Intohand

Amongst my challenges for this week was to try to get an N950 flashed up from the “Developer” branded Beta 1 up to Beta 2, so that some of the later Qt components might work for an app build we’re working on. The kind souls at Nokia have provided an executable “OneClickFlasher” which is available for Linux, Windows and Mac – which was the first port of call for the operation.

I ended up downloading all of the OneClickFlashers and set about trying to do this job. Every one on every platform failed – and I tried six different computers. After the first attempt the device looks like it is bricked, and will not boot into anything other than a basic low level ROM re-write mode. One of my colleagues bricked another N950 in what I presume was exactly the same way.

In each instance the problem on attempted reflash was: “ERROR: Failed to erase MMC using ‘secure’ method”. I finally accepted that the OneClickFlasher as it stood wasn’t going to do the job, so I looked around to start pulling things to pieces.

Firstly, the Windows flasher (“Win_OCF_34-2_EMMC_RM680-OEM1-916.exe”) can be dismantled with Winrar. If you pull apart that package you can run the flasher executable from the command line and look for what is going wrong.

Similarly, the Linux bin file (“Linux_OCF_34-2_EMMC_RM680-OEM1-916.bin”) can also be dismantled with a shell script available from the Meego site.

So on a Ubuntu 11.10 machine with dismantled flasher I ran the commands manually and the failing stage was “./flasher -a img.bin –erase-mmc=secure”, with the failure condition a read problem. It was consistent, and presumably an attribute of the device itself rather than the flashers.

Google is your friend here so I looked for an earlier flasher or even earlier binary files to feed to the flashers, thinking I might mix and match to see if there was an exit for the bricked device. I found a very helpful website which not only has pulled apart the latest flasher, but more importantly has the earlier release of the N950 firmware posted. That release is called “Linux_OCF_22-6_EMMC_RM680-OEM1-916.bin” and as far as I can tell it’s not readily available online. At the time of writing this post, the website has disappeared from view, but not before I grabbed the 22-6 installer for Linux.

The 22-6 installer doesn’t work out of the box either, failing the same way as the 34-2. Once again at the step “./flasher -a img.bin –erase-mmc=secure” there was a read error, one of the CPUs on my machine went to 100% and by tailing dmesg I could see that the USB was connecting and disconnecting, in tune with the device flashing “Nokia” in the screen centre and then blacking out. I left it in this state for around 15 minutes waiting for recovery and wondering what to do next.

Then I had a stroke of good fortune. I ran $ ps aux | grep flasher in another window, and saw that the flasher process was directly eating the 100% CPU. So I killed the process id and the flasher moved on to the next stage: writing the ROM. This finished with a success message, and on disconnect the device booted back into its (original) 22-6 state.

So the next thing to do was try the 34-2 flasher again, on exactly the same machine that had failed a dozen times before. It worked first time, and the device booted into a non-Developer branded 34-2, fully functional. I now realise that by killing the flasher when it failed, the install script just carried on and flashed the device anyway, presumably without a fully successful ‘secure erase’.

Once the N950 connected to the WLAN, it went off searching for software updates – and it found a later version than 34-2 (actually 39-5). After around 300Mbytes of download and 45 minutes install, it bumped itself up to PR1.1 (2.2011.39-5_PR_RM680). Hopefully now all subsequent updates will be over the air!

I’ll probably qualify to sort out the other bricked N950. I’ll do it this way:
1) Reflash 22-6 with the one click installer – and if that fails, during the install I will kill the “flasher” process if it jams up on secure erase. Repeat until the device recovers as 22-6.
2) Flash up with the 34-2 upgrade. Which will probably work and if it doesn’t I’ll likely kill the secure-erase stage to force it through. Somehow I guess that won’t be needed…

Now turning my attentions to an HTC Desire PVT-4…

UPDATE 26th October 2011: Now the one click flasher for the Firmware 39-5 is available on Nokia’s site.