F(x)tec Pro1X (fxtec-qx1050)/Hacking

From postmarketOS Wiki

Hacking the F(x)tec Pro1

Both QX1000 and QX1050 are hacker-friendly devices as:

  • It comes unfused from the factory, meaning user can boot whatever they like without needing the binary to be signed by the vendor.
  • bkerler's fantastic EDL tool contains the firehose binary for the device, you can use this to flash individual partitions or completely switch up the partition table.
  • It works with EDL Deep Flash cable which is disabled on most retail devices.


QX1050 bootloader logs

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.XF.4.1-00327-KAMORTALAZ-1
S - IMAGE_VARIANT_STRING=KamortaPkgLAA
S - OEM_IMAGE_VERSION_STRING=server
S - Boot Interface: UFS
S - Secure Boot: Off
S - Boot Config @ 0x01b46070 = 0x00000049
S - JTAG ID @ 0x01b46130 = 0x0014d0e1
S - OEM ID @ 0x01b46138 = 0x00000000
S - Serial Number @ 0x01b46134 = 0xffffffff
S - OEM Config Row 0 @ 0x01b441b8 = 0x0000000000000000
S - OEM Config Row 1 @ 0x01b441c0 = 0x0000000000000000
S - Feature Config Row 0 @ 0x01b441d0 = 0x0050200019010000
S - Feature Config Row 1 @ 0x01b441d8 = 0x0014000000008000
S - Core 0 Frequency, 1305 MHz
S - PBL Patch Ver: 1
S - PBL freq: 600 MHZ
D -      4943 - pbl_apps_init_timestamp
D -     31453 - bootable_media_detect_timestamp
D -      1146 - bl_elf_metadata_loading_timestamp
D -       681 - bl_hash_seg_auth_timestamp
D -      6218 - bl_elf_loadable_segment_loading_timestamp
D -      5656 - bl_elf_segs_hash_verify_timestamp
D -      7222 - bl_sec_hash_seg_auth_timestamp
D -      1168 - bl_sec_segs_hash_verify_timestamp
D -        28 - pbl_populate_shared_data_and_exit_timestamp
S -     58515 - PBL, End
B -     75045 - SBL1, Start (MPM timestamp = 80703)
B -     77065 - SBL1 BUILD @ 14:55:18 on Jun 16 2022
B -     78032 - usb: hs_phy_nondrive_start
B -     78339 - str_overflow
B -     78379 - usb: hs_phy_nondrive_finish
D -      1313 - sbl1_hw_init
D -        12 - boot_flash_init
B -    197946 - UFS INQUIRY ID: SAMSUNG KM2V8001CM-B707 1900
B -    199361 - UFS Boot LUN: 1
D -       856 - Auth Metadata
D -    138782 - sbl1_xblconfig_init
D -         4 - sbl1_feature_config_init
D -         3 - boot_config_data_table_default_init
D -        17 - sbl1_ddr_set_default_params
B -    217315 - Using default CDT
D -        98 - boot_config_data_table_init
B -    217332 - CDT Version:3,Platform ID:34,Major ID:1,Minor ID:0,Subtype:0
D -        18 - sbl1_hw_platform_pre_ddr
D -      1650 - devcfg init
B -    222685 - PM: PM 0=0x8000028000000041:0x800 
B -    222734 - PM: PM 1=0x8000018000000040:0x800800 
B -    222768 - PM: HARD_RESET by PS_HOLD
B -    278283 - PM: SET_VAL:Skip
B -    278516 - PM: PSI: b0x10_v0x17
B -    282060 - PM: Device Init # SPMI Transn: 4521
B -    286467 - PM: Driver Init # SPMI Transn: 303
B -    286576 - PM: APSD re-run
B -    289233 - PM: battery Id: 10094
B -    789791 - PM: CHG Init # SPMI Transn: 56
D -    570793 - pmic XBL init
D -      5825 - vsense_railway_cpr init
D -    578367 - sbl1_hw_pre_ddr_init
D -         4 - boot_dload_handle_forced_dload_timeout
D -       321 - sbl1_load_ddr_training_data
D -       447 - sbl1_ddr_set_params
B -    799469 - DSF version = 20.0, DSF RPM version = 9.0
B -    799475 - Manufacturer ID = 1, Device Type = 7
B -    799480 - Rank 0 size = 2048 MB, Rank 1 size = 4096 MB
B -    799485 - Max Frequency = 1804 MHz
B -    799501 - Row Hammer Check : DRAM supports unlimited MAC Value : MR24[OP2:0 = 0] & MR24[OP3 = 1] for CH0 & CS0
B -    799514 - Row Hammer Check : DRAM supports unlimited MAC Value : MR24[OP2:0 = 0] & MR24[OP3 = 1] for CH0 & CS1
D -      3482 - sbl1_ddr_init
B -    799662 - do_ddr_training, Start
B -    805059 - Bootup frequency set to 1555200
D -      5445 - do_ddr_training, Delta
D -      5455 - sbl1_do_ddr_training
D -         2 - sbl1_hand_control_to_devprog_ddr_or_ddi
B -    805126 - Pimem init cmd, entry
D -      9917 - Pimem init cmd, exit
D -     10680 - sbl1_post_ddr_init
D -        19 - sbl1_hw_init_secondary
B -    816039 - APDP Image Loaded, Start
D -      1031 - Auth Metadata
D -       569 - Segments hash check
D -      2430 - APDP Image Loaded, Delta - (8204 Bytes)
D -         3 - boot_dload_dump_security_regions
B -    818584 - usb: UFS Serial - ffffffff
B -   1321623 - usb: chgr -  SDP_CHARGER
D -    503940 - boot_dload_check
D -         2 - boot_cache_set_memory_barrier
D -         4 - boot_smem_debug_init
D -       333 - boot_smem_init
D -         4 - boot_smem_alloc_for_minidump
B -   1322830 - PM: SMEM Chgr Info Write Success
D -        61 - boot_smem_store_pon_status
D -        14 - sbl1_hw_platform_smem
D -       108 - boot_clock_init_rpm
D -         2 - boot_vsense_copy_to_smem
D -         2 - boot_share_flash_data
D -        11 - boot_populate_ram_partition_table
D -         8 - boot_populate_ddr_details_shared_table
D -         4 - sbl1_tlmm_init
D -         2 - sbl1_efs_handle_cookies
D -         2 - boot_apt_test
B -   1323203 - OEM_MISC Image Loaded, Start
D -       968 - Auth Metadata
D -       328 - Segments hash check
D -      2205 - OEM_MISC Image Loaded, Delta - (8136 Bytes)
B -   1325639 - QTI_MISC Image Loaded, Start
D -         8 - QTI_MISC Image Loaded, Delta - (0 Bytes)
B -   1328380 - PM: PM Total Mem Allocated: 1493 
D -      2736 - sbl1_pm_aop_pre_init_wrapper
B -   1328391 - RPM Image Loaded, Start
D -      1045 - Auth Metadata
D -      1703 - Segments hash check
D -      8153 - RPM Image Loaded, Delta - (220740 Bytes)
B -   1336552 - QSEE Dev Config Image Loaded, Start
D -      1046 - Auth Metadata
D -       558 - Segments hash check
D -      2946 - QSEE Dev Config Image Loaded, Delta - (35884 Bytes)
B -   1339501 - QSEE Image Loaded, Start
D -      5006 - Auth Metadata
D -     22552 - Segments hash check
D -     78132 - QSEE Image Loaded, Delta - (3343657 Bytes)
D -        52 - sbl1_hw_play_vibr
B -   1417873 - SEC Image Loaded, Start
D -        10 - SEC Image Loaded, Delta - (0 Bytes)
B -   1417888 - QHEE Image Loaded, Start
D -       999 - Auth Metadata
D -      3160 - Segments hash check
D -      7065 - QHEE Image Loaded, Delta - (387768 Bytes)
B -   1425173 - STI Image Loaded, Start
D -        10 - STI Image Loaded, Delta - (0 Bytes)
B -   1425942 - APPSBL Image Loaded, Start
D -      1025 - Auth Metadata
D -     11420 - Segments hash check
D -     18144 - APPSBL Image Loaded, Delta - (2229248 Bytes)
D -         6 - sbl1_appsbl_arch_determination
B -   1444907 - SBL1, End
D -   1369872 - SBL1, Delta
S - Flash Throughput, 181000 KB/s  (6278471 Bytes,  34654 us)
S - DDR Frequency, 1555 MHz


UEFI Start     [ 1644]
 - 0x05FC01000 [ 1650] Sec.efi
ASLR        : ON
DEP         : ON (RTB)
Timer Delta : +6 mS
RAM Entry 0 : Base 0x0000000040000000  Size 0x000000003C900000
RAM Entry 1 : Base 0x00000000C0000000  Size 0x0000000100000000
RAM Entry 2 : Base 0x0000000080000000  Size 0x0000000040000000
UART Buffer size set to 0x8000 
Wrong CPU core 4
Wrong CPU core 5
Wrong CPU core 6
Wrong CPU core 7
UEFI Ver    : 5.0.220616.BOOT.XF.4.1-00327-KAMORTALAZ-1
Build Info  : 64b Jun 16 2022 14:56:08
Boot Device : UFS
PROD Mode   : TRUE
Retail      : TRUE
Module cannot re-initialize DAL module environment
UFS INQUIRY ID: SAMSUNG KM2V8001CM-B707 1900
UFS Boot LUN: 1
Embedded Images Supported and Commonlibs loaded
Read: NumHalfSectors 0x1, ReliableWriteCount 0x0 
Read: NumHalfSectors 0x1, ReliableWriteCount 0x0 
Read: NumHalfSectors 0x8, ReliableWriteCount 0x0 
HW Wdog Setting from PCD : Disabled
PM0: 45, PM1: 37, 
MDPPlatformConfigure 10
MDPPlatformConfigure 6
DisplayDxe: SetupPlatformPanelConfig 33 uHardwareVersionSubtype 0
DisplayDxe: SetupPlatformPanelConfig 44 uPanelCnt 1
DisplayDxe: SetupPlatformPanelConfig 55 pDetectPanel 1
DisplayDxe: SetupPlatformPanelConfig 66 uPanelId 0 eSelectedPanel 35
MDPPlatformConfigure 5
MDPPlatformConfigure 1
Panel power up sequence for default platform:Panel_Default_PowerUp ,by eric.wang.
mask Panel_Default_PowerUp:reset,by eric.wang.
Panel_Default_Peripheral_Power.
GetPmicIBBLABMode.
MDPPlatformConfigure 0
Display: MDP_DISPLAY_PRIMARY
MDPPlatformConfigure 7
Panel_Default_Reset.
Panel power up sequence for default platform:Panel_ResetStateExec.reset pin: 82,by eric.wang
state0:=1,state1:=0,state2:=1,by eric.wang
Display: DynamicDSIPanelDetection
uPanelIndex:0
Detected panel id:00880000
DisplayDxe: Resolution 1080x2160 (1 intf)
MDPPlatformConfigure 5
MDPPlatformConfigure 6
MDPPlatformConfigure 11
UsbConfigPortsQueryConnectionChange: UFP and Type-C
UsbConfigPortsQueryConnectionChange: usbport->connectstate: ATT
[Haptics] Install EFI_QCOM_I2C_HAPTICS_PROTOCOL Success. - Success
EFI_I2cHapticsInit device 3
haptic_nv: uefi driver version is v1.2.0
haptic_nv_hw_init: enter!
haptic_nv_parse_chipid enter
haptic_nv_hw_reset enter
haptic_nv_parse_chipid aw86224_5 detected
haptic_nv_sw_reset enter
haptic_nv_func_init: enter!
haptic_nv_init: enter!
aw8622x_haptic_stop enter
aw8622x_haptic_stop entered standby! glb_state=0x00
haptic_nv_ram_init: enter!
haptic_nv_haptic_play: enter!
haptic_nv_haptic_play: enter! wav_index = 3 
haptic_nv_haptic_play: enter! wav_loop = 0 
EFI_I2cHapticsInit Success
MinidumpTADxe: Minidump TA loading not enabled.
Disp init wait [ 2329] 
MDPPlatformConfigure 8
MDPPlatformConfigure 8
MDPPlatformConfigure 7
Panel_Default_Reset.
Panel power up sequence for default platform:Panel_ResetStateExec.reset pin: 82,by eric.wang
state0:=1,state1:=0,state2:=1,by eric.wang
MDPPlatformConfigure 4
Panel_Default_Brightness_Enable.
GetPmicIBBLABMode.
Panel_Default_Brightness_Level. 3
Panel_Default_Brightness_Level uNumBits 8 uLevel 50
Panel_Default_Brightness_Level command  0x51 0x80 0x0
MDPPlatformConfigure 5
-----------------------------
Platform Init  [ 2597] BDS
UEFI Ver   : 5.0.220616.BOOT.XF.4.1-00327-KAMORTALAZ-1
Platform           : IDP
Chip Name          : SM_KAMORTA_H
Chip Ver           : 1.0
Chip Serial Number : 0xFFFFFFFF
-----------------------------
UEFI Total : 970 ms
POST Time      [ 2614] OS Loader
Loader Build Info: Jul  7 2022 14:40:36
VB: Non-secure device: Security State: (0xF3F)
VB: RWDeviceState: Succeed using devinfo!
GetKeyPress  Success
Total DDR Size: 0x000000017C900000 
KeyPress:0, BootReason:0
Fastboot=0, Recovery:0
GetVmData: No Vm data present! Status = (0x3)
VM Hyp calls not present
Active Slot _a is bootable, retry count 6
Booting from slot (_a)
Booting Into Mission Mode
Loading Image Start : 2643 ms
Loading Image Done : 2644 ms
Total Image Read size : 4096 Bytes
Invalid vendor_boot partition. Skipping
Load Image vbmeta_a total time: 1 ms 
Load Image vbmeta_system_a total time: 1 ms 
Load Image boot_a total time: 191 ms 
avb_slot_verify.c:256: ERROR: boot_a: Hash of data does not match digest in descriptor.
Load Image dtbo_a total time: 49 ms 
avb_slot_verify.c:256: ERROR: dtbo_a: Hash of data does not match digest in descriptor.
VB2: Authenticate complete! boot state is: orange
VB2: boot state: orange(1)
Memory Base Address: 0x40000000
Decompressing kernel image total time: 191 ms
Dtbo hdr magic mismatch 0, with D7B7AB1E
qcom, msm-id in device tree is (8) not a multiple of (12)
DTB offset is incorrect, kernel image does not have appended DTB
VB: Non-secure device: Security State: (0xF3F)
VB: RWDeviceState: Succeed using devinfo!
Cmdline: PMOS_NO_OUTPUT_REDIRECT  pmos_boot_uuid=7048704a-ced5-492f-a66c-a5227e912da9 pmos_root_uuid=096655cd-19ae-461c-8534-a5ca9009d295 androidboot.verifiedbootstate=orange androidboot.keymaster=1 androidboot.vbmeta.device=PARTUUID=b6221cbc-a067-5d87-50
RAM Partitions
Add Base: 0x0000000040000000 Available Length: 0x000000003C900000 
Add Base: 0x00000000C0000000 Available Length: 0x0000000100000000 
Add Base: 0x0000000080000000 Available Length: 0x0000000040000000 
ERROR: Could not get splash memory region node
Update Device Tree total time: 12 ms 
Shutting Down UEFI Boot Services: 3239 ms
Start EBS        [ 3239] 
BDS: LogFs sync skipped, Unsupported
App Log Flush : 50 ms
Exit EBS        [ 3307] UEFI End