読者です 読者をやめる 読者になる 読者になる

FFUイメージの中身を確認する

メモ Windows

必要な環境

windows.microsoft.com

www.wpinternals.net

7-Zip

この手順では、接続したWindows Phoneデバイスのリセットを行います。
個人情報はすべて削除され、工場出荷の状態となります。
この手順によって発生したいかなる責任は、すべて自己責任となります。

手順

  1. Windows Device Recovery Toolを実行し、リカバリーを実行する (データが削除されますが、ダウンロード開始後に外せば回避できるかもしれません)
  2. C:\ProgramData\Microsoft\Packages\Products\ 以下のフォルダーからFFUファイルができていることを確認する
  3. Dumpメニューで、Source・Main OSの展開先を選択してDump Partitionsf:id:morokoshidog:20160409160636p:plain
  4. 7-Zipで展開するf:id:morokoshidog:20160409161214p:plain

MainOS\PROGRAMS\CommonFiles\Sounds
MainOS\PROGRAMS\CommonFiles\Wallpapers
MainOS\Windows\system32\lockscreen
MainOS\Windows\system32\backgrounds
MainOS\PROGRAMS\PHOTOS


以前の情報

必要な環境

windows.microsoft.com
作業フォルダー (C:\Temp) はあらかじめ作成しておく
OSFMount - Mount CD and Disk images in Windows, ISO, DD

"C:\Program Files (x86)\Microsoft Care Suite\Windows Device Recovery Tool\thor2.exe" -mode ffureader -ffufile "C:\ProgramData\Microsoft\Packages\Products\RM-821\RM821_3051.50009.1424.0008_RETAIL_apac_hong_kong_234_08_442718_prd_signed.ffu" -dump_partitions -filedir d:\temp

MainOS.binをマウントすればOK
Data.binはどうやって見るのだろうか?

thor2 -mode ffureader -ffufile "RM821_Production_flash_rnd_signed.ffu" -dump_partitions の実行結果の例

Process started Mon Mar 01 00:00:00 2016
Logging to file C:\Users\USERNAME\AppData\Local\Temp\thor2_win_20160301000000_ThreadId-13996.log
Debugging enabled for  ffureader

Initiating do FFUReader operations
Version of FfuReader is 2015061501
Parsing and dumping partitions of FFU... Please wait...
readFfu() Start.
readSecurityHdrAndCheckValidity() Start.
readSecurityHdrAndCheckValidity() End.
readGpt() Start.
readGpt() End.
readRkh() Start.
readRkh() End.
readRkh() Start.
.readRkh() End.
DumpPartitions() Start.
..............DumpPartitions() End.
checkDppPartition() Start.
checkDppPartition() End.
readFfu() End.

Successfully parsed FFU file. Header size: 0x000e0000, Payload size: 0x000000006ce40000, Chunk size: 0x00020000, Header offset: 0x00000000, Payload offset: 0x00000000000e0000
HeaderStart 0x80000

GPT Header
-------------

Revision         : 65536
CRC32            : 0xabc376
FirstUsableLBA   : 34
LastUsableLBA    : 20971486
AlternateLBA     : 20971519
MyLBA            : 1
NumberOfPartitionEntries : 128
PartitionEntryLBA        : 2
PartitionEntryArrayCRC32 : 0x98027455

GPT Partitions
-------------

DPP
        startLBA  : 0x0000000000001000
        endLBA    : 0x0000000000004fff
        Size      : 0x0000000000004000
        Attributes: 0x8000000000000000
MODEM_FSG
        startLBA  : 0x0000000000005000
        endLBA    : 0x00000000000067ff
        Size      : 0x0000000000001800
        Attributes: 0x8000000000000000
SSD
        startLBA  : 0x0000000000007000
        endLBA    : 0x000000000000701f
        Size      : 0x0000000000000020
        Attributes: 0x8000000000000000
SBL1
        startLBA  : 0x0000000000008000
        endLBA    : 0x0000000000008bb7
        Size      : 0x0000000000000bb8
        Attributes: 0x8000000000000000
SBL2
        startLBA  : 0x0000000000009000
        endLBA    : 0x0000000000009bb7
        Size      : 0x0000000000000bb8
        Attributes: 0x8000000000000000
SBL3
        startLBA  : 0x000000000000a000
        endLBA    : 0x000000000000afff
        Size      : 0x0000000000001000
        Attributes: 0x8000000000000000
UEFI
        startLBA  : 0x000000000000b000
        endLBA    : 0x000000000000c387
        Size      : 0x0000000000001388
        Attributes: 0x8000000000000000
RPM
        startLBA  : 0x000000000000d000
        endLBA    : 0x000000000000d3e7
        Size      : 0x00000000000003e8
        Attributes: 0x8000000000000000
TZ
        startLBA  : 0x000000000000e000
        endLBA    : 0x000000000000e3e7
        Size      : 0x00000000000003e8
        Attributes: 0x8000000000000000
WINSECAPP
        startLBA  : 0x000000000000f000
        endLBA    : 0x000000000000f3ff
        Size      : 0x0000000000000400
        Attributes: 0x8000000000000000
BACKUP_SBL1
        startLBA  : 0x0000000000010000
        endLBA    : 0x0000000000010bb7
        Size      : 0x0000000000000bb8
        Attributes: 0x8000000000000000
BACKUP_SBL2
        startLBA  : 0x0000000000011000
        endLBA    : 0x0000000000011bb7
        Size      : 0x0000000000000bb8
        Attributes: 0x8000000000000000
BACKUP_SBL3
        startLBA  : 0x0000000000012000
        endLBA    : 0x0000000000012fff
        Size      : 0x0000000000001000
        Attributes: 0x8000000000000000
BACKUP_UEFI
        startLBA  : 0x0000000000013000
        endLBA    : 0x0000000000014387
        Size      : 0x0000000000001388
        Attributes: 0x8000000000000000
BACKUP_RPM
        startLBA  : 0x0000000000015000
        endLBA    : 0x00000000000153e7
        Size      : 0x00000000000003e8
        Attributes: 0x8000000000000000
BACKUP_TZ
        startLBA  : 0x0000000000016000
        endLBA    : 0x00000000000163e7
        Size      : 0x00000000000003e8
        Attributes: 0x8000000000000000
BACKUP_WINSECAPP
        startLBA  : 0x0000000000017000
        endLBA    : 0x00000000000173ff
        Size      : 0x0000000000000400
        Attributes: 0x8000000000000000
UEFI_BS_NV
        startLBA  : 0x0000000000018000
        endLBA    : 0x00000000000181ff
        Size      : 0x0000000000000200
        Attributes: 0x8000000000000000
UEFI_NV
        startLBA  : 0x0000000000019000
        endLBA    : 0x00000000000191ff
        Size      : 0x0000000000000200
        Attributes: 0x8000000000000000
PLAT
        startLBA  : 0x000000000001a000
        endLBA    : 0x000000000001dfff
        Size      : 0x0000000000004000
        Attributes: 0x8000000000000000
EFIESP
        startLBA  : 0x0000000000020000
        endLBA    : 0x000000000003ffff
        Size      : 0x0000000000020000
        Attributes: 0x8000000000000000
MODEM_FS1
        startLBA  : 0x0000000000040000
        endLBA    : 0x00000000000417ff
        Size      : 0x0000000000001800
        Attributes: 0x8000000000000000
MODEM_FS2
        startLBA  : 0x0000000000042000
        endLBA    : 0x00000000000437ff
        Size      : 0x0000000000001800
        Attributes: 0x8000000000000000
UEFI_RT_NV
        startLBA  : 0x0000000000044000
        endLBA    : 0x00000000000441ff
        Size      : 0x0000000000000200
        Attributes: 0x8000000000000000
UEFI_RT_NV_RPMB
        startLBA  : 0x0000000000045000
        endLBA    : 0x00000000000450ff
        Size      : 0x0000000000000100
        Attributes: 0x8000000000000000
MMOS
        startLBA  : 0x0000000000046000
        endLBA    : 0x000000000006d07f
        Size      : 0x0000000000027080
        Attributes: 0x8000000000000000
MainOS
        startLBA  : 0x0000000000070000
        endLBA    : 0x000000000051e27f
        Size      : 0x00000000004ae280
        Attributes: 0x0000000000000000
Data
        startLBA  : 0x0000000000520000
        endLBA    : 0x00000000013fefff
        Size      : 0x0000000000edf000
        Attributes: 0x8000000000000000
Number of partitions found 28
RKH of SBL1: 00E9427DF118D9E27D098D13BECB6C6C89CE59F4ECCF5549C49BC0DB952A6BB4
RKH of UEFI: 00E9427DF118D9E27D098D13BECB6C6C89CE59F4ECCF5549C49BC0DB952A6BB4
Platform ID: Nokia.MSM8960.P4301
Hi. index sector 20967168
Computing integrity of FFU. Please wait...
...................

FFU integrity OK.

Exited with success

thor2 のコマンドオプション

Usage: thor2 -mode [MODE] -[ARGUMENT]... -[FLAG]...

Thor2 aims to provide SW update and miscellaneous R&D operations for WP8 products, Alpha, Collins, Theta, Quattro and Romulus engines.

MODEs:

  Sets mode of operation. Modes are emergency, uefiflash, sdflash, vpl, dump, rnd, retail, ffureader, list_connections and uefiserialflash.

ARGUMENTs:

  -ffufile <filepath>			Sets path to FFU file
  -sdfile <filepath>			Sets path to SD file
  -vplfile <filepath>			Sets path to VPL file
  -conn <connection>			Sets connection endpoint/identifier. E.g. COMx in Windows (where x is number).
                      			Connection ID notation is controllerID:hub:port. Like 0.0200.0003.0100:0004:0002
                      			Controller ID notation is the value of each sub strings of PCI of Device Location Paths USB property.
                      			The values of PCI sub strings are concatenated into resulting value separated by comma.
                      			For example PCIROOT(0)#PCI(0200)#PCI(0003)#PCI(0100)#USBROOT(0)#USB(1)#USB(5)#USB(6)#USB(1) results 0.0200.0003.0100 as controllerID.
                      			If omitted, THOR2 tries to auto-detect a connected device.
                      			Use list_connections mode to findout connected device along connection IDs.
  -logfile <filepath>			Sets custom log file for THOR2 traces


*** arguments for emergency mode ***

  -configfile <filepath>		Sets path to 8974 emergency download configuration file (file should be in XML format).
                      			All references to binary files in the configuration file should be located in the same directory.
  -protocol <prot>			Forces usage of specific emergency download protocol. Supported protocols: sahara ( Quattro/Romulus ) and streaming ( Collins / Alpha as default )
  -mbnfile <filepath>			Sets path to mbn file
  -hexfile <filepath>			Sets path to QComm HEX flasher file
  -dumpfileforhexflasher <filepath>	Sets the path to dump file.
  -dumparea <first sector to read,amount of sectors to read>		


*** arguments for uefiflash mode ***

  -partitionname <partition name>	Sets partition name of the GPT to program to.
  -partitionimagefile <filepath>	Sets path to partition image file to be programmed into the device.
  -imagefile <filepath>			Sets image file to be programmed into the device.
  -startsector <first sector to flash>	Sets number of sector from flashing of image begins.
  -productcodeupdate <CTR code>		Updates product code after successful programming. RM-820 is out-scoped.
  -looptest <loopCounter>		Tests FFU programming in a loop while staying in the flash mode between programming trials.


  -timeout <time in seconds>		Waiting time of device to appear.


  -maxtransfersizekb <block size in kb>		Max programming block size.


  -dplfile <filepath>			Sets path to DPL file.
  -batterylevel <value>			Sets minimum battery level that flashing starts.

*** arguments for uefiserialflash mode ***

  -serialflash <loopCounter> 		FFU programming of multiple of devices. Multiple of devices can be programmed in serial one after one.


*** arguments for dump mode ***

  -uefifile <filepath>			Sets path to UEFI file to be loaded into the device.
  -partitionname <name>			Sets name of partition to be read out from the device.
  -dumparea <first sector to read,amount of sectors to read>		


*** arguments for rnd mode ***

  -gptfile <filepath>			Sets path to GPT image file.
  -rawmsgreq  <hex message> 		Message to be send to the device in hexadecimal. Messaging protocol could be NOK, JSON or user defined.
  -rawmsgresp <hex message> 		Expected response message to '-rawmsgreq <hex message>' request message. Returns a zero (0) if match between request and response.
  -asciimsgreq  <ascii message> 	Message to be send to the device in ASCII. Messaging protocol could be NOK, JSON or user defined.
  -jsonfile <filepath>			Sets path to JSON file.
  -asciimsgresp <ascii message> 	Expected response message to '-asciimsgreq <ascii message>' request message. Returns a zero (0) if match between request and response.

  -do_authentication -sdauthenticationtype <production|tucson>.

*** arguments for retail mode ***

  -nvifile <filepath>			Sets path to NVI file.
  -writerdc <filepath>			Writes RDC from the given file to the device.
  -readrdc <filepath>			Reads RDC to the given file from device.
  -erasepartition <name>		Sets name of partition to be erased from the device.

*** arguments for ffureader mode ***

  -partitionimagefile <filepath>	Sets path to partition image file.
  -filedir <dir path>			Sets path to directory, where files are dumped.

FLAGs:

*** flags for emergency mode ***

  -skipprotocoldetection	Skips automatic detection of emergency protocol when connection is opened. Can be used in conjunction
                      		with argument "-protocol sahara"
  -skipffuflash			Skips FFU flashing at the end of emergency download
  -skippayloadsending		Skips payload sending of rnd emergency download
  -use_legacy_hex		Collins and Alpha emergency. Uses legacy HEX flasher.
  -orig_gpt			Collins and Alpha emergency. Programs MBN image.
  -debug			Enables raw message tracing (during Sahara protocol stage)

*** flags for uefiflash mode ***

  -skip_write			Secure FFU flashing. Programming sequence executed without programming to the storage device.
  -skip_hash			Secure FFU flashing. Skips the hash calculation of the payload data.
  -skip_id_check		Secure FFU flashing. Skips Platform ID check between the device and FFU file.
  -skip_signature_check		Secure FFU flashing. Skips signature check of secure header of FFU file.
  -skip_reboot_on_failure	Secure FFU flashing. Skips reboot option if flashing fails.
  -do_factory_reset		Restores Modem FSG partition to Modem FS1 and erases Modem FS2.
  -verify_write			Secure FFU flashing. Normal programming sequence executed followed by read and verify.
  -detect_device_after_reboot	Detects device after reboot.
  -disable_msg_timeout		Secure FFU flashing. Disables messaging timeout of UEFI FlashApp
  -skip_flash			Secure FFU flashing. Boots to the UEFI FlashApp without programming
  -skip_rkh_check		Secure FFU flashing. Skips the Root Key Hash check between the device and FFU file
  -use_crc_in_sffu_prog		Secure FFU flashing. CRC32 is used to check integrity of the payload data
  -erase_data			Secure FFU flashing. Erases the Data partition a.k.a UDA of Windows Phone
  -skip_preserve_dpp		Skips overwriting prevention of DPP partition. By default programming will fail if the DPP partition of FFU file contains data.
  -reboot			Reboots the device, if possible
  -power_off			Powers off the device after the USB cable is disconnected.
  -sync_msging_sffu_prog	Secure FFU flashing. Uses sync messaging between PC and device.
  -do_full_nvi_update		Applies the full NVI settings after successful programming. During the first boot after programming the NVI updater updates the NV items.
  -unbufferedfileio		Use unbuffered file I/O in case of SFFU programming. Aims to fix issues if FFU file is programmed from a network share. 
  -skip_backup_restore		Secure FFU flashing. Skips backup and restore. By default backups of MODEM_FSG, MODEM_FS1, MODEM_FS2, SSD and
                      		DPP partitions to the RAM of device and restores them after successful programming of Windows Phone.
  -show_detailed_progress	Shows detailed progress info (transferred bytes and transfer speed). 
  -trace_usb			Prints out debugging traces of WinUSB client. 
  -use_boot_to_flsapp_json	Re-boots device into the flash mode from the normal/test mode. 
  -skip_exit_on_post_op_failure	Executes all specified post flash operations (factory reset, full NVI update etc.), even if failures occur.

  -restorepartition		Restores backup partition into the eMMC.

*** flags for dump mode ***

  -dump_via_gpt			Reads out the content of eMMC of Windows Phone. The reading is based on the GPT of device.
                      		This is excluded from the official Uefi FlashApp.

  -dump_via_sector		Reads out the content of eMMC of Windows Phone. The reading is based on -dumparea argument. 
                      		This is excluded from the official Uefi FlashApp.

  -skip_read			Skips read in case of reading out the content of eMMC of Windows Phone. 
                      		This enables to load and execute an UEFI app from PC to device.

*** flags for rnd mode ***

  -bootmsc			Boots the device into the USB mass storage mode.
  -detect_device_after_reboot	Detects device after reboot.
  -readjtagserial		Reads serial number of JTAG.
  -bootmmos			Boots the device into the MMOS.
  -normalmode			Operations are done in the normal mode of device.
  -uefitests			Tests DSS UEFI apps of device.
  -delgpt			Clears the GPT of device.
  -skip_gpt_check		The R&D mode validates the GPT. Use this flag to skip the check.
  -bootflashapp			Boots to UEFI Flash App.
  -bootphoneinfoapp		Boots to UEFI Phone Info App.
  -boot_edmode			Boots to Emergency Download mode.
  -read_public_id		Reads public ID from the device.
  -power_off			Powers off the device after the USB cable is disconnected.
  -read_charging_status		Reads charging status from the device.
  -read_final_config		Reads final config from the device.
  -skip_com_scan		Skips scanning of COM ports.
  -reboot			Reboots the device, if possible
  -do_rpmb			Executes RPMB provisioning procedure.
  -do_uefikeys_rd		Executes UEFI Keys provisioning procedure for RD.
  -do_uefikeys_prod		Executes UEFI Keys provisioning procedure for production.
  -dump_gpt			Executes parsing of GPT image file.
  -flashappbuildinfo		Reads build related information about the UEFI flash application.
  -uefisecurebootinfo		Reads information about the UEFI secure boot.
  -readphoneinfo		Reads Phone info.
  -continueboot			Continue boot.
  -readdeviceinfo		Reads miscellaneous information from device.
  -readrpmbstatus		Read RPMB provisioning status.
  -readisswversion		Reads ISSW version and compilation info.
  -do_factory_reset		Restores Modem FSG partition to Modem FS1 and erases Modem FS2.
  -do_authentication		Authenticates device. The default authentication level is
				production. Level can be changed by argument sdauthenticationtype.
  -bootlumiabootmgr		(Re-)Boots to Boot Manager.
  -bootnormalmode		Boots to the normal mode / Windows Phone OS.
  -dump_mbn			Chops up MBN image into files according to the GPT of MBN image.
  -readcid			Reads card identification of eMMC, manufacturer, OID and PSN.
  -validatessdhash		Validates SSD integrity.
  -relock			GDR3 devices which have been retail unlocked with MSFT packages
				are not booting if Blue SW is updated via FFU flashing.
				Re-lock operation should be done prio to flashing Blue FFU.
  -oddt				Connection created to ODDT Control, if it is found.
  -readramsize			Reads size of system memory.
  -read_reset_protection_status	Reads status of reset protection.

  -remove_sbcp			Removes secure boot configuration policy.
*** flags for retail mode ***

  -reboot			Reboots the device, if possible
  -eraserdc			Erases the RDC from the device.
  -power_off			Powers off the device after the USB cable is disconnected.

*** flags for uefiserialflash mode ***

  -power_off			Powers off the device after the USB cable is disconnected.

*** flags for ffureader mode ***

  -dump_gpt			Dumps GPT(s) from FFU file.
  -dump_partitions		Dumps partitions into files according to the GPT of FFU file.
  -read_antitheft_version	Reads only antitheft version from FFU file.

*** miscellaneous ***

  Thor2 supports drag and drop. The basic flashing can be done by drag&drop ffu file over the thor2.exe.
  If thor2 shortcut is added to SendTo menu, you can flash ffu file by sending it to thor2.

  -skip_logfile			Skips logfile creation.
  -mode userauthentication -passcode securitycode [-server saisec001] [-securesessionfile mysession.bin ]	Authentication with VIP Access, creates user's securesessionid file
  /?				Displays this help and exits.
  --help			Displays this help and exits.
  --help -mode [ MODE ]		Displays examples according to defined mode and exits.
  --version			Displays version information and exits.



*-*-* examples *-*-*



*-*-* Uefiflash examples *-*-*

SFFU programming:
  thor2 -mode uefiflash -ffufile "RM821_Production_flash_rnd_signed.ffu"

SFFU programming and product code update:
  thor2 -mode uefiflash -ffufile "RM821_Production_flash_rnd_signed.ffu" -productcodeupdate 01234567 

SFFU programming and Full NVI update:
  thor2 -mode uefiflash -ffufile "RM821_Production_flash_rnd_signed.ffu" -do_full_nvi_update -do_factory_reset

SFFU programming along product code and Full NVI updates:
  thor2 -mode uefiflash -ffufile "RM821_Production_flash_rnd_signed.ffu" -productcodeupdate 01234567 -do_full_nvi_update -do_factory_reset -reboot

SFFU programming and battery level check:
  thor2 -mode uefiflash -ffufile "RM821_Production_flash_rnd_signed.ffu" -batterylevel 10

Partition programming. Programs uefi.mbn partition image file into uefi partition:
  thor2 -mode uefiflash -partitionname uefi -partitionimagefile "uefi.mbn"

Image programming. Programs GPT:
  thor2 -mode uefiflash -startsector 0 -imagefile "gpt.bin"

Partition programming. Programs sbl1.mbn partition image file into sbl1 partition:
  thor2 -mode uefiflash -partitionname sbl1 -partitionimagefile "sbl1.mbn"

Partition restoring. Restores dpp.mbn partition image file into dpp partition:
  thor2 -mode uefiflash -partitionname dpp -partitionimagefile "dpp.mbn" -restorepartition -skip_gpt_check

MMOS programming:
  thor2 -mode uefiflash -mmosfile "mmos.wim"

MMOS programming according to DPL file:
  thor2 -mode uefiflash -dplfile "DPL_RM974.xml"



*-*-* Emergency examples *-*-*

Emergency and SFFU programming for Quattro and Romulus:
  thor2 -mode emergency -configfile "emergency_config.xml" -ffufile "Production_flash.ffu"

Emergency programming for Quattro and Romulus:
  thor2 -mode emergency -configfile "8974_emergency_config.xml" -ffufile "QUMA_Production_flash.ffu" -skipffuflash

Emergency and SFFU programming for Quattro and Romulus ( RnD ) :
  thor2 -mode emergency -hexfile "MPRG8974_fh_v1_0.mbn" -edfile "RM937_1025.0001.1.1.ed" -ffufile "Production_flash.ffu"

Emergency and SFFU programming for Collins and Alpha:
  thor2 -mode emergency -hexfile "FAST8960.hex" -mbnfile "8960_msimage_uefi.mbn" -ffufile "RM821_Production_flash_rnd_signed.ffu"

Emergency programming for Collins and Alpha ( GPT from FFU file ):
  thor2 -mode emergency -hexfile "FAST8960.hex" -mbnfile "8960_msimage_uefi.mbn" -ffufile "RM821_Production_flash_rnd_signed.ffu" -skipffuflash

Emergency programming for Collins and Alpha ( MBN file only ):
  thor2 -mode emergency -hexfile "FAST8960.hex" -mbnfile "8960_msimage_uefi.mbn" -orig_gpt

Reads content of eMMC with HEX flasher. The dump area is in sectors; first_sector_to_read,amount_of_sectors_to_read. Size of one sector is 512 bytes.
  The official HEX flasher does not support reading. Thus a RnD version is needed for that.
  Reads out the GPT of device:
  thor2 -mode emergency -configfile "8974_emergencyflash_config.xml" -dumparea 0,34 -dumpfileforhexflasher "gpt.bin"



*-*-* Rnd mode examples *-*-*

Read phone info:
  thor2 -mode rnd -readphoneinfo

Boot to the USB MSC mode:
  thor2 -mode rnd -bootmsc -skip_com_scan

  Note: PC will freeze, if SBL3 code is used and MSC code is missing from SBL3

Boot to the MMOS:
  thor2 -mode rnd -bootmmos -skip_com_scan

Boot to the Emergency Download mode:
  thor2 -mode rnd -skip_gpt_check -boot_edmode

Delete the GPT of device:
  thor2 -mode rnd -delgpt -skip_com_scan

Execute DSS UEFI app tests:
  thor2 -mode rnd -uefitests -skip_com_scan

Reboot the device:
  thor2 -mode rnd -reboot

Power off the device:
  thor2 -mode rnd -power_off

Read public ID from the device:
  thor2 -mode rnd -read_public_id -skip_com_scan

Chop up MBN image into files according to the GPT:
  thor2 -mode rnd -mbnfile "8960_msimage_uefi.mbn" -dump_mbn

Extract ed payload image:
  thor2 -mode rnd -edfile "ed_payload.ed" -dump_edpayload

Executes UEFI Keys provisioning procedure for RD:
  thor2 -mode rnd -do_uefikeys_rd -skip_com_scan

Executes UEFI Keys provisioning procedure for production:
  thor2 -mode rnd -do_uefikeys_prod -skip_com_scan

Executes RPMB provisioning procedure:
  thor2 -mode rnd -do_rpmb -skip_com_scan

Executes parsing of GPT:
  thor2 -mode rnd -gptfile "gpt.mbn" -dump_gpt -skip_com_scan

Raw messaging. Disables messaging timeout (NOKD):
  thor2 -mode rnd -rawmsgreq 4e4f4b44 -rawmsgresp 4e4f4b44 -skip_com_scan

Raw messaging. Hello (NOKI):
  thor2 -mode rnd -rawmsgreq 4e4f4b49 -rawmsgresp 4e4f4b49 -skip_com_scan

Raw messaging. Reboot (NOKR):
  thor2 -mode rnd -rawmsgreq 4e4f4b52 -skip_com_scan

ASCII messaging. Disables messaging timeout:
  thor2 -mode rnd -asciimsgreq NOKD -asciimsgresp NOKD -skip_com_scan

ASCII messaging. Hello:
  thor2 -mode rnd -asciimsgreq NOKI -asciimsgresp NOKI -skip_com_scan

ASCII messaging. Reboot:
  thor2 -mode rnd -asciimsgreq NOKR -skip_com_scan

Reads serial number of JTAG:
  thor2 -mode rnd -readjtagserial -skip_com_scan

Reads RPMB provisioning status:
  thor2 -mode rnd -readrpmbstatus -skip_gpt_check

Reads PSN:
  thor2 -mode rnd -readpsn -skip_com_scan

Sends JSON messages from JSON file to MMOS / label app:
  thor2 -mode rnd -jsonfile "json_messages_file.json"

Sends JSON messages from JSON file to normal mode / NCSd:
  thor2 -mode rnd -jsonfile "json_messages_file.json -normalmode"

Device authentication:
  thor2 -mode rnd -do_authentication -sdauthenticationtype production -skip_com_scan -skip_gpt_check [-server saisec001.europe.nokia.com] [-securesessionfile mysession.sessionid]"

Reads CID (manufactuter of eMMC):
  thor2 -mode rnd -readcid -skip_com_scan

Validates SSD integrity:
  thor2.exe -mode rnd -validatessdhash -skip_gpt_check

Re-lock:
  thor2.exe -mode rnd -relock -skip_gpt_check

Reads ISSW version and compilation info:
  thor2.exe -mode rnd -readisswversion -skip_gpt_check

Reads status of reset protection:
  thor2.exe -mode rnd -read_reset_protection_status -skip_gpt_check -skip_com_scan

Removes secure boot configuration policy:
  thor2.exe -mode rnd -remove_sbcp -skip_gpt_check -skip_com_scan



*-*-* ffureader mode examples *-*-*


Read FFU file and dump partitions into files according to the GPT:
  thor2 -mode ffureader -ffufile "RM821_Production_flash_rnd_signed.ffu" -dump_partitions

Read FFU file and dump partitions into files into defined directory according to the GPT:
  thor2 -mode ffureader -ffufile "RM821_Production_flash_rnd_signed.ffu" -dump_partitions -filedir c:\temp

Read FFU file and dump GPT(s) into files:
  thor2 -mode ffureader -ffufile "RM821_Production_flash_rnd_signed.ffu" -dump_gpt

Read the RKH from partition image file: 
  thor2 -mode ffureader -partitionimagefile "SBL1.mbn"

Read FFU file and read Antitheft version:
  thor2 -mode ffureader -ffufile "RM821_Production_flash_rnd_signed.ffu" -read_antitheft_version

Read FFU file and check integrity:
  thor2 -mode ffureader -ffufile "RM821_Production_flash_rnd_signed.ffu"



*-*-* dump mode examples *-*-*

Reads content of eMMC with UEFI flash app. Dumps whole eMMC based on the GPT:
  thor2 -mode dump -uefifile "FlashApp_debug_dump.efi" -dump_via_gpt

Reads content of eMMC with UEFI flash app. Dumps eMMC based on the dumparea argument.
  The dump area is in sectors; first_sector_to_read,amount_of_sectors_to_read. Size of one sector is 512 bytes.
  Reads out the GPT of device:
  thor2 -mode dump -uefifile "FlashApp_debug_dump.efi" "-dumparea 0,34" -dump_via_sector

Reads content of eMMC with UEFI flash app based on partitionname argument. Reads uefi partition image file from uefi partition:
  thor2 -mode dump -uefifile "FlashApp_debug_dump.efi" -dump_via_gpt -partitionname uefi



*-*-* Retail mode examples *-*-*

Erases partition based on name of partition. Erases Data partition:
  thor2 -mode retail -erasepartition Data

Reads the RDC from device into the file:
  thor2 -mode retail -readrdc "rdc.bin"

Writes the RDC into the device from file:
  thor2 -mode retail -writerdc "rdc.bin"

Erases the RDC from device:
  thor2 -mode retail -eraserdc

Sends NVIs messages from nvi file to MMOS / label app:
  thor2 -mode retail -nvifile "CustomerNvi.nvi"

Sends NVIs messages from nvi file to normal mode / NCSd:
  thor2 -mode retail -nvifile "CustomerNvi.nvi -normalmode"



*-*-* misc examples *-*-*


VPL programming:
  thor2 -mode vpl -vplfile "RM821_059R7J4_1232.5951.1249.1003_016.vpl"

SD card programming:
  thor2 -mode sdflash -sdfile "RM821_059R7J4_1232.5951.1249.1003_016.img"

Read USB connections and print the result:
  thor2 -mode list_connections

Programs the same FFU file into one or multible devices. User needs to change devices between programming states:
  thor2 -mode uefiserialflash -ffufile "RM821_Production_flash_rnd_signed.ffu" -serialflash 50 -power_off

Copyright @ 2015 Microsoft Mobile