Leaf boot loop after deleting a system app

[Renate]

Frank, I've done my damndest to destroy your spirit and you're still ticking!

Ok, now we embark for the darkest shores.
The concept is that if you can prevent your SoC from accessing the flash memory it will say, "I give up. There's nothing here, I'm in a wasteland, I'm going to 9008."

You are interested in the teeny-tiny black rectangles.
The brown/blondish are of no importance.
In this diagram there aren't a lot of useful possibilities.
Try not to short them, connect to one side or the other.
Use the voltmeter in diode test with the black lead connected to tin.
Do a long power button reset and look for 9008.

Prepare accordingly by downloading edl.exe, Zadig and the Firehose loader on that page.
It may be difficult to hit 9008 and you want to be prepared.

[frankbonatelli]

My sprints are always good! Its dead to me in current state and can not get any deader (lets make it a word yes)
So I think before i attempt Ill need some study time. duckduckgo to the rescue with luck.

Originally Posted by Renate

The brown/blondish are of no importance.

Not sure what this is referring to.

Use the voltmeter in diode test with the black lead connected to tin.
Do a long power button reset and look for 9008.

Black probe to tin and red to either side of (assumption here) the diode?...

1. edl.exe I think I have it setup followed a few different how 2's but not yet tested that it works.
2. Zadig 2.7 running and have used it.
3. Firehose loader not sure on this doing reading to gather an understanding of its uses.

It may be difficult to hit 9008 and you want to be prepared.

When I am ready to begin am I to understand that the success of reaching a 9008 state is on a timer? I have seen such thing on other Chinese devices.
If so what will be the procedure to follow at a successful 9008 (edl state yes??)

Picture attached is for my understanding and for my all important mind map. Yup its a thing
As always i thank you for your shared knowledge!

[Renate]

Little rectangles with a shiny solder blob on two ends are surface mount components.
They are either resistors (black body) or capacitors (tan, brown, blond bodies).
Capacitors are always between different power supplies and for our purposes are boring.
Resistors are often used as "build out", "pull up" or "pull down" and are usually very important.

So, yeah, the positive (red) lead to the resistor, the negative (black) lead to a good ground.

Technically speaking using the meter (in diode test) as a source of confusion is not as impressive as a lower value resistor.

[Renate]

Don't go crazy pursuing this.
If you can't get anything interesting going in 15 minutes then probably the scheme with using the meter doesn't have enough of an effect.

[frankbonatelli]

Yea so far no joy.
Seems destined to stay in the 900E state. I'm going to purchase a magnifying glass as maybe i am not making proper contact. The magic smoke has not fled yet so I haven't touched what I shouldn't have....Yet

[Renate]

Originally Posted by frankbonatelli

Yea so far no joy.

Did you ever do that mutual test on your two meters?

Is there any place that you could buy some resistors?
Do you want to PM me a mailing address and I can drop a couple in the mail?

If you weren't in Canada I would have told you to mail me the darn thing.
I've got 1.8V logic UART, oscilloscope, resistors, things to automate reset...

[denisuu]

I've been following this topic closely because it seems the behavior is quite similar to what my Leaf 2 was doing. Except I was able to get it in to 9008 mode.

This might be a stupid suggestion but did you try a qualcomm cable? I made one and was able to get it in to EDL by pressing the buttons in the attachment. I know the Leaf 1 doesn't have the volume buttons but maybe it works by doing a combination with the power button?

This is the combination to get the Leaf 2 into recovery, maybe it works on the Leaf 1?

- Power off device,
- Press and hold power button,
- After small LED in button turns on, continue holding for about 7 seconds,
- Release button and quickly press it 5 times.

[Renate]

Originally Posted by denisuu

This might be a stupid suggestion but did you try a qualcomm cable?

No, it's a good suggestion.
It's just that I've never gotten it to work.
I'll try again.

Edit: I've tried again. No luck.
I believe that the Poke3 has digital and analog audio out.
That might mean an external mux on the USB 2.0 data lines?
Maybe a TS5USBA224?

Edit^2: Hmm, it looks like the multiplexor could be internal.
Still, that doesn't preclude it breaking the DP detection.

[denisuu]

Originally Posted by Renate

No, it's a good suggestion.
It's just that I've never gotten it to work.
I'll try again.

I only understood half of that post lol.

The first cable I cut up didn't work either, I thought maybe my soldering was off, tried again, still didn't work. I cut up another cable and it worked...

Things I used:

• USB3 Cable that came with a MX Master 3 mouse
• Push Button Momentary Switch
• Soldering iron, solder
• Shrink tube & electrical tape.

[Renate]

Originally Posted by denisuu

I only understood half of that post lol.

Well, you've had a view of the UART so you know that most things you do are visible there.
I won't deny that it's possible that some tricky, magic sequence can unlock the goodies.
I'm just saying that I've never been good at it.

Yes, I actually have discovered sequences like, "you have to touch these four corners in sequence", but only by disassembling, not by trial and error.

Most of the Darwinian differentiation is built into abl.
Shall I become a system boot, a recovery, a fastboot (bootloader), an EDL?

Detecting the state of the USB PHY (physical interface) may not be easy if there is a multiplexor (for analog audio) that is interposed in the path.

No idea. But since source code is a rarity in this field it would take a bit of looking.

[denisuu]

Ok, I understand now.

Yea I never understood how people find these code sequences. It must either be through reverse engineering the code, or leaks from the manufacturer right? I can't imagine people are just trying random combinations in the hope something will happen.

[Renate]

Originally Posted by denisuu

Yea I never understood how people find these code sequences.

This whole post has been changed.

Well, everything is more complicated than I thought.
I don't think that the special modes detection is implemented correctly.

Things that I do know now:

There are three things detected as influencing boot modes and three things that don't

• The power switch
• The backspace or the down arrow keys. They are effectively the same.
• The other 3 arrow keys are detected but not used in any decisions

The power button
The power button must be held down shortly after the device reboots.
If it is not detected at that instant the boot proceeds normally.
If it is detected a measurement period starts where the power key must be pushed 5 more times.
This will get you into recovery. The timing can be tricky.

Pressed down Power key[258].
======> GetBootIntoModeRecovery detect begin. Power key Down [5193 ms]
======> GetBootIntoModeRecovery Power key Up [8495 ms]
======> BootIntoMode detect seg[0] Power key Down [8795 ms]
======> BootIntoMode detect seg[0] Power key Up [8995 ms]
======> BootIntoMode detect seg[1] Power key Down [9095 ms]
======> BootIntoMode detect seg[1] Power key Up [9495 ms]
======> BootIntoMode detect seg[2] Power key Down [9695 ms]
======> BootIntoMode detect seg[2] Power key Up [9795 ms]
======> BootIntoMode detect seg[3] Power key Down [9995 ms]
======> BootIntoMode detect seg[3] Power key Up [10196 ms]
======> BootIntoMode detect seg[4] Power key Down [10296 ms]
======> BootIntoMode detect seg[4] Power key Up [10496 ms]
======> BootIntoRecovery detected. [10496 ms]
======> GetBootIntoModeRecovery detect end [10496 ms]
KeyPress:258, BootReason:0
Fastboot=0, Recovery:1

If you are doing this blind, it might make sense to just push it on and off continuously.
That means that 50% of the time the start will not be detected.
But if it is detected then it will probably catch your five pushes.

The UART
As with the power button something must occur at the beginning of the boot to start a measurement period.
There seems to be something wrong with the timeout logic.
You may get to either recovery or EDL mode.

All the Onyx need 1.8V logic level.

If you only have a 3.3V USB UART adapter you can still make it go.
Just don't connect it directly!
You use the transmit out of the USB UART through a resistor divider to the Onyx UART receive pin.
You can't monitor the other direction, so you only have two wires, the ground and the transmit to the Onyx.
More details if anybody's interested.

[Renate]

So, I figured it out.

It's very simple.
If you hit a down arrow 101 or more times it will go to recovery.
If you hit a down arrow 51 to 100 times it will go to EDL mode.
If you hit a down arrow 0 to 50 times it will boot normally.

The problem?
The counting starts at a certain point after the reset.
Keys hit before this point are ignored.
The keys are buffered so that any keys hit after it starts listening are counted.
If you just hold down the key it will inject and buffer a zillion keys.
If you hit the keys manually you must make sure that the buffer always has something in it and that there is no 1/10 of a second gap.

The answer?

C:\>adb reboot & abltest /r com3
Listening...
Starting
Jabbering...
Detecting...
Going to recovery!
Done

C:\>adb reboot & abltest com3
Listening...
Starting
Jabbering...
Detecting...
Going to EDL mode!
Done

[Renate]

If somebody has a rooted Leaf1, could you pull abl for me so I can double check whether it's close enough to the Poke3 abl that the above program will work? Thanks!

[frankbonatelli]

Wow, thanks for all these new ideas and data points.
Apologies for the delays...
Life..... It happens

This might be a stupid suggestion but did you try a qualcomm cable? I made one and was able to get it in to EDL by pressing the buttons in the attachment. I know the Leaf 1 doesn't have the volume buttons but maybe it works by doing a combination with the power button?

Hey thanks for weighing in!! There is never such a thing as a stupid question in my world. The unasked question could be the one that solves world piece!!! and to answer no I have not but I am defiantly willing to explore the path. I believe I saw somewhere in the tombs of this forum details on how2 so ill dig in and try. It actually has sparked a memory that I purchased a cable to break free my pixelbook from googles clutches that might be a thing similar to this. More study needed And again
WOW thanks for the shared knowledge experiences.

So, I figured it out.

It's very simple.
If you hit a down arrow 101 or more times it will go to recovery.
If you hit a down arrow 51 to 100 times it will go to EDL mode.
If you hit a down arrow 0 to 50 times it will boot normally.

Not a surprise to any of us mortals down here!!
This is really interesting. Its all magic and random to us until the true math is discovered! Not that I am able to follow the thread fully, I am only mortal after all. You just run with it, Ill catch up when the light switch is turned on.

For all that are following along I have not been successful in this adventure
YET......