vache

[TUT] Leaked JellyBean and Unlocked bootloader

192 posts in this topic

Acer-Club.ru got hands on a JellyBean leak for the CloudMobile (thanks to them). The other good news is that it have an unlockable bootloader. "fastboot oem unlock" is back.

So, you will need :

- Installed drivers for the phone. (You can find them here)

- AcerDownloadTools (also known as ADT) to flash the firmware.

- Leaked firmware

Extract both ADT and firmware.

Launch ADT with acer_DownloadTool.exe.

Reboot the phone in bootloader by removing batery, insert it again and then plug your phone with USB cable while pressing Vol+.

You should see "boot mode: fastboot".

Select "Mobile Phone" tab, select the folder where you extract the firmware and tick checkboxes as shown below :

adt.png

Click "Start" button and wait ~5min until the phone reboot by itself.

Once booted, we will know unlock bootloader. For that, reboot again in bootloader, then launch command :

fastboot -i 0x0502 oem unlock[/CODE]

If you don't know how to do that, you can download this automated script : http://vache-android...auto_unlock.zip. Unzip the [b]"auto_unlock"[/b] folder then launch [b]"unlock_CM.bat" [/b]when booted in bootloader[b].[/b]

Enjoy you're updated/unlocked CloudMobile. You can now safely flash the recovery.

4

Share this post


Link to post
Share on other sites

Thanks, is everything wiped?

Will I have to re-install everthing

Ian

0

Share this post


Link to post
Share on other sites

This is great news thank you. Will hold off and see what comes out of this.

0

Share this post


Link to post
Share on other sites

Thanks, is everything wiped?

Will I have to re-install everthing

Ian

Yes it will make a factory reset.

0

Share this post


Link to post
Share on other sites

Anyone tried it yet? Post your experience here (any issues as well)

0

Share this post


Link to post
Share on other sites

This thing don`t work ,tried it but i have Flash Process Failed what to do ?

0

Share this post


Link to post
Share on other sites

Post the ADB log to know what appends. (in LogFile folder)

0

Share this post


Link to post
Share on other sites

BaseFastboot start

Flash Process Beginning

[OutputMsg_Devices] 46c144c5 fastboot

[OutputMsg_Devices] Device_ID [46c144c5]

[Ft_Command_Devices] Exit code is [0]

flash aboot "C:\Smartphone\A9\Corp_Campaign\Acer_AV041_S500_RV41RB01_WW_GEN1\ExtractBinFolder\emmc_appsboot.mbn"

[Ft_Command] : [info] : Args : flash aboot "C:\Smartphone\A9\Corp_Campaign\Acer_AV041_S500_RV41RB01_WW_GEN1\ExtractBinFolder\emmc_appsboot.mbn"

[ErrorMsg] sending 'aboot' (259 KB)...

[ErrorMsg] OKAY [ 0.016s]

[ErrorMsg] writing 'aboot'...

[ErrorMsg] OKAY [ 0.078s]

[ErrorMsg] finished. total time: 0.094s

[Ft_Command] Exit code is [0]

flash aboot OKAY. iRet0

Reboot the device while flash bootloader before bin files!

[Ft_Command] : [info] : Args : reboot-bootloader

[ErrorMsg] rebooting into bootloader...

[ErrorMsg] OKAY [ 0.000s]

[ErrorMsg] finished. total time: 0.000s

[Ft_Command] Exit code is [0]

flash bin "C:\Smartphone\A9\Corp_Campaign\Acer_AV041_S500_RV41RB01_WW_GEN1\Acer_AV041_S500_RV41RB01_WW_GEN1_1.bin"

[Ft_Command] : [info] : Args : flash bin "C:\Smartphone\A9\Corp_Campaign\Acer_AV041_S500_RV41RB01_WW_GEN1\Acer_AV041_S500_RV41RB01_WW_GEN1_1.bin"

[ErrorMsg] < waiting for device >

[ErrorMsg] sending 'bin' (166949 KB)...

[ErrorMsg] OKAY [ 12.391s]

[ErrorMsg] writing 'bin'...

[ErrorMsg] (bootloader) rpm update ready!

[ErrorMsg] FAILED (remote: failed to write bin!)

[ErrorMsg] finished. total time: 113.620s

[Ft_Command] Exit code is [0]

[Clean_Fastboot_Data] Delete fastboot.exe

[Clean_Fastboot_Data] Delete AdbWinApi.dll

post-998941-0-20828500-1355471262_thumb.

Edited by Rendevous
0

Share this post


Link to post
Share on other sites

Something strange here :

Looks like you didn't untick "Flash bootloader before bin". (or just for the screenshot :P)

You have a Acer_AV041_S500_RV41RB01_WW_GEN1 where the leak is Acer_AV051_S500_RV14RB02_WW_GEN1 ?!?

You sure this is the good log ? (LogFile/Date/Log_date_time_UI.txt)

Edited by vache
0

Share this post


Link to post
Share on other sites

you are right the log provided is old this is the newtest one

BaseFastboot start

Flash Process Beginning

[Ft_Command_Devices] Exit code is [0]

[OutputMsg_Devices] 58921b24 fastboot

[OutputMsg_Devices] Device_ID [58921b24]

flash bin "C:\Users\Roberto\Desktop\Acer\Acer_AV051_S500_RV14RB02_WW_GEN1\Acer_AV051_S500_RV14RB02_WW_GEN1_1.bin"

[Ft_Command] : [info] : Args : flash bin "C:\Users\Roberto\Desktop\Acer\Acer_AV051_S500_RV14RB02_WW_GEN1\Acer_AV051_S500_RV14RB02_WW_GEN1_1.bin"

[ErrorMsg] sending 'bin' (163723 KB)...

[ErrorMsg] OKAY [ 12.107s]

[ErrorMsg] writing 'bin'...

[ErrorMsg] FAILED (remote: Device is fused and CPU_TYPE does not match!)

[ErrorMsg] finished. total time: 23.363s

[Ft_Command] Exit code is [0]

[Clean_Fastboot_Data] Delete fastboot.exe

[Clean_Fastboot_Data] Delete AdbWinApi.dll

Edited by Rendevous
0

Share this post


Link to post
Share on other sites

So this is not the good log file, check my previous post.

That's a bad news : Leak can be flashd on CPU_TYPE=8260a-3, where you may have CPU_TYPE=8260a-1.

If you now how to use fastboot could you post result of "fastboot -i 0x0502 oem device-infos" ?

Edited by vache
0

Share this post


Link to post
Share on other sites

look at the picture ,what to do ?

post-998941-0-67106600-1355472558_thumb.

Edited by Rendevous
0

Share this post


Link to post
Share on other sites

This should mean that if I had the balls i could try this and it should work: 12.14.2012-12.25.png

I'll first repair my ZTE Blade's digitizer this evening so I have a backup Phone in case it goes wrong ...

Edited by wimmme
0

Share this post


Link to post
Share on other sites

Yup it worked for my 8260a-3 :)

Is there a way to know the proc version before buying (like, for example, from serial number, or all S500 available now are a-3 while a-1 was only the first selled units)?

I ask because the locked bootloader was the only thing preventing me to buy (well, that and the availability of an extended battery, from acer or any other supplier - still no luck on this one)...But it seems that depending on the proc version, some S500 can still be unlockable...

0

Share this post


Link to post
Share on other sites

No way to know. I thought the 8260-a1 was for the dual-carrier version that is sold in a few countries.

0

Share this post


Link to post
Share on other sites

Is there a way to know the proc version before buying (like, for example, from serial number, or all S500 available now are a-3 while a-1 was only the first selled units)?

I ask because the locked bootloader was the only thing preventing me to buy (well, that and the availability of an extended battery, from acer or any other supplier - still no luck on this one)...But it seems that depending on the proc version, some S500 can still be unlockable...

Hard to say. My CM had 8260a-1 before i brick it and goes to SAV, after they changed motherboard, it's now 8260a-3.

0

Share this post


Link to post
Share on other sites

look at the picture ,what to do ?

At the moment, we don't have a workaround for that.

0

Share this post


Link to post
Share on other sites

Bad news then...

There could be 2 options i guess,a leaked firmware for this ORGROD variant with 8260A-1 cpu or modifying the leaked firmware and change the hardware string,after all,i do not think there is any difference is functionality between 8260A-3 and 8260A-1...no?

0

Share this post


Link to post
Share on other sites

Bad news then...

There could be 2 options i guess,a leaked firmware for this ORGROD variant with 8260A-1 cpu or modifying the leaked firmware and change the hardware string,after all,i do not think there is any difference is functionality between 8260A-3 and 8260A-1...no?

If the hardware string is within the part that is crypto-signed and checked during flash/bootload, this will not work. And I can't see why it would not be included in the signature...

Still, this leaked jellybean is very good news. It may even means that the final jellybean will include an unloackable bootloader :) Maybe Acer listen to their customers (not like motorola - I have a Defy and people complain about locked bootloader since it was relased 2 years ago :-/ )

0

Share this post


Link to post
Share on other sites

Very likely,makes me wonder if that signature can't be attained from previous orgrod firmware's and injected in this one?

0

Share this post


Link to post
Share on other sites

So, for S500 ORGROD:

unlock bootloader-no

Jelly bean-no.

0

Share this post


Link to post
Share on other sites

Hello,

I'm new here and new to cloudmobile S500....

With the risk of being out of topic can anyone help me to sim unlock my Cloudmobile?

Does this leak of Jelly Bean make the unlock by flashing another baseband?

Thx!

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now

MoDaCo is part of the MoDaCo.network, © Paul O'Brien 2002-2016. MoDaCo uses IntelliTxt technology.