. just compiled for a different virtual base address.
[G1 Android Development] :
Just wait until everyone figures out it's you who originally did it, I bet it's going to pile up even more.

I already see it all over Q&A... "Can JTAG my G1?!"

=[

Good work, both of you. ;) (Think I already said this, no idea, though. :P)
[G1 Android Development] scholbert:
Yeah that's really interesting...

I think i'll start some disassembler sessions with the 1.33.20xx again.

Wish the source code of some HTC bootcode would have leaked somewhere... :D

Thanks for the details!

scholbert
[G1 Android Development] ezterry:
Hrm.. I don't recall an "Update" on the phone's side of things.. wonder if its an alias to "fastboot flash zip <filename>"

That certainly exists [but have not tested it]

(accepts a zip file with partitions images in it.. example: containing hboot.img/recovery.img/system.img/userdata.img/cache.img/radio.img)

An example of such a file is the "System Image" from HTC:

System Image	signed-dream_devphone_userdebug-img-14721.zip

Also the help screen ignores 'fastboot oem <command line>' all together (runs a bootloader command line and echos back the output.. also available on serial console in 'HBOOT' mode. This is missing from the 0.95.x000 SPLs.
[G1 Android Development] kwanbis:
So, we need:

SPL_1_33_2003.zip (MD5: 3d1116ff756db91b7a8a29bf7ea28c00)

radio-2_22_23_02.img (MD5: d800642198456993467c675796c67aed)

hboot-1_33_2005.img (MD5: cdf75d34e24937da1a8a84bcd72496c3)

hboot-1_33_2003.img (MD5: 4d84b5db4ced89f6984da1f683e71fc9)

ROOT AS NORMAL

1. Downgrade to RC29/RC7.

2. Root the phone.

3. Flash Recovery Image.

RECOVERY

FLASH SPL 1.33.2003 -- NOT FOR STOCK ROGERS RADIO

3X

1. Place spl_1_33_2003.zip on the root of your SD card.

2. Power off your phone.

3. Press and hold Home and then press Power to boot into recovery mode.

4. Once in recovery mode, select "apply any zip from SD" and select spl_1_33_2003.zip.

5. After the update is complete, hold Home + Back to restart.

6. Once your phone has booted up, turn your phone off so that we can make sure the update worked.

7. Press and hold the Camera and Power buttons to boot into your SPL. It should have three androids on skateboards at the bottom, with a white background.

8. Press Action. Press Call, Menu and End at the same time to reboot.

FASTBOOT

FLASH DEATH SPL

1. Turn off your phone and hold down the "camera" button while powering it back on.

2. You will see a white screen with skateboarding bugdroids.

3. Plug your phone into the usb and if you see "serial0" hit the "back" key. You should now see "fastboot" on the screen.

4. Execute the following commands, one after the other, on you PC console

5. fastboot devices (your device should be listed)

6. fastboot flash radio radio-2_22_23_02.img (if you do not have a 2x radio)

7. fastboot flash hboot hboot-1_33_2005.img

8. fastboot reboot

(IF YOU NEED TO) RETUR TO STOCK PARTITION LAYOUT

1. Turn off your phone and hold down the "camera" button while powering it back on.

2. You will see a white screen with skateboarding bugdroids.

3. Plug your phone into the usb and if you see "serial0" hit the "back" key. You should now see "fastboot" on the screen.

5. Execute the following commands, one after the other, on you PC console

6. fastboot devices (your device should be listed)

7. fastboot flash hboot hboot-1_33_2003.img

8. fastboot reboot

Correct? And what happens if i'm at Engineering SPL 0.95.3000? Should i FASTBOOT flash stock SPL first, and then proceed?
[G1 Android Development] ezterry:
Re: CONFIRMED!! BRICK THEORY: Radio and SPL

If you have a 1.x or 2.x radio you can just flash the 1.33.2003 update.zip from any 0.95.* spl if a custom recovery is installed

No reason to roll back to stock
[G1 Android Development] kwanbis:
I have 2.22.23.02. So, you mean RECOVERY flash, right? As you said, update.zip, i would assume so.
[G1 Android Development] ezterry:
Re: CONFIRMED!! BRICK THEORY: Radio and SPL

Yes if you have a 1.x or 2.x radio and a 0.95.* spl that will not allow 'fastboot flash hboot' you can flash 1.33.2003 spl via custom recovery such as a RA recovery.

Then you will still have a stock partition layout and can boot the phone fastboot erase ect. Or flash different radio's and spls via fastboot.
[G1 Android Development] kwanbis:
Right, i have done it, and then the Death SPL, without any issues thanks.
[G1 Android Development] xaueious:
lbcoder why don't we end that script with flashing the proper recovery for the device as well?

I mentioned making an update.zip that flashes the entire stack before and there wasn't much enthusiasm.
[G1 Android Development] lbcoder:
Because that completely defeats the purpose of nuking the recovery, which is to force the device into fastboot and cancelling out the FORCED boot-recovery. By having an INTACT RECOVERY, you will still get forced into recovery indefinitely, potentially becoming a brick.
[G1 Android Development] lbcoder:
Note: there are combinations of radio/hboot that are functional in FASTBOOT, but can't possibly boot ANY ROM. An example of this is 1.33.2005 SPL + 1.x radio. If you are flashing the SPL, how do you know that 100% of the time, the radio will be compatible with that recovery? Or how about if you're flashing the radio, how do you know 100% that the existing SPL is compatible with it? The answer is you don't, and the ONLY known way to eliminate the possibility of bricking is to ensure that it doesn't end up stuck in recovery, and there are TWO KNOWN WAYS to always guarantee that you don't get stuck in a broken recovery:

1) Do not set boot-recovery in the misc partition,

2) Nuke the recovery to force it into fastboot.

If you are flashing the radio or hboot via recovery, then there is NO OPTION not to set boot-recovery in the misc partition, leaving precisely option #2.

Option #1 can be used when you have a 1.33.2xxx SPL, which allows you to flash the hboot/radio via fastboot.
[G1 Android Development] lbcoder:
Though this is a nice idea, you need to understand that this is quite IMPOSSIBLE.

This is the reason:

Some partitions, specifically boot, cache, misc, system, data, and possibly recovery can be flashed from the booted operating system (which includes recovery mode).

The other two partitions, hboot and radio, cannot be flashed from the running operating system. They can only be flashed from the SPL, and the WAY that they are flashed is by setting up the cache and misc partitions in this manner:

The IMAGE is loaded to the cache partition, and the misc partition (which BTW is just a data structure used to pass information between the SPL and operating system) is set up to INSTRUCT the SPL to flash the hboot or radio image stored in the cache partition. It does so by setting one of two special boot modes: update-hboot or update-radio. It then REBOOTS so that this instruction will be sent to the SPL, and the actual update is performed. When the update is finished (and the reason why bricks happen), the update-whatever function writes the instruction boot-recovery into the misc partition, which already has parameters set to FORMAT the cache partition (since storing the image there nuked it).

So what you can see from this is that ONLY ONE of the radio or hboot can be flashed at a time (except where being flashed through fastboot). At least TWO reboots must happen between writing an hboot and a radio, and one of those reboots can put you in a bad place.

With fastboot, you CAN write *everything* in a single session, but this, of course, requires an SPL that (a) has fastboot, and (b) has the hboot and radio partitions mapped. With fastboot also, since you don't have a boot-recovery trap, it isn't actually NECESSARY to flash them all in a single session.

The only way to flash a full working stack at once is by using an NBH file, and unfortunately, this requires either a specially hacked SPL (which to my knowledge doesn't exist), or it requires you to have the device's security password (which we haven't figured out how to get... yet).
[G1 Android Development] ezterry:
The real reason is a single update.zip can't flash both the radio and spl in a single reboot to the bootloader.. you might be able to sequence something (particularly with a custom recovery image in between)..

But I think if we remove some automation it may be easier:

+ If 1x radio install 2x radio

+ if 2x or 3x radio install danger

+ have users flash the zip twice.

+ To switch between stock partition layout and danger partition layout use fastboot and 1.33.2003/1.33.2005 spls

The question is how far do you go to prevent the user from bricking?

I'd want to examine a brick caused by flashing danger on a 2x radio.. but usually when pressed you find people who claim such bricks did something like:

Check radio (is 2x) -- decide they want things clean and flag rc29 nbh (radio is now 1x) -- tellnetd to root and install custom recovery. --- flash danger -- post about new brick saying they had the 2x radio installed.. while 1x was installed from the nbh.
[G1 Android Development] ezterry:
If you run 'adb shell flash_image recovery /dev/zero' before flashing the SPL.. you will find the fastboot screen.

Then if you 'fastboot boot recovery.img' when recovery boots you clear the status.. if recovery can't boot some fighting with the battery will return you eventually to fastboot where a more appropriate SPL/radio can be flashed..

of course if you are on the 1x radio and flash a recovery + reboot you are still at boot mode 3.

Thus far all recovery scripts to attempt this fail [seems recovery update scripts can't flash recovery... but you can run flash_image recovery from recovery???)...

Can't we just add an assert statement to check the radio version somehow...
[G1 Android Development] rynosaur:
That is exactly what I did, minus the sheepish fibbing. I have a G1 with a screen that won't wake up when in the "shut" position and heard a rumor that some screen controller software bit might be borked rather than the more likely bad cable or bad screen scenario. Regardless, I flashed RC29, then telnetd/su, flashed testkeys, reboot back into 1.0/telnet (because the screen would almost NEVER wake up in bootloader or recovery modes)--so I flash_imaged hardspl, then took the risky step of flashing DangerSPL on top of it. Not too risky, I guess, except that I rebooted holding camera key, hoping to see the skaters come up and the numbers to confirm and -- no, the screen stayed black. Foolishly, I tried to key it into fastboot mode (rather than pulling the battery), but since I wasn't accustomed to the reversed keys (in multicolor, action aborts an nbh flash, not so in hardspl bootloader?) I ended up reflashing rc29.nbh . . . thereby bricking the phone by pairing a 1x radio with Danger. So . . . what was a salvageable G1 is now a brick with a dead-ish screen. Hey, want a bricked G1 with a half-dead screen to toy with? :D

Anyhow, this was my experience/series of errors that confirm your theory.
[G1 Android Development] mblaster:
Two questions on that:

1) Does this confirm that bootmode 3 flag is unset if there is no recovery partition present (-> does it mean that the sequence 'delete recovery completely - flash dangerous stuff from a fastboot boot recovery.img - reboot - fail to get to recovery, thus go to fastboot - fastboot flash a recovery and be done with bm3 flag unset' will leave a g1 unbricked, except if spl/radio flash is incomplete?)

2) If there is no recovery present, but a working system, will it boot the system normally? It should in my opinion, perhaps i will try later [€: yes, boots normally, home+power on leads to bootloader] If this works it would be quite safe not to have a recovery on the phone at all if you don't need it around 24/7. Just always use a fastbooted recovery and you can't brick your phone?
[G1 Android Development] ezterry:
no boot mode 3 will remain set until you successfully boot recovery (or maybe a rom) and it clears /cache

However since the recovery is missing the phone enters a fail safe 'fastboot' mode to allow you to load a valid image. (and if need be load a valid radio+SPL for that image)

THis is why I said to boot not flash recovery.. since if you flash it and restart we will potentially get bricked just as if the recovery has always been there.

This is how people report "FASTBOOT USB" appearing after their near brick experience with danger spl.

Remember the splash screen is displayed in this mode.

If you are in normal boot mode the system will boot... home+power will enter the fail safe fastboot since there is no recovery.. and camera will enter the SPL screen as usual.
[G1 Android Development] mblaster:
Thanks for clarifying. Actually all this info was in your last post, i just didn't get it :o