[TUT] Leaked JellyBean and Unlocked bootloader

[Guest vache]

Acer-Club.ru got hands on a JellyBean leak for the CloudMobile (thanks to them). The other good news is that it have an unlockable bootloader. "fastboot oem unlock" is back.

So, you will need :

- Installed drivers for the phone. (You can find them here)

- AcerDownloadTools (also known as ADT) to flash the firmware.

- Leaked firmware

Extract both ADT and firmware.

Launch ADT with acer_DownloadTool.exe.

Reboot the phone in bootloader by removing batery, insert it again and then plug your phone with USB cable while pressing Vol+.

You should see "boot mode: fastboot".

Select "Mobile Phone" tab, select the folder where you extract the firmware and tick checkboxes as shown below :

Click "Start" button and wait ~5min until the phone reboot by itself.

Once booted, we will know unlock bootloader. For that, reboot again in bootloader, then launch command :

fastboot -i 0x0502 oem unlock[/CODE]

If you don't know how to do that, you can download this automated script : http://vache-android...auto_unlock.zip. Unzip the [b]"auto_unlock"[/b] folder then launch [b]"unlock_CM.bat" [/b]when booted in bootloader[b].[/b]

Enjoy you're updated/unlocked CloudMobile. You can now safely flash the recovery.

[Guest ian00009]

Thanks, is everything wiped?

Will I have to re-install everthing

Ian

[Guest Chrispynutt]

This is great news thank you. Will hold off and see what comes out of this.

[Guest vache]

Thanks, is everything wiped?

Will I have to re-install everthing

Ian

Yes it will make a factory reset.

[Guest scarba]

If anyone tried it will he/she be kind and post 1-2 screenshots?

[Guest johndoemodaco]

The russians tested it.

[Guest trics]

Anyone tried it yet? Post your experience here (any issues as well)

[Guest Rendevous]

This thing don`t work ,tried it but i have Flash Process Failed what to do ?

[Guest vache]

Post the ADB log to know what appends. (in LogFile folder)

[Guest Rendevous]

BaseFastboot start

Flash Process Beginning

[OutputMsg_Devices] 46c144c5 fastboot

[OutputMsg_Devices] Device_ID [46c144c5]

[Ft_Command_Devices] Exit code is [0]

flash aboot "C:\Smartphone\A9\Corp_Campaign\Acer_AV041_S500_RV41RB01_WW_GEN1\ExtractBinFolder\emmc_appsboot.mbn"

[Ft_Command] : [info] : Args : flash aboot "C:\Smartphone\A9\Corp_Campaign\Acer_AV041_S500_RV41RB01_WW_GEN1\ExtractBinFolder\emmc_appsboot.mbn"

[ErrorMsg] sending 'aboot' (259 KB)...

[ErrorMsg] OKAY [ 0.016s]

[ErrorMsg] writing 'aboot'...

[ErrorMsg] OKAY [ 0.078s]

[ErrorMsg] finished. total time: 0.094s

[Ft_Command] Exit code is [0]

flash aboot OKAY. iRet0

Reboot the device while flash bootloader before bin files!

[Ft_Command] : [info] : Args : reboot-bootloader

[ErrorMsg] rebooting into bootloader...

[ErrorMsg] OKAY [ 0.000s]

[ErrorMsg] finished. total time: 0.000s

[Ft_Command] Exit code is [0]

flash bin "C:\Smartphone\A9\Corp_Campaign\Acer_AV041_S500_RV41RB01_WW_GEN1\Acer_AV041_S500_RV41RB01_WW_GEN1_1.bin"

[Ft_Command] : [info] : Args : flash bin "C:\Smartphone\A9\Corp_Campaign\Acer_AV041_S500_RV41RB01_WW_GEN1\Acer_AV041_S500_RV41RB01_WW_GEN1_1.bin"

[ErrorMsg] < waiting for device >

[ErrorMsg] sending 'bin' (166949 KB)...

[ErrorMsg] OKAY [ 12.391s]

[ErrorMsg] writing 'bin'...

[ErrorMsg] (bootloader) rpm update ready!

[ErrorMsg] FAILED (remote: failed to write bin!)

[ErrorMsg] finished. total time: 113.620s

[Ft_Command] Exit code is [0]

[Clean_Fastboot_Data] Delete fastboot.exe

[Clean_Fastboot_Data] Delete AdbWinApi.dll

Edited December 14, 2012 by Rendevous

[Guest vache]

Something strange here :

Looks like you didn't untick "Flash bootloader before bin". (or just for the screenshot :P)

You have a Acer_AV041_S500_RV41RB01_WW_GEN1 where the leak is Acer_AV051_S500_RV14RB02_WW_GEN1 ?!?

You sure this is the good log ? (LogFile/Date/Log_date_time_UI.txt)

Edited December 14, 2012 by vache

[Guest Rendevous]

you are right the log provided is old this is the newtest one

BaseFastboot start

Flash Process Beginning

[Ft_Command_Devices] Exit code is [0]

[OutputMsg_Devices] 58921b24 fastboot

[OutputMsg_Devices] Device_ID [58921b24]

flash bin "C:\Users\Roberto\Desktop\Acer\Acer_AV051_S500_RV14RB02_WW_GEN1\Acer_AV051_S500_RV14RB02_WW_GEN1_1.bin"

[Ft_Command] : [info] : Args : flash bin "C:\Users\Roberto\Desktop\Acer\Acer_AV051_S500_RV14RB02_WW_GEN1\Acer_AV051_S500_RV14RB02_WW_GEN1_1.bin"

[ErrorMsg] sending 'bin' (163723 KB)...

[ErrorMsg] OKAY [ 12.107s]

[ErrorMsg] writing 'bin'...

[ErrorMsg] FAILED (remote: Device is fused and CPU_TYPE does not match!)

[ErrorMsg] finished. total time: 23.363s

[Ft_Command] Exit code is [0]

[Clean_Fastboot_Data] Delete fastboot.exe

[Clean_Fastboot_Data] Delete AdbWinApi.dll

Edited December 14, 2012 by Rendevous

[Guest vache]

So this is not the good log file, check my previous post.

That's a bad news : Leak can be flashd on CPU_TYPE=8260a-3, where you may have CPU_TYPE=8260a-1.

If you now how to use fastboot could you post result of "fastboot -i 0x0502 oem device-infos" ?

Edited December 14, 2012 by vache

[Guest Rendevous]

look at the picture ,what to do ?

Edited December 14, 2012 by Rendevous

[Guest wimmme]

This should mean that if I had the balls i could try this and it should work:

I'll first repair my ZTE Blade's digitizer this evening so I have a backup Phone in case it goes wrong ...

Edited December 14, 2012 by wimmme

[Guest]

Yup it worked for my 8260a-3 :)

[Guest gkai]

Yup it worked for my 8260a-3 :)

Is there a way to know the proc version before buying (like, for example, from serial number, or all S500 available now are a-3 while a-1 was only the first selled units)?

I ask because the locked bootloader was the only thing preventing me to buy (well, that and the availability of an extended battery, from acer or any other supplier - still no luck on this one)...But it seems that depending on the proc version, some S500 can still be unlockable...

[Guest]

No way to know. I thought the 8260-a1 was for the dual-carrier version that is sold in a few countries.

[Guest vache]

Is there a way to know the proc version before buying (like, for example, from serial number, or all S500 available now are a-3 while a-1 was only the first selled units)?

I ask because the locked bootloader was the only thing preventing me to buy (well, that and the availability of an extended battery, from acer or any other supplier - still no luck on this one)...But it seems that depending on the proc version, some S500 can still be unlockable...

Hard to say. My CM had 8260a-1 before i brick it and goes to SAV, after they changed motherboard, it's now 8260a-3.

[Guest vache]

look at the picture ,what to do ?

At the moment, we don't have a workaround for that.

[Guest Dum3]

Bad news then...

There could be 2 options i guess,a leaked firmware for this ORGROD variant with 8260A-1 cpu or modifying the leaked firmware and change the hardware string,after all,i do not think there is any difference is functionality between 8260A-3 and 8260A-1...no?

[Guest gkai]

Bad news then...

There could be 2 options i guess,a leaked firmware for this ORGROD variant with 8260A-1 cpu or modifying the leaked firmware and change the hardware string,after all,i do not think there is any difference is functionality between 8260A-3 and 8260A-1...no?

If the hardware string is within the part that is crypto-signed and checked during flash/bootload, this will not work. And I can't see why it would not be included in the signature...

Still, this leaked jellybean is very good news. It may even means that the final jellybean will include an unloackable bootloader :) Maybe Acer listen to their customers (not like motorola - I have a Defy and people complain about locked bootloader since it was relased 2 years ago :-/ )

[Guest Dum3]

Very likely,makes me wonder if that signature can't be attained from previous orgrod firmware's and injected in this one?

[Guest srsdani]

So, for S500 ORGROD:

unlock bootloader-no

Jelly bean-no.

[Guest dlallyn]

Hello,

I'm new here and new to cloudmobile S500....

With the risk of being out of topic can anyone help me to sim unlock my Cloudmobile?

Does this leak of Jelly Bean make the unlock by flashing another baseband?

Thx!