38 replies to this topic

[ahngau]

ZTE put this up on the their web page a few days ago:-

http://www.zte.com.c...70587791564.zip

Edited by ahngau, 08 May 2011 - 04:33 PM.

[Jekle]

ahngau, on May 8 2011, 17:32, said:

ZTE put this up on the their web page a few days ago:-

http://www.zte.com.c...70587791564.zip

Great News Thank you, is this for China Unicom?

Is it 2.2?

Downloading Now

Seems to be a .bin update which you go to about and system updates and it looks like it does a TPT update

Edited by Jekle, 08 May 2011 - 05:23 PM.

[hecatae]

Jekle, on May 8 2011, 18:05, said:

Great News Thank you, is this for China Unicom?

Is it 2.2?

Downloading Now

can you multiupload it when downloaded, thank you

[Jekle]

hecatae, on May 8 2011, 18:22, said:

can you multiupload it when downloaded, thank you

Will do, it downloaded quickly, Why the need for the mirror?

Edited by Jekle, 08 May 2011 - 05:26 PM.

[wbaw]

Jekle, on May 8 2011, 18:05, said:

Great News Thank you, is this for China Unicom?

Is it 2.2?

Downloading Now

Seems to be a .bin update which you go to about and system updates and it looks like it does a TPT update

It is a gen2 image.bin TPT  

[ph0o]

That means what?

I have an Gen1 Blade, so i have to change it to Gen2 before i apply the update?

[Jekle]

wbaw, on May 8 2011, 19:21, said:

It is a gen2 image.bin TPT  

How to extract?

[shootomanUK]

MIRRORS:

Filename: P020110505570587791564.zip (151.12 MB)

MD5: 6E087173054D426B83500AA40B232F08



http://rapidshare.co...70587791564.zip

http://www.megaupload.com/?d=NVV5G84H

http://depositfiles....files/ppl2e0kr6

http://hotfile.com/d...791564.zip.html

http://www.zshare.ne...92084573a33da4/

[wbaw]

ph0o, on May 8 2011, 19:41, said:

That means what?

I have an Gen1 Blade, so i have to change it to Gen2 before i apply the update?

Firstly, this is Chinese, so...

You do not want to install this file on your phone

It'll break stuff.

However, if you're stupid, then you'll need a proper Gen2 phone (upgraded using windows flasher, or bought as Gen2, not TPT upgraded), then you'll need to put image.bin in the image folder on your sd card, then power on with vol+ & menu held to install.

I'll repeat that you do not want to install this.

However, it's useful for developers, this is the first proper image.bin that we've seen & it opens the door to tpt on proper gen2 phones.


This is from build.prop

ro.build.display.id=UNI_CN_V880 1.1
ro.build.version.incremental=20110426.142154
ro.build.version.sdk=8
ro.build.version.codename=REL
ro.build.version.release=2.2
ro.build.date=Tue Apr 26 14:34:55 CST 2011
ro.build.date.utc=1303799695

Edited by wbaw, 08 May 2011 - 06:53 PM.

[Jekle]

wbaw, on May 8 2011, 19:51, said:

Firstly, this is Chinese, so...

You do not want to install this file on your phone

It'll break stuff.

However, if you're stupid, then you'll need a proper Gen2 phone (upgraded using windows flasher, or bought as Gen2, not TPT upgraded), then you'll need to put image.bin in the image folder on your sd card, then power on with vol+ & menu held to install.

I'll repeat that you do not want to install this.

However, it's useful for developers, this is the first proper image.bin that we've seen & it opens the door to tpt on proper gen2 phones.
This is from build.prop

ro.build.display.id=UNI_CN_V880 1.1
ro.build.version.incremental=20110426.142154
ro.build.version.sdk=8
ro.build.version.codename=REL
ro.build.version.release=2.2
ro.build.date=Tue Apr 26 14:34:55 CST 2011
ro.build.date.utc=1303799695

Can you tell us how extract it or can you make a dump of the ROM?

[ph0o]

wbaw, on May 8 2011, 18:51, said:

Firstly, this is Chinese, so...

You do not want to install this file on your phone

It'll break stuff.

However, if you're stupid, then you'll need a proper Gen2 phone (upgraded using windows flasher, or bought as Gen2, not TPT upgraded), then you'll need to put image.bin in the image folder on your sd card, then power on with vol+ & menu held to install.

I'll repeat that you do not want to install this.

However, it's useful for developers, this is the first proper image.bin that we've seen & it opens the door to tpt on proper gen2 phones.
This is from build.prop

ro.build.display.id=UNI_CN_V880 1.1
ro.build.version.incremental=20110426.142154
ro.build.version.sdk=8
ro.build.version.codename=REL
ro.build.version.release=2.2
ro.build.date=Tue Apr 26 14:34:55 CST 2011
ro.build.date.utc=1303799695

Thanks for the explanation

[fonix232]

Hmm, we need to take a look and do a diff on the Gen2 TPT coding, to see how to dismember the bin file...
As I saw it contains the RAW data of the mbn and img files, system.img at the end, and probably partitions.mbn at the very beginning...

[Jekle]

fonix232, on May 8 2011, 20:10, said:

Hmm, we need to take a look and do a diff on the Gen2 TPT coding, to see how to dismember the bin file...
As I saw it contains the RAW data of the mbn and img files, system.img at the end, and probably partitions.mbn at the very beginning...

how d'you view or extract it? Thanks

[fonix232]

Jekle, on May 8 2011, 21:29, said:

how d'you view or extract it? Thanks

Viewing is easy, Total Commander's Viewer F3
Noone extracted it yet, I guess wbaw did the same and copied the build.prop from the end of the file.
BUT, I am disassembling OEMSBL now, and trying to figure it out how the bin file works... dammit ZTE, y u no use generic stuff again?

[wbaw]

fonix232, on May 8 2011, 20:42, said:

Viewing is easy, Total Commander's Viewer F3
Noone extracted it yet, I guess wbaw did the same and copied the build.prop from the end of the file.
BUT, I am disassembling OEMSBL now, and trying to figure it out how the bin file works... dammit ZTE, y u no use generic stuff again?

cpg already tried that & he wrote some c source that might produce an image.bin

http://android.modac...p...t&p=1677792

Edited by wbaw, 08 May 2011 - 11:15 PM.

[cpg]

My initial code for the image.bin format was close to complete, but this allowed me to correct it and to fill some holes i couldn't get from the gen2 oemsbl.
I changed the code to work, but i guess describing the format here might be more helpful.

The header of image.bin starts with the text "ZTE SOFTWARE UPDATE PACKAGE" filled up to offset 0x40 with zeroes.
The dword at 0x40 is the number of entries included in the update.
After this, for every entry, 6 dwords follow.

struct
{
	unsigned type;
	unsigned offset;
	unsigned size;
	unsigned hasheader;
	unsigned headeroffset;
	unsigned headersize;
}

The types are (not all of these are normally used for TPT images):

0x01 - qcsblhd_cfgdata
0x02 - qcsbl
0x03 - oemsbl (+ header)
0x04 - amss (+ header)
0x05 - appsboot (+ header)
0x06 - apps (+ header)
0x13 - boot image
0x14 - system image
0x15 - recovery image
0x16 - userdata image
0x17 - misc image
0x18 - cache image
0x19 - splash image
0x1c - partition
0x1d - partition_zte
0x1e - end of list marker (though not required since there's a counter at 0x40 anyway)

Partition and partition_zte always have to be the first and second entries (respectively) in the index; that's what oemsbl assumes. These first two entries are read with a fixed size, but the actual size of partition_zte.mbn in the image can be varied (in my code i padded it with zeroes at first, but this official update does not).
In case you miss it, cefs.mbn is never used (the original TPT method doesn't use it either) as the settings (IMEI etc) are stored on that part and overwriting those isn't something TPT should do.

The header in the official update is padded with zeroes up to 0x400, though oemsbl only reads the first 20 items (up to offset 0x224, for the whole header).
A block of 128 bytes (zeroes) is added to the end of image.bin, with "ZTE SOFTWARE UPDATE PACKAGE" at offset 0x40 of it.

Again, though, double check this if you can. I can't test this myself as i have my original (gen1) oemsbl.

Attached Files

•  ztepack.zip   2.57K   281 downloads

[wbaw]

great work, cpg, really appreciate it. if i run ztepack -x & then ztepack -p the resulting image.bin doesn't exactly match the original.

[cpg]

If it's only the 0x1e in the header - my code puts it there as a (redundant) end marker. If the length is correct (index 0x40), the 0x1e item will never be processed.
The file format allows for different ordering of the files, but when i quickly tested this version, it only showed that single byte difference to me.

[wbaw]

cpg, on May 9 2011, 00:23, said:

If it's only the 0x1e in the header - my code puts it there as a (redundant) end marker. If the length is correct (index 0x40), the 0x1e item will never be processed.
The file format allows for different ordering of the files, but when i quickly tested this version, it only showed that single byte difference to me.

Great job then

I just did md5sum & saw they were different.

I'll have to see if I can compile it for the phone & use it for my tpt backup & repartition tool.

[hecatae]

wont install on a cm7.0.3, off to find a stock 2.2 and try the internal update

edit same issue as previous uv880 rom, romdumping now

edit: this changes your amss.mbn and you will not get network in the uk

baseband version P729J_GENERICB01


P729CUV1.0.0B13

Edited by hecatae, 09 May 2011 - 10:59 AM.