Tegra3 Guide: nvflash

Introduction


After many months of painstaking research and development AndroidRoot.mobi is excited to release the nvflash kit for the ASUS Transformer Prime which will grant you nvflash access to your tablet.

This guide will walk you through the process of acquiring nvflash access to your Transformer Prime, Transformer TF300 and Transformer TF700 tablet. Note that this has only been tested on TF201 and TF300! TF300TG, TF300TL or similar has a high risk of bricking if you try this on those!

As part of the process of gaining this access you will need to flash the AndroidRoot patched custom bootloader which will provide numerous other benefits over the stock bootloader. However, flashing the bootloader is a potentially very risky activity so please think carefully before you proceed.

As part of undertaking this guide you disclaim AndroidRoot and its members of all liability or responsibility for any damage incurred. By performing the following steps you undertake all risks thereof.

Please note that this procedure is an advanced process and should only be completed by competent users.

The AndroidRoot Patched Bootloader


The current AndroidRoot.mobi bootloader versions are


ChangeLog:-

* Patch: Enable 'fastboot boot' command (removes 'fastboot continue', use 'fastboot reboot' instead).

* Patch: Force unlocked state (protect your unlock status no matter what happens to your token).

* Patch: Remove blob requirement from 'fastboot flash' (Flash the raw images and not blob files). (Not TF700)

Prerequisites

  1. An unlocked Transformer Prime, TF300 or TF700 tablet
  2. Working fastboot binary & all necessary drivers
  3. The nvflash binary from NVIDIA (See Downloads)
  4. For TF201: If you upgraded to Offiical JB it *won't* work!
  5. For TF300: If you upgraded to Offiical JB it *won't* work!
  6. For TF700: If you upgraded to 9.4.5.30, it *won't* work!
  7. Nerves of steel!

Generating your nvflash blob files


To gain access to nvflash you will need to generate nvflash blob files which will allow you to authenticate with the APX mode on device.

To begin please download the file suitable for your OS and tablet from the download section.

When you have downloaded the nvflash pack and unzipped it you will need to reboot your device into fastboot mode. You can do this by rebooting the device and holding the volume down key until "Checking for RCK image" appears, at this stage do nothing until the boot menu loads. Once you are at the boot menu press the volume down key until the fastboot/usb icon is selected then press the volume up key to put the device into fastboot mode.

Now that you are in fastboot mode please run the following command to flash the AndroidRoot bootloader:-

$ fastboot -i 0x0b05 flash staging ebtblob.bin


Please ensure flashing succeeds before continuing this guide.
You can verify you have the AndroidRoot bootloader installed as described below.

After the flash process has completed you will need to reboot your device into fastboot again by following the process above (or otherwise) ensuring this time that instead of the text "This Device is UnLocked" appearing in the top left of the boot screen the text "AndroidRoot 9.4.2.28r01" or "AndroidRoot 9.4.3.30r01" is present instead. We recommend rebooting with the following command:

$ fastboot -i 0x0b05 reboot


Once you are back in fastboot mode having booted with the AndroidRoot bootloader it is finally time to generate your nvflash blob files with the following command:-

$ fastboot -i 0x0b05 boot nvfblobgen.img


That command will boot the custom AndroidRoot blob generation boot image and begin generating your required files. Please note that this process can take 20 - 30 seconds and will automatically reboot once it has completed. No progress is displayed during this time, just wait patiently for it to complete. On TF700, fastboot will show an error, but this is expected!

After the reboot your device should fully boot into Android allowing you to complete the next section of the guide.

Accessing nvflash


Once your blobs have been generated you will need to retrieve them from the "internal" SD card from the AndroidRoot directory (e.g. /sdcard/AndroidRoot). You can do this either through MTP mode or by pulling them using adb.

** You absolutely must keep these files in triplicate copies - they are your life-line **

Finally, you will now be able to access nvflash using wheelie. To do this please reboot your tablet into APX mode by holding down the volume up key during the reboot process. If successful the screen should remain blank and be detected over USB by your computer as an NVIDIA APX mode device.

To "bootstrap" into nvflash using wheelie simply run the following command:-

$ wheelie --blob blob.bin


If successful your device will boot into nvflash mode and the bootloader screen will appear on the device.

WARNING: If you run the following command it will boot your device into regular android. This is listed as an *EXAMPLE*. Run the commands in "What Next?" section first.

From this point you will be able to use nvflash as normal by running commands such as the following to continue booting your device:-

$ nvflash --resume --go

What Next?


Good news! You have acquired nvflash access so what should you do next?

We strongly recommend that absolutely everyone who obtains nvflash access runs the following command:-

$ nvflash --resume --rawdeviceread 0 2944 bricksafe.img


This is a very important back-up file which is to be stored safely along with your nvflash blob files.

** Failure to make this back-up file will lead to support being withheld if you brick your device. You have been warned. **

You should also back-up your unlock token and your device's factory generated configuration by using the following two commands:-

$ nvflash --resume --read 14 factory-config.img

$ nvflash --resume --read 7 unlock-token.img
Store these files securely with the blob data and bricksafe.img

Downloads

Coming Soon


We hope to provide support for more devices - watch this space.

Credits


In alphabetical order the entire AndroidRoot.mobi team: Bumble-Bee, IEF, kmdm, lilstevie & RaYmAn.

Our beta-testers for risking their devices so that you don't have to (in no particular order):


We would also like to take this opportunity to thank ASUS for providing the ability to unlock the Transformer Prime and to further state that DRM is not compromised since the DRM keys have already been erased from the device during the unlock process and our work can only be used on an unlocked device.