tofurky / tegra30_debrick

fusee-gelee payload, supporting files, and guide for debricking Tegra 3 devices (2012 Nexus 7 and Ouya)
GNU General Public License v2.0
43 stars 15 forks source link

Nexus 7 2012 Help needed #5

Closed schneemaier closed 3 years ago

schneemaier commented 3 years ago

Hi, i am not sure what happened to my Nexus 7 (16GB Wifi). It was sitting for a long time and now when i try to boot nothing happens. I found this repositiory so started to follow the instructions.

I am able to get the device in APX mode with holding the power button to ~20 seconds

[Fri Nov  5 21:16:27 2021] usb 1-1: new high-speed USB device number 57 using xhci_hcd
[Fri Nov  5 21:16:28 2021] usb 1-1: New USB device found, idVendor=0955, idProduct=7330, bcdDevice= 1.03
[Fri Nov  5 21:16:28 2021] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[Fri Nov  5 21:16:28 2021] usb 1-1: Product: APX
[Fri Nov  5 21:16:28 2021] usb 1-1: Manufacturer: NVIDIA Corp.

I am able to execute step 4 with success but after that i am stuck.

Step 5 does not work:

root@xxxx:~/tegra30_debrick# ./utils/nvflash_v1.13.87205 --getbct --bct BCT_READBACK_N7.BIN --configfile ./utils/flash.cfg
Nvflash v1.13.87205 started

I can only exit it with unplugging the device

Skipping step 5 step 6 sometimes works:

root@xxxx:~/tegra30_debrick# ./utils/nvflash_v1.13.87205_miniloader_patched --setbct --bct ./bct/nexus_7_grouper_bct.bin --configfile ./utils/flash.cfg --bl ./bootloader/bootloader-grouper-4.23.img --go
Nvflash v1.13.87205 started
chip uid from BR is: 0x0000000000000000015d24a818180c05
rcm version 0X30001
System Information:
   chip name: unknown
   chip id: 0x30 major: 1 minor: 3
   chip sku: 0x83
   chip uid: 0x0000000000000000015d24a818180c05
   macrovision: disabled
   hdcp: enabled
   jtag: disabled
   sbk burned: true
   dk burned: true
   boot device: emmc
   operating mode: 3
   device config strap: 1
   device config fuse: 17
   sdram config strap: 0

sending file: ./bct/nexus_7_grouper_bct.bin
- 6128/6128 bytes sent
./bct/nexus_7_grouper_bct.bin sent successfully
downloading bootloader -- load address: 0x80108000 entry point: 0x80108000
sending file: ./bootloader/bootloader-grouper-4.23.img
- 2150992/2150992 bytes sent
./bootloader/bootloader-grouper-4.23.img sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully

After this step i have the Google logo on the screen, but when i try step 7 i get an error :

root@xxxx:~/tegra30_debrick# ./utils/nvflash_v1.13.87205_miniloader_patched --resume --download EBT bootloader/bootloader-grouper-4.23.img --sync --configfile ./utils/flash.cfg
Nvflash v1.13.87205 started
[resume mode]
failed executing command 20 NvError 0x120002
Unable to retrieve Partition table from device NvError 0x0
command failure: partition not found in partition table (bad data)
bootloader status: partition table is required for this command (code: 8) message: nverror:0x5 (0x1000005) flags: 0

Any suggestion? Is it recoverable or bad eMMC?

Thanks

tofurky commented 3 years ago

it may be an issue with emmc (spontaneous bricking is a bad sign).

could you try a raw emmc read with nvflash? it should go something like this, but the battery on my n7 is dead so i'm unable to test (yet):

sudo ./utils/nvflash_v1.13.87205_miniloader_patched --resume --rawdeviceread 0 2048 mmc-0-2048.bin
gzip mmc-0-2048.bin

then attach mmc-0-2048.bin.gz to the issue? (.zip also works, github should allow both). .bin file should be 8MB uncompressed i think (4k sectors).

you'd need to run that --rawdeviceread after these first two commands:

sudo ./fusee-launcher/fusee-launcher.py ./payload/uart_payload_n7.bin -P 7330
sudo ./utils/nvflash_v1.13.87205_miniloader_patched --setbct --bct ./bct/nexus_7_grouper_bct.bin --configfile ./utils/flash.cfg --bl ./bootloader/bootloader-grouper-4.23.img --go

if emmc is bad, it might fail to do the read at all. the first 8MB of emmc would include the BCT and partition table and beginning of the bootloader partition.

schneemaier commented 3 years ago

Thanks for the advice. I tried but got an error:

root@xxxx:~/tegra30_debrick# ./utils/nvflash_v1.13.87205_miniloader_patched --resume --rawdeviceread 0 2048 mmc-0-2048.bin
Nvflash v1.13.87205 started
[resume mode]
failed executing command 31 NvError 0x120002
command failure: readdeviceraw failed (bad data)

I guess the eMMC is bad :(

tofurky commented 3 years ago

yeah, i think it's a hardware issue. this is what you should see:

matt@aquos:~/devel/ouya/tegra30_debrick$ sudo ./fusee-launcher/fusee-launcher.py ./payload/uart_payload_n7.bin -P 7330
2021-11-06 21:26:57,674 INFO:usb.core:find(): using backend "usb.backend.libusb1"

Important note: on desktop Linux systems, we currently require an XHCI host controller.
A good way to ensure you're likely using an XHCI backend is to plug your
device into a blue 'USB 3' port.

Identified a Linux system; setting up the appropriate backend.
intermezzo_size: 0x00000078
target_payload_size: 0x000005ee
Found a Tegra with Device ID: b'05163c81bc245d01'
Stack snapshot: b'0000000000000000100000003c9f0040'
EndpointStatus_stack_addr: 0x40009f3c
ProcessSetupPacket SP: 0x40009f30
InnerMemcpy LR stack addr: 0x40009f20
overwrite_len: 0x00004f20
overwrite_payload_off: 0x00004de0
payload_first_length: 0x000005ee
overwrite_payload_off: 0x00004de0
payload_second_length: 0x00000000
b'00a0004000300040ee05000000000000'
Setting rcm msg size to 0x00030064
RCM payload (len_insecure): b'64000300'

Setting ourselves up to smash the stack...
Payload offset of intermezzo: 0x00000074
overwrite_payload_off: 0x00004de0
overwrite_len: 0x00004f20
payload_overwrite_len: 0x00004e5c
overwrite_payload_off: 0x00004de0
smash_padding: 0x000047f2
overwrite_payload_off: 0x00004de0
Uploading payload...
txing 20480 bytes total
txing 4096 bytes (0 already sent) to buf[0] 0x40003000
txing 4096 bytes (4096 already sent) to buf[1] 0x40005000
txing 4096 bytes (8192 already sent) to buf[0] 0x40003000
txing 4096 bytes (12288 already sent) to buf[1] 0x40005000
txing 4096 bytes (16384 already sent) to buf[0] 0x40003000
Smashing the stack...
sending status request with length 0x00004f20
The USB device stopped responding-- sure smells like we've smashed its stack. :)
Launch complete!
matt@aquos:~/devel/ouya/tegra30_debrick$ sudo ./utils/nvflash_v1.13.87205_miniloader_patched --setbct --bct ./bct/nexus_7_grouper_bct.bin --configfile ./utils/flash.cfg --bl ./bootloader/bootloader-grouper-4.23.img --go
Nvflash v1.13.87205 started
chip uid from BR is: 0x0000000000000000015d24bc813c1605
rcm version 0X30001
System Information:
   chip name: unknown
   chip id: 0x30 major: 1 minor: 3
   chip sku: 0x83
   chip uid: 0x0000000000000000015d24bc813c1605
   macrovision: disabled
   hdcp: enabled
   jtag: disabled
   sbk burned: true
   dk burned: true
   boot device: emmc
   operating mode: 3
   device config strap: 1
   device config fuse: 17
   sdram config strap: 0

sending file: ./bct/nexus_7_grouper_bct.bin
- 6128/6128 bytes sent
./bct/nexus_7_grouper_bct.bin sent successfully
downloading bootloader -- load address: 0x80108000 entry point: 0x80108000
sending file: ./bootloader/bootloader-grouper-4.23.img
- 2150992/2150992 bytes sent
./bootloader/bootloader-grouper-4.23.img sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
matt@aquos:~/devel/ouya/tegra30_debrick$ sudo ./utils/nvflash_v1.13.87205_miniloader_patched --resume --rawdeviceread 0 2048 mmc-0-2048.bin
Nvflash v1.13.87205 started
[resume mode]
Bytes to receive 8388608
receiving file: mmc-0-2048.bin, expected size: 8388608 bytes
/ 8388608/8388608 bytes received
file received successfully
schneemaier commented 3 years ago

Thanks. It seems to be a hardware error. I can execute all but the last step

pgwipeout commented 3 years ago

Know anyone with a hot air station?

On Mon, Nov 8, 2021, 18:43 schneemaier @.***> wrote:

Thanks. It seems to be a hardware error. I can execute all but the last step

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/tofurky/tegra30_debrick/issues/5#issuecomment-963676827, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAFWB7JNOLTEKVP2CVNYAQ3ULBOBHANCNFSM5HPAR43Q . Triage notifications on the go with GitHub Mobile for iOS https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Android https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.

schneemaier commented 3 years ago

Probably i can get access to a hotair station, but i am not that good with these type of components :)