[deleted post]

 

Yes my restored sd card is locked.

 

 

The steps I used to restore my card is as follows:

 

1. Remove Internal SdCard.
2. Boot With the AVIC5000 SD Card Image
3. Insert the testmode_n_2, TEST_MODE_N.key
4. Boot To recovery mode
5. power off unit.
6. Remove internal sd card
7. Boot Again with the test mode n 2 key
8. Receive System Error. Let it sit here for about 30 seconds to be sure. (this seems to trigger the NOR Flash, not the sd card, to always boot in recovery until you write a file using recovery)
9. Put original SD Card back in.
10. Boot with the last OS update you used (i.e. if you used 5100 update last, put that on the USB stick) on the USB Port 2
11. Write the platform files.
12. Reboot normally.

 

2. how do you boot with the image if you remove the sdcard?

3. At this state is it powered on normally?

4. does it perform booting automatically?

I'm asking you to clarify everything.  What state is the device in, per step, and what actions did you perform?  I was only able to get this screen below once, and I have no idea what I did to force it to enter this mode.  I also don't know which device was target and which was host, nor did I mark which key was used.

2. how do you boot with the image if you remove the sdcard?

3. At this state is it powered on normally?

4. does it perform booting automatically?

 

I'm asking you to clarify everything.  What state is the device in, per step, and what actions did you perform?  I was only able to get this screen below once, and I have no idea what I did to force it to enter this mode.  I also don't know which device was target and which was host, nor did I mark which key was used.

IMG_20150725_132521077.jpg

Ok thats the screen from the test_mode_n.key under the testmode_n_2 folder.  Use the one from the testmode_n_1 folder as that boots the recovery mode. (That was my 2 am mistake in typing)

Sorry It was about 2 in the morning when I wrote the steps, so it made sense at the time.

1. Remove Broken Internal SdCard.
2. Insert the sd card with the AVIC5000 SD Card Image
3. Boot With the AVIC5000 SD Card Image
4. Insert the testmode_n_1, TEST_MODE_N.key, which will make the unit boot to recovery
5. Power off unit.
6. Remove internal AVIC5000 SD Card
7. Boot Again with the test mode n 1 key
8. Receive System Error. Let it sit here for about 30 seconds to be sure. (this seems to trigger the NOR Flash, not the sd card, to always boot in recovery until you write a file using recovery). Then insert the usb stick into the other usb port and wait 30 seconds. (Again yo be sure as I do not know which one works)
9. Put original SD Card back in.
10. Boot with the last OS update you used (i.e. if you used 5100 update last, put that on the USB stick) on the USB Port 2
11. Write the platform files.
12. Reboot normally.

ok.  So, i'm using an 8100NEX and that 5000 NEX does not boot.   The closest thing I can do is

1. Boot without an Internal SDCard

2. Insert Internal SDCard

3. Insert USB Test Key.

4. Observe the device entering the new mode

Test Key N1 does not affect operations

Test Key S does not affect operations

Test Key A does not affect operations

I think I need Test Key 1 to work.

How do the secondary settings operate on the device, such as Magic Numbers and Boot Modes?   I need to enter EasyRecovery or Recovery somehow to flash this back to  stock. 

Here is test key N3.

What does 3 do?

ok.  So, i'm using an 8100NEX and that 5000 NEX does not boot.   The closest thing I can do is

1. Boot without an Internal SDCard

2. Insert Internal SDCard

3. Insert USB Test Key.

4. Observe the device entering the new mode

 

Test Key N1 does not affect operations

Test Key S does not affect operations

Test Key A does not affect operations

 

I think I need Test Key 1 to work.

 

How do the secondary settings operate on the device, such as Magic Numbers and Boot Modes?   I need to enter EasyRecovery or Recovery somehow to flash this back to  stock. 

 

Here is test key N3.

IMG_20150725_145443938.jpg

 

What does 3 do?

I think have not figured out what TestKey 3 does or how to do the boot sub modes or secondary flags. If we can figure that out I can get adb and change the usb modes.

Something else you can try is dd'd the expanded images from the update files of the 8100 to the respective partitions on the 5000 sd card. That should at least get something bootable to force NOR into recovery mode.

I think have not figured out what TestKey 3 does or how to do the boot sub modes or secondary flags. If we can figure that out I can get adb and change the usb modes.

 

 

Something else you can try is dd'd the expanded images from the update files of the 8100 to the respective partitions on the 5000 sd card. That should at least get something bootable to force NOR into recovery mode.

That is a huge task with no guarantee of working.  Each image must have the header removed and we're working with loop devices.  I will do that if it comes down to it..  but that will be later because I don't have time now.   

Can you get Key 1 working?

That is a huge task with no guarantee of working.  Each image must have the header removed and we're working with loop devices.  I will do that if it comes down to it..  but that will be later because I don't have time now.   

 

Can you get Key 1 working?

I have key 1 working, It just only seems to work though on a booted device following the steps I outlined, I have no clue why. Do you need it sent to you?

As for each image removing the header. You just need to comment out 1 line from my script and it will save the .img out for you.

[deleted post]

no I have it.  I think I've done all I have time to do today.  I'm making an AVIC-5000NEX SDCard and I will pick up on dd'ing the partitions tomorrow. 

You need working device to use testmode keys. As I said before, testmode keys checked in /lib/libNPSysCtrlHandler.so, so system need at least load this "dll" file during startup.

 

But I propose to look at the source code of the U-Boot sources, there is a lot of useful info. As I said before, it is possible to change boot flags in bsp (NOR flash) in U-Boot.

 

Look at uboot_imx\uboot_imx\src\common\cmd_bootconfigs.c

Yeah, but Keys N2 and N3 operate properly.  N1 does not.  That's the one I need. 

[deleted post]

So been looking around. The test mode looks like it may be the same as http://avic411.com/index.php?/topic/35253-advanced-puzzles-testmodekey-scriptexecini/

I have tried the script on the n_2 and the n_3 and get the following

Daniels-MacBook-Pro:~ daniel$ perl test.pl /Users/daniel/Desktop/testmode_n_3/TESTMODE_N.KEY 

002008000120ENHE

Daniels-MacBook-Pro:~ daniel$ perl test.pl /Users/daniel/Desktop/testmode_n_2/TESTMODE_N.KEY 

002008000120EIEY

[deleted post]

@whatisbypass. Can you dump the strings for that as I assume it's a bit different on our models.

[deleted post]

It really comes down to figuring out the method to the data in the testmode_n files as those do specific functions and n_2 and n_3 are the same up until the change from flag 8 to flag 12. So if we can figure out the bit setting or encryption (if they use encryption on those files)  We allow ourselves to flip the bits in the bsp without needing a jtag.

Also thinking about it, my 8000 did not work well with the 5000 sd card image (The screen would not tilt or think it could tilt) as it seemed to have something on the EXTDATA partition (the one partition that the updates don't touch). I wonder if the Bluetooth audio for Android Auto and the system is looking for some key or piece of information on this EXTDATA partition, that the x000's do not have.

But, again it comes down to figuring out the TestMode Keys, enabling debuging and ADB with them, then browsing the filesystem, seeing the logs and comparing the EXTDATA partitions.

[deleted post]

[deleted post]

[deleted post]

[deleted post]

Can you post your version of the script?

Also, @AdamOutler based on the above that would explain why the n_1 is not working, since it is not doing it from the norflash.

[deleted post]

Ok sweet. The TESTMODE_A that I have that works has the contents of:

007SERVICE003ALL00833333333007S

After decode which makes sense now.