Pro¹ X - backup, restore and repair device specific partitions

[mosen 202]

Edited the first post with working repair instructions using restorecon.
Ii just now successfully found that way to be working on my side. 🥳🎉

[sspiff 29]

6 hours ago, mosen said:

Ii just now successfully found that way to be working on my side. 🥳🎉

Does this also give you working attestation?

[mosen 202]

10 minutes ago, sspiff said:

Does this also give you working attestation?

That is 100% a matter of having a (backup?) persit partition with keys contained in the data folder.
User Ducksoup had a question that also involves identifying whether a partition or image of a partition contains keys at all.
To not double post too much, i invite you to read how to check for keys here:

 

Edited August 19, 2022 by mosen

[sspiff 29]

5 minutes ago, mosen said:

That is 100% a matter of having a (backup?) persit partition with keys contained in the data folder.
User Ducksoup had a question that also involves identifying whether a partition or image of a partition contains keys at all.

I read this shortly after asking here. I'll continue the discussion there.

[mosen 202]

Updated the first post with warnings regarding the restore of backups.
Sadly, i could not identify a pattern in which case restoring a backup works reliably. Even after days of trying and countless reflashes/lock/unlock BL...
I managed to put a device in the perilous state where a restored backup with contained keys does not make those usable in Android. And was not able to recover from that state by any means.
I documented the way i reached that. But the unsettling thing is, i did nothing different than during the successful restores.

Until someone else with deeper knowledge solves the restore issue, the only, but 100% working way to repair a persist partition that has broken sensors is the restorecon fix.
Just do not attempt to restore the persist, but repair the existing persist on device using restorcon. And you are fine.

For those that are in the same "No keys visible in Andy but physically existing in persist" boat.
Testers have exercised the reprovison of a device successfully. Devices with lost keys can receive new ones. But that involves a send in to F(x) service for now.

[zaptastic 3]

Which Key Attestation app do you mean?

There is:

https://github.com/vvb2060/KeyAttestation

https://play.google.com/store/apps/details?id=io.github.vvb2060.keyattestation

and so on.

[mosen 202]

@zaptastici used that second one you linked. But since the method is called Key Attestation, i guess all of those tester apps should do quite the same.
You can observe using those, that key attestation is a feature that does not depend on Safetynet/Play Api integrity. But the other way around.
Using this Play API integrity checker, you can observe that unlocking the bootloader breaks "Device integrity". Rooting the device breaks "Basic integrity" and missing keys break "Strong integrity".
But the pure Key Attestation checker apps you linked above, are happy as soon as they see keys. Not minding root state or unlocked BL.
Most banking apps are working when basic and device integrity are met. Strong trusted environment key attestation is not much used by any apps currently.

[eorg 11]

Hey there, I have not so much routine in rooting, flashing and restoring. I once did this a lot with a htc desire z and a Motorola droid 4(?), but since I bought my BlackBerry Priv back in 2017 I'm out of the game.

I now want to root my pro1x in order to get rid of (all) google apps and use microG instead (if this is possible). I don't want to flash another ROM, just degoogle android. Am I at risk crashing my persist partition in this process as well? As far as I understand, that should not be the case.

However, being able to create a backup would be nice anyway, but I sadly could not reproduce the process described by @EskeRahn on his site. The phone was delivered with unlocked bootloader, but it seems there is no recovery available, whenever I try to enter recovery mode (from adb or key combination) I only get a dead android. Now I'm afraid to brick my phone in the process of uninstalling for example google play services and not being able to restore it.

Do you know of anyone who has successfully degoogled their stock android on the pro1x?

[EskeRahn 5,464]

1 hour ago, eorg said:

, but it seems there is no recovery available,

Yes, unfortunately I see the same on the test/unit I got. I had hoped that was not so for the retail units....
So the only option I currently know of is the somewhat complex using EDL. I have not found the time to experiment with that yet, and it is unlikely that I will for the next couple of weeks.

[eorg 11]

But the EDL is a linux tool, right? Since I've no Linux this seems quite difficult to me. or is there a way to use this over WSL? I had some problems with installing programs on WSL in the past. In addition have no experience in using my USB connection from within WSL as well.

However, do I need this? I don't want to switch OS only uninstall the google apps. I haven't done any changes to the device yet, so flashing the stock android would not be a problem, if I would brick the phone.

[EskeRahn 5,464]

15 minutes ago, eorg said:

But the EDL is a linux tool, right?

Well it requires Phyton, but apart from that it should be possible to get it working with Windows, I have not experimented with it though....

[eorg 11]

Okay, maybe I try it, on the weekend, if I can find some time for it. Python should indeed be no problem. In the backup process there shouldn't go anything deadly wrong, I guess ^^.

[mosen 202]

@EskeRahn @eorg
The recovery is the dead droid. To activate its menu, press the power button and the volume up button. Still, the limitation is that ADB is not fully available in recovery. We can only sideload patches. In the beta group its used to manual sideload local updates from "OTA" packages that are contained in the releases.
We even got an alternate fastbootd that can write logical partitions. You can reach that by either `fastboot reboot fastboot` or from the recovery menu item fastboot.

@eorg Don't let yourself confuse too much from the evolving threads here. Most things have been corrected over time and its easy to get sidetracked by now obsolete posts.

Summary is:
- As long as you remain in android world, your persist and thus attestation keys are always fine. Root/unroot, re/lock bootloader, full flash using the official scripts or instructions as often as you wish.
- Only when you boot SailfishOS or Ubuntu touch, they write into the sensors folder while not being in SE Linux context. Which breaks it for android. The fix for that, when flashing back to android is documented here and reliably working.
- The only thing that one can do wrong, is manually flash a stock or sadly even backuped persist. flashing persist is also completely unnecessary now, since "broken" persists can be repaired on device. Restore persist backups was only tried for completeness to know if restore works. It does NOT reliably. And some users lost their attestation keys unnecessarily during the time while it was not know. The reason is yet unknown.
- It is still generally advised to make a backup of your device specific partitions. For the case some bright person figures out how to restore them in the future.

EDL.py has just the same protocol (QFIL/Firehose) implemented as the official Qualcomm QPST flash tool uses. If you, unlike me, can handle GUIs in windows, you might be able to figure out how to backup using QPST. Its what F(x)tec uses in their official flashing instructions. And it should absolutely be able to read/dump partitions to a local image file.
But when you have the device rooted using the official guide, Eskes ADB backup method posted at the beginning of this thread will also work.

Edited September 4, 2022 by mosen

[eorg 11]

Thank you a lot @mosen, for the detailed reply. So as long as I stick to android, I shouldn't need to fix a broken persist, that is good to know. If I want to be on the save side, I could fumble with the Qualcomm QPST gui to create some backups, but they should not be needed.

Concerning the recovery, I was not able to get a menu in it, only for the bootloader. But I guess I will stick to the official root and flash instructions, so I may not need this, hopefully.

Just for anyone's information, who may come across this post and needs some input for using edl on windows:

I was not able to get the EDL tool to run, but I think the last thing missing is installing "libusb_win32 driver from Zadig" I didn't want to do that, since I remember briefly that I once lost completely the possibility of accessing a device after having installed such a driver, and I didn't want to go at this risk.

To install edl on windows, you can just follow the steps on the github page. While installing the requirements, I run into some problems, due to visual c++ library versions, the easiest workaround was to just install the affected from a precompiled wheel file. I found them on this page. when using the edl tool on windows, it is good to know, that it is a python tool, and uses a standard shebang line, which does not work in windows. So just call it with a leading python call: "python edl -h" for example. If you get the "Please first install libusb_win32 driver from Zadig" as well, I downloaded the installer here.

Maybe this is helpful for someone else. 

[thilo 0]

I can't manage to backup the partitions of my Pro1X. Neither adb nor edl recognizes my phone. It doesn't matter whether it is booted normal, or in fastboot mode or in bootloader mode. But I don't want to start flashing my device with sailfishOS without saving my partitions first.

I'm using a new dell laptop with just USB-C connectors. I remember, that the newer USB standards used to be a problem when trying to flash my Sony experia xa2 with a linux computer (finally I had to use a windows computer to flash a linux system 😞). Maybe a similar problem here?

lsusb gives:

Bus 002 Device 022: ID 18d1:d001 Google Inc. Nexus 4 (fastboot)

and udevadm info

  looking at device '/devices/pci0000:00/0000:00:0d.0/usb2/2-3':
    KERNEL=="2-3"
    SUBSYSTEM=="usb"
    DRIVER=="usb"
    ATTR{authorized}=="1"
    ATTR{avoid_reset_quirk}=="0"
    ATTR{bConfigurationValue}=="1"
    ATTR{bDeviceClass}=="00"
    ATTR{bDeviceProtocol}=="00"
    ATTR{bDeviceSubClass}=="00"
    ATTR{bMaxPacketSize0}=="9"
    ATTR{bMaxPower}=="896mA"
    ATTR{bNumConfigurations}=="1"
    ATTR{bNumInterfaces}==" 1"
    ATTR{bcdDevice}=="0419"
    ATTR{bmAttributes}=="80"
    ATTR{busnum}=="2"
    ATTR{configuration}=="fastboot"
    ATTR{devnum}=="23"
    ATTR{devpath}=="3"
    ATTR{idProduct}=="4ee0"
    ATTR{idVendor}=="18d1"
    ATTR{ltm_capable}=="no"
    ATTR{manufacturer}=="Fx_tec_Pro1X"
    ATTR{maxchild}=="0"
    ATTR{power/active_duration}=="573696"
    ATTR{power/async}=="enabled"
    ATTR{power/autosuspend}=="2"
    ATTR{power/autosuspend_delay_ms}=="2000"
    ATTR{power/connected_duration}=="573696"
    ATTR{power/control}=="auto"
    ATTR{power/level}=="auto"
    ATTR{power/persist}=="1"
    ATTR{power/runtime_active_kids}=="0"
    ATTR{power/runtime_active_time}=="573550"
    ATTR{power/runtime_enabled}=="enabled"
    ATTR{power/runtime_status}=="active"
    ATTR{power/runtime_suspended_time}=="0"
    ATTR{power/runtime_usage}=="0"
    ATTR{power/usb3_hardware_lpm_u1}=="disabled"
    ATTR{power/usb3_hardware_lpm_u2}=="disabled"
    ATTR{product}=="QX1050"
    ATTR{quirks}=="0x0"
    ATTR{removable}=="removable"
    ATTR{rx_lanes}=="1"
    ATTR{serial}=="7fed0148"
    ATTR{speed}=="5000"
    ATTR{tx_lanes}=="1"
    ATTR{urbnum}=="18"
    ATTR{version}==" 3.20"

 

Edited September 25, 2022 by thilo

[EskeRahn 5,464]

42 minutes ago, thilo said:

I remember, that the newer USB standards used to be a problem when trying to flash my Sony experia xa2 with a linux computer (finally I had to use a windows computer to flash a linux system 😞). Maybe a similar problem here?

Yes, it can be easier to get things working with an old port, or perhaps using some hub. Obviously the usb-driver can also be the issue. Or even cables / can be quite a puzzle...
On my Yoga it only works with an unsigned Google driver, and when going through a hub - currently using a thunderbolt 4 docking/hub

[EskeRahn 5,464]

1 hour ago, toast said:

Im sorry for being a tad off-topic, but sometimes, when I read about this, I cant help but feeling a bit quizzical..
Is this really this common a problem? Im not asking to be a pain, Im asking because it legit 100% never happened to me since I started flashing devices a few years back (not very many mind you, but 4-5 different devices with a few different roms per device). It never happened neither on this current laptop (Lenovo Legion 5 on Debian) or on my previous one (Asus ROG G56JK on Linux Mint), and neither using USB2, USB3 or USB-C jacks or any cable I tested (usb 2 -> microusb, usb 3 -> usb-c, usb-c -> usb-c)..
Is it a Windows thing? or is it common in Linux distributions as well, and I just got very very lucky so far?

Until windows started to require signed drivers (that they later relaxed on), I felt the same, super easy plug and play, how hard can it be...? But later I could not get it working at all, and understood what people was on about., To an extend I limited myself to OTA, for the weekly updates. And PTP&MPT still worked just fine, but fastboot was a lot of trouble. but after a lot of experiments i got things working with an ancient cheap $1 usb-hub, that is terribly slow. And when I got a new PC it got even worse, I then optimistically plugged the USB in the docking hub, and it have worked flawlessly since...

[eorg 11]

I suppose you have a pro1x? so all you need is the phone, a usb cable to connect it with a computer, and a computer.

But I highly recomment you read the complete threat befor starting, since I belive this is no longer a problem.

check espacially the comments from @EskeRahn

[eorg 11]

Then you have to wait for it to arrive, you can't backup your phone, without the phone itselfe 😉

You may be able to start downloading all of the necessary software. However I recomment to wait with setting it up until the device arrives.

[fedup 1]

On 9/7/2022 at 8:15 PM, eorg said:

Thank you a lot @mosen, for the detailed reply. So as long as I stick to android, I shouldn't need to fix a broken persist, that is good to know. If I want to be on the save side, I could fumble with the Qualcomm QPST gui to create some backups, but they should not be needed.

Concerning the recovery, I was not able to get a menu in it, only for the bootloader. But I guess I will stick to the official root and flash instructions, so I may not need this, hopefully.

Just for anyone's information, who may come across this post and needs some input for using edl on windows:

I was not able to get the EDL tool to run, but I think the last thing missing is installing "libusb_win32 driver from Zadig" I didn't want to do that, since I remember briefly that I once lost completely the possibility of accessing a device after having installed such a driver, and I didn't want to go at this risk.

To install edl on windows, you can just follow the steps on the github page. While installing the requirements, I run into some problems, due to visual c++ library versions, the easiest workaround was to just install the affected from a precompiled wheel file. I found them on this page. when using the edl tool on windows, it is good to know, that it is a python tool, and uses a standard shebang line, which does not work in windows. So just call it with a leading python call: "python edl -h" for example. If you get the "Please first install libusb_win32 driver from Zadig" as well, I downloaded the installer here.

Maybe this is helpful for someone else. 

Install something like Virtualbox on your windows OS first, then boot up a virtual machine and pass through the usb to it, so you dont have to install loads of random crap on your main computer.  Or boot from a usb os first. Or use a crap laptop to do this sort of stuff on. 

Edited October 15, 2022 by fedup

[uubi22 1]

2 hours ago, eorg said:

Then you have to wait for it to arrive, you can't backup your phone, without the phone itselfe 😉

You may be able to start downloading all of the necessary software. However I recomment to wait with setting it up until the device arrives.

Like I said, if you are a windows user, install virtualbox and port the usb through to the VM, or install windows subsystem for linux. 

[Craig 1,435]

On 8/12/2022 at 12:44 PM, mosen said:

The EDL commands to dump the partitions into image files are executed as root/sudo as following

edl r persist persist_backup.img
edl r modemst2 modemst2_backup.img
edl r modemst1 modemst1_backup.img
edl r fsc fsc_backup.img
edl r fsg fsg_backup.img

 

 

Why root/sudo?

[mosen 202]

@CraigActually, i never bothered to check without root rights. Agreed, the official EDL.py instructions on Bkerlers git do not mention sudo or root. I only now see.
But the EDL instructions i followed (the ones you qouted) showed them executed by root, with leading #. So i just did that as of yet while not feeling adventurous and trying differently.
Did you try? Does it work?

Edited October 23, 2022 by mosen

[DillonM 10]

How long should each of these processes take? My device gets to "firehose - Trying to read first storage sector..." and then just sits there.

[thilo 0]

On 9/26/2022 at 12:17 AM, thilo said:

I can't manage to backup the partitions of my Pro1X. Neither adb nor edl recognizes my phone. It doesn't matter whether it is booted normal, or in fastboot mode or in bootloader mode. But I don't want to start flashing my device with sailfishOS without saving my partitions first.

Meanwhile I'm a bit further. When running android my phone is recognized by

linux:~ # adb devices -l
List of devices attached
xxxxxxx               device usb:3-8.2 product:QX1050_2_EEA model:QX1050 device:QX1050 transport_id:16

but when in recovery mode I get

linux:~ # adb devices 
List of devices attached
xxxxxxxx        unauthorized

So I can't use

linux:~ # adb pull /dev/block/sda2 persist_20221101.img
adb: error: failed to get feature set: device unauthorized.
This adb server's $ADB_VENDOR_KEYS is not set
Try 'adb kill-server' if that seems wrong.
Otherwise check for a confirmation dialog on your device.

When in fastboot mode fastboot recognizes my phone:

linux:~ # fastboot devices
xxxxxxxx        fastboot

When I try to make a backup via fastboot, I get the following error.

linux:~ # fastboot fetch persist persist_20221101.img
fastboot: error: Unable to get max-fetch-size. Device does not support fetch command.

When in edl mode using edl for the backup, edl recognizes my pro1x, but nothing happens.

linux:~ # edl r persist persist_backup.img
Capstone library is missing (optional).
Keystone library is missing (optional).
Qualcomm Sahara / Firehose Client V3.60 (c) B.Kerler 2018-2022.
main - Trying with no loader given ...
main - Waiting for the device
main - Device detected :)
main - Mode detected: sahara

Running edl with --debugmode shows timeout errors (see attached file)edl-debug.txt.

So I still don't manage to make a backup. Any hints?