Closed schneemaier closed 3 years ago
it may be an issue with emmc (spontaneous bricking is a bad sign).
could you try a raw emmc read with nvflash? it should go something like this, but the battery on my n7 is dead so i'm unable to test (yet):
sudo ./utils/nvflash_v1.13.87205_miniloader_patched --resume --rawdeviceread 0 2048 mmc-0-2048.bin
gzip mmc-0-2048.bin
then attach mmc-0-2048.bin.gz to the issue? (.zip also works, github should allow both). .bin file should be 8MB uncompressed i think (4k sectors).
you'd need to run that --rawdeviceread
after these first two commands:
sudo ./fusee-launcher/fusee-launcher.py ./payload/uart_payload_n7.bin -P 7330
sudo ./utils/nvflash_v1.13.87205_miniloader_patched --setbct --bct ./bct/nexus_7_grouper_bct.bin --configfile ./utils/flash.cfg --bl ./bootloader/bootloader-grouper-4.23.img --go
if emmc is bad, it might fail to do the read at all. the first 8MB of emmc would include the BCT and partition table and beginning of the bootloader partition.
Thanks for the advice. I tried but got an error:
root@xxxx:~/tegra30_debrick# ./utils/nvflash_v1.13.87205_miniloader_patched --resume --rawdeviceread 0 2048 mmc-0-2048.bin
Nvflash v1.13.87205 started
[resume mode]
failed executing command 31 NvError 0x120002
command failure: readdeviceraw failed (bad data)
I guess the eMMC is bad :(
yeah, i think it's a hardware issue. this is what you should see:
matt@aquos:~/devel/ouya/tegra30_debrick$ sudo ./fusee-launcher/fusee-launcher.py ./payload/uart_payload_n7.bin -P 7330
2021-11-06 21:26:57,674 INFO:usb.core:find(): using backend "usb.backend.libusb1"
Important note: on desktop Linux systems, we currently require an XHCI host controller.
A good way to ensure you're likely using an XHCI backend is to plug your
device into a blue 'USB 3' port.
Identified a Linux system; setting up the appropriate backend.
intermezzo_size: 0x00000078
target_payload_size: 0x000005ee
Found a Tegra with Device ID: b'05163c81bc245d01'
Stack snapshot: b'0000000000000000100000003c9f0040'
EndpointStatus_stack_addr: 0x40009f3c
ProcessSetupPacket SP: 0x40009f30
InnerMemcpy LR stack addr: 0x40009f20
overwrite_len: 0x00004f20
overwrite_payload_off: 0x00004de0
payload_first_length: 0x000005ee
overwrite_payload_off: 0x00004de0
payload_second_length: 0x00000000
b'00a0004000300040ee05000000000000'
Setting rcm msg size to 0x00030064
RCM payload (len_insecure): b'64000300'
Setting ourselves up to smash the stack...
Payload offset of intermezzo: 0x00000074
overwrite_payload_off: 0x00004de0
overwrite_len: 0x00004f20
payload_overwrite_len: 0x00004e5c
overwrite_payload_off: 0x00004de0
smash_padding: 0x000047f2
overwrite_payload_off: 0x00004de0
Uploading payload...
txing 20480 bytes total
txing 4096 bytes (0 already sent) to buf[0] 0x40003000
txing 4096 bytes (4096 already sent) to buf[1] 0x40005000
txing 4096 bytes (8192 already sent) to buf[0] 0x40003000
txing 4096 bytes (12288 already sent) to buf[1] 0x40005000
txing 4096 bytes (16384 already sent) to buf[0] 0x40003000
Smashing the stack...
sending status request with length 0x00004f20
The USB device stopped responding-- sure smells like we've smashed its stack. :)
Launch complete!
matt@aquos:~/devel/ouya/tegra30_debrick$ sudo ./utils/nvflash_v1.13.87205_miniloader_patched --setbct --bct ./bct/nexus_7_grouper_bct.bin --configfile ./utils/flash.cfg --bl ./bootloader/bootloader-grouper-4.23.img --go
Nvflash v1.13.87205 started
chip uid from BR is: 0x0000000000000000015d24bc813c1605
rcm version 0X30001
System Information:
chip name: unknown
chip id: 0x30 major: 1 minor: 3
chip sku: 0x83
chip uid: 0x0000000000000000015d24bc813c1605
macrovision: disabled
hdcp: enabled
jtag: disabled
sbk burned: true
dk burned: true
boot device: emmc
operating mode: 3
device config strap: 1
device config fuse: 17
sdram config strap: 0
sending file: ./bct/nexus_7_grouper_bct.bin
- 6128/6128 bytes sent
./bct/nexus_7_grouper_bct.bin sent successfully
downloading bootloader -- load address: 0x80108000 entry point: 0x80108000
sending file: ./bootloader/bootloader-grouper-4.23.img
- 2150992/2150992 bytes sent
./bootloader/bootloader-grouper-4.23.img sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
matt@aquos:~/devel/ouya/tegra30_debrick$ sudo ./utils/nvflash_v1.13.87205_miniloader_patched --resume --rawdeviceread 0 2048 mmc-0-2048.bin
Nvflash v1.13.87205 started
[resume mode]
Bytes to receive 8388608
receiving file: mmc-0-2048.bin, expected size: 8388608 bytes
/ 8388608/8388608 bytes received
file received successfully
Thanks. It seems to be a hardware error. I can execute all but the last step
Know anyone with a hot air station?
On Mon, Nov 8, 2021, 18:43 schneemaier @.***> wrote:
Thanks. It seems to be a hardware error. I can execute all but the last step
— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/tofurky/tegra30_debrick/issues/5#issuecomment-963676827, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAFWB7JNOLTEKVP2CVNYAQ3ULBOBHANCNFSM5HPAR43Q . Triage notifications on the go with GitHub Mobile for iOS https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Android https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.
Probably i can get access to a hotair station, but i am not that good with these type of components :)
Hi, i am not sure what happened to my Nexus 7 (16GB Wifi). It was sitting for a long time and now when i try to boot nothing happens. I found this repositiory so started to follow the instructions.
I am able to get the device in APX mode with holding the power button to ~20 seconds
I am able to execute step 4 with success but after that i am stuck.
Step 5 does not work:
I can only exit it with unplugging the device
Skipping step 5 step 6 sometimes works:
After this step i have the Google logo on the screen, but when i try step 7 i get an error :
Any suggestion? Is it recoverable or bad eMMC?
Thanks