Recover hard-bricked Max Lumi 2 - Page 4

richard.black · 10-19-2024, 09:17 AM

Code:

.\7za.exe l x

7-Zip (a) 24.08 (x86) : Copyright (c) 1999-2024 Igor Pavlov : 2024-08-11

Scanning the drive for archives:
1 file, 33554432 bytes (32 MiB)

Listing archive: x

--
Path = x
Type = xz
ERRORS:
There are data after the end of archive
Offset = 73311
Physical Size = 2223620
Tail Size = 31257501
Method = ARMT LZMA2:192k
Streams = 2
Blocks = 2

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
                    .....            0      2223620  x~
------------------- ----- ------------ ------------  ------------------------
                                     0      2223620  1 files

Warnings: 1

Errors: 1

Renate · 10-19-2024, 11:37 AM

Nope. Those are not happy messages.
It could be that persist is not used on this or that it's not a normal format.
Or that you trashed it.

That has sensor calibration data (mostly?).
That might not be so important but its absence might be the cause of your problems.

Ok, another test:

Code:

edl /u0 /r /psuper /c2048 y

That should make a file of 1 MB.
You can just rename it y.prc and post it as attachment.

richard.black · 10-19-2024, 12:32 PM

Here it is

Renate · 10-19-2024, 03:51 PM

Hey, my math sucks.
Or I just forgot that you're UFS.
It's all good. Sec....

Yup, you overwrote super with a zip file.

Lunchtime for me, I'll be back.

Renate · 10-19-2024, 08:43 PM

Oh, dear.
Updates have the logical partitions but not the correct metadata.
You killed the metadata too.
We have to make that from scratch.

Lemme see...

richard.black · 10-20-2024, 01:14 AM

Quote:

We have to make that from scratch.

How hard is it?

Renate · 10-20-2024, 08:22 AM

The problem is I don't know whether this has 2 or 3 slots and how it's arranged. It's probably like this:

Code:

====== Slot 0 ======
03000 Header v10.2
03100 P0 system_a (readonly) E0 G1
03134 P1 system_b (readonly) G2
03168 P2 system_ext_a (readonly) E1 G1
0319c P3 system_ext_b (readonly) G2
031d0 P4 product_a (readonly) E2 G1
03204 P5 product_b (readonly) G2
03238 P6 vendor_a (readonly) E3 G1
0326c P7 vendor_b (readonly) G2
032a0 E0 2048 - 4194952 (4192904) D0
032b8 E1 4196352 - 4794296 (597944) D0
032d0 E2 4794368 - 5947552 (1153184) D0
032e8 E3 5949440 - 6958184 (1008744) D0
03300 G0 default ()
03330 G1 qti_dynamic_partitions_a ()
03360 G2 qti_dynamic_partitions_b ()
03390 D0 super

Of course we have to fix all the sizes.

So you need to extract the four big files, system, system_ext, product, vendor.

There is the Python payload_dumper here. Since it was updated a few months ago I presume that they've fixed the protobuf problem.

So extract the four big files. Don't post them, I don't want them. But tell me the exact size to the byte of each of them.

richard.black · 10-20-2024, 09:59 PM

Oh, you mean these are partitions from the update file.

Code:

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----        10/19/2024  12:39 PM         151552 abl.img
-a----        10/19/2024  12:39 PM      100663296 boot.img
-a----        10/19/2024  12:39 PM        8388608 dtbo.img
-a----        10/19/2024  12:39 PM       40439808 modem.img
-a----        10/19/2024  12:39 PM      590430208 product.img
-a----        10/19/2024  12:39 PM      100663296 recovery.img
-a----        10/19/2024  12:39 PM     2186334208 system.img
-a----        10/19/2024  12:39 PM      306155520 system_ext.img
-a----        10/19/2024  12:39 PM           8192 vbmeta.img
-a----        10/19/2024  12:39 PM           4096 vbmeta_system.img
-a----        10/19/2024  12:39 PM      516665344 vendor.img
-a----        10/19/2024  12:39 PM        3133440 xbl.img

Renate · 10-20-2024, 10:48 PM

Quote:

Originally Posted by richard.black

Oh, you mean these are partitions from the update file.

Ok, proceed carefully. Copy/paste the commands one by one waiting for each to finish. There should be no errors or complaints about size. Stop if anything is fishy. Just rename the attached file .img

Code:

edl /u0 /w /s8712 /c256 manifest.img

edl /u0 /w /s8968 /c533773 system.img

edl /u0 /w /s542741 /c74745 system_ext.img

edl /u0 /w /s617486 /c144148 product.img

edl /u0 /w /s761634 /c126139 vendor.img

edl /u0 /w /pvbmeta_system_a vbmeta_system.img

edl /z

richard.black · 10-21-2024, 02:11 AM

Code:

.\edl.exe /u0 /w /s8712 /c256 .\manifest.img
Found EDL 9008, configuring... ok
Requesting info on LUN 0... ok
Requesting write manifest.img... ok, writing 100% ok
.\edl.exe /u0 /w /s8968 /c533773 .\update\output\system.img
Found EDL 9008, configuring... ok
Requesting info on LUN 0... ok
Requesting write system.img... ok, writing 100% ok
.\edl.exe /u0 /w /s542741 /c74745 .\update\output\system_ext.img
Found EDL 9008, configuring... ok
Requesting info on LUN 0... ok
Requesting write system_ext.img... ok, writing 100% ok
.\edl.exe /u0 /w /s617486 /c144148 .\update\output\product.img
Found EDL 9008, configuring... ok
Requesting info on LUN 0... ok
Requesting write product.img... ok, writing 100% ok
.\edl.exe /u0 /w /s761634 /c126139 .\update\output\vendor.img
Found EDL 9008, configuring... ok
Requesting info on LUN 0... ok
Requesting write vendor.img... ok, writing 100% ok
.\edl.exe /u0 /w /pvbmeta_system_a .\update\output\vbmeta_system.img
Found EDL 9008, configuring... ok
Requesting info on LUN 0... ok
Requesting GPT 0 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting write vbmeta_system.img... ok, writing 100% ok
.\edl.exe /z
Found EDL 9008, requesting reboot... ok

After reboot, still 900E system crash...

Here's the GPT table,

Code:

.\edl.exe /u /g
Found EDL 9008, configuring... ok
Requesting info on LUN 0... ok
Requesting GPT 0 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting GPT 1 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting GPT 2 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting GPT 3 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting GPT 4 header... ok, receiving... ok, requesting entries... ok, receiving... ok
Requesting GPT 5 header... ok, receiving... ok, requesting entries... ok, receiving... ok

LUN   #  Name                   Start       Count  Type
───  ──  ────────────────  ──────────  ──────────  ────────────────────
 0    1  ssd                        6           2  Secure SW download
 0    2  persist                    8        8192  Persist
 0    3  misc                    8200         256  Misc
 0    4  keystore                8456         128  Key store
 0    5  frp                     8584         128  FRP
 0    6  super                   8712     1048576  Super
 0    7  recovery_a           1057288       24576  Recovery
 0    8  recovery_b           1081864       24576    352b8083
 0    9  vbmeta_system_a      1106440          16  VB meta system
 0   10  vbmeta_system_b      1106456          16    fe3ab853
 0   11  metadata             1106472        4096    988a98c9
 0   12  onyxconfig           1110568        6144  System
 0   13  userdata             1116712    29003219  User data

 1    1  xbl_a                      6         896  Bootloader
 1    2  xbl_config_a             902          32  Boot config
 1    3  last_parti               934        1109  Empty

 2    1  xbl_b                      6         896  Bootloader
 2    2  xbl_config_b             902          32  Boot config
 2    3  last_parti               934        1109  Empty

 3    1  ALIGN_TO_128K_1            6          26    fde1604b
 3    2  cdt                       32          32  CDT
 3    3  ddr                       64         256  DDR
 3    4  last_parti               320       32443  Empty

 4    1  rpm_a                      6         128  Inactive
 4    2  tz_a                     134        1024  Inactive
 4    3  hyp_a                   1158         128  Inactive
 4    4  modem_a                 1286       46080  Inactive
 4    5  bluetooth_a            47366         256  Inactive
 4    6  mdtpsecapp_a           47622        1024  Inactive
 4    7  mdtp_a                 48646        8192  Inactive
 4    8  abl_a                  56838         256  Inactive
 4    9  dsp_a                  57094        8192  Inactive
 4   10  keymaster_a            65286         128  Inactive
 4   11  boot_a                 65414       24576  Inactive
 4   12  cmnlib_a               89990         128  Inactive
 4   13  cmnlib64_a             90118         128  Inactive
 4   14  devcfg_a               90246          32  Inactive
 4   15  qupfw_a                90278          16  Inactive
 4   16  vbmeta_a               90294          16  Inactive
 4   17  dtbo_a                 90310        6144  Inactive
 4   18  imagefv_a              96454         512  Inactive
 4   19  uefisecapp_a           96966         512    be8a7e08
 4   20  featenabler_a          97478          32    741813d2
 4   21  rpm_b                  97510         128  Resource/power mgmt
 4   22  tz_b                   97638        1024  TrustZone
 4   23  hyp_b                  98662         128  Hypervisor
 4   24  modem_b                98790       46080  FAT32
 4   25  bluetooth_b           144870         256  Bluetooth
 4   26  mdtpsecapp_b          145126        1024  MDTP secure
 4   27  mdtp_b                146150        8192  MDTP
 4   28  abl_b                 154342         256  Android bootloader
 4   29  dsp_b                 154598        8192  DSP
 4   30  keymaster_b           162790         128  Key master
 4   31  boot_b                162918       24576  Boot
 4   32  cmnlib_b              187494         128  Common lib
 4   33  cmnlib64_b            187622         128  Common lib64
 4   34  devcfg_b              187750          32  Device config
 4   35  qupfw_b               187782          16  QUP firmware
 4   36  vbmeta_b              187798          16  VB meta
 4   37  dtbo_b                187814        6144  DTBO
 4   38  featenabler_b         193958          32  Inactive
 4   39  imagefv_b             193990         512  Image FV
 4   40  uefisecapp_b          194502         512  Inactive
 4   41  devinfo               195014           1  Device info
 4   42  dip                   195015         256  DIP
 4   43  apdp                  195271          64  APDP
 4   44  spunvm                195335        2048  Spun VM
 4   45  splash                197383        8356  Splash
 4   46  limits                205739           1  Limits
 4   47  toolsfv               205740         256  Tools FV
 4   48  logfs                 205996        2048  Log FS
 4   49  cateloader            208044         512  STI
 4   50  rawdump               208556       32768  RAM dump
 4   51  logdump               241324       16384  Log dump
 4   52  storsec               257708          32  Store secure
 4   53  multiimgoem           257740           8    e126a436
 4   54  multiimgqti           257748           8    846c6f05
 4   55  uefivarstore          257756         128    165bd6bc
 4   56  secdata               257884           7    76cfc7ef
 4   57  catefv                257891         128  Cate FV
 4   58  catecontentfv         258019         256  Cate content FV
 4   59  last_parti            258275      790296  Empty

 5    1  ALIGN_TO_128K_2            6          26    6891a3b7
 5    2  modemst1                  32         512  Modem ST1
 5    3  modemst2                 544         512  Modem ST2
 5    4  fsg                     1056         512  Modem storage
 5    5  fsc                     1568          32  FSC
 5    6  last_parti              1600       31163  Empty

Renate · 10-21-2024, 07:26 AM

If you wrote an update of ~1.7 GB to LUN 0 then you trashed everything up to super and about half of super (4 GB). We may have gotten super fixed (we don't know).

Code:

LUN   #  Name        My Go6
───  ──  ──────────  ─────────
 0    1  ssd         zero
 0    2  persist     ext4
 0    3  misc        zero
 0    4  keystore    zero
 0    5  frp         40 bytes
 0    6  super

So the persist and the frp could be a problem. You should probably zero out all five. The random data can't help.

Code:

edl /u0 /f /p1
edl /u0 /f /p2
edl /u0 /f /p3
edl /u0 /f /p4
edl /u0 /f /p5

You can double check the 4 logical partitions in super.

Code:

edl /u0 /r /psuper super.img
lputil /x /s0 /psystem_a s.img
fc /b s.img from-update-system.img | more
lputil /x /s0 /psystem_ext_a se.img
fc /b se.img from-update-system_ext.img | more
lputil /x /s0 /pproduct_a p.img
fc /b p.img from-update-product.img | more
lputil /x /s0 /pvendor_a v.img
fc /b v.img from-update-vendor.img | more

Has recovery been working? Can you get there?

Edit: I've never had any dealings with the frp, but if Onyx actually enforced that you could be screwed. It's even possible that if you write frp, boot up, then restore the original frp you could be permanently locked out too.

Post-disaster advice: If you had made a full, raw backup you could type a single line, make a coffee and come back to a working device.

Maybe it's time to plead with Onyx. If you have a clear title they can probably reflash it.

richard.black · 10-21-2024, 10:00 AM

Code:

FC: no differences encountered

No difference encountered on all of them.

Quote:

Maybe it's time to plead with Onyx. If you have a clear title they can probably reflash it.

They didn't acknowledge my request to reflash when I emailed them about this problem, they just said that rebooting to recovery and factory reset will fix it. I'll contact them again...

Hey, I can run fairly risky commands if you believe you can fix it.

Renate · 10-21-2024, 10:25 AM

Try the factory reset again.
It might not work before if the super manifest was trashed.
Can you get to recovery?

You can flash recovery.img from the update.

You can flash misc-recovery.img to /misc and you should go to recovery with reboot.
If you want to undo that, just do the /f (fill) again on misc

richard.black · 10-21-2024, 10:49 AM

Nope, still can't get to recovery...900E (which was working previously, btw)

Renate · 10-21-2024, 11:29 AM

Did flashing the new recovery kill it?

10-21-2024, 07:26 AM	#56
Renate Onyx-maniac Posts: 3,281 Karma: 13468977 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	If you wrote an update of ~1.7 GB to LUN 0 then you trashed everything up to super and about half of super (4 GB). We may have gotten super fixed (we don't know). Code: LUN # Name My Go6 ─── ── ────────── ───────── 0 1 ssd zero 0 2 persist ext4 0 3 misc zero 0 4 keystore zero 0 5 frp 40 bytes 0 6 super So the persist and the frp could be a problem. You should probably zero out all five. The random data can't help. Code: edl /u0 /f /p1 edl /u0 /f /p2 edl /u0 /f /p3 edl /u0 /f /p4 edl /u0 /f /p5 You can double check the 4 logical partitions in super. Code: edl /u0 /r /psuper super.img lputil /x /s0 /psystem_a s.img fc /b s.img from-update-system.img \| more lputil /x /s0 /psystem_ext_a se.img fc /b se.img from-update-system_ext.img \| more lputil /x /s0 /pproduct_a p.img fc /b p.img from-update-product.img \| more lputil /x /s0 /pvendor_a v.img fc /b v.img from-update-vendor.img \| more Has recovery been working? Can you get there? Edit: I've never had any dealings with the frp, but if Onyx actually enforced that you could be screwed. It's even possible that if you write frp, boot up, then restore the original frp you could be permanently locked out too. Post-disaster advice: If you had made a full, raw backup you could type a single line, make a coffee and come back to a working device. Maybe it's time to plead with Onyx. If you have a clear title they can probably reflash it. Last edited by Renate; 10-21-2024 at 07:41 AM.

10-21-2024, 10:49 AM	#59
richard.black Connoisseur Posts: 84 Karma: 10 Join Date: Sep 2024 Device: Max Lumi 2	Nope, still can't get to recovery...900E (which was working previously, btw) Last edited by richard.black; 10-21-2024 at 10:52 AM.

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Free Boox Max Lumi 1 (Eu)	Neru	Flea Market	0	10-16-2022 11:11 AM
Max Lumi	Dodman	Onyx Boox	3	03-18-2022 12:15 PM
Max 3 / Max Lumi: lack of physical buttons annoying?	mr_sm1th	Onyx Boox	6	12-19-2020 11:45 AM
max lumi reviews	whopper	Onyx Boox	27	10-14-2020 12:13 PM

10-19-2024, 11:37 AM	#47
Renate Onyx-maniac Posts: 3,281 Karma: 13468977 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	Nope. Those are not happy messages. It could be that persist is not used on this or that it's not a normal format. Or that you trashed it. That has sensor calibration data (mostly?). That might not be so important but its absence might be the cause of your problems. Ok, another test: Code: edl /u0 /r /psuper /c2048 y That should make a file of 1 MB. You can just rename it y.prc and post it as attachment.

10-19-2024, 03:51 PM	#49
Renate Onyx-maniac Posts: 3,281 Karma: 13468977 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	Hey, my math sucks. Or I just forgot that you're UFS. It's all good. Sec.... Yup, you overwrote super with a zip file. Lunchtime for me, I'll be back.

10-19-2024, 08:43 PM	#50
Renate Onyx-maniac Posts: 3,281 Karma: 13468977 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	Oh, dear. Updates have the logical partitions but not the correct metadata. You killed the metadata too. We have to make that from scratch. Lemme see...

10-20-2024, 08:22 AM	#52
Renate Onyx-maniac Posts: 3,281 Karma: 13468977 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	The problem is I don't know whether this has 2 or 3 slots and how it's arranged. It's probably like this: Code: ====== Slot 0 ====== 03000 Header v10.2 03100 P0 system_a (readonly) E0 G1 03134 P1 system_b (readonly) G2 03168 P2 system_ext_a (readonly) E1 G1 0319c P3 system_ext_b (readonly) G2 031d0 P4 product_a (readonly) E2 G1 03204 P5 product_b (readonly) G2 03238 P6 vendor_a (readonly) E3 G1 0326c P7 vendor_b (readonly) G2 032a0 E0 2048 - 4194952 (4192904) D0 032b8 E1 4196352 - 4794296 (597944) D0 032d0 E2 4794368 - 5947552 (1153184) D0 032e8 E3 5949440 - 6958184 (1008744) D0 03300 G0 default () 03330 G1 qti_dynamic_partitions_a () 03360 G2 qti_dynamic_partitions_b () 03390 D0 super Of course we have to fix all the sizes. So you need to extract the four big files, system, system_ext, product, vendor. There is the Python payload_dumper here. Since it was updated a few months ago I presume that they've fixed the protobuf problem. So extract the four big files. Don't post them, I don't want them. But tell me the exact size to the byte of each of them.

10-21-2024, 11:29 AM	#60
Renate Onyx-maniac Posts: 3,281 Karma: 13468977 Join Date: Feb 2012 Device: Nook NST, Glow2, 3, 4, '21, Kobo Aura2, Poke3, Poke5, Go6	Did flashing the new recovery kill it?

Advert

Advert