iPad Air 2 - DFU - waiting for ipad - no error

[cisco2017]

I need help with this one, I hit the wall with this one after so many different ways trying to fix this.

I started what it looks like an easy Nand upgrade and now a nightmare.

Nand had 100% black glue under and I had to heat Nand for about a minute at 350C, everything was ok until almost at the end of cleaning up black glue from main board pad (E3) came off well I fixed it by soldering a wire and making a pad with copper foil.

Now when trying to restore iTunes will get stuck in "waiting for ipad"

iTunes logs looks like this

2017-06-09 21:06:46.247 [9056:2364]: restore library built Apr 3 2017 at 08:37:23
2017-06-09 21:06:46.247 [9056:2364]: iTunes: iTunes 12.6.1.25
2017-06-09 21:06:46.247 [9056:2364]: iTunes: Software payload version: 14F89
2017-06-09 21:06:46.247 [9056:2364]: iTunes: Using MobileRestore state machine
[02:07:20.0366] requested restore behavior: Erase
[02:07:20.0416] Automatically set FormatForAPFS => True and FormatForLwVM => False.
[02:07:20.0416] Changing state from '(null)' to 'Restoring'
[02:07:20.0416] AppleDevice::GetDeviceID: failed for iBoot
[02:07:20.0416] AppleDevice::GetDeviceID: failed for iBoot
[02:07:20.0421] requested restore behavior: Erase
[02:07:20.0461] no override trust object found
[02:07:20.0461] requested restore behavior: Erase
[02:07:20.0461] requested restore behavior: Erase
[02:07:20.0461] requested variant: Erase
[02:07:20.0461] requested restore behavior: Erase
[02:07:20.0461] amai: AMAuthInstallBundleFDRSupported: FDR is supported for this device
[02:07:20.0466] personalizing: <AMAuthInstall 000001F2F29E2890>{ap=(personalize=YES j81ap ecid=0x3294e38468426, chipid=0x7001, boardid=0x6, isProduction=YES, EPRO=YES, isSecure=YES, ESEC=YES, img4=YES, demotionPolicy=, nonce=0x1e0faaca30b95e1c94d906fc87cc97236a3c0647, sepNonce=0x1662b6cab45f6a2ff839e8666c4eaafcfd4023d 3), bp=(personalize=YES), UserAuth=NO, iTunes=YES, server="http://gs.apple.com:80", locale=en_US, version="libauthinstall_Win-473.50.16",

.
.
.
. many lines to end
.
.
[02:07:31.0045] <DFU Device 000001F2FA9CB0C0>: operation 0 progress 76
[02:07:31.0050] <DFU Device 000001F2FA9CB0C0>: operation 0 progress 77
[02:07:31.0055] <DFU Device 000001F2FA9CB0C0>: operation 0 progress 78
[02:07:31.0060] <DFU Device 000001F2FA9CB0C0>: operation 0 progress 79
[02:07:31.0064] <DFU Device 000001F2FA9CB0C0>: operation 0 progress 80
[02:07:31.0069] <DFU Device 000001F2FA9CB0C0>: operation 0 progress 81
[02:07:31.0074] <DFU Device 000001F2FA9CB0C0>: operation 0 progress 82
[02:07:31.0079] <DFU Device 000001F2FA9CB0C0>: operation 0 progress 84
[02:07:31.0083] <DFU Device 000001F2FA9CB0C0>: operation 0 progress 85
[02:07:31.0086] <DFU Device 000001F2FA9CB0C0>: operation 0 progress 86
[02:07:31.0094] <DFU Device 000001F2FA9CB0C0>: operation 0 progress 87
[02:07:31.0098] <DFU Device 000001F2FA9CB0C0>: operation 0 progress 88
[02:07:31.0103] <DFU Device 000001F2FA9CB0C0>: operation 0 progress 89
[02:07:31.0107] <DFU Device 000001F2FA9CB0C0>: operation 0 progress 91
[02:07:31.0112] <DFU Device 000001F2FA9CB0C0>: operation 0 progress 92
[02:07:31.0117] <DFU Device 000001F2FA9CB0C0>: operation 0 progress 93
[02:07:31.0122] <DFU Device 000001F2FA9CB0C0>: operation 0 progress 94
[02:07:31.0127] <DFU Device 000001F2FA9CB0C0>: operation 0 progress 95
[02:07:31.0132] <DFU Device 000001F2FA9CB0C0>: operation 0 progress 96
[02:07:31.0136] <DFU Device 000001F2FA9CB0C0>: operation 0 progress 97
[02:07:31.0141] <DFU Device 000001F2FA9CB0C0>: operation 0 progress 99
[02:07:31.0142] WinDFU::UploadData: EOF, cbRead: 1669
[02:07:31.0146] <DFU Device 000001F2FA9CB0C0>: operation 0 progress 100
[02:07:31.0147] WinDFU::UploadData: ZLP
[02:07:31.0151] WinDFU::FinalizeDfuUpdate: GetStatus: status: 0, state: 6
[02:07:31.0151] WinDFU::ProcessUpdateState: status.bState == DFU_STATE_MANIFEST_SYNC
[02:07:31.0152] WinDFU::FinalizeDfuUpdate: GetStatus: status: 0, state: 7
[02:07:31.0152] WinDFU::ProcessUpdateState: status.bState == DFU_STATE_MANIFEST, PollTimeout: 3000
[02:07:34.0153] WinDFU::FinalizeDfuUpdate: GetStatus: status: 0, state: 8
[02:07:34.0153] WinDFU::ProcessUpdateState: status.bState == DFU_STATE_MANIFEST_WAIT_RESET
[02:07:34.0153] WinDFU::ResetDevice: resetting...
[02:07:34.0342] WinDFU::FinalizeDfuUpdate: success
[02:07:34.0342] <DFU Device 000001F2FA9CB0C0>: DFU succeeded
[02:07:34.0342] Finished DFU Restore Phase: Successful

After the last line it will stay like that for ever I even wait over night.

I done the E3 pad wire two times just to make sure.

E3 goes to the CPU, but not sure if the source for this nightmare.

I checked all caps around and test for shorts

re-heat main board

I disabled antivirus...

Used a different computer

used 3utools

"Now, is it possible that I fry a chip? how do I find it"

I don't have schematics for iPad Air 2.


Any help will be appreciated

[cisco2017]

Any body out there that might had the same issue?

Unfortunately I erased the original Nand and restoring both boot1 and boot2 is not changing the outcome.

Any body knows what is the recovery process, that might give me an idea where is failing.

[cisco2017]

Update:

Tested without a Nand in main board and the same, it get stuck in "waiting for ipad" so at this point I don't think is a Nand issue.

1- battery is charging, I get a 24 mA when I connect to power/usb
2- battery measures 4.3v

Any ideas on why is not detecting Nand and why is no error until I disconnect usb cable.
When I disconnect usb cable is error 4014 for obvious reason.

[aries20]

Originally Posted by cisco2017

Update:

Tested without a Nand in main board and the same, it get stuck in "waiting for ipad" so at this point I don't think is a Nand issue.

1- battery is charging, I get a 24 mA when I connect to power/usb
2- battery measures 4.3v

Any ideas on why is not detecting Nand and why is no error until I disconnect usb cable.
When I disconnect usb cable is error 4014 for obvious reason.

In my experience when I restore without nand, I always get error 4013

[dam1inc]

Should be able to erase nand chip, solder back on and restore iTunes, then after pull chip off add serial number solder back on and just turn it on...if u can't do that I think there is maybe measure/check components around nand and also check solder job...without nand restore will get 4013 I think that's normal but not entirely sure

Sent from my SM-G955U using Tapatalk

[cisco2017]

Originally Posted by dam1inc

Should be able to erase nand chip, solder back on and restore iTunes, then after pull chip off add serial number solder back on and just turn it on...if u can't do that I think there is maybe measure/check components around nand and also check solder job...without nand restore will get 4013 I think that's normal but not entirely sure

Sent from my SM-G955U using Tapatalk

I have un/solder couple different nands and the same result.

tested few caps not all them since I have to take them out, and check for continuity, same result.

I was extra careful and took pics of before Nand because of those micro smd that usually come off, but what I do is to put a bit of green UV protector and let it dry, and like that I successfully avoid accidentally taking off one of those, one of them is the 240 ohn which is unique for the whole board.

The no error 4013 with no Nand is bothering me.

[cisco2017]

LOL , I have another iPad air 2 board I use for parts, missing several caps and when I plug that one in without a Nand it do much better than the complete board ????

The error is a (4014) not a (4013)


[03:57:07.0253] DFU mode device disconnected
[03:57:07.0253] Device removed when in state Restoring, moving device to transition state
[03:57:07.0253] Changing state from 'Restoring' to 'Transitioning'
[03:57:07.0253] Creating timer to monitor transition
[03:57:07.0253] Creating a timer for 10 minutes
[03:57:08.0643] Recovery mode device connected
[03:57:08.0643] Transitioning device returned, continuing restore.
[03:57:08.0643] Canceling timer
[03:57:08.0643] Changing state from 'Transitioning' to 'Restoring'
[03:57:08.0643] requested restore behavior: Erase
[03:57:08.0656] amai: AMAuthInstallBundleCopyBuildIdentityForVariant: No baseband chipid reported. Will match Build Identity based on ap chipid and boardid only.
[03:57:08.0658] amai: AMAuthInstallBundleFDRSupported: FDR is supported for this device
[03:57:08.0658] no override trust object found
[03:57:08.0658] requested restore behavior: Erase
[03:57:08.0658] requested restore behavior: Erase
[03:57:08.0658] requested variant: Erase
[03:57:08.0659] requested restore behavior: Erase
[03:57:08.0659] amai: AMAuthInstallBundleFDRSupported: FDR is supported for this device
[03:57:08.0659] personalizing: <AMAuthInstall 0000022C1F8925A0>{ap=(personalize=YES j81ap ecid=0x1c24d820ea0426, chipid=0x7001, boardid=0x6, isProduction=YES, EPRO=YES, isSecure=YES, ESEC=YES, img4=YES, demotionPolicy=, nonce=0x8800e8b18a9afa4562f7735b8de0cae5730c5d07, sepNonce=0x1aa8e1d162594d97d0a732694438d4177b09feb 0), bp=(personalize=YES), UserAuth=NO, iTunes=YES, server="http://gs.apple.com:80", locale=en_US, version="libauthinstall_Win-473.50.16", platform=win/10.0(14393) }
[03:57:08.0659] amai: _AMAuthInstallBundleShouldPersonalizeOS: Personalize OS = Yes
[03:57:08.0659] amai: _AMAuthInstallBundleShouldPersonalizeOS: Personalize OS = Yes
[03:57:08.0662] amai: _AMAuthInstallBundleCreateServerRequestDictionary: withApTicket is False
[03:57:08.0662] amai: _AMAuthInstallBundleCreateServerRequestDictionary: not personalizing "RestoreLogo"
[03:57:08.0662] amai: _AMAuthInstallBundleCreateServerRequestDictionary: not personalizing "RestoreDeviceTree"
[03:57:08.0662] amai: _AMAuthInstallBundleCreateServerRequestDictionary: not personalizing "RestoreKernelCache"
[03:57:08.0662] amai: _AMAuthInstallBundleCreateServerRequestDictionary: not personalizing "RestoreRamDisk"
[03:57:08.0662] amai: _AMAuthInstallBundleCreateServerRequestDictionary: entry "OSRamdisk" not part of manifest, skipping
[03:57:08.0662] amai: _AMAuthInstallBundleCreateServerRequestDictionary: not personalizing "iBEC"
[03:57:08.0662] amai: _AMAuthInstallBundleCreateServerRequestDictionary: not personalizing "iBSS"
[03:57:08.0662] amai: _AMAuthInstallBundleCreateServerRequestDictionary: not personalizing "KernelCache"
[03:57:08.0662] amai: _AMAuthInstallBundleCreateServerRequestDictionary: skipping "ftap" entry
[03:57:08.0662] amai: _AMAuthInstallBundleCreateServerRequestDictionary: skipping "rfta" entry
[03:57:08.0662] amai: _AMAuthInstallBundleCreateServerRequestDictionary: skipping "ftsp" entry
[03:57:08.0662] amai: _AMAuthInstallBundleCreateServerRequestDictionary: skipping "rfts" entry
[03:57:08.0662] amai: _AMAuthInstallBundleCreateServerRequestDictionary: entry "Diags" not part of manifest, skipping
[03:57:08.0662] amai: _AMAuthInstallBundleCreateServerRequestDictionary: entry "CFELoader" not part of manifest, skipping
[03:57:08.0662] amai: _AMAuthInstallBundleCreateServerRequestDictionary: entry "RBM" not part of manifest, skipping
[03:57:08.0662] amai: _AMAuthInstallBundleCreateServerRequestDictionary: entry "PHLEET" not part of manifest, skipping
[03:57:08.0662] amai: _AMAuthInstallBundleCreateServerRequestDictionary: entry "PERTOS" not part of manifest, skipping
[03:57:08.0662] amai: _AMAuthInstallBundleCreateServerRequestDictionary: entry "PEHammer" not part of manifest, skipping
[03:57:08.0662] amai: _AMAuthInstallBundleCreateServerRequestDictionary: entry "Alamo" not part of manifest, skipping
[03:57:08.0662] amai: _AMAuthInstallBundleCreateServerRequestDictionary: skipping "OS" entry
[03:57:08.0662] amai: _AMAuthInstallBundleCreateServerRequestDictionary: not personalizing "LLB"
[03:57:08.0663] amai: _AMAuthInstallBundleCreateServerRequestDictionary: not personalizing "AppleLogo"
[03:57:08.0663] amai: _AMAuthInstallBundleCreateServerRequestDictionary: not personalizing "BatteryCharging1"
[03:57:08.0663] amai: _AMAuthInstallBundleCreateServerRequestDictionary: not personalizing "SEP"
[03:57:08.0663] amai: _AMAuthInstallBundleCreateServerRequestDictionary: not personalizing "BatteryFull"
[03:57:08.0663] amai: _AMAuthInstallBundleCreateServerRequestDictionary: not personalizing "BatteryPlugin"
[03:57:08.0663] amai: _AMAuthInstallBundleCreateServerRequestDictionary: not personalizing "BatteryCharging0"
[03:57:08.0663] amai: _AMAuthInstallBundleCreateServerRequestDictionary: not personalizing "BatteryLow1"
[03:57:08.0663] amai: _AMAuthInstallBundleCreateServerRequestDictionary: not personalizing "RestoreSEP"
[03:57:08.0663] amai: _AMAuthInstallBundleCreateServerRequestDictionary: not personalizing "BatteryLow0"
[03:57:08.0663] amai: _AMAuthInstallBundleCreateServerRequestDictionary: not personalizing "RecoveryMode"
[03:57:08.0663] amai: _AMAuthInstallBundleCreateServerRequestDictionary: not personalizing "DeviceTree"
[03:57:08.0663] amai: _AMAuthInstallBundleCreateServerRequestDictionary: not personalizing "iBoot"
[03:57:08.0663] amai: _AMAuthInstallBundleCreateServerRequestDictionary: nothing to be done
[03:57:08.0663] interface has 1 endpoints, file pipe = 1
[03:57:08.0663]
[03:57:08.0665] iBoot build-version = iBoot-3406.60.10
[03:57:08.0667] iBoot build-style = RELEASE
[03:57:08.0667] unable to open device_map.txt: No such file or directory
[03:57:08.0668] found device map entry for 0x00007001 0x00000006. boardConfig=j81ap platform=t7001
[03:57:08.0668] _AMRestoreCopyDeviceMapPlistEntryForHardware: firmwareDirectory not in options
[03:57:08.0668] requested restore behavior: Erase
[03:57:08.0670] requested restore behavior: Erase
[03:57:08.0672] unable to open device_map.txt: No such file or directory
[03:57:08.0672] found device map entry for 0x00007001 0x00000006. boardConfig=j81ap platform=t7001
[03:57:08.0672] _AMRestoreCopyDeviceMapPlistEntryForHardware: firmwareDirectory not in options
[03:57:08.0674] AMDeviceIoControl: GetOverlappedResult failed
[03:57:08.0674] AMDeviceIoControl: pipe stall
[03:57:08.0674] USBControlTransfer: error 31, usbd status c0000004
[03:57:08.0674] command device request for 'getenv radio-error' failed: 2008
[03:57:08.0674] radio-error not set
[03:57:08.0675] unable to open device_map.txt: No such file or directory
[03:57:08.0675] <Recovery Mode Device 0000022C1FA5F740>: production fused device
[03:57:08.0675] unable to open device_map.txt: No such file or directory
[03:57:08.0675] found device map entry for 0x00007001 0x00000006. boardConfig=j81ap platform=t7001
[03:57:08.0675] _AMRestoreCopyDeviceMapPlistEntryForHardware: firmwareDirectory not in options
[03:57:08.0675] requested restore behavior: Erase
[03:57:08.0677] requested restore behavior: Erase
[03:57:08.0679] <Recovery Mode Device 0000022C1FA5F740>: operation 4 progress -1
[03:57:08.0684] unable to open device_map.txt: No such file or directory
[03:57:08.0684] found device map entry for 0x00007001 0x00000006. boardConfig=j81ap platform=t7001
[03:57:08.0684] _AMRestoreCopyDeviceMapPlistEntryForHardware: firmwareDirectory not in options
[03:57:08.0684] requested restore behavior: Erase
[03:57:08.0686] requested restore behavior: Erase
[03:57:08.0688] <Recovery Mode Device 0000022C1FA5F740>: operation 43 progress -1
[03:57:08.0688] requested restore behavior: Erase
[03:57:08.0692] Max file size is: 268435456
[03:57:09.0714] AMDeviceIoControl: GetOverlappedResult failed
[03:57:09.0714] AMDeviceIoControl: failed, error 31, usbd status c0000011
[03:57:09.0719] Recovery mode device disconnected
[03:57:09.0719] Device removed when in state Restoring, moving device to transition state
[03:57:09.0719] Changing state from 'Restoring' to 'Transitioning'
[03:57:09.0719] Creating timer to monitor transition
[03:57:09.0719] Creating a timer for 10 minutes
[03:57:10.0219] AMDeviceIoControl: failed, error 2, usbd status c0000011
[03:57:10.0576] DFU mode device connected
[03:57:10.0576] Transitioning device returned, continuing restore.
[03:57:10.0576] Canceling timer
[03:57:10.0576] Changing state from 'Transitioning' to 'Restoring'
[03:57:10.0721] AMDeviceIoControl: failed, error 2, usbd status c0000011
[03:57:11.0233] USBControlTransfer: error 2, usbd status c0000011
[03:57:11.0233] command device request for 'bgcolor 0 0 0' failed: 2009
[03:57:11.0233] AMRAuthInstallDeletePersonalizedBundle
[03:57:11.0426] <Recovery Mode Device 0000022C1FA5F740>: Recovery mode failed (result = 2009)
[03:57:11.0426] Failed to restore device in recovery mode, libusbrestore error:2009
[03:57:11.0426] Finished Recovery Restore Phase: Failed
[03:57:11.0426] State Machine Dump, status:ERROR - [stateFU remaining-cycles:0] -> [state:Recovery remaining-cycles:0] -> [state:RestoreOS remaining-cycles:1 (current state)]
[03:57:11.0426] Changing state from 'Restoring' to 'Error'
[03:57:11.0426] State is now set to error
[03:57:11.0427] State Machine Dump, status:ERROR - [stateFU remaining-cycles:0] -> [state:Recovery remaining-cycles:0] -> [state:RestoreOS remaining-cycles:1 (current state)]
[03:57:11.0427] Unexpected device state 'DFU' expected 'RestoreOS'
[03:57:11.0427] Restore completed, status:4014
[03:57:11.0427] Failure Description:
[03:57:11.0427] Depth:0 Code:4014 Error:Unexpected device state 'DFU' expected 'RestoreOS'
[03:57:11.0427] Changing state from 'Error' to 'Error'
[03:57:11.0427] State is now set to error

[cisco2017]

These are the readings on the iPad Air 2 board, are those correct? I don't have the schematics.
I'm looking around the iPad Air schematics and I get one side 3.3v and 1.8v

any body?

[hiena_222g]

I have the same problem. If you solve, please tell me on [email protected]

[rikimaer]

Cpu overheated try to reball

[mcmihai003]

On Air1, when U8360 is not soldered properly could get ~1V2-1V3 instead of 1V8...
When this is happenning, "waiting for ipad" after dfu completed happens to Air1 too..
PP3V3_NAND and PP1V8_NAND are present and OK?
Maybe it helps...

[cisco2017]

Originally Posted by mcmihai003

On Air1, when U8360 is not soldered properly could get ~1V2-1V3 instead of 1V8...
When this is happenning, "waiting for ipad" after dfu completed happens to Air1 too..
PP3V3_NAND and PP1V8_NAND are present and OK?
Maybe it helps...

I'll check later today, the board is on a draw was never able to fix it.

[cisco2017]

Originally Posted by cisco2017

I'll check later today, the board is on a draw was never able to fix it.

voltage is *** on the air 2, but I found a 3.3v on one that should be 1.8v according to schematics.

So I'll be tracing that issue.

Thanks.

[calais250]

looking forward to any solution you might have.
thank you

[cisco2017]

Originally Posted by calais250

looking forward to any solution you might have.
thank you

I'm currently working on iPad Pro no wifi after wifi IC change, then I'll go back to the Air 2.

I'll keep you posted.