Thanks again for this, @mattmon! I got it up and running! It runs pretty smooth as well. I might snag a couple more of these for my mom’s setup.
All that is left for me is typical android stuff (that I need to read up on)
Wallpanel has an option for start on boot
Here’s a post by @dshokouhi with another option
Have also heard of people doing with an app called tasker. Though it’s not FOSS.
Awesome post! Thank you for sharing - just ordered a couple.
(Maybe this is super obvious but)….If this is a conferencing device it has a good mic and speakers, could it be used to voice control HA (like rhaspy?) some kind of wake word detection app, and use a local whisper server?
Has anyone explored this yet?
Have been waiting for someone to ask this, haha
This platform might have built in support for qualcomms “hey snapdragon” wakeword detection (with customizeable hot word).
The software was present on the original rom, though I removed it because it didn’t work right.
I’ll make the SVA app available if anyone wants to try getting it working.
Of course, not the only way to do this, but would be cool to use hardware to do it!
This looks like an awesome project so I snagged one and started my journey. Flashed fine but I can’t seem to get adb after the flash. Any suggestions?
Yes I ordered 2, but the economics of ordering from Amazon is different here, but that is still cheap at NZ $100 each.
Try re-inserting the usbc cable or using another one.
Inspect edl’s output and make sure that each included .bin file was successfully flashed.
EDIT: Got it! My adb was too new apparently as I switched to my other computer that has older adb software on it and it picked it right up. Sorry for the confusion.
Tried a different cable but to no avail. I’m an android user who performs flashes on my pixel each month so pretty confident in my cables. I’ve attached the edl output below and all looks ok to me but not familiar with edl tbh:
[15:07](ttys000):kingston-ha-rom[0]$ edl qfil bin/rawprogram.xml bin/patch0.xml flash/ --loader=bin/prog_emmc_firehose_8953_ddr.mbn
Capstone library is missing (optional).
Keystone library is missing (optional).
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2023.
main - Using loader bin/prog_emmc_firehose_8953_ddr.mbn ...
main - Waiting for the device
......
main - Hint: Press and hold vol up+dwn, connect usb. For some, only use vol up.
main - Xiaomi: Press and hold vol dwn + pwr, in fastboot mode connect usb.
Run "./fastpwn oem edl".
main - Other: Run "adb reboot edl".
........main - Device detected :)
sahara - Protocol version: 2, Version supported: 1
main - Mode detected: sahara
sahara -
Version 0x2
------------------------
HWID: 0x000660e160008000 (MSM_ID:0x000660e1,OEM_ID:0x6000,MODEL_ID:0x8000)
CPU detected: "APQ8053"
PK_HASH: 0xb9eca30dfea4693497b6ac7eec81d006967281e259eb9ac239f9ce6dabb70c14
Serial: 0x5f9184ea
sahara - Protocol version: 2, Version supported: 1
sahara - Uploading loader bin/prog_emmc_firehose_8953_ddr.mbn ...
sahara - 32-Bit mode detected.
sahara - Firehose mode detected, uploading...
sahara - Loader successfully uploaded.
main - Trying to connect to firehose loader ...
firehose_client
firehose_client - [LIB]: No --memory option set, we assume "eMMC" as default ..., if it fails, try using "--memory" with "UFS","NAND" or "spinor" instead !
firehose - TargetName=MSM8953
firehose - MemoryName=eMMC
firehose - Version=1
firehose - Trying to read first storage sector...
firehose - Running configure...
firehose - Storage report:
firehose - total_blocks:15269888
firehose - block_size:512
firehose - page_size:512
firehose - num_physical:3
firehose - mfr_id:21
firehose - serial_num:4093595192
firehose - fw_version:6
firehose - mem_type:eMMC
firehose - prod_name:8GTF4R
firehose_client - Supported functions:
-----------------
firehose_client - [qfil] raw programming...
firehose_client - [qfil] programming bin/rawprogram.xml
firehose_client
firehose_client - [LIB]: flash/NON-HLOS.bin doesn't exist!
firehose_client
firehose_client - [LIB]: flash/sbl1.bin doesn't exist!
firehose_client
firehose_client - [LIB]: flash/sbl1.bin doesn't exist!
firehose_client
firehose_client - [LIB]: flash/rpm.bin doesn't exist!
firehose_client
firehose_client - [LIB]: flash/rpm.bin doesn't exist!
firehose_client
firehose_client - [LIB]: flash/tz.bin doesn't exist!
firehose_client
firehose_client - [LIB]: flash/tz.bin doesn't exist!
firehose_client
firehose_client - [LIB]: flash/devcfg.bin doesn't exist!
firehose_client
firehose_client - [LIB]: flash/devcfg.bin doesn't exist!
firehose_client
firehose_client - [LIB]: flash/adspso.bin doesn't exist!
firehose_client
firehose_client - [LIB]: flash/sec.dat doesn't exist!
firehose_client - [qfil] programming flash/splash.bin to partition(0)@sector(655360)...
firehose -
Writing to physical partition 0, sector 655360, sectors 327
Progress: |██████████| 100.0% Write (Sector 0x146 of 0x146, ) 2.57 MB/s
firehose_client
firehose_client - [LIB]: flash/emmc_appsboot.bin doesn't exist!
firehose_client
firehose_client - [LIB]: flash/emmc_appsboot.bin doesn't exist!
firehose_client - [qfil] programming flash/boot.bin to partition(0)@sector(790528)...
firehose -
Writing to physical partition 0, sector 790528, sectors 65536
Progress: |██████████| 100.0% Write (Sector 0x10000 of 0x10000, ) 3.46 MB/s
firehose_client
firehose_client - [LIB]: flash/recovery.bin doesn't exist!
firehose_client - [qfil] programming flash/system.bin to partition(0)@sector(923648)...
firehose -
Writing to physical partition 0, sector 923648, sectors 3145728
Progress: |██████████| 100.0% Write (Sector 0x300000 of 0x300000, ) 4.48 MB/s
firehose_client - [qfil] programming flash/vendor.bin to partition(0)@sector(4069376)...
firehose -
Writing to physical partition 0, sector 4069376, sectors 786432
Progress: |██████████| 100.0% Write (Sector 0xC0000 of 0xC0000, ) 4.44 MB/s
firehose_client
firehose_client - [LIB]: flash/cache.bin doesn't exist!
firehose_client
firehose_client - [LIB]: flash/persist.bin doesn't exist!
firehose_client - [qfil] programming flash/oem.bin to partition(0)@sector(5307456)...
firehose -
Writing to physical partition 0, sector 5307456, sectors 204800
Progress: |██████████| 100.0% Write (Sector 0x32000 of 0x32000, ) 4.38 MB/s
firehose_client
firehose_client - [LIB]: flash/mdtp.bin doesn't exist!
firehose_client
firehose_client - [LIB]: flash/lksecapp.bin doesn't exist!
firehose_client
firehose_client - [LIB]: flash/lksecapp.bin doesn't exist!
firehose_client
firehose_client - [LIB]: flash/cmnlib_30.bin doesn't exist!
firehose_client
firehose_client - [LIB]: flash/cmnlib_30.bin doesn't exist!
firehose_client
firehose_client - [LIB]: flash/cmnlib64_30.bin doesn't exist!
firehose_client
firehose_client - [LIB]: flash/cmnlib64_30.bin doesn't exist!
firehose_client
firehose_client - [LIB]: flash/keymaster64.bin doesn't exist!
firehose_client
firehose_client - [LIB]: flash/keymaster64.bin doesn't exist!
firehose_client - [qfil] programming flash/resource.bin to partition(0)@sector(6161424)...
firehose -
Writing to physical partition 0, sector 6161424, sectors 729088
Progress: |██████████| 100.0% Write (Sector 0xB2000 of 0xB2000, ) 4.45 MB/s
firehose_client
firehose_client - [LIB]: flash/userdata.bin doesn't exist!
firehose_client
firehose_client - [LIB]: flash/gpt_main0.bin doesn't exist!
firehose_client
firehose_client - [LIB]: flash/gpt_backup0.bin doesn't exist!
firehose_client - [qfil] raw programming ok.
firehose_client - [qfil] patching...
firehose_client - [qfil] patching with bin/patch0.xml
firehose_client - [qfil] patching DISK sector(14), size=8
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="296" filename="DISK" physical_partition_number="0" size_in_bytes="8" start_sector="14" value="NUM_DISK_SECTORS-34." what="Update last partition 51 'userdata' with actual size in Primary Header." />
</data>
firehose_client - [qfil] patching DISK sector(NUM_DISK_SECTORS-21.), size=8
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="296" filename="DISK" physical_partition_number="0" size_in_bytes="8" start_sector="NUM_DISK_SECTORS-21." value="NUM_DISK_SECTORS-34." what="Update last partition 51 'userdata' with actual size in Backup Header." />
</data>
firehose_client - [qfil] patching DISK sector(1), size=8
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="48" filename="DISK" physical_partition_number="0" size_in_bytes="8" start_sector="1" value="NUM_DISK_SECTORS-34." what="Update Primary Header with LastUseableLBA." />
</data>
firehose_client - [qfil] patching DISK sector(NUM_DISK_SECTORS-1.), size=8
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="48" filename="DISK" physical_partition_number="0" size_in_bytes="8" start_sector="NUM_DISK_SECTORS-1." value="NUM_DISK_SECTORS-34." what="Update Backup Header with LastUseableLBA." />
</data>
firehose_client - [qfil] patching DISK sector(1), size=8
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="32" filename="DISK" physical_partition_number="0" size_in_bytes="8" start_sector="1" value="NUM_DISK_SECTORS-1." what="Update Primary Header with BackupGPT Header Location." />
</data>
firehose_client - [qfil] patching DISK sector(NUM_DISK_SECTORS-1.), size=8
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="24" filename="DISK" physical_partition_number="0" size_in_bytes="8" start_sector="NUM_DISK_SECTORS-1." value="NUM_DISK_SECTORS-1." what="Update Backup Header with CurrentLBA." />
</data>
firehose_client - [qfil] patching DISK sector(NUM_DISK_SECTORS-1), size=8
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="72" filename="DISK" physical_partition_number="0" size_in_bytes="8" start_sector="NUM_DISK_SECTORS-1" value="NUM_DISK_SECTORS-33." what="Update Backup Header with Partition Array Location." />
</data>
firehose_client - [qfil] patching DISK sector(1), size=4
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="88" filename="DISK" physical_partition_number="0" size_in_bytes="4" start_sector="1" value="CRC32(2,6656)" what="Update Primary Header with CRC of Partition Array." />
</data>
firehose_client - [qfil] patching DISK sector(NUM_DISK_SECTORS-1.), size=4
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="88" filename="DISK" physical_partition_number="0" size_in_bytes="4" start_sector="NUM_DISK_SECTORS-1." value="CRC32(NUM_DISK_SECTORS-33.,6656)" what="Update Backup Header with CRC of Partition Array." />
</data>
firehose_client - [qfil] patching DISK sector(1), size=4
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="16" filename="DISK" physical_partition_number="0" size_in_bytes="4" start_sector="1" value="0" what="Zero Out Header CRC in Primary Header." />
</data>
firehose_client - [qfil] patching DISK sector(1), size=4
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="16" filename="DISK" physical_partition_number="0" size_in_bytes="4" start_sector="1" value="CRC32(1,92)" what="Update Primary Header with CRC of Primary Header." />
</data>
firehose_client - [qfil] patching DISK sector(NUM_DISK_SECTORS-1.), size=4
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="16" filename="DISK" physical_partition_number="0" size_in_bytes="4" start_sector="NUM_DISK_SECTORS-1." value="0" what="Zero Out Header CRC in Backup Header." />
</data>
firehose_client - [qfil] patching DISK sector(NUM_DISK_SECTORS-1.), size=4
<?xml version="1.0" ?><data>
<patch SECTOR_SIZE_IN_BYTES="512" byte_offset="16" filename="DISK" physical_partition_number="0" size_in_bytes="4" start_sector="NUM_DISK_SECTORS-1." value="CRC32(NUM_DISK_SECTORS-1.,92)" what="Update Backup Header with CRC of Backup Header." />
</data>
firehose_client - [qfil] patching ok
firehose - Setbootablestoragedrive succeeded.
firehose_client - [qfil] partition(0) is now bootable
Brilliant work, thanks @mattmon!
I picked one up, and got it flashed on Windows using the EDL you’re linking to. I am not able to rotate the boot animation though as ‘adb remount’ for some reason is hanging (‘adb root’ works).
Anyone seen the same behavior ? Latest Android Studio.
Thanks again!
Congrats for flashing it with Windows - how did you manage to install UsbDk so that it is recognized? In took the installer msi and installed, does it need any special install options?
What version?
Had to install Zadig for Python (and edl) to access USB…
Did you execute the provisioning commands?
Try turning on developer mode in settings.
(Tap build number 7 times in settings → about)
I’ve always used whatever version of ADB that is available through the Linux distro package manager. Never had a problem.
On linux, make sure your user can access usb. You might need to add this device’s usb vid/pid to a udev rule.
Sure, but if someone claims it isn’t working for them, they should state the details, because “too new” has no meaning. This will help others should they find this post/thread – assuming it’s valid. I don’t want to make an argument out of this. I just want the info to be clear.
When some of you guys have this up and running, can you post a pic of the device? I’ve been perusing in this thread to see how it goes for you, also wondering how maintainable will the device be.
[quote=“mattmon, post:53, topic:658422, full:true”]
Did you execute the provisioning commands?
Try turning on developer mode in settings.
(Tap build number 7 times in settings → about)
Yes, did the provisioning. Ended up using ‘adb shell’, ‘su’ and then mounted manually using ‘mount -o rw,remount /system’ which worked.
Same difference, glad you got it working 
$ adb --version
Android Debug Bridge version 1.0.41
Version 34.0.5-10900879
it depends.
will this ROM ever receive android updates, no
can system components be replaced manually, yes
for example, it would be possible to ‘maintain’ HA dash functionality going forward by updating the system webview, so long as the chromium project retains sdk27 support.
@mattmon, can you explain the Android updates situation ? (me trying to understand, not being critical). Is it hardware limitations causing it?
This is based on a leaked debug rom. It was built and signed by Lenovo in 2019. Only they have the keys to produce “updates” for it.
Though because it’s a debug variant with all the safeguards turned off, we have the freedom to make changes to the file system, so long as lenovo’s signed frameworks remain intact.
If someone was motivated, it should be possible to build modern AOSP for this device. Though, for use as an HA dashboard, I don’t see any benefit.
adb 1.0.29 worked and adb 1.0.41 did not. Older was on a windows machine and newer was on a macbook but I use the macbook to flash my phone so unsure of the exact issue causing my particular problem but based on the responses above that wasn’t my issue as 1.0.41 is listed as working.