How to add the -- sync command? I have tried three or four times in step 5, but have been unable to back up the BCT file

[Awe7]

Use the currently running nv3pserver mode to reflash the bootloader to eMMC (Note: if step 5 failed due to corrupt/missing BCT, add --sync to this command. It will re-write the BCT.):

Please give me the correct command

[tofurky]

For N7 it'd look something like:

# step 4
sudo ./fusee-launcher/fusee-launcher.py ./payload/uart_payload_n7.bin -P 7330
# step 6
sudo ./utils/nvflash_v1.13.87205_miniloader_patched --setbct --bct ./bct/nexus_7_grouper_bct.bin --configfile ./utils/flash.cfg --bl ./bootloader/bootloader-grouper-4.23.img --go
# step 7 w/addition of --sync
sudo ./utils/nvflash_v1.13.87205_miniloader_patched --resume --download EBT bootloader/bootloader-grouper-4.23.img --configfile ./utils/flash.cfg --sync

It'd be helpful if you posted full terminal output of steps 4 and 5 as well as dmesg showing the enumeration into APX mode to confirm that the payload is even working.

Per step #4, something similar to the following would be expected:

     [Sat Jul  4 19:17:25 2020] usb 2-3.4: USB disconnect, device number 20
     [Sat Jul  4 19:17:25 2020] usb 2-3.4: new high-speed USB device number 21 using xhci_hcd
     [Sat Jul  4 19:17:26 2020] usb 2-3.4: New USB device found, idVendor=0955, idProduct=7330, bcdDevice= 1.03
     [Sat Jul  4 19:17:26 2020] usb 2-3.4: New USB device strings: Mfr=1, Product=2, SerialNumber=0
     [Sat Jul  4 19:17:26 2020] usb 2-3.4: Product: APX
     [Sat Jul  4 19:17:26 2020] usb 2-3.4: Manufacturer: NVIDIA Corp.

[Awe7]

Thank you very much for your reply. I will try it out after work.

…

---Original--- From: ***@***.***> Date: Sun, Jan 19, 2025 03:34 AM To: ***@***.***>; Cc: ***@***.******@***.***>; Subject: Re: [tofurky/tegra30_debrick] How to add the -- sync command? I havetried three or four times in step 5, but have been unable to back up the BCTfile (Issue #19) For N7 it'd look something like: # step 4 sudo ./fusee-launcher/fusee-launcher.py ./payload/uart_payload_n7.bin -P 7330 # step 6 sudo ./utils/nvflash_v1.13.87205_miniloader_patched --setbct --bct ./bct/nexus_7_grouper_bct.bin --configfile ./utils/flash.cfg --bl ./bootloader/bootloader-grouper-4.23.img --go # step 7 w/addition of --sync sudo ./utils/nvflash_v1.13.87205_miniloader_patched --resume --download EBT bootloader/bootloader-grouper-4.23.img --configfile ./utils/flash.cfg --sync It'd be helpful if you posted full terminal output of steps 4 and 5 as well as dmesg showing the enumeration into APX mode to confirm that the payload is even working. Per step #4, something similar to the following would be expected: [Sat Jul 4 19:17:25 2020] usb 2-3.4: USB disconnect, device number 20 [Sat Jul 4 19:17:25 2020] usb 2-3.4: new high-speed USB device number 21 using xhci_hcd [Sat Jul 4 19:17:26 2020] usb 2-3.4: New USB device found, idVendor=0955, idProduct=7330, bcdDevice= 1.03 [Sat Jul 4 19:17:26 2020] usb 2-3.4: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [Sat Jul 4 19:17:26 2020] usb 2-3.4: Product: APX [Sat Jul 4 19:17:26 2020] usb 2-3.4: Manufacturer: NVIDIA Corp. — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: ***@***.***>

[Awe7]

`aaa@aaa:~$ cd /home/tegra30_debrick
aaa@aaa:/home/tegra30_debrick$ sudo ./fusee-launcher/fusee-launcher.py ./payload/uart_payload_n7.bin -P 7330
[sudo] password for aaa:
2025-01-19 10:10:48,236 INFO:usb.core:find(): using backend "usb.backend.libusb1"

Important note: on desktop Linux systems, we currently require an XHCI host controller.
A good way to ensure you're likely using an XHCI backend is to plug your
device into a blue 'USB 3' port.

Identified a Linux system; setting up the appropriate backend.
intermezzo_size: 0x00000078
target_payload_size: 0x000005ee
Found a Tegra with Device ID: b'0d1004ca09215d01'
Stack snapshot: b'0000000000000000100000003c9f0040'
EndpointStatus_stack_addr: 0x40009f3c
ProcessSetupPacket SP: 0x40009f30
InnerMemcpy LR stack addr: 0x40009f20
overwrite_len: 0x00004f20
overwrite_payload_off: 0x00004de0
payload_first_length: 0x000005ee
overwrite_payload_off: 0x00004de0
payload_second_length: 0x00000000
b'00a0004000300040ee05000000000000'
Setting rcm msg size to 0x00030064
RCM payload (len_insecure): b'64000300'

Setting ourselves up to smash the stack...
Payload offset of intermezzo: 0x00000074
overwrite_payload_off: 0x00004de0
overwrite_len: 0x00004f20
payload_overwrite_len: 0x00004e5c
overwrite_payload_off: 0x00004de0
smash_padding: 0x000047f2
overwrite_payload_off: 0x00004de0
Uploading payload...
txing 20480 bytes total
txing 4096 bytes (0 already sent) to buf[0] 0x40003000
txing 4096 bytes (4096 already sent) to buf[1] 0x40005000
txing 4096 bytes (8192 already sent) to buf[0] 0x40003000
txing 4096 bytes (12288 already sent) to buf[1] 0x40005000
txing 4096 bytes (16384 already sent) to buf[0] 0x40003000
Smashing the stack...
sending status request with length 0x00004f20
The USB device stopped responding-- sure smells like we've smashed its stack. :)
Launch complete!
aaa@aaa:/home/tegra30_debrick$ sudo ./utils/nvflash_v1.13.87205_miniloader_patched --setbct --bct ./bct/nexus_7_grouper_bct.bin --configfile ./utils/flash.cfg --bl ./bootloader/bootloader-grouper-4.23.img --go
Nvflash v1.13.87205 started
chip uid from BR is: 0x0000000000000000015d2109ca04100d
rcm version 0X30001
System Information:
chip name: unknown
chip id: 0x30 major: 1 minor: 3
chip sku: 0x83
chip uid: 0x0000000000000000015d2109ca04100d
macrovision: disabled
hdcp: enabled
jtag: disabled
sbk burned: true
dk burned: true
boot device: emmc
operating mode: 3
device config strap: 1
device config fuse: 17
sdram config strap: 0

sending file: ./bct/nexus_7_grouper_bct.bin

• 6128/6128 bytes sent
  ./bct/nexus_7_grouper_bct.bin sent successfully
  downloading bootloader -- load address: 0x80108000 entry point: 0x80108000
  sending file: ./bootloader/bootloader-grouper-4.23.img
• 2150992/2150992 bytes sent
  ./bootloader/bootloader-grouper-4.23.img sent successfully
  waiting for bootloader to initialize
  bootloader downloaded successfully
  aaa@aaa:/home/tegra30_debrick$ sudo ./utils/nvflash_v1.13.87205_miniloader_patched --resume --download EBT bootloader/bootloader-grouper-4.23.img --configfile ./utils/flash.cfg --sync
  Nvflash v1.13.87205 started
  [resume mode]
  failed executing command 20 NvError 0x120002
  Unable to retrieve Partition table from device NvError 0x0
  command failure: partition not found in partition table (bad data)
  bootloader status: partition table is required for this command (code: 8) message: nverror:0x5 (0x1000005) flags: 0
  `

[Awe7]

I forcibly restarted n7, tried 8 steps, but couldn't enter fastboot. After I inserted the n7 into the Win10 computer, it still displayed APX mode. Are there any other issues that have not been resolved?

[Awe7]

https://xdaforums.com/t/close-linux-on-the-nexus-7-2012-wifi-rev-e1565-grouper-2023-edition.4323099/

After following the tutorial to install it, I found that it was stuck in the startup cursor interface and couldn't continue. Then I forcibly restarted n7, but afterwards I couldn't enter the system and the screen remained black. Subsequently, when inserting n7 into Win10 and directly entering APX mode, multiple forced restarts were unable to resolve the issue.

[Awe7]

`aaa@aaa:/home/tegra30_debrick$ sudo ./fusee-launcher/fusee-launcher.py ./payload/uart_payload_n7.bin -P 7330
[sudo] password for aaa:
2025-01-19 10:31:38,495 INFO:usb.core:find(): using backend "usb.backend.libusb1"

Important note: on desktop Linux systems, we currently require an XHCI host controller.
A good way to ensure you're likely using an XHCI backend is to plug your
device into a blue 'USB 3' port.

Identified a Linux system; setting up the appropriate backend.
intermezzo_size: 0x00000078
target_payload_size: 0x000005ee
Found a Tegra with Device ID: b'0d1004ca09215d01'
Stack snapshot: b'0000000000000000100000003c9f0040'
EndpointStatus_stack_addr: 0x40009f3c
ProcessSetupPacket SP: 0x40009f30
InnerMemcpy LR stack addr: 0x40009f20
overwrite_len: 0x00004f20
overwrite_payload_off: 0x00004de0
payload_first_length: 0x000005ee
overwrite_payload_off: 0x00004de0
payload_second_length: 0x00000000
b'00a0004000300040ee05000000000000'
Setting rcm msg size to 0x00030064
RCM payload (len_insecure): b'64000300'

Setting ourselves up to smash the stack...
Payload offset of intermezzo: 0x00000074
overwrite_payload_off: 0x00004de0
overwrite_len: 0x00004f20
payload_overwrite_len: 0x00004e5c
overwrite_payload_off: 0x00004de0
smash_padding: 0x000047f2
overwrite_payload_off: 0x00004de0
Uploading payload...
txing 20480 bytes total
txing 4096 bytes (0 already sent) to buf[0] 0x40003000
txing 4096 bytes (4096 already sent) to buf[1] 0x40005000
txing 4096 bytes (8192 already sent) to buf[0] 0x40003000
txing 4096 bytes (12288 already sent) to buf[1] 0x40005000
txing 4096 bytes (16384 already sent) to buf[0] 0x40003000
Smashing the stack...
sending status request with length 0x00004f20
The USB device stopped responding-- sure smells like we've smashed its stack. :)
Launch complete!
aaa@aaa:/home/tegra30_debrick$ sudo ./utils/nvflash_v1.13.87205 --getbct --bct BCT_READBACK_N7.BIN --configfile ./utils/flash.cfg
Nvflash v1.13.87205 started
chip uid from BR is: 0x0000000000000000015d2109ca04100d
rcm version 0X30001
System Information:
chip name: unknown
chip id: 0x30 major: 1 minor: 3
chip sku: 0x83
chip uid: 0x0000000000000000015d2109ca04100d
macrovision: disabled
hdcp: enabled
jtag: disabled
sbk burned: true
dk burned: true
boot device: emmc
operating mode: 4
device config strap: 1
device config fuse: 17
sdram config strap: 0

retrieving bct into: BCT_READBACK_N7.BIN
Failed sending command 2 NvError 1179650command failure: getbct failed (bad data)
bootloader status: Bct file not found (code: 21) message: flags: 1073893660

aaa@aaa:/home/tegra30_debrick$
`

Unable to Take a backup of the tablet's BCT

[Awe7]

Unfortunately, I did not backup any important data of n7 X﹏X

tofurky, please help me

[tofurky]

Seems like somehow the partition table was erased/overwritten. Maybe you wrote the image to the wrong /dev/block/mmc device when trying to install Linux per the XDA link?

failed executing command 20 NvError 0x120002
Unable to retrieve Partition table from device NvError 0x0
command failure: partition not found in partition table (bad data)
bootloader status: partition table is required for this command (code: 8) message: nverror:0x5 (0x1000005) flags: 0

See #9 (comment) and maybe try the --rawdeviceread command there and post the result (.zip). It'd show if the partition table is intact.

Someone posted this in #9, it could possibly help: https://xdaforums.com/t/guide-recover-from-corrupted-partition-table-no-bricksafe-img.4680047/

[Awe7]

I have encountered the same issue as the 'New member', and I am planning to purchase an Emmc (Kingston KE4CN5B6A 32G flash) to replace the faulty Emmc. I will then use PT32 to restore the n7

: https://xdaforums.com/t/guide-recover-from-corrupted-partition-table-no-bricksafe-img.4680047/

[Awe7]

If I replace the EMMC, do I still need to follow this tutorial to obtain Blob.bin ：https://xdaforums.com/t/tutorial-how-to-unbrick-nexus-7-without-blob-bin-requires-another-nexus-7-2012.4083879/

[tofurky]

No, just following https://xdaforums.com/t/guide-recover-from-corrupted-partition-table-no-bricksafe-img.4680047/ should be enough to rewrite BCT, bootloader, and partition table. bricksafe.sh per that post uses SBK to create the encrypted flash image, then uses rawdevicewrite with the patched nvflash to write it to the beginning of flash. Using the bootrom exploit with patched nvflash negates the need for a blob.bin.

I would try it before replacing eMMC. But if eMMC is truly bad, the --rawdevicewrite would fail just the same as a --rawdeviceread.

[Awe7]

root@aaa:/home/aaa/n7/tegra30_debrick# sudo ./utils/nvflash_v1.13.87205_miniloader_patched --resume --rawdevicewrite 0 2688 bricksafe.img
Nvflash v1.13.87205 started
[resume mode]
failed executing command 32 NvError 0x120002
command failure: writedeviceraw failed (bad data)

root@aaa:/home/aaa/n7/tegra30_debrick# sudo ./utils/nvflash_v1.13.87205_miniloader_patched --resume --rawdevicewrite 0 2688 bricksafe.img
Nvflash v1.13.87205 started
[resume mode]
failed executing command 32 NvError 0x120002
command failure: writedeviceraw failed (bad data)

root@aaa:/home/aaa/n7/tegra30_debrick# sudo ./utils/nvflash_v1.13.87205_miniloader_patched --resume --rawdevicewrite 0 2688 bricksafe.img
Nvflash v1.13.87205 started
[resume mode]
failed executing command 32 NvError 0x120002
command failure: writedeviceraw failed (bad data)

I have tried multiple times

[tofurky]

Please report back if you replace eMMC and are able to start using --rawdevicewrite.

Several people have reported similar issues, and it seems a lot like a hardware issue, but I am not fully convinced.

[Awe7]

I purchased the n7 32g from a second-hand website, but there was a problem with the original motherboard. I am not sure if the EMMC is working properly. I replaced the 32g EMMC with my original 16g faulty host, which caused this issue. Please help me troubleshoot the issue

aaa@aaa:~/n7-32g/tegra30_debrick$ sudo ./fusee-launcher/fusee-launcher.py ./payload/uart_payload_n7.bin -P 7330
2025-02-01 08:54:43,459 INFO:usb.core:find(): using backend "usb.backend.libusb1"

Important note: on desktop Linux systems, we currently require an XHCI host controller.
A good way to ensure you're likely using an XHCI backend is to plug your
device into a blue 'USB 3' port.

Identified a Linux system; setting up the appropriate backend.
intermezzo_size: 0x00000078
target_payload_size: 0x000005ee
Found a Tegra with Device ID: b'0d1004ca09215d01'
Stack snapshot: b'0000000000000000100000003c9f0040'
EndpointStatus_stack_addr: 0x40009f3c
ProcessSetupPacket SP: 0x40009f30
InnerMemcpy LR stack addr: 0x40009f20
overwrite_len: 0x00004f20
overwrite_payload_off: 0x00004de0
payload_first_length: 0x000005ee
overwrite_payload_off: 0x00004de0
payload_second_length: 0x00000000
b'00a0004000300040ee05000000000000'
Setting rcm msg size to 0x00030064
RCM payload (len_insecure): b'64000300'

Setting ourselves up to smash the stack...
Payload offset of intermezzo: 0x00000074
overwrite_payload_off: 0x00004de0
overwrite_len: 0x00004f20
payload_overwrite_len: 0x00004e5c
overwrite_payload_off: 0x00004de0
smash_padding: 0x000047f2
overwrite_payload_off: 0x00004de0
Uploading payload...
txing 20480 bytes total
txing 4096 bytes (0 already sent) to buf[0] 0x40003000
txing 4096 bytes (4096 already sent) to buf[1] 0x40005000
txing 4096 bytes (8192 already sent) to buf[0] 0x40003000
txing 4096 bytes (12288 already sent) to buf[1] 0x40005000
txing 4096 bytes (16384 already sent) to buf[0] 0x40003000
Smashing the stack...
sending status request with length 0x00004f20
The USB device stopped responding-- sure smells like we've smashed its stack. :)
Launch complete!
aaa@aaa:~/n7-32g/tegra30_debrick$ sudo ./utils/nvflash_v1.13.87205_miniloader_patched --setbct --bct ./bct/nexus_7_grouper_bct.bin --configfile ./utils/flash.cfg --bl ./bootloader/bootloader-grouper-4.23.img --go
Nvflash v1.13.87205 started
chip uid from BR is: 0x0000000000000000015d2109ca04100d
rcm version 0X30001
System Information:
chip name: unknown
chip id: 0x30 major: 1 minor: 3
chip sku: 0x83
chip uid: 0x0000000000000000015d2109ca04100d
macrovision: disabled
hdcp: enabled
jtag: disabled
sbk burned: true
dk burned: true
boot device: emmc
operating mode: 3
device config strap: 1
device config fuse: 17
sdram config strap: 0

sending file: ./bct/nexus_7_grouper_bct.bin

• 6128/6128 bytes sent
  ./bct/nexus_7_grouper_bct.bin sent successfully
  downloading bootloader -- load address: 0x80108000 entry point: 0x80108000
  sending file: ./bootloader/bootloader-grouper-4.23.img
• 2150992/2150992 bytes sent
  ./bootloader/bootloader-grouper-4.23.img sent successfully
  waiting for bootloader to initialize
  bootloader downloaded successfully
  aaa@aaa:~/n7-32g/tegra30_debrick$ sudo ./utils/nvflash_v1.13.87205_miniloader_patched --resume --download EBT bootloader/bootloader-grouper-4.23.img --configfile ./utils/flash.cfg --sync
  Nvflash v1.13.87205 started
  [resume mode]

I waited for a minute and still have this interface