Nexus 7 2012 Help needed

[schneemaier]

Hi, i am not sure what happened to my Nexus 7 (16GB Wifi). It was sitting for a long time and now when i try to boot nothing happens. I found this repositiory so started to follow the instructions.

I am able to get the device in APX mode with holding the power button to ~20 seconds

[Fri Nov  5 21:16:27 2021] usb 1-1: new high-speed USB device number 57 using xhci_hcd
[Fri Nov  5 21:16:28 2021] usb 1-1: New USB device found, idVendor=0955, idProduct=7330, bcdDevice= 1.03
[Fri Nov  5 21:16:28 2021] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[Fri Nov  5 21:16:28 2021] usb 1-1: Product: APX
[Fri Nov  5 21:16:28 2021] usb 1-1: Manufacturer: NVIDIA Corp.

I am able to execute step 4 with success but after that i am stuck.

Step 5 does not work:

root@xxxx:~/tegra30_debrick# ./utils/nvflash_v1.13.87205 --getbct --bct BCT_READBACK_N7.BIN --configfile ./utils/flash.cfg
Nvflash v1.13.87205 started

I can only exit it with unplugging the device

Skipping step 5 step 6 sometimes works:

root@xxxx:~/tegra30_debrick# ./utils/nvflash_v1.13.87205_miniloader_patched --setbct --bct ./bct/nexus_7_grouper_bct.bin --configfile ./utils/flash.cfg --bl ./bootloader/bootloader-grouper-4.23.img --go
Nvflash v1.13.87205 started
chip uid from BR is: 0x0000000000000000015d24a818180c05
rcm version 0X30001
System Information:
   chip name: unknown
   chip id: 0x30 major: 1 minor: 3
   chip sku: 0x83
   chip uid: 0x0000000000000000015d24a818180c05
   macrovision: disabled
   hdcp: enabled
   jtag: disabled
   sbk burned: true
   dk burned: true
   boot device: emmc
   operating mode: 3
   device config strap: 1
   device config fuse: 17
   sdram config strap: 0

sending file: ./bct/nexus_7_grouper_bct.bin
- 6128/6128 bytes sent
./bct/nexus_7_grouper_bct.bin sent successfully
downloading bootloader -- load address: 0x80108000 entry point: 0x80108000
sending file: ./bootloader/bootloader-grouper-4.23.img
- 2150992/2150992 bytes sent
./bootloader/bootloader-grouper-4.23.img sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully

After this step i have the Google logo on the screen, but when i try step 7 i get an error :

root@xxxx:~/tegra30_debrick# ./utils/nvflash_v1.13.87205_miniloader_patched --resume --download EBT bootloader/bootloader-grouper-4.23.img --sync --configfile ./utils/flash.cfg
Nvflash v1.13.87205 started
[resume mode]
failed executing command 20 NvError 0x120002
Unable to retrieve Partition table from device NvError 0x0
command failure: partition not found in partition table (bad data)
bootloader status: partition table is required for this command (code: 8) message: nverror:0x5 (0x1000005) flags: 0

Any suggestion? Is it recoverable or bad eMMC?

Thanks

[tofurky]

it may be an issue with emmc (spontaneous bricking is a bad sign).

could you try a raw emmc read with nvflash? it should go something like this, but the battery on my n7 is dead so i'm unable to test (yet):

sudo ./utils/nvflash_v1.13.87205_miniloader_patched --resume --rawdeviceread 0 2048 mmc-0-2048.bin
gzip mmc-0-2048.bin

then attach mmc-0-2048.bin.gz to the issue? (.zip also works, github should allow both). .bin file should be 8MB uncompressed i think (4k sectors).

you'd need to run that --rawdeviceread after these first two commands:

sudo ./fusee-launcher/fusee-launcher.py ./payload/uart_payload_n7.bin -P 7330
sudo ./utils/nvflash_v1.13.87205_miniloader_patched --setbct --bct ./bct/nexus_7_grouper_bct.bin --configfile ./utils/flash.cfg --bl ./bootloader/bootloader-grouper-4.23.img --go

if emmc is bad, it might fail to do the read at all. the first 8MB of emmc would include the BCT and partition table and beginning of the bootloader partition.

[schneemaier]

Thanks for the advice. I tried but got an error:

root@xxxx:~/tegra30_debrick# ./utils/nvflash_v1.13.87205_miniloader_patched --resume --rawdeviceread 0 2048 mmc-0-2048.bin
Nvflash v1.13.87205 started
[resume mode]
failed executing command 31 NvError 0x120002
command failure: readdeviceraw failed (bad data)

I guess the eMMC is bad :(

[tofurky]

yeah, i think it's a hardware issue. this is what you should see:

matt@aquos:~/devel/ouya/tegra30_debrick$ sudo ./fusee-launcher/fusee-launcher.py ./payload/uart_payload_n7.bin -P 7330
2021-11-06 21:26:57,674 INFO:usb.core:find(): using backend "usb.backend.libusb1"

Important note: on desktop Linux systems, we currently require an XHCI host controller.
A good way to ensure you're likely using an XHCI backend is to plug your
device into a blue 'USB 3' port.

Identified a Linux system; setting up the appropriate backend.
intermezzo_size: 0x00000078
target_payload_size: 0x000005ee
Found a Tegra with Device ID: b'05163c81bc245d01'
Stack snapshot: b'0000000000000000100000003c9f0040'
EndpointStatus_stack_addr: 0x40009f3c
ProcessSetupPacket SP: 0x40009f30
InnerMemcpy LR stack addr: 0x40009f20
overwrite_len: 0x00004f20
overwrite_payload_off: 0x00004de0
payload_first_length: 0x000005ee
overwrite_payload_off: 0x00004de0
payload_second_length: 0x00000000
b'00a0004000300040ee05000000000000'
Setting rcm msg size to 0x00030064
RCM payload (len_insecure): b'64000300'

Setting ourselves up to smash the stack...
Payload offset of intermezzo: 0x00000074
overwrite_payload_off: 0x00004de0
overwrite_len: 0x00004f20
payload_overwrite_len: 0x00004e5c
overwrite_payload_off: 0x00004de0
smash_padding: 0x000047f2
overwrite_payload_off: 0x00004de0
Uploading payload...
txing 20480 bytes total
txing 4096 bytes (0 already sent) to buf[0] 0x40003000
txing 4096 bytes (4096 already sent) to buf[1] 0x40005000
txing 4096 bytes (8192 already sent) to buf[0] 0x40003000
txing 4096 bytes (12288 already sent) to buf[1] 0x40005000
txing 4096 bytes (16384 already sent) to buf[0] 0x40003000
Smashing the stack...
sending status request with length 0x00004f20
The USB device stopped responding-- sure smells like we've smashed its stack. :)
Launch complete!
matt@aquos:~/devel/ouya/tegra30_debrick$ sudo ./utils/nvflash_v1.13.87205_miniloader_patched --setbct --bct ./bct/nexus_7_grouper_bct.bin --configfile ./utils/flash.cfg --bl ./bootloader/bootloader-grouper-4.23.img --go
Nvflash v1.13.87205 started
chip uid from BR is: 0x0000000000000000015d24bc813c1605
rcm version 0X30001
System Information:
   chip name: unknown
   chip id: 0x30 major: 1 minor: 3
   chip sku: 0x83
   chip uid: 0x0000000000000000015d24bc813c1605
   macrovision: disabled
   hdcp: enabled
   jtag: disabled
   sbk burned: true
   dk burned: true
   boot device: emmc
   operating mode: 3
   device config strap: 1
   device config fuse: 17
   sdram config strap: 0

sending file: ./bct/nexus_7_grouper_bct.bin
- 6128/6128 bytes sent
./bct/nexus_7_grouper_bct.bin sent successfully
downloading bootloader -- load address: 0x80108000 entry point: 0x80108000
sending file: ./bootloader/bootloader-grouper-4.23.img
- 2150992/2150992 bytes sent
./bootloader/bootloader-grouper-4.23.img sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
matt@aquos:~/devel/ouya/tegra30_debrick$ sudo ./utils/nvflash_v1.13.87205_miniloader_patched --resume --rawdeviceread 0 2048 mmc-0-2048.bin
Nvflash v1.13.87205 started
[resume mode]
Bytes to receive 8388608
receiving file: mmc-0-2048.bin, expected size: 8388608 bytes
/ 8388608/8388608 bytes received
file received successfully

[schneemaier]

Thanks. It seems to be a hardware error. I can execute all but the last step

[pgwipeout]

Know anyone with a hot air station?

…

On Mon, Nov 8, 2021, 18:43 schneemaier ***@***.***> wrote: Thanks. It seems to be a hardware error. I can execute all but the last step — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#5 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAFWB7JNOLTEKVP2CVNYAQ3ULBOBHANCNFSM5HPAR43Q> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[schneemaier]

Probably i can get access to a hotair station, but i am not that good with these type of components :)