Why has my Note3 been stuck on the boot animation after I erased userdata and cache?

[dangdang_read]

Because my Note3 kept freezing, I erased the userdata and cache partitions in fastboot mode. After that, it has been stuck on the boot animation. Sadly, I didn't back up the recovery.img either, and ended up flashing a recovery that doesn't work.

Then I tried extracting the latest update.upx, but it turned out to be a differential update package. So I found a full ROM for Note3 here: https://www.123865.com/s/FsnpTd-T4MSh .
It contains system.img, vendor.img, and persist.img... I removed the back cover and shorted the USB ground and D- pins, then used the Python edl tool to flash those images. After that, I ran edl e userdata, edl e cache, and then edl reset. However, it's still stuck on the boot animation.

Then I looked for a Xiaomi recovery image for the same CPU — twrp-3.7.0_9-0-nitrogen.img.
After flashing it via fastboot and running fastboot reboot recovery, the device immediately jumps back to fastboot mode.

However, after several attempts of repeatedly pressing the power button, there's a chance that the device will appear as a Xiaomi "nitrogen" device in lsusb, the screen still remains blank. But when I connect via adb shell, I get a root shell environment.

In that shell, I tried to format userdata and cache. I used mkfs.f2fs to reformat the userdata partition, then rebooted — but it's still stuck on the boot animation.
So I started trying to compile TWRP using the ramdisk from twrp-3.7.0_9-0-nitrogen.img.

As a beginner who's doing this for the first time, I followed the TWRP documentation. I extracted the kernel and kernel_dtb from the original boot.img, then combined them with the ramdisk from twrp-3.7.0_9-0-nitrogen.img to build TWRP.

After successfully compiling it, I flashed the new recovery image via fastboot. However, after running fastboot reboot recovery, the device stays on the logo for a few seconds, then returns back to fastboot mode again.

Now I'm completely out of options.

[dangdang_read]

the boot.img is only 13MB,When I extracted the boot.img, I only got the kernel and kernel_dtb — there was no ramdisk. So is this device using system-as-root ?

Being stuck on the boot animation — does that at least indicate that the system partition was successfully mounted, that the root filesystem is the system partition, and that /system/sbin/init is running normally?

[Renate]

Erasing is bad. You left userdata without a filesystem.
You can "fastboot -w" but that will also invalidate any backups you have made.

You don't need to open the back to do the effect of grounding USB D+ (not D-).
If you opened it you would normally use the EDL test points.

There is a full update:

Model:  Note3 (English)
Finger: ONYX/Note3/Note3:10/2023-12-12_20-36_3.5_4687b1901/12698:user/dev-keys
Link:   http://firmware-us.boox.com/87cbd39a961aa48f8330c9d31b45916c/update.upx
Size:   1,707,826,394
MD5:    87cbd39a961aa48f8330c9d31b45916c

[dangdang_read]

Originally Posted by Renate

Erasing is bad. You left userdata without a filesystem.
You can "fastboot -w" but that will also invalidate any backups you have made.

You don't need to open the back to do the effect of grounding USB D+ (not D-).
If you opened it you would normally use the EDL test points.

There is a full update:

Model:  Note3 (English)
Finger: ONYX/Note3/Note3:10/2023-12-12_20-36_3.5_4687b1901/12698:user/dev-keys
Link:   http://firmware-us.boox.com/87cbd39a961aa48f8330c9d31b45916c/update.upx
Size:   1,707,826,394
MD5:    87cbd39a961aa48f8330c9d31b45916c

I didn’t know fastboot had the -w option ...,so I tried fastboot format,also tried generating a userdata.img using dd, formatted it with mkfs.f2fs, and flashed it via fastboot, but it still didn’t work. Since I couldn’t locate the EDL test points (no clear documentation or images showing which two solder points to short), I used a USB 2.0 cable and a multimeter to measure which test points near the Note3’s USB port were connected to the Type-A interface.

[dangdang_read]

it only contains system.patch.dat and system.transfer.list.

~/device/boox/update$ ls -alh
总用量 1.7G
drwxrwxr-x 3 haha haha 4.0K 5月 21 15:10 .
drwxrwxr-x 3 haha haha 4.0K 5月 21 15:10 ..
-rw-rw-r-- 1 haha haha 148K 1月 1 2009 abl.elf
-rw-rw-r-- 1 haha haha 13M 1月 1 2009 boot.img
-rw-rw-r-- 1 haha haha 7.0K 1月 1 2009 compatibility.zip
drwx------ 3 haha haha 4.0K 5月 21 15:10 META-INF
-rw-rw-r-- 1 haha haha 32M 1月 1 2009 persist.img
-rw-rw-r-- 1 haha haha 39K 1月 1 2009 pmic.elf
-rw-rw-r-- 1 haha haha 220K 1月 1 2009 rpm.mbn
-rw-rw-r-- 1 haha haha 1.5G 1月 1 2009 system.new.dat.br
-rw-rw-r-- 1 haha haha 0 1月 1 2009 system.patch.dat
-rw-rw-r-- 1 haha haha 15K 1月 1 2009 system.transfer.list
-rw-rw-r-- 1 haha haha 157M 1月 1 2009 vendor.new.dat.br
-rw-rw-r-- 1 haha haha 0 1月 1 2009 vendor.patch.dat
-rw-rw-r-- 1 haha haha 2.9K 1月 1 2009 vendor.transfer.list
-rw-rw-r-- 1 haha haha 2.5M 1月 1 2009 xbl.elf

[Renate]

Oh, so you're not counting the 1,528,342,239 bytes of system.new.dat.br ?

[dangdang_read]

Originally Posted by Renate

Oh, so you're not counting the 1,528,342,239 bytes of system.new.dat.br ?

Oh, so it can synthesize the full package. So I generated system.img and vendor.img, then flashed them using the following commands:

brotli --decompress system.new.dat.br
brotli --decompress vendor.new.dat.br
sdat2img system.transfer.list system.new.dat system.img
sdat2img vendor.transfer.list vendor.new.dat vendor.img


edl w xbl xbl.elf --loader=~/device/boox/prog_ufs_firehose_SDM636_ddr.elf
edl w rpm rpm.mbn --loader=~/device/boox/prog_ufs_firehose_SDM636_ddr.elf
edl w pmic pmic.elf --loader=~/device/boox/prog_ufs_firehose_SDM636_ddr.elf
edl w abl abl.elf --loader=~/device/boox/prog_ufs_firehose_SDM636_ddr.elf
edl w system system.img --loader=~/device/boox/prog_ufs_firehose_SDM636_ddr.elf
edl w vendor vendor.img --loader=~/device/boox/prog_ufs_firehose_SDM636_ddr.elf
edl e boot --loader=~/device/boox/prog_ufs_firehose_SDM636_ddr.elf
edl reset

sudo fastboot flash boot boot.img
sudo fastboot -w
sudo fastboot reboot

The commands above all executed successfully, and fastboot -w also showed that userdata and cache were properly formatted.But it still gets stuck on the boot animation. To confirm whether system.img and vendor.img are intact, I mounted them, and the mounting process worked fine.

sudo mount system.img ~/mnt1
sudo mount system.img ~/mnt2
~/mnt1$ ls -alh
总计 176K
drwxr-xr-x. 22 root root 4.0K 2009年 1月 1日 .
drwx------ 66 happ happ 4.0K 5月22日 18:06 ..
drwxr-xr-x. 2 root root 4.0K 2009年 1月 1日 acct
drwxr-xr-x. 2 root root 4.0K 2009年 1月 1日 apex
lrw-r--r--. 1 root root 11 2009年 1月 1日 bin -> /system/bin
lrw-r--r--. 1 root root 50 2009年 1月 1日 bugreports -> /data/user_de/0/com.android.shell/files/bugreports
drwxrwx---. 2 happ 2001 4.0K 2009年 1月 1日 cache
lrw-r--r--. 1 root root 19 2009年 1月 1日 charger -> /system/bin/charger
dr-xr-xr-x. 2 root root 4.0K 2009年 1月 1日 config
lrw-r--r--. 1 root root 17 2009年 1月 1日 d -> /sys/kernel/debug
drwxrwx--x. 2 happ happ 4.0K 2009年 1月 1日 data
drwxr-xr-x. 2 root root 4.0K 2009年 1月 1日 debug_ramdisk
lrw-------. 1 root root 23 2009年 1月 1日 default.prop -> system/etc/prop.default
drwxr-xr-x. 2 root root 4.0K 2009年 1月 1日 dev
lrw-r--r--. 1 root root 11 2009年 1月 1日 etc -> /system/etc
lrwxr-x---. 1 root 2000 16 2009年 1月 1日 init -> /system/bin/init
-rwxr-x---. 1 root 2000 2.1K 2009年 1月 1日 init.environ.rc
-rwxr-x---. 1 root 2000 33K 2009年 1月 1日 init.rc
-rwxr-x---. 1 root 2000 3.1K 2009年 1月 1日 init.recovery.qcom.rc
-rwxr-x---. 1 root 2000 7.6K 2009年 1月 1日 init.usb.configfs.rc
-rwxr-x---. 1 root 2000 5.6K 2009年 1月 1日 init.usb.rc
-rwxr-x---. 1 root 2000 611 2009年 1月 1日 init.zygote32.rc
-rwxr-x---. 1 root 2000 1.1K 2009年 1月 1日 init.zygote64_32.rc
drwx------. 2 root root 16K 2009年 1月 1日 lost+found
drwxr-xr-x. 2 root happ 4.0K 2009年 1月 1日 mnt
drwxr-xr-x. 2 root root 4.0K 2009年 1月 1日 odm
drwxr-xr-x. 2 root root 4.0K 2009年 1月 1日 oem
drwxr-xr-x. 2 root root 4.0K 2009年 1月 1日 onyxconfig
drwxr-xr-x. 2 root root 4.0K 2009年 1月 1日 proc
lrw-r--r--. 1 root root 15 2009年 1月 1日 product -> /system/product
lrw-r--r--. 1 root root 24 2009年 1月 1日 product_services -> /system/product_services
drwxr-xr-x. 4 root root 4.0K 2009年 1月 1日 res
drwxr-x---. 2 root 2000 4.0K 2009年 1月 1日 sbin
lrw-r--r--. 1 root root 21 2009年 1月 1日 sdcard -> /storage/self/primary
drwxr-x--x. 2 root 1028 4.0K 2009年 1月 1日 storage
drwxr-xr-x. 2 root root 4.0K 2009年 1月 1日 sys
drwxr-xr-x. 17 root root 4.0K 2009年 1月 1日 system
-rw-r--r--. 1 root root 2.6K 2009年 1月 1日 ueventd.rc
drwxr-xr-x. 2 root 2000 4.0K 2009年 1月 1日 vendor
-rw-r--r--. 1 root root 524 2009年 1月 1日 verity_key
drwxr-xr-x. 2 root root 4.0K 2009年 1月 1日 waveform

~/mnt2$ ls
app bt_firmware default.prop etc firmware_mnt lib64 odm radio ueventd.rc
bin build.prop dsp firmware lib lost+found overlay rfs

The default filesystem for fastboot -w is ext4, but what is the correct filesystem for userdata—ext4 or f2fs?

[dangdang_read]

The device has returned to normal. After confirmation, the userdata partition must be formatted as f2fs. Thanks to Renate for the help.