Root [Merit] ZTE Merit Touchscreen Bricked after *983*29873283# code

[stayboogy]

Are they now? I have flasher files for the gen2 along with a channel1.nvm that the IMEI was removed from. Wonder what would happen if i installed that boot and recovery, hmmm.

These flasher files, the one for the v880 and one called gen2 both have a channel1 rar included, inside is just called channel1 when you add the extension .nvm it lets you restore in the flasher program. I can successfully in diag mode, backup my nvram and restore it. I keep trying to flash the generic v880 channel1.nvm, this is what m_7 uploaded, was originally on madaco.

As for the v880, I don't have the actually have those recovery and .mdn files but have a file that extracted the t-avail image in .mdn alone with the boot, recovery etc... Also, when you extract the v880 unlocker rar, there is there is a rar file with a channel1 in it. When you rename it channel1.nvm it actually lets you restore it.

My bad, the gen2 is for the blade, what would happen if I flashed those?

i was just trying to figure out what you meant by "gen2"...

as for the nvm and all that, i have no clue. it's all turkish to me lol

there were two generations of the blade initially, gen 1 with a 0x200000 kernel offset, or something similiar as i'm on my windows machine right now, and gen 2 with a 0x260000 offset. the merit and avail are gen 2. the merit and avail are more closely related to the blade 2 / crescent than it is to the first blade.

i was just curious if that's what you were referring to cause i couldn't see how that would relate to anything you are doing, unless you are trying to flash official firmware from another device, which wouldn't work if the offset is wrong.

 

[bethnesbitt]

i was just trying to figure out what you meant by "gen2"...

as for the nvm and all that, i have no clue. it's all turkish to me lol

there were two generations of the blade initially, gen 1 with a 0x200000 kernel offset, or something similiar as i'm on my windows machine right now, and gen 2 with a 0x260000 offset. the merit and avail are gen 2. the merit and avail are more closely related to the blade 2 / crescent than it is to the first blade.

i was just curious if that's what you were referring to cause i couldn't see how that would relate to anything you are doing, unless you are trying to flash official firmware from another device, which wouldn't work if the offset is wrong.

I believe its for the Libra.

I flashed the recovery out of curiosity, it didn't work, had to flash a recovery back via adb. Before doing so, I noticed the diff in the dmseg command.

Said fast boot was enabled, that actually worked to. Even flashed the recovery in fastboot.

Was wondering if m_7 tried one of those ROMs since they actually have an English version, he tried a blade code that caused the brick. Was thinking he had blade on his mind as a fix.

That's why I asked about flashing, then thought about his post about the way he thought maybe it was using the v880 tool with the avail ROM.

Then thought, well what if the reason he suggested was because he had a soft brick using the blade ROM, flashes the blade nvram and it tricked the phone into thinking it was a blade long enough by pulling the battery. Doing this using an avail ROM might work better, be easier and safer since they are identical right down to the nvram.

When you do searches for ftm merit, m_7 comes up all over madaco forum blade posts saying he unlocked it. Got me wondering blade.

 

[micallan_17]

after converting the merit I had, I immediately backed up the nvm with the working ftm mode, now that I have the other 3 merits I have tried flashing the nvram of the working ftm to those one but ftm still wont work.

you can try these nvram files that are from the working ftm merit

 

[bethnesbitt]

K txs. Was wondering, did you try flashing the blade ROM and brick.

Also, did you try the image build technique using the TPT?

 

[bethnesbitt]

Oh ya, if you go in qpst 2.7.402 you can back up the nvram using the software DL tool.

On the avail dial *983*87274#
Select only diag
You will see dfu
In qpst select backup and press start
It will save a file in .qcn
In there I can view the hex codes line by line.

There is a wlanedit program in qpst.
You could back up the avail and merit nvram and look for differences

The rvnav let's you make some changes, some are blocked out like the imei.

 

[bethnesbitt]

Oh ya, if you go in qpst 2.7.402 you can back up the nvram using the software DL tool.

On the avail dial *983*87274#
Select only diag
You will see dfu
In qpst select backup and press start
It will save a file in .qcn
In there I can view the hex codes line by line.

There is a wlanedit program in qpst.
You could back up the avail and merit nvram and look for differences

The rvnav let's you make some changes, some are blocked out like the imei.

LOL,

NM you already did.
I thought you might have tried in that zte flasher program for the v880. It lets you backup your nvram named channel1.nvm.

My thought was in dfu mode in the unlocker you could try backing up the nvram on the avail. switching to the merit and restoring it to the merit.

This all can be done in dfu mode, no need for FTM.

 

[bethnesbitt]

I'm looking at the diff between your .qcn files. It appears the avail has less nv count 362 compared to when it was a merit count 349

Also, the board, it is a surf6025-zrf6000-p - model 191

Mine has 1304 nv count way more then yours and is a surf7627-linux model 4031

Although the Sw Versions are the same m76xx-tsncjolym

Not sure if the qpst you used was different out put in counts. I see you did this with version 323. Mine was done in 402.

The boards could just be numbered alpha/numerically

I bought my phone in march 2012, when did you buy yours?

Also, look at the board versions on the other merits. It just may not work on a newer board.

 

[bethnesbitt]

Well, I found it, way way way way way at the bottom, this line:

NV item: 7145 [NV_LU_REJECT_AUTO_ENABLED_I], index 0

Look for that line on your other merits.

When I looked at the two against mine, I saw yours was missing alot of wcdma values, i'm not really sure why, if this was because you were using an older version of qpst. You could try backing up your nvram with a newer version, found this doing a search.

[QPST 2.7 build 402] - Pg. 2 | Android | XDA Forums

Also, if you go into C:\Program Files\Qualcomm\QPST\bin there are some tools in there that do not show up on the start menu.

What would work to get rid of that nasty line is to find a way to format your nvram, edit out that line in a hex editor program, I like the ones that linux offers cause they are free, then reflash it. Now I am not 100 percent sure if that is the line, there is another way, which could downgrade your nvram, but that would be to remove all the extra lines at the bottom.

In that directory is a .exe called RF_NV_Manager, that lets you make changes to editable parts in the NVRAM. When I opened my .qcn for my phone, it did not actually show those lines that your .qcn is missing, which was really odd. Actually showed all the way down to 6000, so not sure if from beyond 6000 is the area that is causing FTM mode to not work on the newer models.

Now SP Flash tools does let you format and flash nvram, but I'm having issues getting it to work in DFU mode, has the option under settings, but nothing happens. Also, if I could get SPFlash to find the phone, trying to flash a recovery.img via comport but not picking up, then the next step is to find the physical address of the nvram, format it in spflash tools then reflash it.

Stayboogy, if you could do this or have in the past, well this is a perfect way to save those bricks, since I am a poor farmer woman, that could be my contribution.

 

[bethnesbitt]

You did this in qpst 2.7.323, think I just about duplicated your steps. The newer version did not let me load your .qcn but this one did. I just changed my device from the suf7627 to yours.

I also noticed that the surf6025.hex that matches your board is listed, so that has to be what you did, you loaded one of their hexs, loaded it in the service programming tool and wrote it to the phone.

Do you happen to have a FTMeval.exe in your start menu? All the versions I DL it is gone, wondering if you may have gotten ahold of that back when you did this.

 

[bethnesbitt]

I did a lot of research and found this document:

https://www.google.com/url?sa=t&rct...=pkNkluLoc8FfIfXRK3K57g&bvm=bv.75097201,d.aWw

When I mentioned about the soc being higher then zero while in FTM mode was correct, quoted from attached file:

• If the FTM NV flag NV_FTM_MODE_I, is inactive (0) and RF Cal NV is valid, then the FTM NV flag remains inactive and the mobile powers up to normal AMSS operating mode.
• If the FTM NV flag NV_FTM_MODE_I, is inactive (0) and RF Cal NV is invalid, then the FTM NV flag will be set to FTM_MODE and the mobile goes to FTM mode.

There is more there if you want to read it. If you look at those files that the TPT extract tool extracts from that T-AVAIL update, you will notice a file called amss.mbn and ammshdbl.mdn. These are what sets the FTM flag when the correct combination of keys are pressed.

Also, FTM mode happens somewhere between the NVRAM and just before boot. I ran that adb wait command that stayboogy posted and while in CWM recovery, noticed that it did not say FTM flag disabled. So the flag has to be activated before it hits boot.

Compared your .qcn with my .qcn, they are identical, both hex codes are identical down to the 00.

Did a hex to text convert and the RF cal actually converts to 4.0.33 down arrow, hysterical.

If you can figure out a way to flash the amss.mbn files from the t-avail update, you should get FTM mode. The reason this doesn't work on the newer phones, where it probably did at one point in time on older models, is when the merit first came out, the image.bin was apparently unlocking phones. That is why it doesn't really work on the newer merits all the most of the time.

Stayboogy mentioned getting to FTM mode but couldn't duplicate it, probably because he got lucky doing the t-avail update flash. Not sure if he did it on one phone but not another, he may have never even realized he inadvertently unlocked his merit to an avail by performing the tcard flash. FOr those phones he did format, that flasher program will probably fix those phones that he successfully flashed the update with, if he can get into FTM. If he does get into FTM on those phones, he probably converted it to an avail or it was already an avail. That is how he can unbrick his formated nand flash phones.

I did try a few things and created new image.bin files from something I read on madaco, that all you need are these four files to flash.

• If the rom overwrites the part of the phone responsible for TPT and this part of the rom is corrupt. Be extra careful when flashing a rom containing the following files: oemsbl.mbn, amss.mbn and qcsbl.mbn (delete those). The following four are required for a TPT flash: appsboot.mbn appsboothd.mbn partition.mbn & partition_zte.mbn.
• There is no recovery if the TPT part of the phone is damaged. Otherwise TPT is able to recover the phone by flashing a rom that contains all partitions that need to be recovered.

Well I tried that and it actually was successful, yet, it would not let me get into dfu mode, so I reflashed with just the .mdn files and removed all the rom files, recovery, boot, system, etc...


Because of a bad recovery flash and not being able to remove the boot, i'm stuck in dfu mode. If I could remove the boot, could easily fix the recovery in fastboot mode, but the freaken thing is stuck on the at&t logo, can't figure out how to remove the boot since my recovery is screwed up.

 

[stayboogy]

I did a lot of research and found this document:

https://www.google.com/url?sa=t&rct...=pkNkluLoc8FfIfXRK3K57g&bvm=bv.75097201,d.aWw

When I mentioned about the soc being higher then zero while in FTM mode was correct, quoted from attached file:

• If the FTM NV flag NV_FTM_MODE_I, is inactive (0) and RF Cal NV is valid, then the FTM NV flag remains inactive and the mobile powers up to normal AMSS operating mode.
• If the FTM NV flag NV_FTM_MODE_I, is inactive (0) and RF Cal NV is invalid, then the FTM NV flag will be set to FTM_MODE and the mobile goes to FTM mode.

There is more there if you want to read it. If you look at those files that the TPT extract tool extracts from that T-AVAIL update, you will notice a file called amss.mbn and ammshdbl.mdn. These are what sets the FTM flag when the correct combination of keys are pressed.

Also, FTM mode happens somewhere between the NVRAM and just before boot. I ran that adb wait command that stayboogy posted and while in CWM recovery, noticed that it did not say FTM flag disabled. So the flag has to be activated before it hits boot.

Compared your .qcn with my .qcn, they are identical, both hex codes are identical down to the 00.

Did a hex to text convert and the RF cal actually converts to 4.0.33 down arrow, hysterical.

If you can figure out a way to flash the amss.mbn files from the t-avail update, you should get FTM mode. The reason this doesn't work on the newer phones, where it probably did at one point in time on older models, is when the merit first came out, the image.bin was apparently unlocking phones. That is why it doesn't really work on the newer merits all the most of the time.

Stayboogy mentioned getting to FTM mode but couldn't duplicate it, probably because he got lucky doing the t-avail update flash. Not sure if he did it on one phone but not another, he may have never even realized he inadvertently unlocked his merit to an avail by performing the tcard flash. FOr those phones he did format, that flasher program will probably fix those phones that he successfully flashed the update with, if he can get into FTM. If he does get into FTM on those phones, he probably converted it to an avail or it was already an avail. That is how he can unbrick his formated nand flash phones.

I did try a few things and created new image.bin files from something I read on madaco, that all you need are these four files to flash.

• If the rom overwrites the part of the phone responsible for TPT and this part of the rom is corrupt. Be extra careful when flashing a rom containing the following files: oemsbl.mbn, amss.mbn and qcsbl.mbn (delete those). The following four are required for a TPT flash: appsboot.mbn appsboothd.mbn partition.mbn & partition_zte.mbn.
• There is no recovery if the TPT part of the phone is damaged. Otherwise TPT is able to recover the phone by flashing a rom that contains all partitions that need to be recovered.

Well I tried that and it actually was successful, yet, it would not let me get into dfu mode, so I reflashed with just the .mdn files and removed all the rom files, recovery, boot, system, etc...


Because of a bad recovery flash and not being able to remove the boot, i'm stuck in dfu mode. If I could remove the boot, could easily fix the recovery in fastboot mode, but the freaken thing is stuck on the at&t logo, can't figure out how to remove the boot since my recovery is screwed up.

no...

the first day i got my first ST Merit I booted to FTM. No flashing of anything, no nothing. just fresh out of the box and done by accident trying to get into recovery.

when i got my second merit, as soon as i opened the box i booted to recovery installed a fake flash recovery and made a nandroid--it never once booted to the system before the nandroid was made. i have used this nandroid to boot into FTM as well. without rhyme or reason however it won't duplicate all the time--in fact i've done it twice since then, of course i've only tried it a handful of times too since it doesn't do me any good to get into it anyway...

FTM support is configured in the kernel source, whether or not it is configured somewhere else has yet to be proven in my opinion. you've stated it was nvram then you stated it was amss.mbn. i know for a fact it's configured in the kernel. i showed you the board file even.

FTM is just hard to get into obviously--maybe a timing issue, maybe something else.

the fact remains that i don't really care... trust me when i tell you, i've booted to FTM without the use of anything, just the system as it comes out of the box. end of story.

 

[bethnesbitt]

Funny you say that, cause this morning I figured it out, just unlocked the phone, no s**t

It is unbricked to, built an image that got it working, and yes stayboogy, you are right, FTM on this phone is useless, you don't even need it to unlock it.

I'm uploading the image that I build right now, taking a bit, but once you flash it it will full unlock the phone, give you full access to everything, NVRAM, etc..



All you need is this file I'm uploading, which BTW will unbrick your merits you bricked while partitioning.

So, that's it, no unlocker software, no FTM mode which is basically the same as dialing *983*87274#, FTM just gives you a different DFU com port from the *983* way.

As soon as I get all the info together i'll post the links

 

[micallan_17]

Funny you say that, cause this morning I figured it out, just unlocked the phone, no s**t

It is unbricked to, built an image that got it working, and yes stayboogy, you are right, FTM on this phone is useless, you don't even need it to unlock it.

I'm uploading the image that I build right now, taking a bit, but once you flash it it will full unlock the phone, give you full access to everything, NVRAM, etc..



All you need is this file I'm uploading, which BTW will unbrick your merits you bricked while partitioning.

So, that's it, no unlocker software, no FTM mode which is basically the same as dialing *983*87274#, FTM just gives you a different DFU com port from the *983* way.

As soon as I get all the info together i'll post the links

That's so cool, your research paid off , we managed to flash my original merit about a year and a half and although we did I don't consider myself very tech savy, but am glad you figured it out

Cheers
AR

 

[bethnesbitt]

That's so cool, your research paid off , we managed to flash my original merit about a year and a half and although we did I don't consider myself very tech savy, but am glad you figured it out

Cheers
AR

What kills me is all the misinfo on the other forums, they made it seem so damn hard, that is what took me so long to figure it out but also helped me figure it out, funny, what seems hard is usually really easy. After you unlock the phone saw somewhere about entering a *983* code, can't remember what it was will search, but it roots the phone.

Put CWM recovery on it and it actually disabled the FTM, did nothing more then created a second way to get into recovery.

Ya, well anyways was wondering if I was imagining that I unlocked it so fired up qpst's nv rev program and all the items were editable. Before the unlock about 50% where blocked out, now you can right to, I think, all of them. Bascially DFU/FTM is useful if you mess up your nvram but not useful if you screw up your boot, recovery, etc...

Pretty much, if you know what your doing this phone is unbrickable, I even found where the touchscreen info was, did a search and found the firmware, LOL. Ah well, at least it's fixed, didn't lose much only cost me $5, used bing rewards to get an amazon gift card, hehe. Needed those screwdrivers anyways for future repairs.

 

[micallan_17]

Yeah the code to root it is *983*root# (*983*7668#), a pop will pop up something root, after that gobinto the play store and install supersu, but it won't work on the latest at&t avail, not quite sure which rom ot works and on which it doesnt.

 

[bethnesbitt]

just another update guys, seems that every turn we have a bump lol, so as I explained above the phone is able to put itself in DFU mode and now the flasher is able to detect it, but now I get an error "skip to armprg fail!" while trying to flash the phone, be warned that the files am using are the avail files since I don't think there are any from Tracfone, I have learnt that both the avail and merit are identical hardware wise and only seem that the underlying firmware is the actual difference. an image is below here

Okay, well I successfully built the image, after doing the tflash it goes to 100%, this works btw, says success reboot. Now when I go to FTM and open that program like aove, it does that error, how did you get past that?

 

[bethnesbitt]

Okay, well I successfully built the image, after doing the tflash it goes to 100%, this works btw, says success reboot. Now when I go to FTM and open that program like aove, it does that error, how did you get past that?

Heh, scratch that, I got it working now, made a 100% working image that can be tflashed yay. Doesn't say fail either, says success reboot

You know it is working to cause after it gets to 100% it does another 100% to flash the firmware

but I still get the get armprg fail, odd

 

[micallan_17]

If you can get to FTM do this, First go here: ZTE - USA

Second go to Software updates

And download
AT&T Avail Online Software Upgrade Tool

Install software and run it, let it update and then once ot updates, follow the onscreen instructions to flash.

 

[bethnesbitt]

If you can get to FTM do this, First go here: ZTE - USA

Second go to Software updates

And download
AT&T Avail Online Software Upgrade Tool

Install software and run it, let it update and then once ot updates, follow the onscreen instructions to flash.

Heh, they changed the link, AT&T Avail - ZTE USA, cross your fingers. I made a working image, after you do the flash says update success reboot. think it's unlocked for at&t but woud like to fully unlock it so that we can use boost mobile.

 

[micallan_17]

It won't wok on boost since the merit is gsm and boost uses a cdma network. But the file on the AT&T website should be able to flash as long as you can get ftm

 

[micallan_17]

By the way what files did you use to create the image you flash?

 

[bethnesbitt]

What I did was made a working image and flashed it, said update successful and rebooted. This gave me version 19 I think, that image only gave me FTM, no download so I made another one and added two other files but removed the other two, that one worked as well. This gave me version 18 I think.

Still couldn't get the zte update tool to work so I flashed the t-avail original image and that finally worked, downgraded me to 14. Now the update tool is working, defenetly unlocked it to at&t. When I tried that tool with avail on the z990g it said it was the z990g and there were no updates, now it says it's the z990

Now i'm not sure if What I did had to be done in steps or what but i'm going to upload the second file when this is done, keep the first one just in case because now that I have unlocked it to AT&T can't test it again .

I was wondering though, you can dial *983*3640 and change your radio settings, for example, you can change it to only CDMA (pref) so wouldn't that work with boost?

 

[bethnesbitt]

What I did was made a working image and flashed it, said update successful and rebooted. This gave me version 19 I think, that image only gave me FTM, no download so I made another one and added two other files but removed the other two, that one worked as well. This gave me version 18 I think.

Still couldn't get the zte update tool to work so I flashed the t-avail original image and that finally worked, downgraded me to 14. Now the update tool is working, defenetly unlocked it to at&t. When I tried that tool with avail on the z990g it said it was the z990g and there were no updates, now it says it's the z990

Now i'm not sure if What I did had to be done in steps or what but i'm going to upload the second file when this is done, keep the first one just in case because now that I have unlocked it to AT&T can't test it again .

I was wondering though, you can dial *983*3640 and change your radio settings, for example, you can change it to only CDMA (pref) so wouldn't that work with boost?

s**t it failed, maybe if I try the update via the phone.

 

[micallan_17]

Nope that won't work that CDMA toggle is on every smartphone i believe, and so is the gsm toggles on cdma devices. I wanted to know what actual files you used to make the image file. I have a bunch of image.bins that i can use to create one.

 

[bethnesbitt]

s**t it failed, maybe if I try the update via the phone.

Yay, I can't get the unlock program to work, did finally get it to update by installing a rooted rom from area51, flashing stock recovery and then doing the online tool update worked. Updated to version 32, still didn't work, so i'm not really sure, give up. Screw it, it's an at&t phone now, we can at least use that here, easier to get the minutes anyways.

Before the online tool could delete the update I copied and recreated new images to make it easier. This is the latest update. Download the first one - merit.to.avail.rar then you can do a full firmware flash with the second one. If that doesn't work, flash the unlock.z990g.to.z990.zip then flash the other two.

Elizabeth's Blogger Wikis: How to unbrick and unlock the ZTE Mert straighttalk/tracfone z990g to AT&T z990

The files are still uploading