1

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

Maybe it's worth a try to flash it via fastboot or modify OTA package to write raw system partition image.

I have written my own rawprogram_nand_p4K_b256K_update.xml, but even using Qualcomm QFIL to flash it, I cannot mark and skip bad blocks.


2026-04-20 02:40:13.808    02:39:44: INFO: {<program> FILE: 'C:\Users\lxh\Desktop\edl\sec.img'}
2026-04-20 02:40:13.808    02:39:44: INFO: {<program> (1.00 MB) 256 sectors needed at location 52224 on LUN 0}
2026-04-20 02:40:13.809    02:39:44: INFO: =======================================================
2026-04-20 02:40:13.809    
2026-04-20 02:40:13.809    
2026-04-20 02:40:13.809    02:39:44: INFO: TARGET SAID: 'INFO: Calling handler for program start'
2026-04-20 02:40:13.809    
2026-04-20 02:40:13.813    02:39:44: INFO: TARGET SAID: 'INFO: NAND was previously open, returning existing handle 0
2026-04-20 02:40:13.815    '
2026-04-20 02:40:13.815    
2026-04-20 02:40:13.815    02:39:44: INFO: Overall to target  0.219 seconds (4.57 MBps)
2026-04-20 02:40:13.815    02:39:44: INFO: {percent files transferred  38.72%}
2026-04-20 02:40:13.815    02:39:44: INFO: 
2026-04-20 02:40:13.815    02:39:44: INFO: =======================================================
2026-04-20 02:40:13.815    02:39:44: INFO: ==================== {SUCCESS} ========================
2026-04-20 02:40:13.819    02:39:44: INFO: =======================================================
2026-04-20 02:40:13.819    
2026-04-20 02:40:13.820    
2026-04-20 02:40:13.820    02:39:44: INFO: {percent files transferred  38.72%}
2026-04-20 02:40:13.820    02:39:44: INFO: In handleProgram('oem.img')
2026-04-20 02:40:13.822    02:39:44: INFO: Looking for file 'oem.img'
2026-04-20 02:40:13.822    02:39:44: INFO: =======================================================
2026-04-20 02:40:13.824    02:39:44: INFO: {<program> FILE: 'C:\Users\lxh\Desktop\edl\oem.img'}
2026-04-20 02:40:13.825    02:39:44: INFO: {<program> (43.00 MB) 11008 sectors needed at location 52480 on LUN 0}
2026-04-20 02:40:13.826    02:39:44: INFO: =======================================================
2026-04-20 02:40:13.826    
2026-04-20 02:40:13.826    
2026-04-20 02:40:13.826    02:39:44: INFO: TARGET SAID: 'INFO: Calling handler for program start'
2026-04-20 02:40:13.826    
2026-04-20 02:40:13.826    02:39:44: INFO: TARGET SAID: 'INFO: NAND was previously open, returning existing handle 0
2026-04-20 02:40:13.826    '
2026-04-20 02:40:13.830    
2026-04-20 02:40:13.830    02:39:46: INFO: Overall to target  2.000 seconds (4.14 MBps)
2026-04-20 02:40:13.830    02:39:46: INFO: {percent files transferred  40.38%}
2026-04-20 02:40:13.831    02:39:48: INFO: Overall to target  4.000 seconds (4.05 MBps)
2026-04-20 02:40:13.831    02:39:48: INFO: {percent files transferred  41.96%}
2026-04-20 02:40:13.831    02:39:50: INFO: Overall to target  6.000 seconds (3.97 MBps)
2026-04-20 02:40:13.831    02:39:50: INFO: {percent files transferred  43.48%}
2026-04-20 02:40:13.836    02:39:52: INFO: Overall to target  8.000 seconds (3.89 MBps)
2026-04-20 02:40:13.836    02:39:52: INFO: {percent files transferred  44.94%}
2026-04-20 02:40:13.837    02:39:54: INFO: Overall to target 10.000 seconds (3.82 MBps)
2026-04-20 02:40:13.838    02:39:54: INFO: {percent files transferred  46.34%}
2026-04-20 02:40:13.838    02:39:55: INFO: Overall to target 11.406 seconds (3.77 MBps)
2026-04-20 02:40:13.841    02:39:55: INFO: {percent files transferred  47.31%}
2026-04-20 02:40:13.841    02:39:55: INFO: 
2026-04-20 02:40:13.842    02:39:55: INFO: =======================================================
2026-04-20 02:40:13.842    02:39:55: INFO: ==================== {SUCCESS} ========================
2026-04-20 02:40:13.842    02:39:55: INFO: =======================================================
2026-04-20 02:40:13.842    
2026-04-20 02:40:13.842    
2026-04-20 02:40:13.842    02:39:55: INFO: {percent files transferred  47.31%}
2026-04-20 02:40:13.846    02:39:55: INFO: In handleProgram('system.img')
2026-04-20 02:40:13.847    02:39:55: INFO: Looking for file 'system.img'
2026-04-20 02:40:13.848    02:39:55: INFO: =======================================================
2026-04-20 02:40:13.848    02:39:55: INFO: {<program> FILE: 'C:\Users\lxh\Desktop\edl\system.img'}
2026-04-20 02:40:13.848    02:39:55: INFO: {<program> (264.00 MB) 67584 sectors needed at location 63488 on LUN 0}
2026-04-20 02:40:13.848    02:39:55: INFO: =======================================================
2026-04-20 02:40:13.848    
2026-04-20 02:40:13.848    
2026-04-20 02:40:13.850    02:39:55: INFO: TARGET SAID: 'INFO: Calling handler for program start'
2026-04-20 02:40:13.852    
2026-04-20 02:40:13.852    02:39:55: INFO: TARGET SAID: 'INFO: NAND was previously open, returning existing handle 0
2026-04-20 02:40:13.853    '
2026-04-20 02:40:13.853    
2026-04-20 02:40:13.854    02:39:57: INFO: Overall to target  2.000 seconds (4.17 MBps)
2026-04-20 02:40:13.854    02:39:57: INFO: {percent files transferred  48.97%}
2026-04-20 02:40:13.854    02:39:59: INFO: Overall to target  4.000 seconds (4.07 MBps)
2026-04-20 02:40:13.858    02:39:59: INFO: {percent files transferred  50.55%}
2026-04-20 02:40:13.859    02:40:01: INFO: Overall to target  6.000 seconds (3.98 MBps)
2026-04-20 02:40:13.859    02:40:01: INFO: {percent files transferred  52.07%}
2026-04-20 02:40:13.859    02:40:03: INFO: Overall to target  8.000 seconds (3.89 MBps)
2026-04-20 02:40:13.859    02:40:03: INFO: {percent files transferred  53.52%}
2026-04-20 02:40:13.863    02:40:05: INFO: Overall to target 10.000 seconds (3.82 MBps)
2026-04-20 02:40:13.863    02:40:05: INFO: {percent files transferred  54.93%}
2026-04-20 02:40:13.864    02:40:07: INFO: Overall to target 12.000 seconds (3.75 MBps)
2026-04-20 02:40:13.864    02:40:07: INFO: {percent files transferred  56.30%}
2026-04-20 02:40:13.864    02:40:09: INFO: Overall to target 14.000 seconds (3.69 MBps)
2026-04-20 02:40:13.864    02:40:09: INFO: {percent files transferred  57.61%}
2026-04-20 02:40:13.869    02:40:11: INFO: Overall to target 16.000 seconds (3.63 MBps)
2026-04-20 02:40:13.870    02:40:11: INFO: {percent files transferred  58.89%}
2026-04-20 02:41:25.806    02:40:13: INFO: Overall to target 18.000 seconds (3.57 MBps)
2026-04-20 02:41:25.806    02:40:13: INFO: {percent files transferred  60.13%}
2026-04-20 02:41:25.806    02:40:15: INFO: Overall to target 20.000 seconds (3.51 MBps)
2026-04-20 02:41:25.806    02:40:15: INFO: {percent files transferred  61.34%}
2026-04-20 02:41:25.811    02:40:17: INFO: Overall to target 22.000 seconds (3.46 MBps)
2026-04-20 02:41:25.812    02:40:17: INFO: {percent files transferred  62.51%}
2026-04-20 02:41:25.812    02:40:19: INFO: Overall to target 24.000 seconds (3.41 MBps)
2026-04-20 02:41:25.814    02:40:19: INFO: {percent files transferred  63.65%}
2026-04-20 02:41:25.814    02:40:21: INFO: Overall to target 26.000 seconds (3.37 MBps)
2026-04-20 02:41:25.816    02:40:21: INFO: {percent files transferred  64.77%}
2026-04-20 02:41:25.817    02:40:23: INFO: Overall to target 28.000 seconds (3.32 MBps)
2026-04-20 02:41:25.817    02:40:23: INFO: {percent files transferred  65.86%}
2026-04-20 02:41:25.817    02:40:25: INFO: Overall to target 30.000 seconds (3.28 MBps)
2026-04-20 02:41:25.817    02:40:25: INFO: {percent files transferred  66.93%}
2026-04-20 02:41:25.821    02:40:27: INFO: Overall to target 32.000 seconds (3.24 MBps)
2026-04-20 02:41:25.823    02:40:27: INFO: {percent files transferred  67.98%}
2026-04-20 02:41:25.823    02:40:29: INFO: Overall to target 34.000 seconds (3.20 MBps)
2026-04-20 02:41:25.823    02:40:29: INFO: {percent files transferred  69.01%}
2026-04-20 02:41:25.823    02:40:31: INFO: Overall to target 36.000 seconds (3.16 MBps)
2026-04-20 02:41:25.827    02:40:31: INFO: {percent files transferred  70.02%}
2026-04-20 02:41:25.827    02:40:33: INFO: Overall to target 38.000 seconds (3.13 MBps)
2026-04-20 02:41:25.830    02:40:33: INFO: {percent files transferred  71.01%}
2026-04-20 02:41:25.830    02:40:35: INFO: Overall to target 40.000 seconds (3.09 MBps)
2026-04-20 02:41:25.832    02:40:35: INFO: {percent files transferred  71.99%}
2026-04-20 02:41:25.833    02:40:37: INFO: Overall to target 42.000 seconds (3.06 MBps)
2026-04-20 02:41:25.833    02:40:37: INFO: {percent files transferred  72.95%}
2026-04-20 02:41:25.834    02:40:39: INFO: Overall to target 44.000 seconds (3.03 MBps)
2026-04-20 02:41:25.834    02:40:39: INFO: {percent files transferred  73.90%}
2026-04-20 02:41:25.834    02:40:41: INFO: Overall to target 46.000 seconds (3.00 MBps)
2026-04-20 02:41:25.838    02:40:41: INFO: {percent files transferred  74.84%}
2026-04-20 02:41:25.838    02:40:43: INFO: Overall to target 48.000 seconds (2.97 MBps)
2026-04-20 02:41:25.839    02:40:43: INFO: {percent files transferred  75.76%}
2026-04-20 02:41:25.839    02:40:45: INFO: Overall to target 50.000 seconds (2.94 MBps)
2026-04-20 02:41:25.839    02:40:45: INFO: {percent files transferred  76.66%}
2026-04-20 02:41:25.839    02:40:47: INFO: Overall to target 52.000 seconds (2.91 MBps)
2026-04-20 02:41:25.844    02:40:47: INFO: {percent files transferred  77.54%}
2026-04-20 02:41:25.845    02:40:49: INFO: Overall to target 54.000 seconds (2.89 MBps)
2026-04-20 02:41:25.846    02:40:49: INFO: {percent files transferred  78.42%}
2026-04-20 02:41:25.846    02:40:51: INFO: Overall to target 56.000 seconds (2.86 MBps)
2026-04-20 02:41:25.846    02:40:51: INFO: {percent files transferred  79.29%}
2026-04-20 02:41:25.849    02:40:53: INFO: Overall to target 58.000 seconds (2.84 MBps)
2026-04-20 02:41:25.849    02:40:53: INFO: {percent files transferred  80.14%}
2026-04-20 02:41:25.850    02:40:55: INFO: Overall to target 60.000 seconds (2.81 MBps)
2026-04-20 02:41:25.850    02:40:55: INFO: {percent files transferred  80.98%}
2026-04-20 02:41:25.850    02:40:57: INFO: Overall to target 62.000 seconds (2.79 MBps)
2026-04-20 02:41:25.850    02:40:57: INFO: {percent files transferred  81.81%}
2026-04-20 02:41:25.855    02:40:59: INFO: Overall to target 64.000 seconds (2.77 MBps)
2026-04-20 02:41:25.856    02:40:59: INFO: {percent files transferred  82.63%}
2026-04-20 02:41:25.856    02:41:01: INFO: Overall to target 66.000 seconds (2.74 MBps)
2026-04-20 02:41:25.856    02:41:01: INFO: {percent files transferred  83.44%}
2026-04-20 02:41:25.856    02:41:03: INFO: Overall to target 68.000 seconds (2.72 MBps)
2026-04-20 02:41:25.860    02:41:03: INFO: {percent files transferred  84.25%}
2026-04-20 02:41:25.860    02:41:05: INFO: Overall to target 70.000 seconds (2.70 MBps)
2026-04-20 02:41:25.861    02:41:05: INFO: {percent files transferred  85.04%}
2026-04-20 02:41:25.861    02:41:07: INFO: Overall to target 72.000 seconds (2.68 MBps)
2026-04-20 02:41:25.861    02:41:07: INFO: {percent files transferred  85.83%}
2026-04-20 02:41:25.865    02:41:09: INFO: Overall to target 74.000 seconds (2.66 MBps)
2026-04-20 02:41:25.866    02:41:09: INFO: {percent files transferred  86.61%}
2026-04-20 02:41:25.867    02:41:11: INFO: Overall to target 76.000 seconds (2.64 MBps)
2026-04-20 02:41:25.867    02:41:11: INFO: {percent files transferred  87.38%}
2026-04-20 02:41:25.867    02:41:13: INFO: Overall to target 78.000 seconds (2.62 MBps)
2026-04-20 02:41:25.867    02:41:13: INFO: {percent files transferred  88.15%}
2026-04-20 02:41:25.871    02:41:15: INFO: Overall to target 80.000 seconds (2.61 MBps)
2026-04-20 02:41:25.871    02:41:15: INFO: {percent files transferred  88.90%}
2026-04-20 02:41:25.872    02:41:17: INFO: Overall to target 82.000 seconds (2.59 MBps)
2026-04-20 02:41:25.872    02:41:17: INFO: {percent files transferred  89.65%}
2026-04-20 02:41:25.872    02:41:19: INFO: Overall to target 84.000 seconds (2.57 MBps)
2026-04-20 02:41:25.872    02:41:19: INFO: {percent files transferred  90.39%}
2026-04-20 02:41:25.877    02:41:21: INFO: Overall to target 86.000 seconds (2.55 MBps)
2026-04-20 02:41:25.878    02:41:21: INFO: {percent files transferred  91.12%}
2026-04-20 02:41:25.878    02:41:23: INFO: Overall to target 88.000 seconds (2.54 MBps)
2026-04-20 02:41:25.878    02:41:23: INFO: {percent files transferred  91.85%}
2026-04-20 02:41:25.878    02:41:25: INFO: Overall to target 90.000 seconds (2.52 MBps)
2026-04-20 02:41:47.186    02:41:25: INFO: {percent files transferred  92.57%}
2026-04-20 02:41:47.186    02:41:27: INFO: Overall to target 92.000 seconds (2.50 MBps)
2026-04-20 02:41:47.187    02:41:27: INFO: {percent files transferred  93.28%}
2026-04-20 02:41:47.187    02:41:29: INFO: Overall to target 94.000 seconds (2.49 MBps)
2026-04-20 02:41:47.192    02:41:29: INFO: {percent files transferred  93.99%}
2026-04-20 02:41:47.193    02:41:31: INFO: Overall to target 96.000 seconds (2.47 MBps)
2026-04-20 02:41:47.193    02:41:31: INFO: {percent files transferred  94.69%}
2026-04-20 02:41:47.194    02:41:33: INFO: Overall to target 98.000 seconds (2.46 MBps)
2026-04-20 02:41:47.194    02:41:33: INFO: {percent files transferred  95.38%}
2026-04-20 02:41:47.197    02:41:35: INFO: Overall to target 100.000 seconds (2.44 MBps)
2026-04-20 02:41:47.197    02:41:35: INFO: {percent files transferred  96.07%}
2026-04-20 02:41:47.198    02:41:37: INFO: Overall to target 102.000 seconds (2.43 MBps)
2026-04-20 02:41:47.198    02:41:37: INFO: {percent files transferred  96.75%}
2026-04-20 02:41:47.198    02:41:39: INFO: Overall to target 104.000 seconds (2.41 MBps)
2026-04-20 02:41:47.198    02:41:39: INFO: {percent files transferred  97.43%}
2026-04-20 02:41:47.198    02:41:41: INFO: Overall to target 106.000 seconds (2.40 MBps)
2026-04-20 02:41:47.203    02:41:41: INFO: {percent files transferred  98.10%}
2026-04-20 02:41:47.204    02:41:43: INFO: Overall to target 108.000 seconds (2.39 MBps)
2026-04-20 02:41:47.204    02:41:43: INFO: {percent files transferred  98.77%}
2026-04-20 02:41:47.204    02:41:45: INFO: Overall to target 110.000 seconds (2.37 MBps)
2026-04-20 02:41:47.204    02:41:45: INFO: {percent files transferred  99.43%}
2026-04-20 02:41:47.204    02:41:47: INFO: Overall to target 111.344 seconds (2.37 MBps)
2026-04-20 02:41:47.208    02:41:47: INFO: {percent files transferred 100.00%}
2026-04-20 02:41:47.209    
2026-04-20 02:41:47.209    02:41:47: INFO: TARGET SAID: 'INFO: [426] out of good blocks, total blocks:7ff Gblocks:7fd lba:1482c375
2026-04-20 02:41:47.209    '
2026-04-20 02:41:47.213    
2026-04-20 02:41:47.214    02:41:47: INFO: TARGET SAID: 'ERROR: [1238] error : 9 
2026-04-20 02:41:47.215    '
2026-04-20 02:41:47.215    
2026-04-20 02:41:47.215    02:41:47: INFO: TARGET SAID: 'ERROR: Write Failed sector 130880, size 0 result 2'
2026-04-20 02:41:47.215    
2026-04-20 02:41:47.215    
2026-04-20 02:41:47.215         _____                    
2026-04-20 02:41:47.215        |  ___|                   
2026-04-20 02:41:47.219        | |__ _ __ _ __ ___  _ __ 
2026-04-20 02:41:47.219        |  __| '__| '__/ _ \| '__|
2026-04-20 02:41:47.219        | |__| |  | | | (_) | |   
2026-04-20 02:41:47.220        \____/_|  |_|  \___/|_|  
2026-04-20 02:41:47.220    
2026-04-20 02:41:47.220    
2026-04-20 02:41:47.220    02:41:47: {ERROR: Please see log}
2026-04-20 02:41:47.220    
2026-04-20 02:41:47.220    Writing log to 'C:\Users\lxh\AppData\Roaming\Qualcomm\QFIL\COMPORT_10\port_trace.txt', might take a minute
2026-04-20 02:41:47.224    
2026-04-20 02:41:47.225    
2026-04-20 02:41:47.226    Log is 'C:\Users\lxh\AppData\Roaming\Qualcomm\QFIL\COMPORT_10\port_trace.txt'
2026-04-20 02:41:47.226    
2026-04-20 02:41:47.226    Download Fail:FireHose Fail:FHLoader Fail:Process fail
2026-04-20 02:41:47.226    Finish Download

2

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

Maybe it's worth a try to flash it via fastboot or modify OTA package to write raw system partition image.



I tested with fastboot, but the image sizes are inconsistent, so I cannot use this backup to flash. I also tested the OTA incremental package with recovery, and it didn't work either.

3

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

I tried to recreate UBI image for system partition.

Description of the process:
1. Make mtd25 partition backup with script from OpenWRT Wiki: https://openwrt.org/docs/guide-user/ins … ric.backup
2. Make ubi0_1 to ubi1_4 backup with the same script, slightly modified.
3. On modem, mount rootfs to a separate dir:

mkdir -p /tmp/rootfs ; mount -o ro /dev/ubi0_0 /tmp/rootfs

4. On PC, use ubireader_utils_info to get ubi creation parameters.
5. Run mkfs.ubifs on modem with parameters discovered by ubireader, then transfer it to PC:

mkfs.ubifs -m 4096 -e 253952 -c 2146 -x lzo -f 8 -k r5 -p 1 -l 4 -r /tmp/rootfs -o /tmp/ubi0_0.ubifs

6. Create ubi image with re-created ubi0_0 and remaining partitions directly from binary backup:

ubinize -p 262144 -m 4096 -O 4096 -s 4096 -x 1 -Q 783098594 -o img-783098594.ubi img-783098594.ini

Result: https://fromsmash.com/u0fDPpGa_X-dt (MD5 7f38237a42a21a610a8f35f40b244842)


Thank you very much for your help. I tested so many images and the problem is the same: the EDL tool cannot skip bad blocks on the NAND when flashing, so after flashing the firmware, the bad blocks remain in the usrfs partition, causing the UBI reconstruction to fail repeatedly.

4

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

I think that you need an UBIFS image that can be extracted by ubireader on the PC, then it can be flashed to a unit.

Panowie, czy ktoś z Was mógłby wykonać obraz partycji systemowej ze swojego modemu? Polecenie do odpalenia na PC (bo w tmpfs na modemie się nie zmieści):

ssh root@192.168.225.1 "dd if=/dev/ubi0_0" | gzip -9 - | dd of=rootfs.ubifs.gz

Is there a problem with the original backup mtd25_system.backup? The sizes of the usrfs, cachefs, and persist partitions inside it do not match the UBI configuration file.

[rootfs]
mode = ubi
image = img-783098594_vol-rootfs.ubifs
vol_type = dynamic
vol_id = 0
vol_name = rootfs
vol_alignment = 1
vol_size = 115548160

[usrfs]
mode = ubi
image = img-783098594_vol-usrfs.ubifs
vol_type = dynamic
vol_id = 1
vol_name = usrfs
vol_alignment = 1
vol_size = 113008640

[cachefs]
mode = ubi
image = img-783098594_vol-cachefs.ubifs
vol_type = dynamic
vol_id = 2
vol_name = cachefs
vol_alignment = 1
vol_size = 15745024

[systemrw]
mode = ubi
image = img-783098594_vol-systemrw.ubifs
vol_type = dynamic
vol_id = 3
vol_name = systemrw
vol_alignment = 1
vol_size = 6348800

[persist]
mode = ubi
image = img-783098594_vol-persist.ubifs
vol_type = dynamic
vol_id = 4
vol_name = persist
vol_alignment = 1
vol_size = 6348800

-rw-rw-r-- 1 x   4317184 Apr 17 21:18 img-783098594_vol-cachefs.ubifs
-rw-rw-r-- 1 x   3809280 Apr 17 21:18 img-783098594_vol-persist.ubifs
-rw-rw-r-- 1 x 115548160 Apr 17 21:18 img-783098594_vol-rootfs.ubifs
-rw-rw-r-- 1 x   6348800 Apr 17 21:18 img-783098594_vol-systemrw.ubifs
-rw-rw-r-- 1 x 103612416 Apr 17 21:18 img-783098594_vol-usrfs.ubifs

5

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

I think that you need an UBIFS image that can be extracted by ubireader on the PC, then it can be flashed to a unit.

Panowie, czy ktoś z Was mógłby wykonać obraz partycji systemowej ze swojego modemu? Polecenie do odpalenia na PC (bo w tmpfs na modemie się nie zmieści):

ssh root@192.168.225.1 "dd if=/dev/ubi0_0" | gzip -9 - | dd of=rootfs.ubifs.gz

What is the reason for this? This is the backup you helped me make at the very beginning.


~/Desktop/1$ ubireader_extract_files -w mtd25_system.backup
Extracting files to: ubifs-root/783098594/rootfs
index Error: LEB: 65 at 149595160, Node size smaller than expected.
index Error: LEB: 12 at 103133288, Node size smaller than expected.
index Error: LEB: 64 at 105473344, Node size smaller than expected.
index Error: LEB: 32 at 128631552, Node size smaller than expected.
index Error: LEB: 12 at 103132760, Node size smaller than expected.
index Error: LEB: 58 at 204650192, Node size smaller than expected.
index Error: LEB: 12 at 103144024, Node size smaller than expected.
index Error: LEB: 21 at 183156888, Node size smaller than expected.
index Error: LEB: 64 at 105473872, Node size smaller than expected.
index Error: LEB: 18 at 127820600, Node size smaller than expected.
index Error: LEB: 18 at 127796456, Node size smaller than expected.
index Error: LEB: 18 at 127872016, Node size smaller than expected.
index Error: LEB: 12 at 103144552, Node size smaller than expected.
index Error: LEB: 56 at 184365816, Node size smaller than expected.
index Error: LEB: 61 at 106214136, Node size smaller than expected.
index Error: LEB: 13 at 23208328, Node size smaller than expected.
index Error: LEB: 65 at 149594808, Node size smaller than expected.
index Error: LEB: 64 at 105517896, Node size smaller than expected.
index Error: LEB: 18 at 127795392, Node size smaller than expected.
index Error: LEB: 18 at 127816392, Node size smaller than expected.
read Error: LEB: 19 is corrupted or has no data.
extract_files Error: Bad Read Offset Request
Extracting files to: ubifs-root/783098594/usrfs
read Error: LEB: 252 is corrupted or has no data.
extract_files Error: Bad Read Offset Request
Extracting files to: ubifs-root/783098594/cachefs
read Error: LEB: 14 is corrupted or has no data.
extract_files Error: Bad Read Offset Request
Extracting files to: ubifs-root/783098594/systemrw
index Error: LEB: 20 at 16437504, Node size smaller than expected.
read Error: LEB: 17 is corrupted or has no data.
extract_files Error: Bad Read Offset Request
Extracting files to: ubifs-root/783098594/persist
read Error: LEB: 16 is corrupted or has no data.
extract_files Error: Bad Read Offset Request
changliuxian@changliuxian-virtual-machine:~/Desktop/1$

6

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

If you want to try one last thing, here's an UBI image that you can flash to /system that I created by backing up /dev/ubi0_* and recreating ubi image with header data extracted from raw partition image. This image can be extracted by ubi_reader except for rootfs, but I keep my fingers crossed that it works for you:
https://1drv.ms/u/c/6a12b36da65724ae/IQ … 4?e=cggZ6D

If it works, my recommendation is to apply latest OTA from Tricascade to make sure you're running the latest kernel and recovery - my previous backup had a previous version flashed. You'll see the latest version in GUI before flashing but you need to apply the OTA again nonetheless.


Thank you very much, but the situation remains the same. EDL might not be able to detect ECC errors or skip bad blocks when flashing UBI; the original firmware package is required. I give up.

7

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

Can you try this image, it was created with nandump:
https://1drv.ms/u/c/6a12b36da65724ae/IQ … U?e=noFGbY



Thank you so much for all your help over this long time. I've flashed it and the result is still the same, so I'm giving up. Thank you.

8

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

Okay, so we found the cause: you need a clean UBI image to flash to your /system partiton, not a raw NAND image created with DD.

I think the UBI image I created is not entirely correct. One way to go would be to use my "original" backup, use nandsim to emulate it, then ubireader to dump UBI images and recreate UBI.

Maybe if I used another way to make a system image would allow you to flash the image correctly.


Yes, I also created several using ubinize, but still couldn't skip those two bad blocks, resulting in the hardware being recognized only on the first boot and failing on the second. Therefore, the firmware originally backed up from the NAND cannot be used.

9

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

I have made a new backup of my device. Next, I have extracted UBI images from system partiton with ubireader, and created the system.ubi with ubinize, using information provided by ubinfo.

But it's probably not entirely correct, as I haven't used nandsim to rebuild it.

You can try flashing this image if you'd like, it's smaller...
https://1drv.ms/u/c/6a12b36da65724ae/IQ … U?e=4Ss4LB


Core Error Summary
ubi0 error: ubi_io_read: error -74 (ECC error)
ECC error = NAND Flash hardware read verification failure
Indicates the flash chip itself has bad blocks, power loss corruption, or hardware contact / power instability issues

UBIFS error: bad CRC
File system node checksum mismatch
Corresponds to the ECC error above, caused by physical flash damage leading to data corruption

Repeated retries all fail
Continuously reading the same location: PEB 657, LEB 197
This is a fixed bad block error, not an intermittent fault.

Why doesn't it automatically skip bad blocks? This causes the usrfs partition to report errors.

10

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

I have made a new backup of my device. Next, I have extracted UBI images from system partiton with ubireader, and created the system.ubi with ubinize, using information provided by ubinfo.

But it's probably not entirely correct, as I haven't used nandsim to rebuild it.

You can try flashing this image if you'd like, it's smaller...
https://1drv.ms/u/c/6a12b36da65724ae/IQ … U?e=4Ss4LB


I used EDL to flash the UBI image you created with ubinize, and again, I can only see the 9165 device on the first boot; on the second boot, the device is no longer visible.

11

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

Okay, I was able to boot my modem info fastboot but no oem commands are available.

When your device has damaged /system partition, it should boot to recovery, correct? Can you write the system partition image to mtd25 then?

How do you boot your device into EDL mode? I mean I can't do that with my device.

What output do you see from "edl printgpt"?

I'll try writing to mtd25 to see if it works. I used a multimeter to figure out the 9008 shorting points. This is the output of edl printgpt.

The output of fastboot getvar all shows partition-type:system:ext4 and partition-size:system: 0xF800000.


edl$ edl printgpt
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2025.
main - Trying with no loader given ...
main - Waiting for the device
main - Device detected :)
main - Mode detected: firehose
firehose
firehose - [LIB]: INFO: Calling handler for configure
firehose
firehose - [LIB]: INFO: Storage type set to value UFS
firehose
firehose - [LIB]: WARN: NAK: MaxPayloadSizeToTargetInBytes sent by host 1048576 larger than supported 0
Progress: |██████████| 100.0% Scanning (Sector 0x400 of 0x400, ) 0.00 MB/s    

Parsing Lun 0:
Name                Offset        Length        Attr            Flash
-------------------------------------------------------------
sbl                 00000000    00280000    0xff/0x1/0x0    0
mibib               00280000    00280000    0xff/0x1/0xff    0
efs2                00500000    00B00000    0xff/0x1/0xff    0
tz                  01000000    001C0000    0xff/0x1/0x0    0
tz_devcfg           011C0000    00100000    0xff/0x1/0x0    0
ddr                 012C0000    00180000    0xff/0x1/0xff    0
apdp                01440000    00100000    0xff/0x1/0x0    0
xbl_config          01540000    00100000    0xff/0x1/0x0    0
multi_image         01640000    00100000    0xff/0x1/0x0    0
aop                 01740000    00100000    0xff/0x1/0x0    0
qhee                01840000    00100000    0xff/0x1/0x0    0
abl                 01940000    00100000    0xff/0x1/0x0    0
uefi                01A40000    00280000    0xff/0x1/0x0    0
toolsfv             01CC0000    00180000    0xff/0x1/0x0    0
loader_sti          01E40000    00180000    0xff/0x1/0x0    0
boot                01FC0000    00D00000    0xff/0x1/0x0    0
scrub               02CC0000    00100000    0xff/0x1/0x0    0
modem               02DC0000    06B40000    0xff/0x1/0x0    0
misc                09900000    001C0000    0xff/0x1/0x0    0
devinfo             09AC0000    00180000    0xff/0x1/0x0    0
recovery            09C40000    00D00000    0xff/0x1/0x0    0
fota                0A940000    001C0000    0xff/0x1/0x0    0
recoveryfs          0AB00000    02100000    0xff/0x1/0x0    0
sec                 0CC00000    00100000    0xff/0x1/0x0    0
oem                 0CD00000    02B00000    0xff/0x1/0x0    0
system              0F800000    10800000    0xff/0x1/0x0    0
C:\platform-tools>fastboot getvar all
(bootloader) parallel-download-flash:yes
(bootloader) hw-revision:20000
(bootloader) unlocked:yes
(bootloader) off-mode-charge:0
(bootloader) charger-screen-enabled:0
(bootloader) battery-soc-ok:yes
(bootloader) battery-voltage:0
(bootloader) version-baseband:
(bootloader) version-bootloader:
(bootloader) erase-block-size: 0x40000
(bootloader) logical-block-size: 0x1000
(bootloader) variant:SDX NAND
(bootloader) partition-type:system:ext4
(bootloader) partition-size:system: 0xF800000
(bootloader) partition-type:oem:raw
(bootloader) partition-size:oem: 0x2800000
(bootloader) partition-type:sec:raw
(bootloader) partition-size:sec: 0x80000
(bootloader) partition-type:recoveryfs:raw
(bootloader) partition-size:recoveryfs: 0x1EC0000
(bootloader) partition-type:fota:raw
(bootloader) partition-size:fota: 0x140000
(bootloader) partition-type:recovery:raw
(bootloader) partition-size:recovery: 0xBC0000
(bootloader) partition-type:devinfo:raw
(bootloader) partition-size:devinfo: 0x100000
(bootloader) partition-type:misc:raw
(bootloader) partition-size:misc: 0x140000
(bootloader) partition-type:modem:raw
(bootloader) partition-size:modem: 0x6480000
(bootloader) partition-type:scrub:raw
(bootloader) partition-size:scrub: 0x80000
(bootloader) partition-type:boot:raw
(bootloader) partition-size:boot: 0xBC0000
(bootloader) partition-type:loader_sti:raw
(bootloader) partition-size:loader_sti: 0x100000
(bootloader) partition-type:toolsfv:raw
(bootloader) partition-size:toolsfv: 0x100000
(bootloader) partition-type:uefi:raw
(bootloader) partition-size:uefi: 0x200000
(bootloader) partition-type:abl:raw
(bootloader) partition-size:abl: 0x80000
(bootloader) partition-type:qhee:raw
(bootloader) partition-size:qhee: 0x80000
(bootloader) partition-type:aop:raw
(bootloader) partition-size:aop: 0x80000
(bootloader) partition-type:multi_image:raw
(bootloader) partition-size:multi_image: 0x80000
(bootloader) partition-type:xbl_config:raw
(bootloader) partition-size:xbl_config: 0x80000
(bootloader) partition-type:apdp:raw
(bootloader) partition-size:apdp: 0x80000
(bootloader) partition-type:ddr:raw
(bootloader) partition-size:ddr: 0x100000
(bootloader) partition-type:tz_devcfg:raw
(bootloader) partition-size:tz_devcfg: 0x80000
(bootloader) partition-type:tz:raw
(bootloader) partition-size:tz: 0x140000
(bootloader) partition-type:efs2:raw
(bootloader) partition-size:efs2: 0xA00000
(bootloader) partition-type:mibib:raw
(bootloader) partition-size:mibib: 0x200000
(bootloader) partition-type:sbl:raw
(bootloader) partition-size:sbl: 0x200000
(bootloader) secure:no
(bootloader) serialno:e433f729
(bootloader) product:
(bootloader) max-download-size:201326592
(bootloader) kernel:uefi
all:
Finished. Total time: 0.200s

C:\platform-tools>

12

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

Is there any OEM command that you can use to debug it?

fastboot oem help


No documentation was found, and the firmware package is only an OTA incremental package. There is no complete firmware package.

13

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

Try fastboot erase system before writing?


Fastboot still can only send 127964 KB of data.

C:\platform-tools>fastboot devices
e433f729         fastboot

C:\platform-tools>fastboot oem device-info
(bootloader) Verity mode: true
(bootloader) Device unlocked: true
(bootloader) Device critical unlocked: true
(bootloader) Charger screen enabled: false
OKAY [  0.009s]
Finished. Total time: 0.011s

C:\platform-tools>fastboot erase system
******** Did you mean to fastboot format this ext4 partition?
Erasing 'system'                                   OKAY [  1.062s]
Finished. Total time: 1.073s

C:\platform-tools>fastboot flash system mtd25_system.backup
Sending sparse 'system' 1/1 (127964 KB)            OKAY [  3.077s]
Writing 'system'                                   OKAY [  0.001s]
Finished. Total time: 3.858s

C:\platform-tools>

14

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

It looks like your second try worked.

Still failed, only 127964 KB of data was written.

15

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

Let me highlight one fact again: I have zero knowledge about EDL and flashing the modem, I have never done this and I am simply trying to guide you towards a possible solution.

If I were you, I would follow the guide from GitHub for a different X55-based modem:
https://github.com/1alessandro1/T99W175_Recovery

I assume that you have all partitions flashed except for system.

I would try to make the modem boot into fastboot, then flash system (and anything else that you might have erased) in fastboot mode.

I tested it according to the tutorial, but fastboot doesn't work either.

edl$ fastboot  flash system mtd25_system.backup
Warning: skip copying system image avb footer (system partition size: 260046848, system image size: 140724464235144).
Sending sparse 'system' 1/1 (127964 KB)            FAILED (remote: 'Error: Last flash failed : Volume Full')
fastboot: error: Command failed
edl$ fastboot -S 256M flash system mtd25_system.backup
Warning: skip copying system image avb footer (system partition size: 260046848, system image size: 140726402511784).
Sending sparse 'system' 1/1 (127964 KB)            OKAY [  3.172s]
Writing 'system'                                   OKAY [  0.000s]
Finished. Total time: 3.938s

16

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

What is the size of the file if you make a backup of system partition with EDL? You can see that most bytes at the end of my backup file are "FF", so you can try to cut the bytes out from the ending and flash it.

You can also try using different loader:
https://github.com/bkerler/Loaders/tree … 72/quectel
or a loader from this guide:
https://github.com/1alessandro1/T99W175_Recovery


edl$ ls -l mtd25_system.backup
-rwxr-xr-x 1 lxh lxh 276824064    7 01:43 mtd25_system.backu
rxmg1$ ls -l system.bin
-rw-rw-r-- 1 lxh lxh 276824064    20:14 system.bin

The partition sizes are consistent. Does the compatibility between firehose and EDL have something to do with NAND? I used the first EDL you recommended. I tried deleting a bit of the trailing 'FF' bytes using WinHex as you suggested, but flashing still doesn't work. The system partition I backed up myself can no longer be flashed back either. I can only go into 9008 or 900e mode now.

17

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

I don't know how to put this device in EDL mode.

If I make the backup over SSH, the image content is always the same and the same size:

dd if=/dev/mtd27ro bs=4096
dd if=/dev/mtd27 bs=4096
dd if=/dev/mtd27ro

If you look at /proc/mtd, it clearly says that /system size is 0x10800000, that is 276 824 964 bytes.

When I run `ubireader_display_info` on your backup of system parition, I get this warning:

UBI_File Warning: end_offset - start_offset length is not block aligned, could mean missing data.

Your backup is missing data for cachefs, persist, systemrw and usrfs. Also, some data from rootfs is missing.

Only the last partition gives an error when flashing. Truncating part of it doesn't work, and flashing in chunks doesn't work either. I really don't know how to solve it.

/edl$ edl w system mtd25_system.backup \
  --memory=NAND \
  --sectorsize=4096 \
  --pagesperblock=64
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2025.
main - Trying with no loader given ...
main - Waiting for the device
main - Device detected :)
sahara - Protocol version: 2, Version supported: 1
main - Mode detected: sahara
sahara - 
Version 0x2
------------------------
HWID:              0x000cf0e100000000 (MSM_ID:0x000cf0e1,OEM_ID:0x0000,MODEL_ID:0x0000)
CPU detected:      "SDX55M:CD90-PH809"
PK_HASH:           0xd40eee56f3194665574109a39267724ae7944134cd53cb767e293d3c40497955bc8a4519ff992b031fadc6355015ac87000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Serial:            0xe433f729

sahara - Possibly unfused device detected, so any loader should be fine...
sahara - Possible loader available: /usr/local/lib/python3.12/dist-packages/edlclient/../Loaders/qualcomm/model_generic/sdx55/000cf0e100000000_d9357db88795b5a8_fhprg_quectel_em20_rg502.bin
sahara - Trying loader: /usr/local/lib/python3.12/dist-packages/edlclient/../Loaders/qualcomm/model_generic/sdx55/000cf0e100000000_d9357db88795b5a8_fhprg_quectel_em20_rg502.bin
sahara - Protocol version: 2, Version supported: 1
sahara - Uploading loader /usr/local/lib/python3.12/dist-packages/edlclient/../Loaders/qualcomm/model_generic/sdx55/000cf0e100000000_d9357db88795b5a8_fhprg_quectel_em20_rg502.bin ...
sahara - 32-Bit mode detected.
sahara - Firehose mode detected, uploading...
sahara - Loader successfully uploaded.
main - Trying to connect to firehose loader ...
firehose - INFO: Binary build date: Jan 25 2021 @ 18:29:21
firehose - INFO: Binary build date: Jan 25 2021 @ 18:29:21 
firehose - INFO: Chip serial num: 0 (0x0)
firehose - INFO: Supported Functions (15):
firehose - INFO: program
firehose - INFO: read
firehose - INFO: nop
firehose - INFO: patch
firehose - INFO: configure
firehose - INFO: setbootablestoragedrive
firehose - INFO: erase
firehose - INFO: power
firehose - INFO: firmwarewrite
firehose - INFO: getstorageinfo
firehose - INFO: benchmark
firehose - INFO: emmc
firehose - INFO: ufs
firehose - INFO: fixgpt
firehose - INFO: getsha256digest
firehose - INFO: End of supported functions 15
firehose
firehose - [LIB]: INFO: Calling handler for configure
firehose
firehose - [LIB]: INFO: Storage type set to value nand
firehose
firehose - [LIB]: WARN: NAK: MaxPayloadSizeToTargetInBytes sent by host 1048576 larger than supported 0
firehose
firehose - [LIB]: Couldn't detect MaxPayloadSizeFromTargetinBytes
firehose
firehose - [LIB]: Couldn't detect TargetName
firehose - TargetName=Unknown
firehose - MemoryName=nand
firehose - Version=1
firehose - Trying to read first storage sector...
firehose - Running configure...
firehose - Storage report:
firehose - total_blocks:2047
firehose - block_size:262144
firehose - page_size:4096
firehose - num_physical:1
firehose - manufacturer_id:44
firehose - serial_num:0
firehose - fw_version:
firehose - mem_type:NAND
firehose - prod_name:
firehose_client - Supported functions:
-----------------
program,read,nop,patch,configure,setbootablestoragedrive,erase,power,firmwarewrite,getstorageinfo,benchmark,emmc,ufs,fixgpt,getsha256digest
firehose - Nand storage detected.
firehose - Scanning for partition table ...
Progress: |██████████| 100.0% Scanning (Sector 0x400 of 0x400, ) 0.00 MB/s                                              
firehose - Found partition table at sector 640 :)
firehose - Nand storage detected.
firehose - Scanning for partition table ...
firehose - 
Writing to physical partition 0, sector 63488, sectors 67584
Progress: |██████████| 100.0% Write (Sector 0x107E0 of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107E2 of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107E4 of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107E6 of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107E8 of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107EA of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107EC of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107EE of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107F0 of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107F2 of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107F4 of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107F6 of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107F8 of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107FA of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107FC of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x107FE of 0x10800, ) 0.00 MB/s                                             
Progress: |██████████| 100.0% Write (Sector 0x10800 of 0x10800, ) 0.00 MB/s                                             
firehose
firehose - [LIB]: Error:{}
Error writing mtd25_system.backup to sector 63488.

18

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

I don't know how to put this device in EDL mode.

If I make the backup over SSH, the image content is always the same and the same size:

dd if=/dev/mtd27ro bs=4096
dd if=/dev/mtd27 bs=4096
dd if=/dev/mtd27ro

If you look at /proc/mtd, it clearly says that /system size is 0x10800000, that is 276 824 964 bytes.

When I run `ubireader_display_info` on your backup of system parition, I get this warning:

UBI_File Warning: end_offset - start_offset length is not block aligned, could mean missing data.

Your backup is missing data for cachefs, persist, systemrw and usrfs. Also, some data from rootfs is missing.

/ # cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00280000 00040000 "sbl"
mtd1: 00280000 00040000 "mibib"
mtd2: 00b00000 00040000 "efs2"
mtd3: 001c0000 00040000 "tz"
mtd4: 00100000 00040000 "tz_devcfg"
mtd5: 00180000 00040000 "ddr"
mtd6: 00100000 00040000 "apdp"
mtd7: 00100000 00040000 "xbl_config"
mtd8: 00100000 00040000 "multi_image"
mtd9: 00100000 00040000 "aop"
mtd10: 00100000 00040000 "qhee"
mtd11: 00100000 00040000 "abl"
mtd12: 00280000 00040000 "uefi"
mtd13: 00180000 00040000 "toolsfv"
mtd14: 00180000 00040000 "loader_sti"
mtd15: 00d00000 00040000 "boot"
mtd16: 00100000 00040000 "scrub"
mtd17: 06b40000 00040000 "modem"
mtd18: 001c0000 00040000 "misc"
mtd19: 00180000 00040000 "devinfo"
mtd20: 00d00000 00040000 "recovery"
mtd21: 001c0000 00040000 "fota"
mtd22: 02100000 00040000 "recoveryfs"
mtd23: 00100000 00040000 "sec"
mtd24: 02b00000 00040000 "oem"
mtd25: 10800000 00040000 "system"
/ #

Maybe I made a mistake in backing up — there wasn't enough space in /tmp, so I only backed up a part of it. You backed up the complete system partition. However, I can't flash it using EDL; only this partition behaves this way.

19

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

The backup is made with dd over SSH. I guess you may have a better luck if you had backup made with EDL, but I am unable to provide it since my VOS is working at a remote location right now.

Hello, may I ask if that's possible?

20

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

The backup is made with dd over SSH. I guess you may have a better luck if you had backup made with EDL, but I am unable to provide it since my VOS is working at a remote location right now.


I'll try flashing in chunks first. If that doesn't work, will I have to resort to backing up via EDL?Then can I continue waiting for you?
Could you please help me back up just the 'system' partition, aligning the blocks during the backup? The backup command via adb shell is: dd if=/dev/mtd25 of=/tmp/system.img bs=4096. When I back it up this way myself, the firmware size is about 113MB, and flashing it back works fine. The system image you backed up is a complete UBI image of 264MB — could that be the reason it can't be flashed?

21

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

VOS backup, without efs2 that is not readable over SSH:
https://1drv.ms/u/c/6a12b36da65724ae/IQ … o?e=4jOUSU


Still no luck. The last system partition gives an error, and even flashing it in chunks doesn't work.

22

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

VOS backup, without efs2 that is not readable over SSH:
https://1drv.ms/u/c/6a12b36da65724ae/IQ … o?e=4jOUSU

Thank you very much for sharing the firmware. I have successfully flashed it. Thank you!!!!!!!!!

[2026-04-11 11:22:15.083] SEND >>>>>>>>>> ati
[2026-04-11 11:22:15.083] 
[2026-04-11 11:22:15.087] ati
[2026-04-11 11:22:15.087] 
[2026-04-11 11:22:15.087] Manufacturer: Tri Cascade Inc.
[2026-04-11 11:22:15.087] Model: SG500M2-X
[2026-04-11 11:22:15.087] Revision: RXMG1.20.00.326_0R05
[2026-04-11 11:22:15.087] SVN: 02
[2026-04-11 11:22:15.087] IMEI:xxxxxxxxxxxxxxx
[2026-04-11 11:22:15.087] +GCAP: +CGSM
[2026-04-11 11:22:15.087] 
[2026-04-11 11:22:15.087] OK
[2026-04-11 11:22:15.087]

23

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

Would you be able to share your backup from Compal RXM-G1?

Of course, but mine is a Linksys custom version and only supports PCIe EP mode. However, it does not include mtd2, the efs2 partition that contains the IMEI information.

https://drive.google.com/file/d/1jaGxP0 … sp=sharing

24

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

Since you can restore the module to its original state, try doing the firmware-update and keep the boot.img in the update ZIP to flash the kernel.

I tried it, but it didn't work. Mine is the Linksys version, and the partition files are different from those in the APAL and VOS versions. I compared the hardware and it's the same. After the update, it still won't boot and only goes into 9008 mode.

25

(131 odpowiedzi, napisanych Gadżety USB)

kszaq napisał/a:

Are you able to flash back Compal firmware to the modem? Do you have this Compal firmware that you could share? I won't be able to provide the system image in the next few days, maybe someone else from this thread.


I have backed up the complete partition firmware and can flash it back via EDL. What I want to do now is to flash all partitions using the VOS partition firmware, completely overwriting it to become VOS.
Currently the firmware only supports PCIe EP mode, and my DIY USB-to-2.5G adapter cannot be used.