• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Help OTA Firmware URIs Found - Work still needed

kam187 said:
I assume it didnt save the file?
Click to expand...

I had to try like 5 times to get it to download all the way, it would stop at random % and then say bad sector, so I would have to start over. I'm on Edge network at home, maybe thats why. When I go to work so I will try again with 3G speeds!
 
chadmd23 said:
Can we take an image of the whole device? Kind of like Mac Time Machine?
Click to expand...

I've found a way to take an image of the whole device. However, the only way I can figure out how to write it back is possibly ODEN and a script for user data.

I haven't tested this yet, but I do have a fresh ROM dump to play with (once I learn more about how).
 
Nu11u5 said:
I've found a way to take an image of the whole device. However, the only way I can figure out how to write it back is possibly ODEN and a script for user data.

I haven't tested this yet, but I do have a fresh ROM dump to play with (once I learn more about how).
Click to expand...

sweet thats good news!
@Kam, The only link that gave me a download was https://fota.t-mobile.com/omadl/desc?id=2955&r=4975348 and I tried to redownload it through 3G, it said saving! but then after that download unseccesful again:confused:
 
I've updated the OP. When I have the chance I will get my copy of the firmware file hosted ASAP.

I did run the update on my phone and am now running T939UVJA3. The update file is still in the /data/data/com.wssyncmldm folder.

The update file 'fota_delta_dp' is likely a difference file judging by its name and size. This means its meant to be run by some patching engine. Finding out where this is and how to force it needs to be done.

Looking at the file some more. It seems on my system at least the last 28M of the data is blank (0xFF and then switching to 0x00 for some reason for the last few sectors).

This would mean the people who have been getting a 12MB file probably have the whole thing!

There are no recognizable strings in the data aside from "RBMT" for the first 4 bytes. These do not correspond to any magic numbers that I can find. Possibly a proprietary file type.

News: While the update file still exists it is actually blank after the update! The system must maintain a 40MB image, probably to reserve space in the file system. The file downloaded from the URI is then inserted into the image for updating.
 
your system dump will still work though right? and How would we install to our phones? through ODIN?
 
I've posted a couple messages about this a while back, yet just now you guys find it. You can use AnyCut to access the Device Management app, which will show said urls are split into three groups, Production, Lab, and Test. You can even schedule it to check for an update. Though that doesn't mean you'll get it, as I did that a couple of times with no luck. It would pop up with the update notification, reboot and thats it, no update until it just happened on its own. More then likely as this app is simply a client program to a server program managed by the network engineers at Tmobile(Oh and of course these urls wouldn't work on your pc, they only exist internal to Tmobile).

As for the update itself, like its said above, its probably just a patch file that the app uses to patch the os and probably isn't in the format of updates to other android phones. Also that means more then likely that others who haven't gotten the update yet, cannot use the file to force the update. It will still require the Device Management app to talk to the mothership to probably check IMEI and then have access to the update and then apply it.

Of course thats just speculation, but if I ran the network, thats how I'd see it work. So if you haven't gotten the update yet, as I've said in another post, call Tmo to check your IMEI is right. Also would like to point out this tweet I got a while back from Tmo

Twitter / T-Mobile USA: @thelonetraveler Expect th ...

They said about two weeks(which just means its going to take how ever long its going to take) on Feb 22. Which means as of today we are still in the "two week period."
 
How did you dump the rom? are you using dd or something on a partition?

Be VERY carefull about trying to odin any image back to the phone. Its EXTREMELY dangerous. (except the proper odin files of course).

Can you host you're update file?
 
2FR35H said:
I tried that link and it downloaded through 54% and then closed and said "bad socket" whatever that means
Click to expand...
It means the server connection failed, i was able to finish the download after mutiple tries, but at the end it says download was unsuccsesful
 
yatimameiji said:
I've posted a couple messages about this a while back, yet just now you guys find it. You can use AnyCut to access the Device Management app, which will show said urls are split into three groups, Production, Lab, and Test. You can even schedule it to check for an update. Though that doesn't mean you'll get it, as I did that a couple of times with no luck. It would pop up with the update notification, reboot and thats it, no update until it just happened on its own.
Click to expand...

For those running the BH_Man Modifications Device Management is not initialized thus I believe that it will not send the update. When you press any buttons after creating the shortcut to Device Management you get the error that "DM is not initialized". So I guess that might answer some people's questions as if the update can come through the mods.
 
kam187 said:
How did you dump the rom? are you using dd or something on a partition?

Be VERY carefull about trying to odin any image back to the phone. Its EXTREMELY dangerous. (except the proper odin files of course).

Can you host you're update file?
Click to expand...

I've added the link to the update file to the bottom of the OP. It's zipped down to the 12MB on account of the extra 28MB being zeroed. I left it this way just to be safe.

Some brave soul who hasn't updated yet can try placing this file in the proper directory and letting us know what happens, for example, if they reboot or go to Settings | Software Update. I have tried it on mine but I was already updated at the time - no prompts for an update.

Oh Snap! I keep messing up the path! Its fixed now!

Recommended code below, extract from zip and copy the fota_delta_dp file to the sdcard. Requires rooted phone.
Code: 
su
cat /sdcard/fota_delta_dp > /data/data/[COLOR=DarkOrange]com.wssyncmldm[/COLOR]/fota_delta_dp
exit
As for the ROM dump, I used dd to read out the /dev/block/bml# block devices. These correspond to the phone's flash partitions on a physical level, with /dev/block/bml0!c being the entire flash device.

Friendly Advise: DO NOT TRY TO WRITE TO BLOCK DEVICES!

Anyway, the images dumped from the bml devices correspond to the partitions and files referenced in ODIN. I've compared the dumps per byte and they are the same. Partitions that contain file systems rather than raw data are headed with metadata (possibly a bitmap of file usage). The actual file system begins on offset 0xA80000 on these partitions.

The exception to this are bml1 and bml2. For both of these, the data from the 'arm9boot' file is split between them. These are different partitions on the device and have different functions during bootstrapping.

An arm9boot file consists of bml1 joined with bml2 at offset 0x200000 (the end of bml1).

Partitions 3, 10, and 11 are blank on my device.

Partition 7 seems to have some kind of file system on it, but has no corresponding ODIN image. Contents are unknown.

Partition 13 is 99% blank aside from a few stray bits at the very beginning.

Summery of block devices and partitions follows. Partition names originate from the 'partition' ODIN file (in the BOOTLOADER archive).

Partitions with file systems should be accessed via STL devices with no offset - edited table.
Code: 
[COLOR=Blue][B]Device     Partition  Image     Offset     Size (KiB)[/B][/COLOR]
bml1       MIBIM      arm9boot               2048
bml2       OEMSBL1    arm9boot  @0x200000     512
bml3       OEMSBL2    [I]{blank}[/I]                 512
bml4       APPSBL     arm11boot              1024
bml5       AMSS       amss                  23040
bml6       RECOVER    recovery               6144
bml7       EFS2       [I]{radioFS}[/I] 0xA80000    23040
bml8       APPS       kernel                 6144
[COLOR=Orange]stl9[/COLOR]       EFS2APPS   system    [COLOR=Orange][s]0xA80000[/s][/COLOR]   226304
bml10      FOTA       [I]{blank}[/I]                8192
bml11      RFBACKUP   [I]{blank}[/I]                 512
[COLOR=Orange]stl12[/COLOR]      CACHE      cache     [COLOR=Orange][s]0xA80000[/s][/COLOR]    40960
bml13      PARAM      [I]{unknown}[/I]              1024
[COLOR=Orange]stl14[/COLOR]      USERDATA   userdata             173568
What this means is we can make custom ODIN images! If not by editing the partitions manually (or building them using tools) then by modifying them on the device and dumping it.

Update: Simply hexediting the flash file system header out so that the remaining image matches the contents of the original ODIN images does not seem to work.

The problem is that dumping the BML devices with files systems on them (vs RAW) produces an image that is too large. In the originals, all the files were allocated near the beginning of the ROM, and the rest was zeroed (in NAND flash this means 0xFF). After the update I noticed that files were allocated at the end as well. This means one cannot simply remove the extra zeroed space to make it fit for ODIN.

The STL devices work at a higher level, translating addresses in flash so they can work with normal file systems. Using an STL image instead of the edited BML image may work.

The downside of using STL devices for file system dumps is that they are only enabled on specific partitions. The good thing is these other partitions do not really concern us unless we want to edit the radio code (lets leave this alone).

Unfortunately the error in trying to flash the BML image forced me to ODIN back to the UVIJ6 firmware. Once I receive the update again I will test the new ROM dump and release a no-root-needed ROM update via ODIN if it works.
 
Interesting you can access EFS2. Thats a filesystem for the baseband. It holds protected nv items and other info for the REX RTOS that the baseband runs.

So i guess we could construct odin files from some dumps and a bit of hexediting.
 
Nu11u5 said:
Some brave soul who hasn't updated yet can try placing this file in the proper directory and letting us know what happens, for example, if they reboot or go to Settings | Software Update. I have tried it on mine but I was already updated at the time - no prompts for an update.

Recommended code below, extract from zip and copy the fota_delta_dp file to the sdcard. Requires rooted phone.
Code: 
su
cat /sdcard/fota_delta_dp > /data/data/wssyncmldm/fota_delta_dp
exit
quote]
I would love to try this out! I get home at 5:30. If anyone wants to beat me to it, be my guest!:D
Click to expand...
 
Hmm there is a partition called FOTA, wonder if that plays any part in updates. BTW is this the only android phone with Device Management from Tmobile? Considering this phone has such an interesting program, that from another thread, a rep over the phone was able to tell the phone was on/off and pushed the updated, sounds like alot was put into development for this.
 
paul89 said:
Nu11u5 said:
Some brave soul who hasn't updated yet can try placing this file in the proper directory and letting us know what happens, for example, if they reboot or go to Settings | Software Update. I have tried it on mine but I was already updated at the time - no prompts for an update.

Recommended code below, extract from zip and copy the fota_delta_dp file to the sdcard. Requires rooted phone.
Code: 
su
cat /sdcard/fota_delta_dp > /data/data/wssyncmldm/fota_delta_dp
exit
quote]
I would love to try this out! I get home at 5:30. If anyone wants to beat me to it, be my guest!:D
Click to expand...

I tried it however it still states No Update Firmware File Exists...
Nonetheless, I am running the BH_Man's Stock w/touchwiz firmware at the moment.
Click to expand...
 
paul89 said:
I wonder if it has to do with the fact that you r using the hybrid rom:confused:
Click to expand...

The mechanism for updating is in Device Management. If this package is missing I don't see how it will update.

It's completely (and sadly, likely) possible there is more to this process we are not seeing and having Device Management won't do anything still.
 
You must log in or register to reply here.
Back
Top Bottom