F(x)tec Pro1X (fxtec-qx1050)/Hacking
Hacking the F(x)tec Pro1
Both QX1000 and QX1050 are hacker-friendly devices as:
- It comes unfused from the factory, meaning user can boot whatever they like without needing the binary to be signed by the vendor.
- bkerler's fantastic EDL tool contains the firehose binary for the device, you can use this to flash individual partitions or completely switch up the partition table.
- It works with EDL Deep Flash cable which is disabled on most retail devices.
QX1050 bootloader logs
Format: Log Type - Time(microsec) - Message - Optional Info Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic S - QC_IMAGE_VERSION_STRING=BOOT.XF.4.1-00327-KAMORTALAZ-1 S - IMAGE_VARIANT_STRING=KamortaPkgLAA S - OEM_IMAGE_VERSION_STRING=server S - Boot Interface: UFS S - Secure Boot: Off S - Boot Config @ 0x01b46070 = 0x00000049 S - JTAG ID @ 0x01b46130 = 0x0014d0e1 S - OEM ID @ 0x01b46138 = 0x00000000 S - Serial Number @ 0x01b46134 = 0xffffffff S - OEM Config Row 0 @ 0x01b441b8 = 0x0000000000000000 S - OEM Config Row 1 @ 0x01b441c0 = 0x0000000000000000 S - Feature Config Row 0 @ 0x01b441d0 = 0x0050200019010000 S - Feature Config Row 1 @ 0x01b441d8 = 0x0014000000008000 S - Core 0 Frequency, 1305 MHz S - PBL Patch Ver: 1 S - PBL freq: 600 MHZ D - 4943 - pbl_apps_init_timestamp D - 31453 - bootable_media_detect_timestamp D - 1146 - bl_elf_metadata_loading_timestamp D - 681 - bl_hash_seg_auth_timestamp D - 6218 - bl_elf_loadable_segment_loading_timestamp D - 5656 - bl_elf_segs_hash_verify_timestamp D - 7222 - bl_sec_hash_seg_auth_timestamp D - 1168 - bl_sec_segs_hash_verify_timestamp D - 28 - pbl_populate_shared_data_and_exit_timestamp S - 58515 - PBL, End B - 75045 - SBL1, Start (MPM timestamp = 80703) B - 77065 - SBL1 BUILD @ 14:55:18 on Jun 16 2022 B - 78032 - usb: hs_phy_nondrive_start B - 78339 - str_overflow B - 78379 - usb: hs_phy_nondrive_finish D - 1313 - sbl1_hw_init D - 12 - boot_flash_init B - 197946 - UFS INQUIRY ID: SAMSUNG KM2V8001CM-B707 1900 B - 199361 - UFS Boot LUN: 1 D - 856 - Auth Metadata D - 138782 - sbl1_xblconfig_init D - 4 - sbl1_feature_config_init D - 3 - boot_config_data_table_default_init D - 17 - sbl1_ddr_set_default_params B - 217315 - Using default CDT D - 98 - boot_config_data_table_init B - 217332 - CDT Version:3,Platform ID:34,Major ID:1,Minor ID:0,Subtype:0 D - 18 - sbl1_hw_platform_pre_ddr D - 1650 - devcfg init B - 222685 - PM: PM 0=0x8000028000000041:0x800 B - 222734 - PM: PM 1=0x8000018000000040:0x800800 B - 222768 - PM: HARD_RESET by PS_HOLD B - 278283 - PM: SET_VAL:Skip B - 278516 - PM: PSI: b0x10_v0x17 B - 282060 - PM: Device Init # SPMI Transn: 4521 B - 286467 - PM: Driver Init # SPMI Transn: 303 B - 286576 - PM: APSD re-run B - 289233 - PM: battery Id: 10094 B - 789791 - PM: CHG Init # SPMI Transn: 56 D - 570793 - pmic XBL init D - 5825 - vsense_railway_cpr init D - 578367 - sbl1_hw_pre_ddr_init D - 4 - boot_dload_handle_forced_dload_timeout D - 321 - sbl1_load_ddr_training_data D - 447 - sbl1_ddr_set_params B - 799469 - DSF version = 20.0, DSF RPM version = 9.0 B - 799475 - Manufacturer ID = 1, Device Type = 7 B - 799480 - Rank 0 size = 2048 MB, Rank 1 size = 4096 MB B - 799485 - Max Frequency = 1804 MHz B - 799501 - Row Hammer Check : DRAM supports unlimited MAC Value : MR24[OP2:0 = 0] & MR24[OP3 = 1] for CH0 & CS0 B - 799514 - Row Hammer Check : DRAM supports unlimited MAC Value : MR24[OP2:0 = 0] & MR24[OP3 = 1] for CH0 & CS1 D - 3482 - sbl1_ddr_init B - 799662 - do_ddr_training, Start B - 805059 - Bootup frequency set to 1555200 D - 5445 - do_ddr_training, Delta D - 5455 - sbl1_do_ddr_training D - 2 - sbl1_hand_control_to_devprog_ddr_or_ddi B - 805126 - Pimem init cmd, entry D - 9917 - Pimem init cmd, exit D - 10680 - sbl1_post_ddr_init D - 19 - sbl1_hw_init_secondary B - 816039 - APDP Image Loaded, Start D - 1031 - Auth Metadata D - 569 - Segments hash check D - 2430 - APDP Image Loaded, Delta - (8204 Bytes) D - 3 - boot_dload_dump_security_regions B - 818584 - usb: UFS Serial - ffffffff B - 1321623 - usb: chgr - SDP_CHARGER D - 503940 - boot_dload_check D - 2 - boot_cache_set_memory_barrier D - 4 - boot_smem_debug_init D - 333 - boot_smem_init D - 4 - boot_smem_alloc_for_minidump B - 1322830 - PM: SMEM Chgr Info Write Success D - 61 - boot_smem_store_pon_status D - 14 - sbl1_hw_platform_smem D - 108 - boot_clock_init_rpm D - 2 - boot_vsense_copy_to_smem D - 2 - boot_share_flash_data D - 11 - boot_populate_ram_partition_table D - 8 - boot_populate_ddr_details_shared_table D - 4 - sbl1_tlmm_init D - 2 - sbl1_efs_handle_cookies D - 2 - boot_apt_test B - 1323203 - OEM_MISC Image Loaded, Start D - 968 - Auth Metadata D - 328 - Segments hash check D - 2205 - OEM_MISC Image Loaded, Delta - (8136 Bytes) B - 1325639 - QTI_MISC Image Loaded, Start D - 8 - QTI_MISC Image Loaded, Delta - (0 Bytes) B - 1328380 - PM: PM Total Mem Allocated: 1493 D - 2736 - sbl1_pm_aop_pre_init_wrapper B - 1328391 - RPM Image Loaded, Start D - 1045 - Auth Metadata D - 1703 - Segments hash check D - 8153 - RPM Image Loaded, Delta - (220740 Bytes) B - 1336552 - QSEE Dev Config Image Loaded, Start D - 1046 - Auth Metadata D - 558 - Segments hash check D - 2946 - QSEE Dev Config Image Loaded, Delta - (35884 Bytes) B - 1339501 - QSEE Image Loaded, Start D - 5006 - Auth Metadata D - 22552 - Segments hash check D - 78132 - QSEE Image Loaded, Delta - (3343657 Bytes) D - 52 - sbl1_hw_play_vibr B - 1417873 - SEC Image Loaded, Start D - 10 - SEC Image Loaded, Delta - (0 Bytes) B - 1417888 - QHEE Image Loaded, Start D - 999 - Auth Metadata D - 3160 - Segments hash check D - 7065 - QHEE Image Loaded, Delta - (387768 Bytes) B - 1425173 - STI Image Loaded, Start D - 10 - STI Image Loaded, Delta - (0 Bytes) B - 1425942 - APPSBL Image Loaded, Start D - 1025 - Auth Metadata D - 11420 - Segments hash check D - 18144 - APPSBL Image Loaded, Delta - (2229248 Bytes) D - 6 - sbl1_appsbl_arch_determination B - 1444907 - SBL1, End D - 1369872 - SBL1, Delta S - Flash Throughput, 181000 KB/s (6278471 Bytes, 34654 us) S - DDR Frequency, 1555 MHz UEFI Start [ 1644] - 0x05FC01000 [ 1650] Sec.efi ASLR : ON DEP : ON (RTB) Timer Delta : +6 mS RAM Entry 0 : Base 0x0000000040000000 Size 0x000000003C900000 RAM Entry 1 : Base 0x00000000C0000000 Size 0x0000000100000000 RAM Entry 2 : Base 0x0000000080000000 Size 0x0000000040000000 UART Buffer size set to 0x8000 Wrong CPU core 4 Wrong CPU core 5 Wrong CPU core 6 Wrong CPU core 7 UEFI Ver : 5.0.220616.BOOT.XF.4.1-00327-KAMORTALAZ-1 Build Info : 64b Jun 16 2022 14:56:08 Boot Device : UFS PROD Mode : TRUE Retail : TRUE Module cannot re-initialize DAL module environment UFS INQUIRY ID: SAMSUNG KM2V8001CM-B707 1900 UFS Boot LUN: 1 Embedded Images Supported and Commonlibs loaded Read: NumHalfSectors 0x1, ReliableWriteCount 0x0 Read: NumHalfSectors 0x1, ReliableWriteCount 0x0 Read: NumHalfSectors 0x8, ReliableWriteCount 0x0 HW Wdog Setting from PCD : Disabled PM0: 45, PM1: 37, MDPPlatformConfigure 10 MDPPlatformConfigure 6 DisplayDxe: SetupPlatformPanelConfig 33 uHardwareVersionSubtype 0 DisplayDxe: SetupPlatformPanelConfig 44 uPanelCnt 1 DisplayDxe: SetupPlatformPanelConfig 55 pDetectPanel 1 DisplayDxe: SetupPlatformPanelConfig 66 uPanelId 0 eSelectedPanel 35 MDPPlatformConfigure 5 MDPPlatformConfigure 1 Panel power up sequence for default platform:Panel_Default_PowerUp ,by eric.wang. mask Panel_Default_PowerUp:reset,by eric.wang. Panel_Default_Peripheral_Power. GetPmicIBBLABMode. MDPPlatformConfigure 0 Display: MDP_DISPLAY_PRIMARY MDPPlatformConfigure 7 Panel_Default_Reset. Panel power up sequence for default platform:Panel_ResetStateExec.reset pin: 82,by eric.wang state0:=1,state1:=0,state2:=1,by eric.wang Display: DynamicDSIPanelDetection uPanelIndex:0 Detected panel id:00880000 DisplayDxe: Resolution 1080x2160 (1 intf) MDPPlatformConfigure 5 MDPPlatformConfigure 6 MDPPlatformConfigure 11 UsbConfigPortsQueryConnectionChange: UFP and Type-C UsbConfigPortsQueryConnectionChange: usbport->connectstate: ATT [Haptics] Install EFI_QCOM_I2C_HAPTICS_PROTOCOL Success. - Success EFI_I2cHapticsInit device 3 haptic_nv: uefi driver version is v1.2.0 haptic_nv_hw_init: enter! haptic_nv_parse_chipid enter haptic_nv_hw_reset enter haptic_nv_parse_chipid aw86224_5 detected haptic_nv_sw_reset enter haptic_nv_func_init: enter! haptic_nv_init: enter! aw8622x_haptic_stop enter aw8622x_haptic_stop entered standby! glb_state=0x00 haptic_nv_ram_init: enter! haptic_nv_haptic_play: enter! haptic_nv_haptic_play: enter! wav_index = 3 haptic_nv_haptic_play: enter! wav_loop = 0 EFI_I2cHapticsInit Success MinidumpTADxe: Minidump TA loading not enabled. Disp init wait [ 2329] MDPPlatformConfigure 8 MDPPlatformConfigure 8 MDPPlatformConfigure 7 Panel_Default_Reset. Panel power up sequence for default platform:Panel_ResetStateExec.reset pin: 82,by eric.wang state0:=1,state1:=0,state2:=1,by eric.wang MDPPlatformConfigure 4 Panel_Default_Brightness_Enable. GetPmicIBBLABMode. Panel_Default_Brightness_Level. 3 Panel_Default_Brightness_Level uNumBits 8 uLevel 50 Panel_Default_Brightness_Level command 0x51 0x80 0x0 MDPPlatformConfigure 5 ----------------------------- Platform Init [ 2597] BDS UEFI Ver : 5.0.220616.BOOT.XF.4.1-00327-KAMORTALAZ-1 Platform : IDP Chip Name : SM_KAMORTA_H Chip Ver : 1.0 Chip Serial Number : 0xFFFFFFFF ----------------------------- UEFI Total : 970 ms POST Time [ 2614] OS Loader Loader Build Info: Jul 7 2022 14:40:36 VB: Non-secure device: Security State: (0xF3F) VB: RWDeviceState: Succeed using devinfo! GetKeyPress Success Total DDR Size: 0x000000017C900000 KeyPress:0, BootReason:0 Fastboot=0, Recovery:0 GetVmData: No Vm data present! Status = (0x3) VM Hyp calls not present Active Slot _a is bootable, retry count 6 Booting from slot (_a) Booting Into Mission Mode Loading Image Start : 2643 ms Loading Image Done : 2644 ms Total Image Read size : 4096 Bytes Invalid vendor_boot partition. Skipping Load Image vbmeta_a total time: 1 ms Load Image vbmeta_system_a total time: 1 ms Load Image boot_a total time: 191 ms avb_slot_verify.c:256: ERROR: boot_a: Hash of data does not match digest in descriptor. Load Image dtbo_a total time: 49 ms avb_slot_verify.c:256: ERROR: dtbo_a: Hash of data does not match digest in descriptor. VB2: Authenticate complete! boot state is: orange VB2: boot state: orange(1) Memory Base Address: 0x40000000 Decompressing kernel image total time: 191 ms Dtbo hdr magic mismatch 0, with D7B7AB1E qcom, msm-id in device tree is (8) not a multiple of (12) DTB offset is incorrect, kernel image does not have appended DTB VB: Non-secure device: Security State: (0xF3F) VB: RWDeviceState: Succeed using devinfo! Cmdline: PMOS_NO_OUTPUT_REDIRECT pmos_boot_uuid=7048704a-ced5-492f-a66c-a5227e912da9 pmos_root_uuid=096655cd-19ae-461c-8534-a5ca9009d295 androidboot.verifiedbootstate=orange androidboot.keymaster=1 androidboot.vbmeta.device=PARTUUID=b6221cbc-a067-5d87-50 RAM Partitions Add Base: 0x0000000040000000 Available Length: 0x000000003C900000 Add Base: 0x00000000C0000000 Available Length: 0x0000000100000000 Add Base: 0x0000000080000000 Available Length: 0x0000000040000000 ERROR: Could not get splash memory region node Update Device Tree total time: 12 ms Shutting Down UEFI Boot Services: 3239 ms Start EBS [ 3239] BDS: LogFs sync skipped, Unsupported App Log Flush : 50 ms Exit EBS [ 3307] UEFI End