Important information related to RIFF Box eMMC support

[Legija]

hi friends, any way to find bootloader repair with riff box? any manual etc...

best regards

If phone model is supported by dedicated DLL, simply click "Resurrection" button.
Otherwise open new topic with details and we will try to help.

For basic usage tips You can visit FAQ page:
RIFF JTAG Box FAQ - powered by phpMyFAQ 2.9.13

[spike_belmont]

Hello, what is the actual purpose of this "Update eMMC firmware" function? Does it mean that it is possible to update from eMMC v4.41 to 4.51 for example? or from 4.51 to 5.0?

[maanarman]

i need this emmc KLMAG4FEJA-A002 firmware please

[maanarman]

here you are

thanks

[giroplan]

Please tell me.How much dat need when upgrading firmware v3w00m? Thanks.

[voideater]

klmag2geac-b001

Does anyone know the TP for this chip? And KLMAG2GEAC-B002 as well if possible?

[yhomer]

Open serial port...OK
Connecting to the RIFF Box...OK
Firmware Version: 1.38.6b, JTAG Manager Version: 1.57 [BETA 4]

Connecting to the SD/eMMC Card...OK
Set I/O Voltage reads as 3.29V, SD_CLK Frequency is 2.50 MHz

Memory Type .......................... eMMC
Manufacturer ID ...................... 0x15
OEM/Application ID ................... 0x00
Product Name ......................... "V2W00M"
Package .............................. BGA
User Area Partition Size ............. 0x000747C00000 Bytes (29.12 GB)
Boot Partition Size .................. 0x000000400000 Bytes (4.00 MB)
RPMB Partition Size .................. 0x000000080000 Bytes (512.00 KB)
OCR Register ......................... 0xC0FF8080 (Dual Voltage, High Capacity)
Write Protection Bits ................ NONE
Boot Configuration ................... No Boot
Chip Revision ........................ 0.0
Multimedia Card Revision ............. 1.7 (eMMC v5.0)
Serial Number ........................ 0xC309AD98
Memory Manufacturing Date ............ October, 2013




Detected eMMC Chip, ID: 0x15/0x00 (V2W00M), User Area Partition = 0x000747C00000 Bytes (29.12 GB)

Reading the [KMV2W000LM-B506] eMMC Core Firmware...OK
Current Firmware Hash Code: 0180B011E737032AA355ACBD143438216896B06E5D3300567E 8152567FFD7AFA
Saved to File: [C:\Users\Tasya\Desktop\KMV2W000LM-B506_Firmware[0180B011].riffmmcfw]

what interface used?

[Legija]

Requirements:


- Huawei phone, Qualcomm EFI based
- update.app (firmware)
- update.app extractor (HuaweiUpdateExtractor_0.9.9.5)


Procedure:


1. Download firmware file (for example Huawei_C8816D_Android_04.3_EMUI_01.6_V100R001C541B 183_Firmware_Burma_Channell)
2. Extract *.zip archive to get "UPDATE.APP"

3. Start APP Extractor and open *.app file:





.
4. Right click anywhere on partitions list and select "Extract All"
5. Locate "GPT.img" in extracted data folder and rename it to "GPT.img.bin"
6. Start JTAG Manager, eMMC Plugin
7. Click "Parse official firmware" and select "GPT.img.bin" file from extracted folder.

Analizing the FullImage File...OK
Looking for the MBR Signature...OK

Current Phone/Image File is recognized to have the EFI Layout.

Initializing Temporary Storage File for User Area Partition...OK

Loaded Firmware File: "SBL1.img" into partition: <SBL1>
Loaded Firmware File: "SDI.img" into partition: <SDI>
Loaded Firmware File: "RPM.img" into partition: <RPM>
Loaded Firmware File: "TZ.img" into partition: <TZ>
Loaded Firmware File: "ABOOT.img" into partition: <ABOOT>
Loaded Firmware File: "MODEMST1.img" into partition: <MODEMST1>
Loaded Firmware File: "MODEMST2.img" into partition: <MODEMST2>
Loaded Firmware File: "MODEM.img" into partition: <MODEM>
Loaded Firmware File: "FSG.img" into partition: <FSG>
Loaded Firmware File: "PERSIST.img" into partition: <PERSIST>
Loaded Firmware File: "BOOT.img" into partition: <BOOT>
Loaded Firmware File: "RECOVERY.img" into partition: <RECOVERY>
Loaded Firmware File: "CUST.img" into partition: <CUST>
Loaded Firmware File: "CACHE.img" into partition: <CACHE>
Loaded Firmware File: "SYSTEM.img" into partition: <SYSTEM>
Loaded Firmware File: "USERDATA.img" into partition: <USERDATA>

Partitions parsed from the Binary File ................... 30
Partitions which have files with content ................. 16
Partitions not loaded with data due to some errors ....... 0
Partitions with data loaded into current layout .......... 16
The loaded data size (from firmware files) ............... 2.51 GB
 The total size of Partitions loaded ...................... 2.58 GB

8. Review parsed partitions and deselect (by double click) large partitions to save time (SYSTEM, USERDATA)


9. Click "Flash Selected"




---
Source of Huawei extractor:
Link

[otherboy123]

very nice solution for huawei thanks master

Sent from my MI 6 using Tapatalk

[joanbz]

please share firmware for KMQ72000SM

[Legija]

Hello dear users !


We took some time to prepare latest addition to JTAG Manager and built from scratch complete Sahara protocol support (both firehose and streaming download). We didn't just embedded freely available tools from Qualcomm (emmcdl and qh_loader), instead, we used own code.


Great work is done on eMMC Plugin too, which now supports USB, ISP and JTAG access. You can select partition on LU (Logical Unit) to parse.
Among other improvements, we added GPT repair/adjust which serves as analogue to patch0.xml used with QFIL.
"Adjust GPT" will automatically update checksums and resize userdata partition to fill whole chip. This is valuable in cases where gpt is from different chip size.


There is more work, but we feel confident that current functions can satisfy most of the needs in servicing and forensics fields.


So, for start, few important tips:


1. Make sure to have Qualcomm drivers installed
2. Most Snapdragon 200 firehose loaders don't have read support, also some will not output storage info (size, SN, brand). We found out that there is one universal firehose looader which supports all this, but uses a bit different protocol. As this is Alcatel loader, we named it "Alcatel Firehose".
It can be used with MSM8x10, MSM8x12, MSM8x26 which otherwise don't have read support. File is attached here.


3. Sahara protocol requires phone to be in EDL mode. To enter EDL mode, exist few methods:
1. Kill phone BootChain or GPT
2. Switch to EDL from ADB or from TWRP: (TWRP tested on some Samsung models)

"Adb reboot EDL"
3. Use EDL cable (Xiaomi phones for example)
4. Activate Diag mode and JTAG Manager will switch it to EDL automatically if phone supports it.
5. Hold Vol+ for 10 seconds (OnePLus models)

6. Short EDL TP-s if exist
7. Short CMD to GND
9. Most reliable method is to remove eMMC



During testing period I've received Xiaomi Redmi 3x device with locked MiCloud, so here is link to it's firmware with custom rom and unlocked bootloader, flashable as XML firmware.

AOSP ROM, micro GAPPS preinstalled:


Downloads for : Xiaomi Redmi 3 | AndroidFileHost.com | Download GApps, Roms, Kernels, Themes, Firmware and more. Free file hosting for all Android developers.




I'll add some videos to this post later, for now please test functionality and ask for clarification if there is anything unclear.

[nicolayer]

- added USB Connection Mode (Qualcomm Sahara)
- added support for parsing EFI,PIT,MBR-type dumps from UFS memory (Page Size = 0x1000)

Hi!

Does it mean expected a phisical connection of UFSmemory in nearest future?

[Legija]

Hi!

Does it mean expected a phisical connection of UFSmemory in nearest future?

For now via USB cable, for supported Qualcomm chipsets.
It's questionable if ISP connection to UFS is possible at all.

[turca]

Adjust GPT" will automatically update checksums and resize userdata partition to fill whole chip. This is valuable in cases where gpt is from different chip size

Now I can change emmc 4gb to 16gb?

[ruhl2121]

where can I download 1.81