Anyone willing to "repair" an Onyx Note 2?

[tatteredscroll]

Originally Posted by Renate

Don't you just hate patching statically linked binaries?
Especially with weird load addresses.

Ho hum. Time to make soup.

Edit: That turned out pretty well. Turkey, leeks, onions, celery root, carrots, barley...

Sounds like a nice soup.

[Renate]

So, have you used EDL to flash recovery?

edl /w /precovery note2-rec.img
edl /w /pmisc misc-recovery.prc
edl /z

Check for ADB.

adb shell
id
getenforce

[tatteredscroll]

I had it unplugged overnight. When I plugged it in this morning, it immediately connected as QUSB_BULK 9008. I thought maybe the edl command would work, but I got bad XML. And I recall something in another thread to always leave it plugged in when doing this sort of work

No lights on near the button. Tried resetting, hold power button down for 60 seconds, no change. Maybe the battery is dead. Going to plug in to wall charger and leave plugged in for a bit, then try to reset and get back to EDL.

[Renate]

You need to reload the Firehose loader with "ell"

[tatteredscroll]

Still nothing. Getting weird measurements with the meter. This is what I got before

Black on frame and red on square shaped point, 0.
Black on frame and red on circular shaped point, 1800 mV. Oops, wrong setting. On DC and measuring, yes, 0.03 on square and 1.796 on circle.

Black on frame red on circle. I had a steady 1.8 yesterday.

Now when I hold it there for a little bit it will start around 30mV, then jump to around 300mv, then crash out to 0mv, then it repeats. Give or take 15-20mv, but it's definitely a pattern.

Now it's almost up to 1.0 volts, but still some fluctuation and no lights. I wonder if my wall charger I used was not actually charging it. Too much or not enough. Dang. Grabbing a smaller charger and try to charge it up again.

Are there any points or places where I could tell if it's charging?

[tatteredscroll]

I think it's borked. I connected it to serial on my Windows PC and just get gibberish. And not scrolling jibberish as before when it was in the bootloop. Just a block here or there (which I think is just line noise when I wiggle the connector). Thought it was Windows screwing with my USB Serial drivers (which it did in fact, but I fixed) so I moved to my Linux machine and using minicom and Putty, same.

Argh...technology is great when it works.

... 5-minutes later ...

I pressed power and the front panel button at the same time and after about 15 seconds, it woke up.

Now back to the bootloop on serial. I'll get it back into EDL mode on the Windows machine and try to load recovery and misc.

[tatteredscroll]

C:\Users\anon\Downloads\note2-edl>edl /lnote2.bin
Found EDL 9008, handshaking... version 2
HWID: 000460e100000000 (x3), JTAG: 000460e1, OEM: 0000, Model: 0000
Hash: cc3153a80293939b-90d02d3bf8b23e02-92e452fef662c749-98421adad42a380f (x3)
Sending note2.bin 100% ok, starting... ok, waiting for Firehose... no response, poking... ok

C:\Users\anon\Downloads\note2-edl>edl /w /precovery note2-rec.img
Found EDL 9008, configuring... ok
Requesting info on LUN 0... ok
Requesting GPT 0 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting write note2-rec.img... ok, writing 100% ok

C:\Users\anon\Downloads\note2-edl>edl /w /pmisc misc-recovery.prc
Found EDL 9008, configuring... ok
Requesting info on LUN 0... ok
Requesting GPT 0 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting write misc-recovery.prc... ok, writing 100% ok

C:\Users\anon\Downloads\note2-edl>edl /z
Found EDL 9008, requesting reboot... ok

////

adb shell not working
device not showing up on adb devices -l

device not showing up in usblog/device manager

[tatteredscroll]

Serial on windows pc is progressing further--

[ 8.574156] selinux: SELinux: Loaded file_contexts
[ 8.574156]
[ 8.574413] ueventd: Parsing file /ueventd.rc...
[ 8.574924] ueventd: Parsing file /vendor/ueventd.rc...
[ 8.574958] ueventd: Unable to read config file '/vendor/ueventd.rc': open() failed: No such file or directory
[ 8.574979] ueventd: Parsing file /odm/ueventd.rc...
[ 8.575003] ueventd: Unable to read config file '/odm/ueventd.rc': open() failed: No such file or directory
[ 8.575020] ueventd: Parsing file /ueventd.qcom.rc...
[ 8.575042] ueventd: Unable to read config file '/ueventd.qcom.rc': open() failed: No such file or directory
[ 8.642086] ueventd: firmware: loading 'ttdl_cmcp_thresholdfile.csv' for '/devices/soc/78b7000.i2c/i2c-3/3-0024/firmware/ttdl_cmcp_
[ 9.952516] ueventd: Coldboot took 1.375 seconds
[ 9.955357] init: wait for '/dev/.coldboot_done' took 1321ms
[ 9.955449] init: Command 'wait_for_coldboot_done' action=wait_for_coldboot_done (<Builtin Action>:0) took 1321ms and succeeded
[ 9.955477] init: processing action (MixHwrngIntoLinuxRng) from (<Builtin Action>:0)
[ 9.956060] init: Mixed 512 bytes from /dev/hw_random into /dev/urandom
[ 9.956088] init: processing action (SetMmapRndBits) from (<Builtin Action>:0)
[ 9.956862] init: processing action (SetKptrRestrict) from (<Builtin Action>:0)
[ 9.957098] init: processing action (keychord_init) from (<Builtin Action>:0)
[ 9.957120] init: processing action (console_init) from (<Builtin Action>:0)
[ 9.957149] init: processing action (init) from (/init.rc:8)
[ 9.988047] fail to open /onyxconfig/waveform/waveform.wbf!
[ 9.988050] onyx_epdc_init_wavefw(): request_firmware_nowait [/waveform/eink_waveform.wbf]!
[ 9.988075] fail to open /waveform/cfa_lut.bin!
[ 9.988437] onyx_epdc_fb_fw_handler(): fw->size=282231
[ 9.988563] onyx_waveform_parse_and_init_panel(): enter!
[ 9.988565] o_w_p_p(): is_5bit_to_4bit= 0!
[ 9.988568] o_w_p_p(): file_size=282231, fpl_material_version=0x0, waveform_mode_version[0x10]=0x19, WFM_REV[0x16]=0x0, waveform_
[ 9.988572] o_w_p_p(): frame_rate=85HZ, waveform_lookup_table_fmt = 4, waveform_mode_table_address=0x5f, mode_num=8, temp_num=14,
[ 9.988574] o_w_p_p(): waveform file [320_R137_AFDE01_ES103TD1C1_TC]!
[ 10.031049] o_w_p_p(): OK!
[ 10.031053] mode[0] = 99 frames.
[ 10.031055] mode[1] = 22 frames.
[ 10.031056] mode[2] = 38 frames.
[ 10.031057] mode[3] = 38 frames.
[ 10.031058] mode[4] = 38 frames.
[ 10.031060] mode[5] = 38 frames.
[ 10.031061] mode[6] = 10 frames.
[ 10.031062] mode[7] = 24 frames.
[ 10.031064] onyx_waveform_mode_transform_init(): waveform_mode_version[0x25]
[ 10.031067] get_glr16_mode_index(): waveform_info_index = 7.
[ 10.031069] get_glr16_mode_index(): gc16[2] glr16[4] gld16[5] a2[6] gcc16[-1] glrc16[-1].
[ 10.031071] o_c_w_d_p(): waveform_mode_index = 4!
[ 10.031193] o_c_w_d_p(): waveform_mode_index = 5!
[ 10.031312] o_e_d_mode0(): begin!
[ 10.031315] onyx_epdc_set_temp(): set temp[24] temp_index[8]!
[ 10.032954] onyx_epdc_draw_mode0(): kernel_init_mode_disable[1]!
[ 10.046066] onyx_epdc_draw_mode0(): splash mem w[139] h[627] bpp[16] at x[864] y[388].
[ 10.758116] of_batterydata_get_best_profile: 4038356_actionprowave_a835_cholipower_4300mah_pmi8 952_averaged_masterslave_jul15th2019
[ 10.773691] FG: fg_batt_profile_init: vbat_est_diff: 12665uv, allow range: 50000uv
[ 10.782884] FG: fg_batt_profile_init: Battery SOC: 90, V: 4216589uV
[ 10.788500] of_batterydata_get_best_profile: 4038356_actionprowave_a835_cholipower_4300mah_pmi8 952_averaged_masterslave_jul15th2019
[ 10.800476] SMBCHG: smbchg_config_chg_battery_type: Vfloat changed from 4400mV to 4350mV for battery-type 4038356_actionprowave_a832_averaged_masterslave_ju l15th2019
[ 18.708026] mdss_mdp_epdc_thread: mdss_mdp_epdc_thread(): start!!
[ 18.713221] mdss_mdp_epdc_thread: mdss epdc open fb0.
[ 18.718137] ################ fb_blank(): caller = mdss_mdp_epdc_thread+0x110/0x920, blank=0
[ 18.737185] ################ fb_blank(): END!
[ 55.418288] random: nonblocking pool is initialized
[ 66.408146] cyttsp5_i2c_adapter 3-0024: cyttsp5_cmcp_parse_threshold_file: No builtin cmcp threshold file

It's been sitting at this for a while. Single quick press of the power button gave the following, otherwise, nothing happening.

[ 293.738362] PMIC input: code=116, sts=0x1
[ 293.931911] PMIC input: code=116, sts=0x0


full startup log here --> https://justpaste.it/db6rl

[Renate]

This is a recovery like none that I've ever seen.

When booting does the screen flash? Does it show a "splash" screen? Does it go to white?

Is this the first time that you've seen this version of the console log?

Are you sure that it's in recovery and not a broken normal system?

Extract the recovery image from the update and flash that and misc as above. Look for ADB and adb sideload.

[tatteredscroll]

Yes, at boot (as in I press and hold the button for about 18 seconds, the screen goes blank, then put's up the note splash image/logo.

Is this the first time I've seen this version of the console log? Yes, mostly. If you look at previous pastebin log in this thread, it would get up to around 13 seconds and reboot itself, blank the screen, start the boot process all over.

With note2-rec.img or recovery.img it "boots" but then get's stuck. Whereas before it did the bootloop.

I completed a recovery flash from the update.npx (zip) file and the misc-recovery.prc from post #47. Looks the same as using the note2-rec.img.

[ 18.758023] mdss_mdp_epdc_thread: mdss_mdp_epdc_thread(): start!!
[ 18.763253] mdss_mdp_epdc_thread: mdss epdc open fb0.
[ 18.768133] ################ fb_blank(): caller = mdss_mdp_epdc_thread+0x110/0x920, blank=0
[ 18.786029] ################ fb_blank(): END!
[ 23.049206] random: nonblocking pool is initialized

no response from adb commands

I see references to Ubuntu in the bootup log. This line was in previous bootlogs
Linux version 3.18.120-perf-gce29d74-dirty (onyx@onyx-ubuntu)

This line was not
OEM_IMAGE_VERSION_STRING=ubuntu

It's at the top. If you look at the recent https://justpaste.it/db6rl everything from

Format: Log Type - Time(microsec) - Message - Optional Info

to

Android Bootloader - UART_DM Initialized!!!

is new.

[tatteredscroll]

Is boot.img useful for what we're doing? What about the .mbn files?

Forgot to post this in previous comment. Here are edl commands with recovery and misc--

C:\Users\anon\Downloads\note2-edl>edl /lnote2.bin
Found EDL 9008, handshaking... version 2
HWID: 000460e100000000 (x3), JTAG: 000460e1, OEM: 0000, Model: 0000
Hash: cc3153a80293939b-90d02d3bf8b23e02-92e452fef662c749-98421adad42a380f (x3)
Sending note2.bin 100% ok, starting... ok, waiting for Firehose... no response, poking... ok

C:\Users\anon\Downloads\note2-edl>edl /w /precovery recovery.img
Found EDL 9008, configuring... ok
Requesting info on LUN 0... ok
Requesting GPT 0 header... ok, receiving... ok, requesting entries... ok, receiving... ok
File is not an integral number of blocks (512)

C:\Users\anon\Downloads\note2-edl>edl /w /pmisc misc-recovery.prc
Found EDL 9008, configuring... ok
Requesting info on LUN 0... ok
Requesting GPT 0 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting write misc-recovery.prc... ok, writing 100% ok

C:\Users\anon\Downloads\note2-edl>edl /z
Found EDL 9008, requesting reboot... ok

[Renate]

The stock recovery is supposed to give you an on-screen menu.
I guess that it didn't do that?
This is supposed to show this menu:

Reboot system now
Reboot to bootloader
Apply update from ADB
Apply update from SD card
Wipe data/factory reset
Wipe cache partition
Mount /system
View recovery logs
Power off

This thing apparently has a dependency on the /vendor partition, but I'm not sure.

[tatteredscroll]

Correct, the screen never shows a recovery menu. Screen blips the Onyx logo (I think I said note before) off and on, serial logs roll, never see recovery or anything besides Onyx logo.

[tatteredscroll]

I'll see if I can trigger recovery at boot with the 5x power button press trick. No luck yet, but I'll keep trying.

[tatteredscroll]

Looks like I actually hit it, but there is not recovery on the screen.

[900] EINK_PANEL=ES103TC1
[900] DSI xres =325 yres=1423 dst_format=3 dst_Bpp=3
[920] mdp_dma_on(): MDP_INTR_STATUS[0x100].
[920] mdp_dma_on(): MDP_INTR_CLEAR.
[920] ========> Power Key Down
[6030] ========> Power Key Up
[6230] ========> seg[0] Power Key Down
[6430] ========> seg[0] Power Key Up
[6530] ========> seg[1] Power Key Down
[6740] ========> seg[1] Power Key Up
[6840] ========> seg[2] Power Key Down
[7040] ========> seg[2] Power Key Up
[7140] ========> seg[3] Power Key Down
[7340] ========> seg[3] Power Key Up
[7550] ========> seg[4] Power Key Down
[7650] ========> seg[4] Power Key Up
[7650] ========> boot_into_recovery detected!!!
[7660] Device is unlocked! Skipping verification...

And this here about recovery mode (which has been in previous logs) and I see it can't stat /dev/block

[ 8.161526] init: First stage mount skipped (recovery mode)
[ 8.167180] init: Using Android DT directory /proc/device-tree/firmware/android/
[ 8.174562] init: Skipped setting INIT_AVB_VERSION (not vbmeta compatible)
[ 8.181401] init: Loading SELinux policy
[ 8.295791] audit: type=1403 audit(52046.709:2): policy loaded auid=4294967295 ses=4294967295
[ 8.303617] selinux: SELinux: Loaded policy from /sepolicy
[ 8.303617]
[ 8.310529] init: kernel_enforcing: 0, is_enforcing: 0, is_recovery_mode: 1
[ 8.317178] init:
[ 8.323740] selinux: SELinux: Loaded file_contexts
[ 8.323740]
[ 8.332185] init: init second stage started!
[ 8.358361] init: Using Android DT directory /proc/device-tree/firmware/android/
[ 8.369928] selinux: SELinux: Loaded file_contexts
[ 8.369928]
[ 8.375184] init: Running restorecon...
[ 8.385038] selinux: SELinux: Could not stat /dev/block: No such file or directory.