A couple months ago, an eBay listing popped up advertising a rare motorola xt898 prototype engineering sample. This intrigued me, because when you search for that model number online, the only clues about it speculative articles from 2012 discussing the release of this device as a sort of successor to the Droid 4. It turns out that these plans fell through, because that’s the last we here about the xt898…
The xt897 e-sim is in the exact same spot as the xt898 physical sim card slot. This clues us in to the theory that these devices may be the same logic board with slight modification. If true, this would mean that porting a custom recovery or Android ROM much easier.
Moving on to the software, the xt898 comes with an engineering bootloader 10.72 from March 30, 2012 and an engineering build of Android 4.0.3 (Icecream Sandwich), which comes with full root access. The root access on this build allowed me to take a full disk backup of the software using dd.
martin@Penguin:~/$ fastboot getvar all
(bootloader) version-bootloader: 1072
(bootloader) product: asanti
(bootloader) secure: no
(bootloader) mid: 0000
(bootloader) version: 0.5
(bootloader) serialno: LA7A2A0182
(bootloader) qe: qe 0/0
(bootloader) unlocked: not supported
(bootloader) max-download-size: 805306368
(bootloader) emmc-size: 8GB
(bootloader) reason: Boot menu selected
(bootloader) revision-hardware: 0x8200
(bootloader) cpu: MSM8960 CS
(bootloader) uid: 50D3360002000000000000000000 all: Finished. Total time: 0.069s
martin@Penguin:~/$ adb push emmc_appsboot.mbn /sdcard/xt897-aboot.img
martin@Penguin:~/$ adb shell root@asanti:/ # dd if=/sdcard/xt897-aboot.img of=/dev/block/platform/msm_sdcc.1/by-name/aboot
512+0 records in 512+0 records out 262144 bytes transferred in 0.160 secs (1638400 bytes/sec) root@asanti:/ # rm /dev/block/platform/msm_sdcc.1/by-name/modemst1
root@asanti:/ # rm /dev/block/platform/msm_sdcc.1/by-name/modemst2
root@asanti:/ # ^D
martin@Penguin:~/$ adb reboot bootloader
I cleared the modemst1 & modemst2 as good practice. I had to do the same thing when downgrading my xt926 from kkbl (kitkat bootloader) to jbbl.
Entering these commands was stressful…
 |
| The seller, 2-advance, says that he is an ex-Motorola employee and is in possession of 17 of these devices as of January 2022. |
Naturally, I bid on the listing and spent around $230 between two of them.
Upon receiving the xt898, I can say that it looks long-lost brother to the xt897 Photon Q LTE. From a distance, you may think they’re the same model, but as you inspect further, you notice subtle differences. Sprint’s iconic yellow keyboard accent is replaced with an AT&T blue. Itss body is less angular and more rounded. Taking a look beneath the removavable cover where the SD card is usually found in the xt897, you find a the expected SD plus a mini-SIM card slot as well!
Upon receiving the xt898, I can say that it looks long-lost brother to the xt897 Photon Q LTE. From a distance, you may think they’re the same model, but as you inspect further, you notice subtle differences. Sprint’s iconic yellow keyboard accent is replaced with an AT&T blue. Itss body is less angular and more rounded. Taking a look beneath the removavable cover where the SD card is usually found in the xt897, you find a the expected SD plus a mini-SIM card slot as well!
 |
| The Sprint XT897 on the left vs. the AT&T XT898 |
The xt897 e-sim is in the exact same spot as the xt898 physical sim card slot. This clues us in to the theory that these devices may be the same logic board with slight modification. If true, this would mean that porting a custom recovery or Android ROM much easier.
Moving on to the software, the xt898 comes with an engineering bootloader 10.72 from March 30, 2012 and an engineering build of Android 4.0.3 (Icecream Sandwich), which comes with full root access. The root access on this build allowed me to take a full disk backup of the software using dd.
martin@Penguin:~/$ fastboot getvar all
(bootloader) version-bootloader: 1072
(bootloader) product: asanti
(bootloader) secure: no
(bootloader) mid: 0000
(bootloader) version: 0.5
(bootloader) serialno: LA7A2A0182
(bootloader) qe: qe 0/0
(bootloader) unlocked: not supported
(bootloader) max-download-size: 805306368
(bootloader) emmc-size: 8GB
(bootloader) reason: Boot menu selected
(bootloader) revision-hardware: 0x8200
(bootloader) cpu: MSM8960 CS
(bootloader) uid: 50D3360002000000000000000000 all: Finished. Total time: 0.069s
My system backup will allow me to extract proprietary firmware files when compiling LineageOS. As of yet, I haven’t had any luck even getting TWRP booting on it. I think I may have to update the aboot partition to jbbl (Jellybean bootloader ver 10.9B), like that used in the xt897, xt907, xt925, & xt926. I hope that I can take the aboot from the well supported xt897 and transplant it directly on the xt898. In theory, it should work, seeing that they both run on Qualcomm MSM8960 processors and almost identical hardware.
martin@Penguin:~/Devices/Android/Motorola.XT898.Asanti.ATT/xt898_stock$ for i in ./*.bin; do md5sum "$i"; done
7def161f4963d57584c0cf06567f2c06 ./aboot.bin
8c3226cfe14a4b640c8af3195fa533da ./boot.bin
bebb6d65b788768aac4fc186abcb6b6e ./cache.bin
bed3c0a4a1407f584989b4009e9ce33f ./cdr.bin
59071590099d21dd439896592338bf95 ./cid.bin
13422cfd52c6aef8c750dc9511735ba8 ./devtree.bin
b2b566b6b152e0e851fc725101d8ae6f ./fsg.bin
0e56e3685334da3be782983277648751 ./grow.bin
8cbd12ebf38bf46bbd3d74fc6ccdcc48 ./hob.bin
b2d1236c286a3c0704224fe4105eca49 ./kpan.bin
77a10e7f920506bf9dbe3af7ede4305e ./logo.bin
b2d1236c286a3c0704224fe4105eca49 ./mbl.bin
91509c0e269445a289db161b3f9b83c9 ./misc.bin
219578f7f92eb85405f848d0bdbe1373 ./modem.bin
24d1479efec50ed76f1558bf4b5cdf74 ./modemst1.bin
8c9adb38348a80b15cab31b1931c5795 ./modemst2.bin
1276481102f218c981e0324180bafd9f ./pad.bin
9bf3453bf6c9fe093ad081b126cb453d ./pds.bin
0c6d420169416ab18165fd0c671147df ./persist.bin
d8b61b2c0025919d5321461045c8226f ./pia.bin
eb1217c0b0fd6da64b17ea9fcbc89b9e ./recovery.bin
804dc7828b8d875e676fb287d9f11510 ./rpm.bin
6962bed8be7ef474d297a23a06154237 ./sbl1.bin
059b5d26fd6646d2a4b5b646b4fb8a35 ./sbl2.bin
1c86aea28faa06ab8efabdc416fe9230 ./sbl3.bin
b6d81b360a5672d80c27430f39153e2c ./sp.bin
0829f71740aab1ab98b33eae21dee122 ./ssd.bin
1890e2282d15d3626dfc961856ee68d8 ./system.bin
88322612371f154d948793753b392358 ./tombstones.bin
063c0f3ec15f75fe89d299a8bd0c50ba ./tz.bin
98ddb17430cafa05bac263251cd54c76 ./userdata.bin
1a69378fab2ba79b0d408a84ede4a91c ./utags.bin
72214008be35f6ee48439c112a4fe1c0 ./webtop.bin
martin@Penguin:~/Devices/Android/Motorola.XT898.Asanti.ATT/xt898_stock$ for i in ./*.bin; do md5sum "$i"; done
7def161f4963d57584c0cf06567f2c06 ./aboot.bin
8c3226cfe14a4b640c8af3195fa533da ./boot.bin
bebb6d65b788768aac4fc186abcb6b6e ./cache.bin
bed3c0a4a1407f584989b4009e9ce33f ./cdr.bin
59071590099d21dd439896592338bf95 ./cid.bin
13422cfd52c6aef8c750dc9511735ba8 ./devtree.bin
b2b566b6b152e0e851fc725101d8ae6f ./fsg.bin
0e56e3685334da3be782983277648751 ./grow.bin
8cbd12ebf38bf46bbd3d74fc6ccdcc48 ./hob.bin
b2d1236c286a3c0704224fe4105eca49 ./kpan.bin
77a10e7f920506bf9dbe3af7ede4305e ./logo.bin
b2d1236c286a3c0704224fe4105eca49 ./mbl.bin
91509c0e269445a289db161b3f9b83c9 ./misc.bin
219578f7f92eb85405f848d0bdbe1373 ./modem.bin
24d1479efec50ed76f1558bf4b5cdf74 ./modemst1.bin
8c9adb38348a80b15cab31b1931c5795 ./modemst2.bin
1276481102f218c981e0324180bafd9f ./pad.bin
9bf3453bf6c9fe093ad081b126cb453d ./pds.bin
0c6d420169416ab18165fd0c671147df ./persist.bin
d8b61b2c0025919d5321461045c8226f ./pia.bin
eb1217c0b0fd6da64b17ea9fcbc89b9e ./recovery.bin
804dc7828b8d875e676fb287d9f11510 ./rpm.bin
6962bed8be7ef474d297a23a06154237 ./sbl1.bin
059b5d26fd6646d2a4b5b646b4fb8a35 ./sbl2.bin
1c86aea28faa06ab8efabdc416fe9230 ./sbl3.bin
b6d81b360a5672d80c27430f39153e2c ./sp.bin
0829f71740aab1ab98b33eae21dee122 ./ssd.bin
1890e2282d15d3626dfc961856ee68d8 ./system.bin
88322612371f154d948793753b392358 ./tombstones.bin
063c0f3ec15f75fe89d299a8bd0c50ba ./tz.bin
98ddb17430cafa05bac263251cd54c76 ./userdata.bin
1a69378fab2ba79b0d408a84ede4a91c ./utags.bin
72214008be35f6ee48439c112a4fe1c0 ./webtop.bin
 |
| the xt897 running LineageOS 14.1 and the xt898 with its engineering build of AOSP 4.0.3 |
What’s a story without a risk? So, I went about flashing the Photon Q xt897’s Jellybean bootloader onto the xt898. At this point I’m pretty certain I can recover with RSD lite (Motorola flashing software used in factories.
martin@Penguin:~/$ adb push emmc_appsboot.mbn /sdcard/xt897-aboot.img
martin@Penguin:~/$ adb shell root@asanti:/ # dd if=/sdcard/xt897-aboot.img of=/dev/block/platform/msm_sdcc.1/by-name/aboot
512+0 records in 512+0 records out 262144 bytes transferred in 0.160 secs (1638400 bytes/sec) root@asanti:/ # rm /dev/block/platform/msm_sdcc.1/by-name/modemst1
root@asanti:/ # rm /dev/block/platform/msm_sdcc.1/by-name/modemst2
root@asanti:/ # ^D
martin@Penguin:~/$ adb reboot bootloader
I cleared the modemst1 & modemst2 as good practice. I had to do the same thing when downgrading my xt926 from kkbl (kitkat bootloader) to jbbl.
Entering these commands was stressful…
But the risk paid off! The xt898 now runs the same jbbl from the xt897!!!
martin@Penguin:~/ fastboot getvar all
(bootloader) version-bootloader: 109B(*)
(bootloader) product: asanti_c
(bootloader) secure: no
(bootloader) mid: 0000
(bootloader) version: 0.5
(bootloader) serialno: LA7A2A0182
(bootloader) qe: qe 0/0
(bootloader) unlocked: Not supported
(bootloader) iswarrantyvoid: Not supported
(bootloader) max-download-size: 31457280
(bootloader) emmc-size: 8GB
(bootloader) reason: Reboot to bootloader
(bootloader) revision-hardware: 0x2100
(bootloader) cpu: MSM8960 CS
(bootloader) uid: 50D3360002000000000000000000
(bootloader) cid: 0xdead all: Finished. Total time: 0.139s
Compared to the earlier getvar all, this has some interesting differences. hardware revision, product name, and max download have changed. But the serial and uid stay the same.
Let’s throw TWRP and Lineage 14.1 on this thing ASAP!
martin@Penguin:~/XT897$ fastboot flash recovery xt897-twrp-3.1.1.0.img
(bootloader) Variable not supported!
(bootloader) Variable not supported!
Sending 'recovery' (8304 KB) OKAY [ 1.102s]
Writing 'recovery' OKAY [ 2.390s]
Finished. Total time: 3.720s
martin@Penguin:~/XT897$
There must be some incompatibility with TWRP, because it refuses to load the recovery at all.
martin@Penguin:~/ fastboot getvar all
(bootloader) version-bootloader: 109B(*)
(bootloader) product: asanti_c
(bootloader) secure: no
(bootloader) mid: 0000
(bootloader) version: 0.5
(bootloader) serialno: LA7A2A0182
(bootloader) qe: qe 0/0
(bootloader) unlocked: Not supported
(bootloader) iswarrantyvoid: Not supported
(bootloader) max-download-size: 31457280
(bootloader) emmc-size: 8GB
(bootloader) reason: Reboot to bootloader
(bootloader) revision-hardware: 0x2100
(bootloader) cpu: MSM8960 CS
(bootloader) uid: 50D3360002000000000000000000
(bootloader) cid: 0xdead all: Finished. Total time: 0.139s
Compared to the earlier getvar all, this has some interesting differences. hardware revision, product name, and max download have changed. But the serial and uid stay the same.
Let’s throw TWRP and Lineage 14.1 on this thing ASAP!
martin@Penguin:~/XT897$ fastboot flash recovery xt897-twrp-3.1.1.0.img
(bootloader) Variable not supported!
(bootloader) Variable not supported!
Sending 'recovery' (8304 KB) OKAY [ 1.102s]
Writing 'recovery' OKAY [ 2.390s]
Finished. Total time: 3.720s
martin@Penguin:~/XT897$
There must be some incompatibility with TWRP, because it refuses to load the recovery at all.
The device simply reboots repeatedly.
This will need looking in to- maybe an older version compatible with 4.0.3 would work better.
I will make an update when I understand the issue more!
Comments
Post a Comment