Read eMMC on Desire Z after S-OFF [SOLVED] - GSM-Forum

sepulchral · 01-13-2020, 09:37

Is it possible to use the fastboot interface to read the eMMC of the HTC Desire Z after I have put it in S-OFF mode? I used the legacy option in order to achieve S-OFF, and with other models this is often enough in order to use

Quote:

htc_fastboot dump emmc <filename> start_address stop_address

to get the content of the eMMC, but for this device I get a command "not allowed" response in fastboot.

Any suggestions?

Quote:

htc_fastboot.exe getvar all
(bootloader) version: 0.5
(bootloader) version-bootloader: 0.85.0013
(bootloader) version-baseband: 26.10.04.03_M
(bootloader) version-cpld: None
(bootloader) version-microp: 0425
(bootloader) version-main: 2.42.405.4
(bootloader) serialno: removed on purpose
(bootloader) imei: removed on purpose
(bootloader) product: vision
(bootloader) platform: HBOOT-7230
(bootloader) modelid: PC1011000
(bootloader) cidnum: HTC__Y13
(bootloader) battery-status: good
(bootloader) battery-voltage: 3775mV
(bootloader) partition-layout: Generic
(bootloader) security: off
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: 81c588a7
(bootloader) hbootpreupdate: 11
(bootloader) gencheckpt: 0
all: Done!
finished. total time: 0.016s
htc_fastboot finished. total time: 0.425s

xtc2clip · 01-13-2020, 17:24

Hello!

This is a rather old model, most likely it doesn't even have the read command.
What do you want to do with the read information? If there is a custom recovery for this model, you can flash it and make backup using TWPR for example.

sepulchral · 01-16-2020, 08:29

Quote:

Originally Posted by xtc2clip

Hello!

This is a rather old model, most likely it doesn't even have the read command.
What do you want to do with the read information? If there is a custom recovery for this model, you can flash it and make backup using TWPR for example.

Old indeed. A customer who wanted the data on the device, and didn't want to risk bricking it/etc, so wanted to read the eMMC w/o flashing recovery/etc and/or soldering off the chip.

Turned out the device supports the read_emmc command which can be used to dump the entire eMMC. It takes a looooooooooooooooooooooong time however, but it works, so that's what I ended up doing with a small script that parsed the output from read_emmc,

01-13-2020, 17:24	#2 (permalink)
xtc2clip No Life Poster Join Date: Jun 2015 Posts: 6,556 Member: 2416253 Status: Offline Thanks Meter: 4,162	Hello! This is a rather old model, most likely it doesn't even have the read command. What do you want to do with the read information? If there is a custom recovery for this model, you can flash it and make backup using TWPR for example.