Cat S22

0xDBFB7 · March 28, 2024, 12:42am

failed ro

0xDBFB7 · March 28, 2024, 12:47am

I flashed using ADB, using the images and instructions from this post: Cat S22 Flip - revert to Stock | XDA Forums. Held the power button (end call) and volume down.

OEM bootloader toggle switch in the android settings needs to be turned on.

fastboot -w
fastboot flashing unlock
fastboot erase cache

fastboot flash boot boot.img
fastboot flash vbmeta vbmeta.img
fastboot flash vbmeta_system vbmeta_system.img
fastboot flash modem modem.img
fastboot flash dsp adspso.img
fastboot flash dtbo dtbo.img 

fastboot reboot fastboot
fastboot flash system system.img
fastboot flash vendor vendor.img
fastboot flash product product.img

After rebooting, OTA update still didn’t succeed, but this time, Android recognized the fault before rebooting, and so ADB could stay connected.

adb logcat > update2.log
 
cat update2.log | grep SystemUpdate
03-25 20:15:49.062  1309  1309 I SystemUpdate: [Phone,SystemUpdateChimeraActivity] Status change: status=0x002, isSetupWizard=false.
03-25 20:15:49.526   592  1737 I SystemUpdate: [Execution,InstallationEventIntentOperation] Handling event of type 110.
03-25 20:15:49.579   592  1737 I SystemUpdate: [Execution,InstallationIntentOperation] Received intent: Intent { act=com.google.android.gms.update.INSTALL_UPDATE cat=[targeted_intent_op_prefix:.update.execution.InstallationIntentOperation] cmp=com.google.android.gms/.chimera.GmsIntentOperationService }.
03-25 20:15:49.781  1309  1309 I SystemUpdate: [Phone,SystemUpdateChimeraActivity] Status change: status=0x110, isSetupWizard=false.
03-25 20:15:49.898   592  1737 I SystemUpdate: [Control,InstallationControl] Installation progress updated to (0x110, -1.000).
03-25 20:15:49.957   592  1737 I SystemUpdate: [Control,InstallationControl] Resume on reboot feature enabled: true.
03-25 20:15:50.003   592  1737 I SystemUpdate: [Execution,ExecutionManager] Action non-ab-reboot executed for 0.42 seconds.
03-25 20:15:50.032   592  1737 I SystemUpdate: [Execution,ExecutionManager] Action fixed-delay-execution executed for 0.02 seconds.
03-25 20:15:59.582   592  1917 I SystemUpdate: [Execution,InstallationEventIntentOperation] Handling event of type 105.
03-25 20:15:59.598   592  1917 I SystemUpdate: [Execution,InstallationIntentOperation] Received intent: Intent { act=com.google.android.gms.update.INSTALL_UPDATE cat=[targeted_intent_op_prefix:.update.execution.InstallationIntentOperation] cmp=com.google.android.gms/.chimera.GmsIntentOperationService }.
03-25 20:15:59.772   592  1917 I SystemUpdate: [Control,InstallationControl] Installation progress updated to (0x310, -1.000).
03-25 20:15:59.793  1309  1309 I SystemUpdate: [Phone,SystemUpdateChimeraActivity] Status change: status=0x310, isSetupWizard=false.
03-25 20:15:59.834   592  1917 I SystemUpdate: [Control,InstallationControl] Resume on reboot feature enabled: true.
03-25 20:15:59.892   592  1917 I SystemUpdate: [Execution,ExecutionManager] Action non-ab-reboot executed for 0.29 seconds.
03-25 20:15:59.900   592  1917 E SystemUpdate: [Execution,NonAbRebootAction] Failed to execute RecoverySystem.installPackage().
03-25 20:15:59.900   592  1917 E SystemUpdate: java.io.FileNotFoundException: /cache/recovery/uncrypt_file: open failed: ENOENT (No such file or directory)
03-25 20:15:59.900   592  1917 E SystemUpdate: 	at libcore.io.IoBridge.open(IoBridge.java:492)
03-25 20:15:59.900   592  1917 E SystemUpdate: 	at java.io.FileOutputStream.<init>(FileOutputStream.java:236)
03-25 20:15:59.900   592  1917 E SystemUpdate: 	at java.io.FileOutputStream.<init>(FileOutputStream.java:186)
03-25 20:15:59.900   592  1917 E SystemUpdate: 	at java.io.FileWriter.<init>(FileWriter.java:90)
03-25 20:15:59.900   592  1917 E SystemUpdate: 	at android.os.RecoverySystem.installPackage(RecoverySystem.java:578)
03-25 20:15:59.900   592  1917 E SystemUpdate: 	at android.os.RecoverySystem.installPackage(RecoverySystem.java:534)
03-25 20:15:59.900   592  1917 E SystemUpdate: 	at bbvj.call(:com.google.android.gms@214516063@21.45.16 (170300-414021728):0)
03-25 20:15:59.900   592  1917 E SystemUpdate: 	at com.google.android.gms.update.execution.InstallationIntentOperation.onHandleIntent(:com.google.android.gms@214516063@21.45.16 (170300-414021728):32)
03-25 20:15:59.900   592  1917 E SystemUpdate: 	at com.google.android.chimera.IntentOperation.onHandleIntent(:com.google.android.gms@214516063@21.45.16 (170300-414021728):2)
03-25 20:15:59.900   592  1917 E SystemUpdate: 	at rwq.onHandleIntent(:com.google.android.gms@214516063@21.45.16 (170300-414021728):4)
03-25 20:15:59.900   592  1917 E SystemUpdate: 	at ejb.run(:com.google.android.gms@214516063@21.45.16 (170300-414021728):5)
03-25 20:15:59.900   592  1917 E SystemUpdate: 	at eja.run(:com.google.android.gms@214516063@21.45.16 (170300-414021728):11)
03-25 20:15:59.900   592  1917 E SystemUpdate: 	at bsko.run(:com.google.android.gms@214516063@21.45.16 (170300-414021728):2)
03-25 20:15:59.900   592  1917 E SystemUpdate: 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
03-25 20:15:59.900   592  1917 E SystemUpdate: 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
03-25 20:15:59.900   592  1917 E SystemUpdate: 	at java.lang.Thread.run(Thread.java:923)
03-25 20:15:59.900   592  1917 E SystemUpdate: Caused by: android.system.ErrnoException: open failed: ENOENT (No such file or directory)
03-25 20:15:59.900   592  1917 E SystemUpdate: 	at libcore.io.Linux.open(Native Method)
03-25 20:15:59.900   592  1917 E SystemUpdate: 	at libcore.io.ForwardingOs.open(ForwardingOs.java:166)
03-25 20:15:59.900   592  1917 E SystemUpdate: 	at libcore.io.BlockGuardOs.open(BlockGuardOs.java:254)
03-25 20:15:59.900   592  1917 E SystemUpdate: 	at libcore.io.ForwardingOs.open(ForwardingOs.java:166)
03-25 20:15:59.900   592  1917 E SystemUpdate: 	at android.app.ActivityThread$AndroidOs.open(ActivityThread.java:7597)
03-25 20:15:59.900   592  1917 E SystemUpdate: 	at libcore.io.IoBridge.open(IoBridge.java:478)
03-25 20:15:59.900   592  1917 E SystemUpdate: 	... 15 more
03-25 20:15:59.919   592  1917 I SystemUpdate: [Control,InstallationControl] Installation progress updated to (0x407, -1.000).
03-25 20:15:59.937  1309  1309 I SystemUpdate: [Phone,SystemUpdateChimeraActivity] Status change: status=0x407, isSetupWizard=false.
03-25 20:15:59.972   592  1917 I SystemUpdate: [Control,InstallationControl] Resume on reboot feature enabled: true.

Tried flashing a recovery.img to the recovery partition, still hit the same error.

It seems like if I replace the factory /recovery with something like TWRP (fastboot boot twrp.zip) maybe I could access the cache directory and fix whatever problem the errno

trying to patch v30.

export NAME=system
(base) arthurdent@DeepThought-Ryzen-Debian:~/Downloads/IMG_Patch_Tools_0.2/IMG_Patch_Tools_0.2/Linux_x64$ ./BlockImageUpdate /home/arthurdent/Downloads/android_CAT_S22_patched/$NAME.img /home/arthurdent/Downloads/V30/$NAME.transfer.list /home/arthurdent/Downloads/V30/$NAME.new.dat /home/arthurdent/Downloads/V30/$NAME.patch.dat

This worked fine. However, the next step,

export NAME=modem
(base) arthurdent@DeepThought-Ryzen-Debian:~/Downloads/IMG_Patch_Tools_0.3/IMG_Patch_Tools_0.3/Linux_x64$ ./ApplyPatch /home/arthurdent/Downloads/android_CAT_S22_patched/$NAME.img - ee82c75d51068a497f194b2acfd2af9f5b54e957 100000 ca05b271bca920c04d08e8adc926e410ab175256 /home/arthurdent/Downloads/V30/patch/firmware-update/$NAME.img.p

Don’t have the target SHAs. However the check seems to happen after the patch has occurred, so as long as we make up a fake target SHA and get the initial sha from the V29 file, we should be golden. got too late so I didn’t finish this part. flashed V29 so I have a functional phone again.

0xDBFB7 · March 30, 2024, 4:52am

Was able to get into recovery mode from the bootloader selection menu by following rhese instructions:

"If you are trying to get into recovery mode, and see an android on his back with No Command, then press and hold Power, then tap Volume Up once, then release Power. This will display the Recovery Mode Menu.

Do not hold power too long, and do not hold both power and volume up waiting for the menu to come up. These action will cause the Nexus to reboot. It is actually the transition of Volume Up going from pressed to not pressed while power is pressed that forces the menu to be displayed.!

Some error messages re: /cache partition were displayed.

Maybe I need to recreate cache? Think I already tried that via fastboot.
Tried wipimg cache from recovery. No dice.

Might be able to apply the V30 update from sd or adb

0xDBFB7 · March 30, 2024, 4:17pm

was able to use imgpatchtools to patch almost everything from the V30 into the V29. Except, hung up when patching system.img, seemingly infinite loop, had to interrupt.

bypassed unknown target sha hashes by copying the temporary img.patch files that the ApplyPatch outputs.

Invalid sparse file format at header magic
Sending sparse ‘product’ 1/3 (471812 KB) OKAY [ 16.728s]
Writing ‘product’ FAILED (remote: ‘partition table doesn’t exist’)
fastboot: error: Command failed

forgot to reboot fastboot, got this error.

This worked great, except I was still unable to update. Patching the V30 changes in to V29 doesn’t seem to fix the problem on its own.

Something on this particular device is corrupt. I have a few screenshots of logs that I’ll put here.