probably broke my n9
 

i have a issue i am not able to flash n9 firmware on my nokia heres the log output any help wuld be appriciated
(note i did install the 001 vershion earlier is there any way i can overcome this)
Microsoft Windows [Version 10.0.14393]
(c)TEAMOS [?X?S?Y & tomeCar]

C:\Windows\system32>cd C:\Program Files\Nokia\Flasher

C:\Program Files\Nokia\Flasher>flasher -f -F asian.bin
flasher 3.12.1 (Oct 6 2011) Harmattan
WARNING: This tool is intended for professional use only. Using it may result
in permanently damaging your device or losing the warranty.

Ping attempt 1 (250 ms)
Server application: 1.7.2
Found product RM-696 rev. 1603
Server implements softupd protocol version 1.8
Image SW version DFL61_HARMATTAN_40.2012.21-3_PR_005
Image moslo not present
Image mmc not present
Image tar skipped
Image config skipped

Battery level 20 %, continuing.

image [state progress transfer flash speed]
---------------------------------------------------------------------
[_] cert-sw [init 0 % 0 / 0 kB NA ]
[ ] cmt-2nd [pending 0 % 0 / 0 kB NA ]
[ ] cmt-algo [pending 0 % 0 / 0 kB NA ]
[ ] cmt-mcusw [pending 0 % 0 / 0 kB NA ]
[ ] xloader [pending 0 % 0 / 0 kB NA ]
[ ] secondary [pending 0 % 0 / 0 kB NA ]
[ ] kernel [pending 0 % 0 / 0 kB NA ]
[ ] rootfs [pending 0 % 0 / 0 kB NA ]
ERROR: SU_GET_UPDATE_STATUS_REQ terminated with error code 10: Security failure

image [state progress transfer flash speed]
---------------------------------------------------------------------
[f] cert-sw [init 0 % 1 / 1 kB NA ]
[ ] cmt-2nd [pending 0 % 0 / 0 kB NA ]
[ ] cmt-algo [pending 0 % 0 / 0 kB NA ]
[ ] cmt-mcusw [pending 0 % 0 / 0 kB NA ]
[ ] xloader [pending 0 % 0 / 0 kB NA ]
[ ] secondary [pending 0 % 0 / 0 kB NA ]
[ ] kernel [pending 0 % 0 / 0 kB NA ]
[ ] rootfs [pending 0 % 0 / 0 kB NA ]
Fetching error list:
========================================
bb5_rdc_cert_read failed
bb5_rdc_cert_read failed
bb5_rdc_cert_read failed
bb5_rdc_cert_read failed
bb5_rdc_cert_read failed
bb5_rdc_cert_read failed
Downgrade disallowed (1338190008)
[Pipe 0] Finishing in error state with status 10
========================================

ERROR: Failed to flash images

please help me breathe life into my n9 one more time(also what the hell is the security faliure thingy)

Re: probably broke my n9
 

also note my original firmware was pr003 witch still gives the same warning

Re: probably broke my n9
 

I'm only a novice, but I see "Downgrade Disallowed" at the end of the log. That might be the only problem.
You can only flash the same firmware or upgrade (incrementing numbers; 001, 002......), you may never be able to downgrade. Chinese firmware is generally avoided since it imposes added restrictions to future flashing.

Edit: if your going from 003 to 005 and get errors, you may need to use '003 firmware' to flash cmt (see recovering from flash errors).

Re: probably broke my n9
 

still can i go from 001 to 005? as i had that at the time of flashing (and yes i did do i downgrade once from 003 to 001 and suprisingly it did work then and now it wont)

Re: probably broke my n9
 

guess ill try the 001 again

Re: probably broke my n9
 

No, you cannot downgrade from 003 to 001 with normal tools.

Re: probably broke my n9
 

are there other tools that can flash a n9?

Re: probably broke my n9
 

also any way to cold flash the n9?

Re: probably broke my n9
 

ok so i figured somestuff out is it possible to upgrade from 006 to 009 and then from 009 to 001?(while staying on pr1.3 as i cant appear to find any other firmware variant)

Re: probably broke my n9
 

Two possible ways:

https://talk.maemo.org/showpost.php?...6&postcount=18
https://talk.maemo.org/showpost.php?...0&postcount=19

https://talk.maemo.org/showpost.php?...0&postcount=33

Re: probably broke my n9
 

can you give me quick steps for the process i need to do to rewrite cert-sw as i probably am stuck on pr006 itll be really helpful if you could explain a little about what i have to do

BTW i have got the n9 back (but on pr006 which sucks as no cmt)
i have developer mode
and have aegis

Re: probably broke my n9
 

From the third link I gave you:

Step 1: Obtain an older cert.
A: Dump it from your /dev/mtd1 or B: use the cert from that post.

Step 2: rename the the cert and place it in '/root/' so you end up with '/root/cert.bin'

for example:
Step 3: Install that deb (compile it yourself from source, if you want)
note it has to be installed from com.nokia.maemo origin. So you need to have aegis-install hack.

Step 4: Invoke cal-writer as root from command-line.


NO GUARANTEES as I never tried it myself.

Re: probably broke my n9
 

i did the steps you said but it gives an error

Error: open(/dev/mtd1): permission denied
couldnt open cal for writing

and before you say yes i did install it by doing
aegis-dpkg -i <file address>
also i did have the cert.bin in the root directory and yes i did run it as root

EDIT: i tried it out with inception privleges and it probably worked
the last thing it says is
debug: 2: nand_write: 4096 bytes to 0x000e3000 retval : 0
is that a good sign? even if it is or isnt ima try flashing and tell please gimme the news while im flashing

Re: probably broke my n9
 

You can't be in openmode, as it disables writing to CAL. Are you?
Else try this and try again

If that doesn't work you need to figure out why you don't have all rights to write to CAL. I can't think of what's blocking that.

If it works you need to change the owner of mtd1 back:

Re: probably broke my n9
 

my man it worked im on pr001 now im just waiting for zeroise to finish its thing so that i can check if the cmt flashing of the pr003 works damn thanks man youre a genius i might just use my n9 as a daily driver now

inception does actually add a whole new level of accessibility

Re: probably broke my n9
 

heres the output of the flash
cmt still wont flash if theres any fix for that will have the n9 back to speed

Re: probably broke my n9
 

edit: just realised that this is repeating info, sorry.

If the phone has ever been flashed with 003, cmt might only be flashed using 003, as you see here.

Re: probably broke my n9
 

Oh boy you have damaged CMT hardware or software. In your case it's software because only CMT-mcusw fails, the other CMT parts ARE flashed, actually a good sign.
Basically if you flash new RPL file specifically for your phone it might be fixed. Unfortunately, we can't get these files from Nokia anymore. We wouldn't anyway because they were only sold to repair-shop owners / Nokia Service Centers. So that option is striked.
For users that have a working N9, there are tools out there that can backup RPL. Google RPL + BB5.
Addition from what I read; It seems that you can create RPL from PM backup. Making a PM backup and then make RPL from it and write RPL might fix it too.

The thing is we need to flash CMT of 003 variant. But we are running a bit out of options, unfortunately.

But there things you can try, what happens if you upgrade everything to 003?

Else we must resort to more experimental methods and that's a long time ago for me. In the symbian days we could use JAF over USB to flash almost everything. Now we need sort of the same thing, to force flash the right CMT.

The options are listed below, again no guarantees.

I would start to examine JAF, you probably need windows XP for this, 7 may work too but I am not sure of win10. You might one to tick dead-phone/usb mode.

Maybe Cyclone Box software can be hacked to work over USB too.Or maybe it works out of the box over USB. I don't know.

Otherwise BB5 service tool by Infinity Team might help you.

Really these are experimental waters, to see if we can revive it.
As last option would be to optain a flash-box, but then no guarantees that that will work.


EDIT: I'm trying to examine the errors from your logs. Then I found this: https://bugs.maemo.org/show_bug.cgi?id=7433. Some suggest to try different PC / OS. Might help.
Suggestion 2:
Also try with --no-preserve
Suggestion 3: Check if firmware files are not corrupt.

Re: probably broke my n9
 

i tried using --no-preserve got the same result heres the output so --no-preserve didnt help i also tried with windows 7 same result
so it seems that when i accedintally flashed the 006 firm it mustve overwritten my cmt-mcusw as i did the zeroise thing and wont let me reflash the cmt completely even on another zero hmm interisting probably needs more checking i dunno if even inception can help at this point as i dunno what state its in

Re: probably broke my n9
 

also the files are good i downloaded around 3 of the same firmware from diffrent sources(the chinese 003 firm) and all gave the same result probably not the file's fault

Re: probably broke my n9
 

i was wondering is it possible to write the cmt partition completely as in /dev/cmt with the files in the 003 variant dumped from another n9 by using aegis and inception in conjugation to delete the cmt completely and paste the new files there

EDIT-probably a recipie for brick but still is it possible and if it is can some link the dumped files

Re: probably broke my n9
 

C:\Program Files\Nokia\Flasher>flasher -f -F china.bin --flash-only=cmt --no-preserve

You did only flash CMT, what happens if you flash full 003 with --no-preserve or erase?

Probably you can extract it from the image.

Does the flasher have unpack option?
I know that 0xFFFF has for N900 but not for N9 yet.

Re: probably broke my n9
 

trying a zeroise with --no-preserve as you suggested now will report in a little while(as soon as its done)

EDIT- nope no progress on zeroise with --no-preserve(tough i guess that was to be expectedwell heres the log anyways

Re: probably broke my n9
 

the only problem im having now is whenever i insert the sim card the imei goes away therefore i am unable to connect to the network i reboot the device and the imei is fine and present

Re: probably broke my n9
 

I'm giving up. Would gladly upload my CMT but it's no 003 CMT if that matters. But I guess it will change you're N9 into a brick like you said.

You could try to force flash / downgrade using JAF or any of the other Baseband 5 flashing tools I suggested. But again no guarantees.

Edit: Did you try cold-flash. Probably won't work but you can try

Re: probably broke my n9
 

i would gladly try anything at this point in time to fix the cmt so if anyone reading the thread has any clear ideas please tell me and please explain the steps required briefly(just dont tell me to do anything that has a brick possibility of 50% or more)

Re: probably broke my n9
 

for now ill just start uploading the firmware files to my mega account as its really hard these days finding fixed firmware files

Re: probably broke my n9
 

It is Cyclone Box/Cyclone Key Reloaded which achieves the function you mentioned:
http://forum.gsmhosting.com/vbb/f528...added-1483437/

Surprisingly although software has not been updated for years, support server moved to new address in January 2017. consequently was able to update my Cyclone Key Reloaded and Read PM upon N9 via USB connection without any modification.
https://s28.postimg.org/lc48jihz1/Cyclone_Reloaded.jpg

Re: probably broke my n9
 

so how does it work gimme some steps and ill do em(as ive never used something like this before so what i need is the link to it and what to do to get a rpl backup ill try and figure the rest out from there)

Re: probably broke my n9
 

Sorry for not getting back sooner, beginning to think that Cyclone can only only backup PM or write factory BB5 RPL but not backup RPL upon N9. Any attempt fails with attempting to put device in RAW mode. There is a backup RPL feature within Flashing function although have never used Cyclone for this feature but always Harmattan flasher, so can't confirm validity of what is saved.