[Firmware & Tools] ZTE AXON 10 Pro EDL-SD Firmware & Firehose

EDIIIZ · 2019-05-28T19:50:33+0200

Firmwarefiles für das ZTE Axon 10 Pro. Selbst nicht getestet. Nutzung auf eigene Gefahr!

GEN_EU_EEA_A2020G_Pro_V1.1(SD card software).zip
(EU)
Payload Dumper zum extrahieren der Payload.bin benöntigt.

Link:
StackPath

PSTW_KST_ZTEA2020GProV1.0.0B01.zip
(Kill Switch Tool) Funktion?

Link:
StackPath

P855A01V1.0.0B16_DL.zip
(EDL EU)

Link:
StackPath

PV_ZTE_P855A01V1.0.0B09_DL .zip
(EDL EU)

Link:
StackPath

ZTE_A2020_Pro(SD)367600B14MR283ZTE_A2020_ProV1.0.0B09.zip
(non G Kompatibilität? non EU)
Payload Dumper zum extrahieren der Payload.bin benöntigt.

Link:
StackPath

prog_ufs_firehose_Sdm855.elf
(zum flashen der EDL Firmware via QFIL)

Link:
StackPath

ZTE A2020G Pro Android 9 Kernel(4.14.x).tar.gz

Link:
https://bit.ly/2HGEddE

EDIIIZ · 2019-05-29T12:05:15+0200

Uploads hinzugefügt!

Rennert · 2019-05-29T19:39:42+0200

EDL Tool sollte kein Problem sein, hatte schon das vom A7 ans A9 angepasst. Ein Backup konnte ich damit erstellen. Wenn die Strukturen der einzelnen Partitionen gleich ist, sollte es funktionieren.

EDIIIZ · 2019-05-29T20:03:52+0200

@Rennert Das wäre doch schonmal was! Wie siehts aus mit flashen? Die EDL Tools fürs A7 und ZMax können das ja. Dann könnte man ja einfach eine gepatchte boot.img flashen und root wäre vorhanden. Oder funktioniert das nicht mehr?

Rennert · 2019-05-29T20:14:07+0200

habs mal angepasst, gebe aber keine Garantie das es funzt. Zumindest ein Backup geht zum erstellen.
Wenn es mal eine gepatchte Boot.img gibt, kann man die auch mit MiFlash flashen oder wie beim A7 eine fastboot_unlock Datei.

Flashen tue ich nix, warte da lieber auf offizielle bzw. getestete Sachen.

EDIIIZ · 2019-05-29T20:21:33+0200

@Rennert
Das kommt bei mir wenn ich ein Backup machen will. Gibts irgendwas zu beachten außer in den EDL zu booten ?

Code:

20:19:38: INFO: Current working dir (cwd): C:\Windows\system32\
20:19:38: INFO: Showing network mappings to allow debugging
20:19:38: INFO:



20:19:38: INFO: Trying to store 'full.xml' in string table
20:19:38: INFO: Looking for file 'full.xml'
20:19:38: INFO: 1. Calling fopen('C:\Users\Ediz\Desktop\Axon10_EDL_Tool\Axon10_EDL_Tool\backup\full/DigestsPerFile.txt') with AccessMode='w'
20:19:38: INFO: User requested *minimal* logging with --loglevel=0


         _____
        |  ___|
        | |__ _ __ _ __ ___  _ __
        |  __| '__| '__/ _ \| '__|
        | |__| |  | | | (_) | |
        \____/_|  |_|  \___/|_|


20:19:38: {ERROR: XML not formed correctly. Expected a &lt; character at loc 0}


         _____
        |  ___|
        | |__ _ __ _ __ ___  _ __
        |  __| '__| '__/ _ \| '__|
        | |__| |  | | | (_) | |
        \____/_|  |_|  \___/|_|


20:19:38: {ERROR: 3. TAG not found or recognized}


         _____
        |  ___|
        | |__ _ __ _ __ ___  _ __
        |  __| '__| '__/ _ \| '__|
        | |__| |  | | | (_) | |
        \____/_|  |_|  \___/|_|


20:19:38: {ERROR:

        There is a chance your target is in SAHARA mode!!
        There is a chance your target is in SAHARA mode!!
        There is a chance your target is in SAHARA mode!!

This can mean
        1. You forgot to send DeviceProgrammer first (i.e. QSaharaServer.exe -s 13:prog_emmc_firehose_8994_lite.mbn)
        2. OR, you did send DeviceProgrammer, but it has crashed and/or is not correct for this target

Regardless this program speaks FIREHOSE protocol and your target is speaking SAHARA protcol, so this will not work

}

Writing log to 'C:\Windows\system32\port_trace.txt', might take a minute


Log is 'C:\Windows\system32\port_trace.txt'



Press any key to exit

Rennert · 2019-05-29T20:36:45+0200

Das Tool muss glaube in C:
Ich teste auch mal

EDIIIZ · 2019-05-29T20:46:33+0200

Rennert schrieb:
Das Tool muss glaube in C:
Ich teste auch mal

Okey jetzt macht er was, kommt aber der selbe Error. Aber er erstellt die Dateien. Sind halt nur 0KB Groß.
[doublepost=1559155593,1559155497][/doublepost]@Rennert Der Komplette log

Binary build date: Nov 21 2017 @ 02:53:37
QSAHARASERVER CALLED LIKE THIS: 'C:\Axon10_EDL_Tool\Axon10_EDL_Tool\tools\QSaharaServer.ex'Current working dir: C:\Windows\system32
Sahara mappings:
2: amss.mbn
6: apps.mbn
8: dsp1.mbn
10: dbl.mbn
11: osbl.mbn
12: dsp2.mbn
16: efs1.mbn
17: efs2.mbn
20: efs3.mbn
21: sbl1.mbn
22: sbl2.mbn
23: rpm.mbn
25: tz.mbn
28: dsp3.mbn
29: acdb.mbn
30: wdt.mbn
31: mba.mbn
13: C:\Axon10_EDL_Tool\Axon10_EDL_Tool\tools\prog_ufs_firehose_Sdm855.elf

20:43:31: ERROR: function: sahara_rx_data:237 Unable to read packet header. Only read 0 bytes.

20:43:31: ERROR: function: sahara_main:924 Sahara protocol error

20:43:31: ERROR: function: main:303 Uploading Image using Sahara protocol failed

20:43:35: INFO: FH_LOADER WAS CALLED EXACTLY LIKE THIS
************************************************
C:\Axon10_EDL_Tool\Axon10_EDL_Tool\tools\fh_loader.exe --port=\\.\COM19 --sendxml=boot.xml --search_path=C:\Axon10_EDL_Tool\Axon10_EDL_Tool\tools --mainoutputdir=C:\Axon10_EDL_Tool\Axon10_EDL_Tool\backup\boot --showpercentagecomplete --memoryname=ufs --convertprogram2read --showdigestperfile --loglevel=0
************************************************

20:43:35: DEBUG: Binary build date: Mar 26 2017 @ 22:09:16

20:43:35: DEBUG: Build Version: 17.03.26.22.09.16

20:43:35: INFO: Current working dir (cwd): C:\Windows\system32\
20:43:35: INFO: Showing network mappings to allow debugging
20:43:35: DEBUG: Neue Verbindungen werden gespeichert.

20:43:35: DEBUG:

20:43:35: DEBUG:

20:43:35: DEBUG: Status Lokal Remote Netzwerk

20:43:35: DEBUG:

20:43:35: DEBUG: -------------------------------------------------------------------------------

20:43:35: DEBUG: OK Y: \\Homerouter-nas\hdd Microsoft Windows Network

20:43:35: DEBUG: OK Z: \\HomeRouter-Nas\MyEmbyMedia

20:43:35: DEBUG: Microsoft Windows Network

20:43:35: DEBUG: Der Befehl wurde erfolgreich ausgefhrt.

20:43:35: DEBUG:

20:43:35: INFO:

20:43:35: INFO: Trying to store 'boot.xml' in string table
20:43:35: DEBUG: ==================================================================================
20:43:35: DEBUG: ==================================================================================
20:43:35: INFO: Looking for file 'boot.xml'
20:43:35: DEBUG: 1. Calling stat(C:\Axon10_EDL_Tool\Axon10_EDL_Tool\tools\boot.xml')
20:43:35: DEBUG: 2. Calling fopen('C:\Axon10_EDL_Tool\Axon10_EDL_Tool\tools\boot.xml') with AccessMode='rb'
20:43:35: DEBUG: Trying get filesize, calling fseek()
20:43:35: DEBUG: Found 'C:\Axon10_EDL_Tool\Axon10_EDL_Tool\tools\boot.xml' (425 bytes)
20:43:35: DEBUG: 2. Calling fopen('C:\Axon10_EDL_Tool\Axon10_EDL_Tool\tools\boot.xml') with AccessMode='r'
20:43:35: DEBUG: Trying get filesize, calling fseek()
20:43:35: INFO: 1. Calling fopen('C:\Axon10_EDL_Tool\Axon10_EDL_Tool\backup\boot/DigestsPerFile.txt') with AccessMode='w'
20:43:35: INFO: User requested *minimal* logging with --loglevel=0
20:43:35: INFO: User wants to talk to port '\\.\COM19'
20:43:35: DEBUG: port_fd=0xD0

20:43:35: INFO: Took 0.00000000 seconds to open port
20:43:35: INFO: Sorting TAGS to ensure order is <configure>,<erase>, others, <patch>,<power>
20:43:35: INFO: If you don't want this, use --dontsorttags

20:43:35: DEBUG: ==================================================================================
20:43:35: DEBUG: ==================================================================================
20:43:35: INFO: Looking for file 'boot.img'
20:43:35: DEBUG: 1. Calling stat(C:\Axon10_EDL_Tool\Axon10_EDL_Tool\tools\boot.img')
20:43:35: DEBUG: 2. Calling stat(boot.img')

(_)
__ ____ _ _ __ _ __ _ _ __ __ _
\ \ /\ / / _` | '__| '_ \| | '_ \ / _` |
\ V V / (_| | | | | | | | | | | (_| |
\_/\_/ \__,_|_| |_| |_|_|_| |_|\__, |
__/ |
|___/

20:43:35: WARNING: find_file:7645 Couldn't find the file 'boot.img', returning NULL
20:43:35: INFO: 1. Calling fopen('C:\Axon10_EDL_Tool\Axon10_EDL_Tool\backup\boot/boot.img') with AccessMode='wb'
20:43:35: INFO: Sending <configure>
20:43:35: DEBUG: CHANNEL DATA (P0000) (H00202) ( 227 bytes) - HOST TO TARGET -->
===========================================================================================================
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<configure MemoryName="ufs" Verbose="0" AlwaysValidate="0" MaxDigestTableSizeInBytes="8192" MaxPayloadSizeToTargetInBytes="1048576" ZlpAwareHost="1" SkipStorageInit="0" />
</data>

============================================================================================================

20:43:35: DEBUG: CharsInBuffer=0 Trying to read from USB 8192 bytes
20:43:35: DEBUG: CHANNEL DATA (16 bytes) <-- TARGET to HOST
20:43:35: DEBUG: CharsInBuffer = 16

_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|

20:43:35: {ERROR: DetermineTag:6073 XML not formed correctly. Expected a < character at loc 0

_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|

20:43:35: {ERROR: GetNextPacket:7147 3. TAG not found or recognized

_____
| ___|
| |__ _ __ _ __ ___ _ __
| __| '__| '__/ _ \| '__|
| |__| | | | | (_) | |
\____/_| |_| \___/|_|

20:43:35: {ERROR: GetNextPacket:7157

There is a chance your target is in SAHARA mode!!
There is a chance your target is in SAHARA mode!!
There is a chance your target is in SAHARA mode!!

This can mean
1. You forgot to send DeviceProgrammer first (i.e. QSaharaServer.exe -s 13rog_emmc_firehose_8994_lite.mbn)
2. OR, you did send DeviceProgrammer, but it has crashed and/or is not correct for this target

Regardless this program speaks FIREHOSE protocol and your target is speaking SAHARA protcol, so this will not work

Rennert · 2019-05-29T21:03:05+0200

er lädt den Programmer nicht, vielleicht passt die elf Datei nicht. Am Axon9 ging das mit passendem Programmer

EDIIIZ · 2019-05-29T21:21:27+0200

Hmm der Programmer ist aus dem Offiziellen ZTE Kill Switch Tool für das A2020G. Was ich so aus den Dateien rauslesen kann kann es: rom_upgrade, repair, refurbish, prl, download.

Das war mit in dem Ordner wo ich die prog gefunden hab.
Kannst ja mal selbst installieren und schauen ob du noch was findest.
Ich werde morgen mal bei ZTE anrufen und mich versuchen freischalten zu lassen.

Code:

<?xml version="1.0" encoding="utf-8"?>
<upgrade_config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="su_cfg_schema.xsd">
    <!-- changelog: -->
    <!-- 2013-04-22     add configuration TAG about ADB commands adb_update-->
    <!-- 2013-05-02
                    change shake_hand to verify_security_data
                    add verify_random_data                                      -->
    <!-- 2013-05-09
                    add device_backup_nvs configuration                        
                    change phone_backup_sms_pb to device_backup_sms_pb          -->
    <!-- 2013-05-13
                    add sec_data_file_name attribute on verify_security_data node to config which file contains security data
                    add sec_data_start_flag attrigute on verify_security_data nodt to config the security data start flag.      -->
    <!-- 2013-05-14
                    add is_repairing_device configuration.                      -->
    <!-- 2013-05-23  
                    Version - 1.0.7.0
                    add upgrade_efs_entry configuration.
                    used to config whether to upgrade efs entries.              -->
    <!-- 2013-06-21  
                    Version - 1.0.8.0
                    add backup_locknet_nvs configuration.
                    used to config whether to backup locknet nvs.               -->
    <!-- 2013-11-18  
                    Version - 1.0.9.0
                    add backup_efs_entry configuration.
                    used to config whether to backup a group of efs files or directories.                   -->
    <!-- 2014-01-13
                    Version - 1.0.10.0
                    add restore_infos configuration.
                    used to config whether to resore infos after upgrading a device.                        -->
    <!-- 2014-01-15
                    Version - 1.0.11.0
                    add set_enter_ftm_mode_flag and clear_enter_ftm_mode_flag configuration.
                    used to config which mode the device will enter when at booting next time.              -->
    <!-- 2014-01-16
                    Version - 1.0.12.0
                    1) add overwrite_partition configuration.
                       used to config whether to overwrite the partition in the device.
                    2) add device_id_type configuration.
                       used to config what is the device's identifier.                                      -->
    <!-- 2014-01-17
                    Version - 1.0.13.0
                    move the armprg_image_id from qc_mdm_9x25 to qc.
                    used to config the armprg_image_id which is used when downloading armprg using sahara.  -->
    <!-- 2014-01-18
                    Version - 1.0.14.0
                    move configurations about backup to backup_info node.
                    move configurations about upgrade_firmware to upgrade_firmware node                     -->
    <!-- 2014-01-27
                    Version - 1.0.15.0
                    add the failed_data_backup_file_dir configuration.
                    used to config the dir to store data backup files when upgrading failed.                -->
    <!-- 2014-02-11
                    Version - 1.0.16.0
                    add the backup_user_data configuration.
                    used to config whether to keep the user data, whether to download the user_data.img     -->
    <!-- 2014-02-12
                    Version - 1.0.17.0
                    add the check_version_flag configuration.
                    used to config whether to check if the firmware files are valid.                        -->
    <!-- 2014-08-08
                    Version - 1.0.18.0
                    add firehose_max_payload_to_target
                        firehose_memory_name
                        firehose_target_name.                                                                 -->
    <!-- 2014-09-09
                    Version - 1.0.19.0
                    add firehose_upgrade_patch0                                                                -->
    <!-- 2014-09-18
                    Version - 1.0.20.0
                    add need_check_spc                                                                        -->
    <!-- 2015-01-19
                    Version - 1.0.21.0
                    add skip_no_entry attribute to efs_entry element                                        -->
    <!-- 2015-05-06
                    Version - 1.0.22.0
                    add tool_name element to tell bl the tool's name
                    add model_name element to tell bl the model name current selected
                    add custom_log element to tell bl to whether to create custom log and where to save them
                    add sdi_log element to tell bl whether to create sdi log required by custom service     -->
    <!-- general_config -->
    <!-- the version of this config file, used to decide how to parse the file  -->
    <version>1.0.21.0</version>
    <!-- node_val - LIST: qual_comm, tsp -->
    <platform>qual_comm</platform>
    <!-- node_val - LIST: qc_mdm_9x00, qc_mdm_9x15, qc_mdm_9x25, qc_mdm_82x0, qc_mdm_8200a, qc_msm_89x0, qc_msm_8x25, qc_msm_7x2x, qc_msm_7x30, tsp_297500-->
    <model>qc_msm_8996</model>
    <!-- V1.0.12.0 -->
    <!-- value - LIST: meid, imei | what is the identifier of the device -->
    <device_id_type value="imei"/>
    <!-- node_val - STR_VAL: | the dir contains files needed, such as firmware files, pcui, webui, and so on -->
    <needed_files_dir>.\firmware</needed_files_dir>
    <!--
        node_val - STR_VAL: | the dir you want to put data backup file to it.
        If this is empty, the dir of the application will be used.
    -->
    <data_backup_file_dir>.\data</data_backup_file_dir>
    <!--
        node_val - STR_VAL: | the name of data backup file.
        If this is empty, "data_backup.xml" will be used.
    -->
    <data_backup_file_name>data_backup.xml</data_backup_file_name>
    <!--
        node_val - STR_VAL: | the path of failed data backup dir.
                              used to store a copy of the data backup file when upgrade failed and data was not restored successfully.
        If this is empty, app dir will be used.
    -->
    <failed_data_backup_file_dir>.\failed_data_backup</failed_data_backup_file_dir>
    <!-- value - LIST: yes, no | want to repair a device or not -->
    <is_repairing_device value="no"/>
    <!--
         execute     - LIST: yes, no | whether to check firmware files are valid
                                       throug checking a certain firmware file contains a certain flag string.
         file_name   - STR_VAL | name of the file contains flag_string
         flag_string - STR_VAL | the string which indicates the version is valid
    -->
    <check_version_flag execute="no" file_name="system.img" flag_string="ro.build.display.id="/>
    <!--
         node_val    - STR_VAL | the name of the tool. it will be set by UI automatically. just leave it empty.
    -->
    <tool_name></tool_name>
    <!--
         node_val    - STR_VAL | the name of the model currently selected. it will be set by UI automatically. just leave it empty.
    -->
    <model_name></model_name>
    <!--
         need        - LIST: yes, no | whether to create custom log
         dir         - STR_VAL | where to save the custom log
    -->
    <custom_log need="" dir="" />
    <!--
         need        - LIST: yes, no | whether to create sdi log
    -->
    <sdi_log need="" />

    <qc>
        <!-- qual_comm platform relative config -->
        <!-- node_val - FIXED_LEN_STR_VAL: | 6 bytes of security code, in ASCII format (digits 0 to 9 only) -->
        <spc_code>000000</spc_code>
        <!-- node_val - FIXED_LEN_STR_VAL: | 6 bytes of security code, in ASCII format (digits 0 to 9 only) -->
        <bd_default_spc_code>000000</bd_default_spc_code>
        <!-- execute - LIST: yes, no | whether to check SPC even not backup and restore infos. -->       
        <need_check_spc execute="no"/>
        <!-- node_val - STR_VAL: | the directory contains the download plugin used to upgrade firmware files -->
        <armprg_file_dir>.\firmware</armprg_file_dir>
        <!-- node_val - STR_VAL: | the download plugin file name -->
        <armprg_file_name>prog_ufs_firehose_Sdm855.elf</armprg_file_name>
        <!-- node_val - STR_VAL: | the partition table file name -->
        <partition_file_name>gpt_main0.bin</partition_file_name>
        <!-- firehose_max_payload_to_target - DEC_DIGIT: | the max data sent to a device in one packet. -->
        <firehose_max_payload_to_target>1048576</firehose_max_payload_to_target>
        <!-- node_val - STR_VAL: | flash memory name -->
        <firehose_memory_name>ufs</firehose_memory_name>
        <!-- firehose_target_name - STR_VAL: | flash target name -->
        <firehose_target_name>8996</firehose_target_name>
        <!-- the rawprogram file list-->
        <firehose_rawprogram_file_list>rawprogram0,rawprogram1,rawprogram2,rawprogram3,rawprogram4,rawprogram5</firehose_rawprogram_file_list>
        <!-- execute - LIST: yes, no | whether to upgrade patch0.xml-->
        <firehose_upgrade_patch0 execute="yes"/>
        <!-- the patch file list-->
        <firehose_patch_file_list>patch0,patch1,patch2,patch3,patch4,patch5</firehose_patch_file_list>
        <!-- execute - LIST:yes, no | whether to all erase when partition changed  -->
        <firehose_partition_change_need_all_erase execute="yes"/>
        <!--if firehose_partition_change_need_all_erase is no, and partition changed, judge this image pos change-->
        <firehose_partition_change_check_special_image_list></firehose_partition_change_check_special_image_list>
        <!--if firehose_partition_change_need_all_erase is yes, and partition changed, backup this image-->
        <firehose_backup_image_label_list>frp,modemst1,modemst2,fsc,ztecfg,persist</firehose_backup_image_label_list>
        <!-- execute - LIST:yes, no | whether to get sparse to read from version file  -->
        <firehose_sparse_image_read_from_version execute="yes"/>
        <!--image can use sparse-->
        <firehose_sparse_image_label_list>system,cache,persist,carrier,userdata</firehose_sparse_image_label_list>
        <!-- execute - LIST: yes, no | A nother name is "kill switch". whether to set erase frp partition after version download completed, from android 5.1, a new feature named
        "FRP"(Factory Reset Protection) is imported. After erase the userdata partition, you must erase the frp partition too! Otherwise when phone started,
        the system will ask a account and the password. When the user forgot the acccount or password, he dos not use the phone. Unless he put the phone
        to make a repairing.-->
        <erase_frp_partition execute="yes"/>
        <!--image frp partitions-->
        <frp_partition_list>frp</frp_partition_list>
        <!-- execute - LIST: yes, no | whether to enter zte dl mode before backing up infos-->
        <enter_zte_dl_mode execute="no"/>
        <!-- execute - LIST: yes, no | whether to exit zte dl mode after restoring infos-->
        <exit_zte_dl_mode execute="no"/>
        <!-- execute - LIST: yes, no | whether to close autorun before backing up infos-->
        <close_autorun execute="no"/>
        <!-- execute - LIST: yes, no | whether to open autorun after restoring infos-->
        <open_autorun execute="no"/>
        <!-- V1.0.11.0 -->
        <!-- execute - LIST: yes, no | whether to set ftm mode flag to tell the device enter ftm mode when booting next time-->
        <set_enter_ftm_mode_flag execute="no"/>
        <!-- V1.0.11.0 -->
        <!-- execute - LIST: yes, no | whether to clear ftm mode flag to tell the device enter normal mode when booting next time-->
        <clear_enter_ftm_mode_flag execute="no"/>
        <!-- execute - LIST: yes, no | whether to verify security data to backup and restore lock_net_nvs before backing up infos and upgrading firmwares -->
        <verify_security_data execute="no" sec_data_file_name="dsp2.mbn" sec_data_start_flag="0x2C 0x1A 0xBE 0x6E"/>
        <!-- execute - LIST: yes, no | whether to verify random data to download and goto armprg before changing to dlp modes -->
        <verify_random_data execute="no"/>
        <!-- execute - LIST: yes, no | whether to backup infos -->
        <backup_infos execute="no">
            <!--
                node_val    - STR_VAL: | a string conatains item nvs list, whitch need to be backed up, with the "," as the seperator
                execute     - LIST: yes, no | whether to backup item nvs
            -->
            <backup_item_nvs execute="no"></backup_item_nvs>
            <!--
                node_val    - STR_VAL: | a string conatains lock net nvs list, which need to be backed up whening upgrading a lock-net device, with the "," as the seperator
                execute     - LIST: yes, no | whether to backup locknet nvs
            -->
            <backup_locknet_nvs execute="no"></backup_locknet_nvs>
            <!--
                node_val            - STR_VAL: | a string conatains efs file nvs list, whitch need to be backed up, with the "," as the seperator
                execute             - LIST: yes, no | whether to backup efs nvs
                partition           - LIST: primary, alternative | which partition the efs entry will be put to
                efs_nv_parent_dir   - STR_VAL: | which directory the efs nv is in.     
            -->
            <backup_efs_nvs execute="no" partition="primary" efs_nv_parent_dir="/nv/item_files/rfnv"></backup_efs_nvs>
            <!-- execute - LIST: yes, no | whether to backup and restore a series of efs entries. -->
            <backup_efs_entry execute="no">
                <!--
                    infos of an efs entry
                    partition     - LIST: primary, alternative | which partition the efs entry will be put to
                    parent_dir    - STR_VAL: | which directory the efs entry will be put to
                    name          - STR_VAL: | the name of the efs entry
                    is_dir        - LIST: yes, no | whether the efs entry is a directory
                    skip_no_entry - LIST: yes, no | whether to skip a efs_entry and continue when it doesnot exist
                Sample:
                    <efs_entry partition="primary" parent_dir="/nv/item_files" name="tst.xml" is_dir="no" skip_no_entry="yes"/>
                -->
            </backup_efs_entry>
            <!-- execute - LIST: yes, no | whether to backup and restore nv by device -->
            <device_backup_nvs execute="no"/>
            <!-- execute - LIST: yes, no | whether to backup and restore msg and phone books on phone side -->
            <device_backup_sms_pb execute="no"/>
            <!-- execute - LIST: yes, no | whether to backup wifi mac address -->
            <backup_mac_address execute="no"/>
            <!-- execute - LIST: yes, no | whether to backup bt address -->
            <backup_bt_address execute="no"/>
            <!-- execute - LIST: yes, no | whether to backup prl, only be valuable for CDMA devices -->
            <backup_prl execute="no"/>
        </backup_infos>
        <!-- V1.0.10.0 -->
        <!-- execute - LIST: yes, no | whether to backup infos -->
        <restore_infos execute="no"/>
        <!-- execute - LIST: yes, no | whether to upgrade firmware files -->
        <upgrade_firmware execute="yes">
            <!-- V1.0.13.0 -->
            <!-- node_value - DEC_DIGIT: | the image id of the armprg. This is used only when using sahara protocol to download armprg. -->
            <armprg_image_id>13</armprg_image_id>
            <!-- V1.0.12.0 -->
            <!-- value- LIST: force_overwrite, not_overwrite, auto_overwrite | whether to overwrite the partition when downloading partition table -->
            <overwrite_partition value="force_overwrite"/>
            <!-- execute - LIST: yes, no | whether to keep user data. for android device whether to download user_data.img -->
            <backup_user_data execute="no"/>
            <!-- execute - LIST: yes, no | whether to upgrade efs firmware files -->
            <upgrade_efs_firmware execute="no"/>
            <!-- execute - LIST: yes, no | whether to upgrade chameleon firmware files -->
            <upgrade_chameleon_firmware execute="no"/>
            <!-- list_in_cfg_file - LIST: yes, no | "yes" means getting file list from a certain config file in "needed_files_dir" given above -->
            <firmware_file_list list_in_cfg_file="yes">
                <!--
                    file_name              - STR_VAL:
                    open_multi_type        - DEC_DIGIT: [0-255] |
                    open_multi_type_string - STR_VAL: | a string tell the download plugin where to put the file
                    download_manner        - LIST: high_speed, normal_speed | how to download the file to the device
                    is_efs_firmware        - LIST: yes, no | a efs file or not. if upgrade_efs_firmware=false and is_efs_firmware=true the file will not be download
                    optional               - LIST: yes, no | if yes, the file will be downloaded if it exists and not be downloaded if it doesn't exist; otherwise the file must exist and will be downloaded
                Sample:
                    <firmware_file file_name="dbl.mbn" open_multi_type="15" open_multi_type_string="" download_manner="high_speed" is_efs_firmware="no" optional="no"/>
                -->
            </firmware_file_list>
        </upgrade_firmware>
        <!-- execute - LIST: yes, no | whether to wait dmp port to do some operate after upgrade firmware -->
        <wait_dmp_port_after_upgrade_firmware execute="no"/>
        <!-- execute - LIST: yes, no | whether to restart all operate finish -->
        <restart_all_operate_finish execute="no"/>
        <!-- execute - LIST: yes, no | whether to reset wifi(ssid key) factory -->
        <set_wifi_factory execute="no"/>
        <!-- execute - LIST: yes, no | whether to upgrade port config. Generally, it is an efs file -->
        <upgrade_port_config execute="no">
            <!--
                infos of an efs entry
                partition     - LIST: primary, alternative | which partition the efs entry will be put to
                parent_dir    - STR_VAL: | which directory the efs entry will be put to
                name          - STR_VAL: | the name of the efs entry
                is_dir        - LIST: yes, no | whether the efs entry is a directory
                skip_no_entry - LIST: yes, no | whether to skip a efs_entry and continue when it doesnot exist
            Sample:
                <efs_entry partition="primary" parent_dir="/nv/item_files" name="tst.xml" is_dir="no" skip_no_entry="yes"/>
            -->
        </upgrade_port_config>
        <!-- execute - LIST: yes, no | whether to upgrade port config. Generally, it is an efs file -->
        <upgrade_combine_config execute="no">
            <!--
                infos of an efs entry
                partition     - LIST: primary, alternative | which partition the efs entry will be put to
                parent_dir    - STR_VAL: | which directory the efs entry will be put to
                name          - STR_VAL: | the name of the efs entry
                is_dir        - LIST: yes, no | whether the efs entry is a directory
                skip_no_entry - LIST: yes, no | whether to skip a efs_entry and continue when it doesnot exist
            Sample:
                <efs_entry partition="primary" parent_dir="/nv/item_files" name="tst.xml" is_dir="no" skip_no_entry="yes"/>
            -->
        </upgrade_combine_config>
        <!-- execute - LIST: yes, no | whether to upgrade port config. Generally, it is an efs file -->
        <upgrade_pc_ui execute="no">
            <!--
                infos of an efs entry
                partition     - LIST: primary, alternative | which partition the efs entry will be put to
                parent_dir    - STR_VAL: | which directory the efs entry will be put to
                name          - STR_VAL: | the name of the efs entry
                is_dir        - LIST: yes, no | whether the efs entry is a directory
                skip_no_entry - LIST: yes, no | whether to skip a efs_entry and continue when it doesnot exist
            Sample:
                <efs_entry partition="primary" parent_dir="/nv/item_files" name="tst.xml" is_dir="no" skip_no_entry="yes"/>
            -->
        </upgrade_pc_ui>
        <!-- execute - LIST: yes, no | whether to upgrade port config. Generally, it is an efs file -->
        <upgrade_version_info execute="no">
            <!--
                infos of an efs entry
                partition     - LIST: primary, alternative | which partition the efs entry will be put to
                parent_dir    - STR_VAL: | which directory the efs entry will be put to
                name          - STR_VAL: | the name of the efs entry
                is_dir        - LIST: yes, no | whether the efs entry is a directory
                skip_no_entry - LIST: yes, no | whether to skip a efs_entry and continue when it doesnot exist
            Sample:
                <efs_entry partition="primary" parent_dir="/nv/item_files" name="tst.xml" is_dir="no" skip_no_entry="yes"/>
            -->
        </upgrade_version_info>
        <!-- execute - LIST: yes, no | whether to upgrade a series of efs entries. -->
        <upgrade_efs_entry execute="no">
            <!--
                infos of an efs entry
                partition     - LIST: primary, alternative | which partition the efs entry will be put to
                parent_dir    - STR_VAL: | which directory the efs entry will be put to
                name          - STR_VAL: | the name of the efs entry
                is_dir        - LIST: yes, no | whether the efs entry is a directory
                skip_no_entry - LIST: yes, no | whether to skip a efs_entry and continue when it doesnot exist
            Sample:
                <efs_entry partition="primary" parent_dir="/nv/item_files" name="tst.xml" is_dir="no" skip_no_entry="yes"/>
            -->
        </upgrade_efs_entry>
        <!-- execute - LIST: yes, no | whether to execute a series of adb commands. -->
        <adb_update execute="no">
            <!--
                will do adb update only when there are some adb_entrys, and execute execute all adb_entrys in order.
                adbpath     - STR_VAL: | the path of the adb.exe, if empty will just use adb.
                command:    - STR_VAL: | the adb command, no need to add adb at head.
                expect:     - STR_VAL: | expected string in the return data of the adb commnad.
                timewait:   - DEC_DIGIT: | time span used to wait a adb commander to complete.
            Sample:
                <adb_entry adbpath="C:\CUFTemp\adb.exe" command="push F:\web /usr/zte_web/web" expect="" timewait="5"/>
            -->
        </adb_update>
        <mdm_9x15>
            <!-- execute - LIST: yes, no | whether to restore factory settings -->
            <restore_factory_settings execute="yes"/>
            <!-- execute - LIST: yes, no | whether to set wifi ssid after restore infos -->
            <set_wifi_ssid execute="yes"/>
            <!-- execute - LIST: yes, no | whether to set wifi key after restore infos -->
            <set_wifi_key execute="yes"/>
        </mdm_9x15>
        <mdm_9x25>
            <!-- execute - STR_VAL: | a string contained wifi calilbration list. -->
            <backup_wifi_calibration execute="no"/>
            <!-- execute - LIST: yes, no | whether to set wifi ssid after restore infos -->
            <set_wifi_ssid execute="yes"/>
            <!-- execute - LIST: yes, no | whether to set wifi key after restore infos -->
            <set_wifi_key execute="yes"/>
        </mdm_9x25>
    </qc>
    <tsp>
        <!-- tsp platform relative config -->
        <!-- node_value - FIXED_LEN_DIGIT: digit with 8 hex chars, like 0x12345678 |  -->
        <tl_begin_address>0x00100000</tl_begin_address>
        <tsp_7500>
            <!-- execute    - LIST: yes, no | whether to backup nv segments -->
            <backup_nv_segs execute="yes">
                <!--
                    info of an nv segment
                    start_address   - FIXED_LEN_DIGIT: digit with 8 hex chars, like 0x12345678 | start address on a device's flash of the nv segment
                    length          - FIXED_LEN_DIGIT: digit with 8 hex chars, like 0x12345678 | length of the nv segment
                -->
                <nv_seg start_address="0xf5ABC000" length="8796"/>
                <nv_seg start_address="0xf5AB5C02" length="9092"/>
                <nv_seg start_address="0xf5AA4400" length="8"/>
                <nv_seg start_address="0xf5AA4410" length="6"/>
                <nv_seg start_address="0xf5AA4420" length="40"/>
                <nv_seg start_address="0xF5AA8000" length="528"/>
                <nv_seg start_address="0xf5AAE400" length="528"/>
                <nv_seg start_address="0xf5AB7FEC" length="4772"/>
                <nv_seg start_address="0xf5AA8300" length="227"/>
                <nv_seg start_address="0xf5AAE700" length="227"/>
            </backup_nv_segs>
        </tsp_7500>
        <tsp_7510/>
    </tsp>
</upgrade_config>

Rennert · 2019-05-29T21:23:14+0200

Das Kill Switch Tool funzt ja nur mit Freischaltung.

wird auch mitm FTM Modus gestartet, der Programmer läuft vielleicht nicht im EDL Mode

EDIIIZ · 2019-05-29T22:41:50+0200

@Rennert
Ja, gibts da schon erfahrung mit der Freischaltung? Und ist es das überhaupt wert?

Welchen rawprogrammer muss man eigentlich nutzen wenn man die Firmware aufspielen will? Ich denke mal 4 oder ?
[doublepost=1559162510,1559161937][/doublepost]@Rennert
ich denke du liegst richtig mit dem programmer. Es fehlt auch das _ddr nach dem sdm855. Andere Firmwares haben das.

yasar · 2019-05-30T11:40:34+0200

kann man mit der firmware keine patched boot für root generieren?

EDIIIZ · 2019-05-30T11:53:16+0200

yasar schrieb:
kann man mit der firmware keine patched boot für root generieren?

Klar, aber wie willst du das flashen?

yasar · 2019-05-30T12:28:16+0200

Also von der recovery aus Boot to recovery klappt nicht.... dann müsste man als image via recovery flashen...stock recovery

normaler weise oem entsperrung heisst das der bootloader freigeschaltet wird , anscheind hier nicht der fall

// da muss ZTE voll aktiv werden damit sie uns den bootloader entsperren via oem unlock...

adb reboot-bootloader klappt auch nicht handy startet normal

EDIIIZ · 2019-05-30T12:41:16+0200

@yasar ja der Bootloader bzw Fastboot sind für den User nicht erreichbar. Glaube aber kaum das man über die stock recovery irgendwas flashen kann

yasar · 2019-05-30T12:49:34+0200

hast du versucht schon mal deine update.zip im recovery modus via adb zu senden? wenns klapp dann hast du ja die rätzels lösung... dann kann mann noch die build.prop umändern um manche modds auszutesten...ggf

ansonsten abwartet bis man den EDL modus zum laufen bekommt...

Rennert · 2019-05-30T13:07:41+0200

Es fehlt einfach der Fastboot Mode, damit kann man dann den Bootloader vielleicht auch mit fastboot oem unlock entsperren.
Für EDL fehlt leider noch der richtige Programmer. In den EDL Files ist keiner dabei. Kannst ja mal mit MiFlash probieren, obs flasht. Ich trau mich nicht

EDIIIZ · 2019-05-30T13:08:50+0200

@yasar das geht bestimmt. Nur sobald du irgendwas in der payload änderst wird wahrscheinlich die Signatur nicht mehr passen. Ich weiß auch gar nicht ob man einen gedumpte payload wieder zu ner payload.bin machen kann.

yasar · 2019-05-30T13:10:12+0200

japp genau, abwarten vlt wird es in der nächsten firmware gefixxt.... oem unlock im entwicklermodus freigeben aber kein bootloader ist für mich ein bug , oder die passenden tools für den edl modus wie du bereits gesagt hast .. warten wir einfach ab , noch ist das phone vei 4pda forum nicht gelistet

der markt hat noch nicht mal zubehör (panzerglas) für das gerät

ich rede nicht von p30pro folien

[Firmware & Tools] ZTE AXON 10 Pro EDL-SD Firmware & Firehose

EDIIIZ

Ambitioniertes Mitglied

EDIIIZ

Ambitioniertes Mitglied

Rennert

Enthusiast

EDIIIZ

Ambitioniertes Mitglied

Rennert

Enthusiast

Anhänge

EDIIIZ

Ambitioniertes Mitglied

Rennert

Enthusiast

EDIIIZ

Ambitioniertes Mitglied

Rennert

Enthusiast

EDIIIZ

Ambitioniertes Mitglied

Rennert

Enthusiast

EDIIIZ

Ambitioniertes Mitglied

yasar

Fortgeschrittenes Mitglied

EDIIIZ

Ambitioniertes Mitglied

yasar

Fortgeschrittenes Mitglied

EDIIIZ

Ambitioniertes Mitglied

yasar

Fortgeschrittenes Mitglied

Rennert

Enthusiast

EDIIIZ

Ambitioniertes Mitglied

yasar

Fortgeschrittenes Mitglied

Ähnliche Themen