Alcatel open market 4s

[Iain_S]

whats the commond line and flags for over riding platid when using thor2? or if you have the xml file I can edit and do an emergency program using the xml and ffu?

 

[nate0]

So the Platform id information is written to the SMBIOS on the device.

On each device platform, OEMs must ensure that the following values in the SMBIOS system information structure are set:
PhoneManufacturer
Family
Product Name
Version

is there a way to edit the SMBIOS information once its already on the device?

Only way I could see doing that would be with a pre-signed cab file with the smbios.cfg matching what that ffu needs. But when doing that you always want to have a way to revert back to stock. I have found zero files so far containing an smbios.cfg file.

 

[nate0]

whats the commond line and flags for over riding platid when using thor2? or if you have the xml file I can edit and do an emergency program using the xml and ffu?

The idol 4s does not rely on the thor2 command. It used the WDRT app directly (WindowsDeviceRecoveryTool.exe) and sets of .dll files like AnalogAdaptation.dll AlcatelAdaptation.dll Model.dll. I have been looking again at the WDRT trace logs and building more of a understanding of what is happening.
There is a dll file called LogicCommon.dll. It along with the AnalogAdaptation.dll look like they are able to see and read the smbios.cfg file to verify the Device ID embedded there and compare it to what is expected on the FFU.

If thor2 would have worked it would include the skip id check flag to bypass that feature.
-skip_id_check Secure FFU flashing. Skips Platform ID check between the device and FFU file.

Unfortunately other security measures are usually in place if that flag is used. Was thinking maybe there is another tool available since thor2 is not used anyway that might be considered. But we could be doing that at the risk of the device, since there appears to be no Emergency files out there and anything could happen since WDRT is only tool really designed for the IDOL4s.

 

[Iain_S]

The idol 4s does not rely on the thor2 command. It used the WDRT app directly (WindowsDeviceRecoveryTool.exe) and sets of .dll files like AnalogAdaptation.dll AlcatelAdaptation.dll Model.dll. I have been looking again at the WDRT trace logs and building more of a understanding of what is happening.
There is a dll file called LogicCommon.dll. It along with the AnalogAdaptation.dll look like they are able to see and read the smbios.cfg file to verify the Device ID embedded there and compare it to what is expected on the FFU.

If thor2 would have worked it would include the skip id check flag to bypass that feature.
-skip_id_check Secure FFU flashing. Skips Platform ID check between the device and FFU file.

Unfortunately other security measures are usually in place if that flag is used. Was thinking maybe there is another tool available since thor2 is not used anyway that might be considered. But we could be doing that at the risk of the device, since there appears to be no Emergency files out there and anything could happen since WDRT is only tool really designed for the IDOL4s.

I can flash the tmobile rom onto my idol4s independently of wdrt using the ffutool, I don't think that tool uses anything from wdrt. and is done from the command prompt.

 

[Iain_S]

so the flag in thor2 would be -skip_id_check Secure FFU Flashing or just -skip_id_check?

 

[Iain_S]

seems to me that any Microsoft supplied flashing tool only checks the info in the SMBIOS on the device and that is it. If they don't match it doesn't flash.

 

[nate0]

so the flag in thor2 would be -skip_id_check Secure FFU Flashing or just -skip_id_check?

just -skip_id_check if using thor2

 

[nate0]

seems to me that any Microsoft supplied flashing tool only checks the info in the SMBIOS on the device and that is it. If they don't match it doesn't flash.

There is one tool that might work that I came across over a year ago. It is a Qualcomm tool I believe. I'll research it and let you know.

 

[anon(10197358)]

@Nate W

QPST ?

 

[nate0]

@DylanCochard
Ya QPST might work.
Initially I am looking back on a program used by the dragon board from QC. Its a executable called emmcdl. But we would need the flash programmer mbn file for the IDOL4s W10M on SoC 8996. I do not think that can be generated from the ffu can it?

Also I am not sure if the emmcdl.exe supports anything outside what the dragon board ran as far as CPU, but it does not require signature checks. Not needing checks done was why I started there.

I might look into QPST later to see what could be done there too. The IDOL can be put into EDL mode though by holding down both volume rocker buttons in at the same time during boot. Which is the state most of these tools need or expect the device to be in to flash it.

 

[nate0]

emmcdl.exe examples if anyone is interested:
Examples: emmcdl -p COM8 -info
emmcdl -p COM8 -gpt
emmcdl -p COM8 -SkipWrite -SkipStorageInit -MemoryName ufs -f prog_emmc_firehose_8994_lite.mbn -x memory_configure.xml
emmcdl -p COM8 -f prog_emmc_firehose_8994_lite.mbn -x rawprogram0.xml -SetActivePartition 0
emmcdl -p COM8 -f prog_emmc_firehose_8994_lite.mbn -ffu wp8.ffu
emmcdl -p COM8 -f prog_emmc_firehose_8994_lite.mbn -d 0 1000 -o dump_1_1000.bin
emmcdl -p COM8 -f prog_emmc_firehose_8994_lite.mbn -d SVRawDump -o svrawdump.bin
emmcdl -p COM8 -f prog_emmc_firehose_8994_lite.mbn -b SBL1 c:\temp\sbl1.mbn
emmcdl -p COM8 -f prog_emmc_firehose_8994_lite.mbn -e 0 100
emmcdl -p COM8 -f prog_emmc_firehose_8994_lite.mbn -e MODEM_FSG
emmcdl -p COM8 -f prog_emmc_firehose_8994_lite.mbn -raw 0x75 0x25 0x10

 

[Iain_S]

how do we put the device into uefi mode?

 

[nate0]

how do we put the device into uefi mode?

I don't know. My guess is Alcatel should have tools to enable that. I think that requires something to engage the onboard boot manager (if there is one).

 

[Iain_S]

need to have the device in Lumia uefi mode to use thor2 with the skip_id_check flag??

 

[Iain_S]

I can get the device into emergence mode, if only I could get this thing into uefi boot mode then I think thor2 would be able to write the ffu,

 

[nate0]

need to have the device in Lumia uefi mode to use thor2 with the skip_id_check flag??

Lumia uefi mode using the Lumia boot manager is specific only to Lumias.

 

[Iain_S]

Lumia uefi mode using the Lumia boot manager is specific only to Lumias.

so that shoots down using thor2 with the id check flag, because it looks for the device being in lumia uefi boot mode.

 

[Iain_S]

the only other way I can think of doing this is from emergency state, which the 4s will enter but I would need someone to make me a properly written xml file to change the device id using thor2. OEMDevicePlatform.xml would be the file I would need to try this.

 

[nate0]

the only other way I can think of doing this is from emergency state, which the 4s will enter but I would need someone to make me a properly written xml file to change the device id using thor2. OEMDevicePlatform.xml would be the file I would need to try this.

I can give you the proper OEMDevicePlatform.xml, how do you propose to change the Device ID or use the file to flash the Open Market FFU?

Edit: I think I see the command you are planning to run. That being thor2 in emergency mode:
thor2 -mode emergency -configfile "emergency_config.xml" -ffufile "Production_flash.ffu"

 

[nate0]

@Iain_S
This is one from a dump of the Open Market FFU.

View attachment OEMDevicePlatform.zip