It looks like I’m also running into issues with a locked tablet. I’m on Arch and edl
is in the AUR, so I just installed it from there (meaning it’s in my $PATH
somewhere).
Here’s the directory structure I flashed with:
~/Downloads/lenovo-thinksmart-home-assistant-rom
❯ tree
.
├── bin
│ ├── patch0.xml
│ ├── prog_emmc_firehose_8953_ddr.mbn
│ └── rawprogram.xml
├── boot.bin
├── dashboard-cloos.jpg
├── dashboard-madelena.jpg
├── extras
├── flash
├── gallery.apk
├── kingston-ha-rom.7z
├── oem.bin
├── patch0.xml
├── prog_emmc_firehose_8953_ddr.mbn
├── rawprogram.xml
├── README.md
├── resource.bin
├── splash.bin
├── splash.bin.horz
├── system.bin
├── vendor.bin
├── virtualsoftkeys.apk
└── wallpaper.png
I used this command to flash:
edl qfil rawprogram.xml patch0.xml ./ --loader=prog_emmc_firehose_8953_ddr.mbn
Here’s the unabridged output from flashing:
~/Downloads/lenovo-thinksmart-home-assistant-rom
❯ edl qfil rawprogram.xml patch0.xml ./ --loader=prog_emmc_firehose_8953_ddr.mbn
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2023.
main - Using loader prog_emmc_firehose_8953_ddr.mbn ...
main - Waiting for the device
......
main - Hint: Press and hold vol up+dwn, connect usb. For some, only use vol up.
main - Xiaomi: Press and hold vol dwn + pwr, in fastboot mode connect usb.
Run "./fastpwn oem edl".
main - Other: Run "adb reboot edl".
..........main - Device detected :)
sahara - Protocol version: 2, Version supported: 1
main - Mode detected: sahara
sahara -
Version 0x2
------------------------
HWID: 0x000660e160008000 (MSM_ID:0x000660e1,OEM_ID:0x6000,MODEL_ID:0x8000)
CPU detected: "APQ8053"
PK_HASH: 0xb9eca30dfea4693497b6ac7eec81d006967281e259eb9ac239f9ce6dabb70c14
Serial: 0xe8e2ec57
sahara - Protocol version: 2, Version supported: 1
sahara - Uploading loader prog_emmc_firehose_8953_ddr.mbn ...
sahara - 32-Bit mode detected.
sahara - Firehose mode detected, uploading...
sahara - Loader successfully uploaded.
main - Trying to connect to firehose loader ...
firehose_client
firehose_client - [LIB]: No --memory option set, we assume "eMMC" as default ..., if it fails, try using "--memory" with "UFS","NAND" or "spinor" instead !
firehose - TargetName=MSM8953
firehose - MemoryName=eMMC
firehose - Version=1
firehose - Trying to read first storage sector...
firehose - Running configure...
firehose - Storage report:
firehose - total_blocks:15269888
firehose - block_size:512
firehose - page_size:512
firehose - num_physical:3
firehose - mfr_id:21
firehose - serial_num:4093136428
firehose - fw_version:6
firehose - mem_type:eMMC
firehose - prod_name:8GTF4R
firehose_client - Supported functions:
-----------------
firehose_client - [qfil] raw programming...
firehose_client - [qfil] programming rawprogram.xml
firehose_client
firehose_client - [LIB]: ./NON-HLOS.bin doesn't exist!
firehose_client
firehose_client - [LIB]: ./sbl1.bin doesn't exist!
firehose_client
firehose_client - [LIB]: ./sbl1.bin doesn't exist!
firehose_client
firehose_client - [LIB]: ./rpm.bin doesn't exist!
firehose_client
firehose_client - [LIB]: ./rpm.bin doesn't exist!
firehose_client
firehose_client - [LIB]: ./tz.bin doesn't exist!
firehose_client
firehose_client - [LIB]: ./tz.bin doesn't exist!
firehose_client
firehose_client - [LIB]: ./devcfg.bin doesn't exist!
firehose_client
firehose_client - [LIB]: ./devcfg.bin doesn't exist!
firehose_client
firehose_client - [LIB]: ./adspso.bin doesn't exist!
firehose_client
firehose_client - [LIB]: ./sec.dat doesn't exist!
firehose_client - [qfil] programming ./splash.bin to partition(0)@sector(655360)...
firehose -
Writing to physical partition 0, sector 655360, sectors 22528
Progress: |██████████| 100.0% Write (Sector 0x5800 of 0x5800, ) 8.84 MB/s
firehose_client
firehose_client - [LIB]: ./emmc_appsboot.bin doesn't exist!
firehose_client
firehose_client - [LIB]: ./emmc_appsboot.bin doesn't exist!
firehose_client - [qfil] programming ./boot.bin to partition(0)@sector(790528)...
firehose -
Writing to physical partition 0, sector 790528, sectors 65536
Progress: |██████████| 100.0% Write (Sector 0x10000 of 0x10000, ) 9.69 MB/s
firehose_client
firehose_client - [LIB]: ./recovery.bin doesn't exist!
firehose_client - [qfil] programming ./system.bin to partition(0)@sector(923648)...
firehose -
Writing to physical partition 0, sector 923648, sectors 3145728
Progress: |██████████| 100.0% Write (Sector 0x300000 of 0x300000, ) 9.38 MB/s
firehose_client - [qfil] programming ./vendor.bin to partition(0)@sector(4069376)...
firehose -
Writing to physical partition 0, sector 4069376, sectors 786432
Progress: |██████████| 100.0% Write (Sector 0xC0000 of 0xC0000, ) 9.73 MB/s
firehose_client
firehose_client - [LIB]: ./cache.bin doesn't exist!
firehose_client
firehose_client - [LIB]: ./persist.bin doesn't exist!
firehose_client - [qfil] programming ./oem.bin to partition(0)@sector(5307456)...
firehose -
Writing to physical partition 0, sector 5307456, sectors 204800
Progress: |██████████| 100.0% Write (Sector 0x32000 of 0x32000, ) 8.86 MB/s
firehose_client
firehose_client - [LIB]: ./mdtp.bin doesn't exist!
firehose_client
firehose_client - [LIB]: ./lksecapp.bin doesn't exist!
firehose_client
firehose_client - [LIB]: ./lksecapp.bin doesn't exist!
firehose_client
firehose_client - [LIB]: ./cmnlib_30.bin doesn't exist!
firehose_client
firehose_client - [LIB]: ./cmnlib_30.bin doesn't exist!
firehose_client
firehose_client - [LIB]: ./cmnlib64_30.bin doesn't exist!
firehose_client
firehose_client - [LIB]: ./cmnlib64_30.bin doesn't exist!
firehose_client
firehose_client - [LIB]: ./keymaster64.bin doesn't exist!
firehose_client
firehose_client - [LIB]: ./keymaster64.bin doesn't exist!
firehose_client - [qfil] programming ./resource.bin to partition(0)@sector(6161424)...
firehose -
Writing to physical partition 0, sector 6161424, sectors 729088
Progress: |██████████| 100.0% Write (Sector 0xB2000 of 0xB2000, ) 9.71 MB/s
firehose_client
firehose_client - [LIB]: ./userdata.bin doesn't exist!
firehose_client
firehose_client - [LIB]: ./gpt_main0.bin doesn't exist!
firehose_client
firehose_client - [LIB]: ./gpt_backup0.bin doesn't exist!
firehose_client - [qfil] raw programming ok.
firehose_client - [qfil] patching...
firehose_client - [qfil] patching with patch0.xml
firehose_client - [qfil] patching DISK sector(14), size=8
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="296" filename="DISK" physical_partition_number="0" size_in_bytes="8" start_sector="14" value="NUM_DISK_SECTORS-34." what="Update last partition 51 'userdata' with actual size in Primary Header." />
</data>
firehose_client - [qfil] patching DISK sector(NUM_DISK_SECTORS-21.), size=8
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="296" filename="DISK" physical_partition_number="0" size_in_bytes="8" start_sector="NUM_DISK_SECTORS-21." value="NUM_DISK_SECTORS-34." what="Update last partition 51 'userdata' with actual size in Backup Header." />
</data>
firehose_client - [qfil] patching DISK sector(1), size=8
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="48" filename="DISK" physical_partition_number="0" size_in_bytes="8" start_sector="1" value="NUM_DISK_SECTORS-34." what="Update Primary Header with LastUseableLBA." />
</data>
firehose_client - [qfil] patching DISK sector(NUM_DISK_SECTORS-1.), size=8
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="48" filename="DISK" physical_partition_number="0" size_in_bytes="8" start_sector="NUM_DISK_SECTORS-1." value="NUM_DISK_SECTORS-34." what="Update Backup Header with LastUseableLBA." />
</data>
firehose_client - [qfil] patching DISK sector(1), size=8
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="32" filename="DISK" physical_partition_number="0" size_in_bytes="8" start_sector="1" value="NUM_DISK_SECTORS-1." what="Update Primary Header with BackupGPT Header Location." />
</data>
firehose_client - [qfil] patching DISK sector(NUM_DISK_SECTORS-1.), size=8
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="24" filename="DISK" physical_partition_number="0" size_in_bytes="8" start_sector="NUM_DISK_SECTORS-1." value="NUM_DISK_SECTORS-1." what="Update Backup Header with CurrentLBA." />
</data>
firehose_client - [qfil] patching DISK sector(NUM_DISK_SECTORS-1), size=8
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="72" filename="DISK" physical_partition_number="0" size_in_bytes="8" start_sector="NUM_DISK_SECTORS-1" value="NUM_DISK_SECTORS-33." what="Update Backup Header with Partition Array Location." />
</data>
firehose_client - [qfil] patching DISK sector(1), size=4
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="88" filename="DISK" physical_partition_number="0" size_in_bytes="4" start_sector="1" value="CRC32(2,6656)" what="Update Primary Header with CRC of Partition Array." />
</data>
firehose_client - [qfil] patching DISK sector(NUM_DISK_SECTORS-1.), size=4
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="88" filename="DISK" physical_partition_number="0" size_in_bytes="4" start_sector="NUM_DISK_SECTORS-1." value="CRC32(NUM_DISK_SECTORS-33.,6656)" what="Update Backup Header with CRC of Partition Array." />
</data>
firehose_client - [qfil] patching DISK sector(1), size=4
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="16" filename="DISK" physical_partition_number="0" size_in_bytes="4" start_sector="1" value="0" what="Zero Out Header CRC in Primary Header." />
</data>
firehose_client - [qfil] patching DISK sector(1), size=4
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="16" filename="DISK" physical_partition_number="0" size_in_bytes="4" start_sector="1" value="CRC32(1,92)" what="Update Primary Header with CRC of Primary Header." />
</data>
firehose_client - [qfil] patching DISK sector(NUM_DISK_SECTORS-1.), size=4
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="16" filename="DISK" physical_partition_number="0" size_in_bytes="4" start_sector="NUM_DISK_SECTORS-1." value="0" what="Zero Out Header CRC in Backup Header." />
</data>
firehose_client - [qfil] patching DISK sector(NUM_DISK_SECTORS-1.), size=4
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="16" filename="DISK" physical_partition_number="0" size_in_bytes="4" start_sector="NUM_DISK_SECTORS-1." value="CRC32(NUM_DISK_SECTORS-1.,92)" what="Update Backup Header with CRC of Backup Header." />
</data>
firehose_client - [qfil] patching ok
firehose - Setbootablestoragedrive succeeded.
firehose_client - [qfil] partition(0) is now bootable
When I rebooted my tablet, there was a password. Repeatedly entering the wrong password didn’t trigger a device wipe for me. Here’s a summary of the issues I encountered when trying to erase the user data in fastboot mode:
❯ fastboot devices
HUA0BXPT fastboot
❯ fastboot erase userdata
******** Did you mean to fastboot format this ext4 partition?
Erasing 'userdata' FAILED (remote: 'device is locked. Cannot erase')
fastboot: error: Command failed
❯ fastboot format:ext4 userdata
mke2fs 1.46.6 (1-Feb-2023)
Creating filesystem with 1047417 4k blocks and 262144 inodes
Filesystem UUID: 1abf00d8-2e53-43d6-97f6-e42da742d3ef
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736
Allocating group tables: done
Writing inode tables: done
Creating journal (16384 blocks): done
Writing superblocks and filesystem accounting information: done
Sending 'userdata' (2160 KB) OKAY [ 0.098s]
Writing 'userdata' FAILED (remote: 'Partition flashing is not allowed')
fastboot: error: Command failed
❯ fastboot oem unlock-go
FAILED (remote: 'oem unlock is not allowed')
fastboot: error: Command failed
Are there any other recommended courses of action? I may have just gotten unlucky with this tablet.
EDIT: I believe this can be worked around by holding up while powering on to get to the recovery menu and kicking off a factory reset from there.
EDIT: The above is wrong. I believe I’m starting to understand the nature of the problem. I installed edl
incorrectly. I need files packaged in the repo, and the way I installed edl
doesn’t give me that. I’ll provide more details in a sec.
EDIT: Yeah, so my problem is that I assumed that an AUR installation would be equivalent to doing my own git clone
of the repo. You must use the repo, or you must know enough about how this all works to get the loaders from the repo and set them up yourself. I’m an idiot when it comes to anything Android, so I’m just going to stick with the git repo. I wish that the repo author advised folks to use a virtualenv for installing their python dependencies though…
One last EDIT: I still needed to do a factory reset with the up arrow recovery menu on my second tablet, even when I did things somewhat more correctly.