Database Users

[Q] RyanZA lagfix failing on JI6

So, when I first applied the JI6 update from OTA, the phone stopped booting (I had RyanZA's lagfix applied at that time). Restored to stock w/ Odin and applied the JI6 that had been posted here and that worked fine. Today i re-applied the same ext2 lagfix, but had to adjust it a tad to add a remount command for /system because it failed setting up userinit.sh for rebooting, but that worked fine.
The problems appeared after a reboot. several apps were misbehaving, and i saw these messages in logcat:
Code:
E/ApplicationContext( 3232): Couldn't create directory for SharedPreferences file [COLOR="red"]/data/data/[/COLOR]com.alfray.timeriffic/share
d_prefs/com.alfray.timeriffic_preferences.xml
E/AndroidRuntime( 3232): Uncaught handler: thread main exiting due to uncaught exception
E/AndroidRuntime( 3232): java.lang.RuntimeException: Unable to resume activity {com.alfray.timeriffic/com.alfray.timerif
fic.profiles.ProfilesUI}: android.database.sqlite.SQLiteException: [COLOR="Red"]database is locked[/COLOR]
The first one immediately raised a red flag for me, and the second is concerning (I'm not sure where these databases are stored but i think they may be /data/data).
So i open adb shell as root and tried to create a file in my new ext2 partition and i get this:
Code:
# echo "" > com.alfray.timeriffic_preferences.xml
cannot create com.alfray.timeriffic_preferences.xml: [COLOR="red"]remote access failed[/COLOR]
#
but the file was created at some point, i did these things a few minutes later:
Code:
# pwd
pwd
/data/ext2data/data/com.alfray.timeriffic/shared_prefs
# mount
mount
rootfs / rootfs ro 0 0
tmpfs /dev tmpfs rw,mode=755 0 0
devpts /dev/pts devpts rw,mode=600 0 0
proc /proc proc rw 0 0
sysfs /sys sysfs rw 0 0
/dev/block/stl6 /mnt/.lfs j4fs rw 0 0
tmpfs /sqlite_stmt_journals tmpfs rw,size=4096k 0 0
none /dev/cpuctl cgroup rw,cpu 0 0
/dev/block/stl9 /system rfs ro,vfat,log_off,check=no,gid/uid/rwx,iocharset=utf8 0 0
/dev/block/mmcblk0p2 /data rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iocharset=utf8 0 0
/dev/block/mmcblk0p3 /data_tmo rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iocharset=utf8 0 0
/dev/block/stl10 /dbdata rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iocharset=utf8 0 0
/dev/block/stl11 /cache rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iocharset=utf8 0 0
/dev/block/stl3 /efs rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iocharset=utf8 0 0
[COLOR="red"]/dev/loop0 /data/ext2data ext2 rw,noatime,nodiratime,errors=continue 0 0[/COLOR]
/dev/block//vold/179:1 /sdcard vfat rw,dirsync,nosuid,nodev,noexec,uid=1000,gid=1015,fmask=0102,dmask=0002,allow_utime=0
020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/block//vold/179:9 /sdcard/sd vfat rw,dirsync,nosuid,nodev,noexec,uid=1000,gid=1015,fmask=0000,dmask=0000,allow_utim
e=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
# ls
ls
[COLOR="Red"]com.alfray.timeriffic_preferences.xml[/COLOR]
#
Huh? Then i tried to read or delete that file:
Code:
# cat com.alfray.timeriffic_preferences.xml
cat com.alfray.timeriffic_preferences.xml
com.alfray.timeriffic_preferences.xml: [COLOR="red"]Stale NFS file handle[/COLOR]
# rm com.alfray.timeriffic_preferences.xml
rm com.alfray.timeriffic_preferences.xml
rm failed for com.alfray.timeriffic_preferences.xml, Stale NFS file handle
#
So, any suggestions?

"Today i re-applied the same ext2 lagfix, but had to adjust it a tad to add a remount command for /system because it failed setting up userinit.sh for rebooting, but that worked fine."
I don't understand why you had to adjust anything and that should be the first indicator that you did something wrong.
Odin back to stock, making sure to use the 512 pit file. Odin to JI6, no pit file needed. Download OCLF from the market, root and then try again. I've used OCLF probably 20 times and never had any issues.
Or, take a look in the development forum. There is a new lagfix that I am using, Z4Mod. Works pretty well.
Edit: Actually, I should say that it works remarkably well. Here is the link: http://forum.xda-developers.com/showthread.php?t=822964

Hmm? The /system was mounted as read-only and the script i was using assumed it was read/write mounted. I remounted it rw and didn't change anything else. Thanks for the advice but i don't really need to reflash back to stock, that's an incredible hassle so i just put my phone back the way it was manually and it's working fine now. I didn't use the OCLF from the market but the original shell scripts that were released... That's more comfortable for me because i can know what the scripts are doing and roll the changes back manually if it goes sideways, like in this case.
I'm guessing that my phone crashed and corrupted the ext2 file, i did find it to be powered off unexpectedly but i thought my battery had just run down.

Looking for kernel / build Without Audio stuttering on Blackstone!

Trying to solve audio stuttering...
I'm currently running the Eclair build from Kenia from
http://forum.xda-developers.com/showthread.php?t=827537
Like the speed, most things working fine.
... but playing media results in audio stutter.
Problem is apparently well known and affects more devices, see also
http://forum.xda-developers.com/showthread.php?t=711692&page=364
Indeed, killing battery service solves stuttering, but I'd like to keep it running, of course
Any build/kernel out there that does not suffer from this?
I'd like to find out what's different, since in the past it seemed to have worked, but with pushing more accurate battery readout in the latest kernels, this problem was introduced...
Maybe just putting an old battery service in a current kernel could work?
Cheers,
Robbert

I can confirm that audio shuttering is a common problem, but I wasn't aware it can be related to the battery code. Can anyone check if killing battery service helps with shuttering audio (youtube maybe?) on other build (e.g. FRX03)?
TBH battery code is unfinished since Camro (the guy who did most of it) bricked his phone. If it's really a kernel issue maybe I'd could build test kernel w/o battery code sometime next week.

g3rm0 said:
I can confirm that audio shuttering is a common problem, but I wasn't aware it can be related to the battery code. Can anyone check if killing battery service helps with shuttering audio (youtube maybe?) on other build (e.g. FRX03)?
TBH battery code is unfinished since Camro (the guy who did most of it) bricked his phone. If it's really a kernel issue maybe I'd could build test kernel w/o battery code sometime next week.
Click to expand...
Click to collapse
Hi, g3rm0,
Always happy to do some more testing!
Took me some time to get a FRX03 build back working (not my daily build, Froyo is just too slow on blackstone, I'm afraid)
Anyway: Using the FRX03 build from
http://forum.xda-developers.com/showthread.php?t=711692
(full package, so using the included rootfs, zimage and modules.)
I can *confirm* that audio still stutters, and also on this build stuttering immediately disappears when battery service is killed!
Hope it helps?
If there's need to test different rootfs/zimage/modules/startup/..., just let me know!
Actually, for me, I just want to disable battery service so I can listen to music on my 15min bike ride to work!
But I am a linux Noob, so although "kill -9" is in my power to stop the service, actually restarting a service is momentarily out of reach...
Any help with restarting the [battery] service would be greatly appreciated!
Cheers,
Robbert

You don't need to compile a kernel tbh, why don't you just create an init script which includes the "kill -9 28" command? The init script will get launched on startup therefore killing the battery service as desired.
Best Regards,
ST1Cl<^^aN

Stickman89 said:
You don't need to compile a kernel tbh, why don't you just create an init script which includes the "kill -9 28" command? The init script will get launched on startup therefore killing the battery service as desired.
Best Regards,
ST1Cl<^^aN
Click to expand...
Click to collapse
Hi, Stickman89,
Yes, I read this also somewhere, thanks for reminding me!
My bigger wish is to be able to restart the battery service after finishing listening to music, not having to restart Android (and first WinMo) because that takes way too much time.
How do I restart the service, any idea?
Cheers,
Robbert

well to do that you would need to install a mobile terminal app from the market and create two scripts, one to disable the service and the other to enable it. Only problem is this would not be automated and you would need to execute the script via the terminal app installed.
Best Regards,
ST1Cl<^^aN

Stickman89 said:
well to do that you would need to install a mobile terminal app from the market and create two scripts, one to disable the service and the other to enable it. Only problem is this would not be automated and you would need to execute the script via the terminal app installed.
Best Regards,
ST1Cl<^^aN
Click to expand...
Click to collapse
I could live with that (still hoping for a proper fix, of course!)
Most builds come with a terminal app (Busybox is popular, if I remember correctly) that's what you mean?
But still I need the command line / script lines to execute, and that's where I'm stuck, since I know how to kill the service from the prompt of my terminal in the phone, but not how to "unkill" it!
"Disable/enable" sounds much better than "kill/unkill", but how???
As a side note, I also get the impression that the android terminal does not give me full access to a shell environment, since, for example, the "ps" command is severely limited! (wanted to find out more information on process "[battery]", but no chance with the crippled "ps" command...)
Maybe there are better (more functional) terminals out there?
Or do we actaully have access to "enable/disable service" commands in this "busybox" and I just don't know the proper command?
(just for reference: I'm running Kenia's eclair build that includes busybox 1.5 as terminal)
Cheers, Robbert

Even better, look what I just found for you: http://forum.xda-developers.com/showthread.php?t=486486
Basically you can create a homescreen icon and assign a shell command to it, simply create an icon and assign the "kill -9 28" command to it which will kill the battery service, I would have to check out the process name to be able to start it again. Let me take a look for you (I don't think "start -9 28" will work as we have only issued the process ID and since it is no longer running will be useless)
Best Regards,
ST1Cl<^^aN

If you have a working adb setup then type: "adb shell ps -w"
or download a mobile terminal and type: "ps -w"
Ok here are the processes running, PID 28 is krpcserversd in our case which is incorrect so we need to look for the battery service which is PID 29 for me.
Code:
# ps
ps
PID USER VSZ STAT COMMAND
1 0 312 S /init.android
2 0 0 SW [kthreadd]
3 0 0 SW [ksoftirqd/0]
4 0 0 SW [watchdog/0]
5 0 0 SW [events/0]
6 0 0 SW [khelper]
7 0 0 SW [suspend]
8 0 0 SW [kblockd/0]
9 0 0 SW [cqueue]
10 0 0 SW [kmmcd]
11 0 0 SW [btaddconn]
12 0 0 SW [btdelconn]
13 0 0 SW [kondemand/0]
14 0 0 SW [smd_tty]
15 0 0 DW [rpcrouter]
16 0 0 SW [kadspd]
17 0 0 SW [detection/0]
18 0 0 SW [button/0]
21 0 0 SW [kswapd0]
22 0 0 SW [aio/0]
23 0 0 SW [panel_on/0]
24 0 0 SW [tty_wq/0]
25 0 0 SW [usb_mass_storag]
26 0 0 SW [kstriped]
27 0 0 SW< [krfcommd]
28 0 0 SW [krpcserversd]
29 0 0 DW [battery]
54 0 0 SW [mmcqd]
71 0 0 SW< [loop2]
90 0 0 SW< [loop0]
94 0 0 SW< [loop1]
133 0 1736 S busybox telnetd -b 192.168.20.1 -l /bin/sh
1168 0 1740 S /bin/sh /bin/userinit.sh -c /sdcard/conf/froyo.user.
1226 0 1740 S /bin/sh
1227 1000 812 S /system/bin/servicemanager
1228 0 3728 S /system/bin/vold
1229 0 1736 S /bin/sh /bin/netd
1231 0 668 S /system/bin/debuggerd
1232 1001 5464 S /system/bin/rild -l /lib/froyo/libhtcgeneric-ril.so
1233 0 87964 S zygote /bin/app_process -Xzygote /system/bin --zygot
1234 1013 26664 S < /system/bin/mediaserver
1238 1002 1260 S /system/bin/dbus-daemon --system --nofork
1239 0 824 S /system/bin/installd
1240 1017 1612 S /system/bin/keystore /data/misc/keystore
1241 0 3340 R /sbin/adbd
1243 0 3720 S /system/bin/netd
1258 1000 246m S system_server
1330 10054 124m S com.swype.android.inputmethod
1345 10011 129m S N com.google.process.gapps
1434 1001 134m S < com.android.phone
1685 1000 123m S com.android.settings
2847 0 0 DW [audmgr_rpc]
3391 0 0 DW [ksdiorqd]
3392 0 0 SW [tiwlan_wifi_wq]
3400 1010 3004 S /system/bin/wpa_supplicant -Dtiwlan0 -itiwlan0 -c/da
3588 10007 107m S com.android.quicksearchbox
4937 10053 159m S android.process.acore
5076 10058 108m S com.appspot.swisscodemonkeys.apps
5083 10023 105m S com.android.voicedialer
5095 10004 110m S com.android.vending
5106 10026 114m S com.google.android.googlequicksearchbox
5113 10002 126m S android.process.acore
5233 10037 105m S com.android.defcontainer
5243 10030 112m S com.google.android.apps.genie.geniewidget
5273 10010 111m S < android.process.media
5284 10014 114m S com.google.android.gm
5338 0 0 SW [pdflush]
5462 10064 106m S mobi.infolife.taskmanager
5524 0 0 SW [pdflush]
5532 10070 123m S stericson.busybox
5584 10061 115m S com.facebook.katana
5631 0 1736 S sleep 500
5635 10059 114m S cn.miren.browser
5662 0 740 S /system/bin/sh -
5665 10060 122m S com.voxmobili.phonebook2
5691 10056 108m S com.miui.player
5697 10028 108m S com.google.android.apps.uploader
5705 0 1740 R ps
Once the battery service has been located so in my case PID 29 then to kill that PID via adb simply issue "adb shell kill 29" (PID number may vary so please check) and to start the PID issue "command-removed".
So if you want to use the application i linked you to over at the G1 thread then simply assign the commands "kill 29" to kill the service and "command-removed" (remember that the PID number may vary so please check) to start the service again.
FYI charging will stop at this point and battery stats will freeze at there current percentage.
Best Regards,
ST1Cl<^^aN

Stickman89 said:
Ok here are the processes running, PID 28 is krpcserversd, interestingly we also have the PID 29 which is battery.
Click to expand...
Click to collapse
Same here for me: PID is 29 (it may different in some builds) but... when I killed battery service (kill -9 29) audio shuttering stopped. It also solved "audpp: DMA missed" messages in dmesg so maybe we're on the right track.
IMHO killing battery service every time is not a solution. Maybe code just needs to be cleaned up a little.
Anyway, for now kill -9 is the only (known) way to achieve smooth playback.

Ok then all we need to do is adjust the scheduling priority until we find the sweet spot via renice
That way we wouldn't need to kill anything and that can be added to init fairly easy, we would have to test some values first.
Best Regards,
ST1Cl<^^aN

Stickman89 said:
Ok then all we need to do is adjust the scheduling priority until we find the sweet spot via renice
That way we wouldn't need to kill anything and that can be added to init fairly easy, we would have to test some values first.
Best Regards,
ST1Cl<^^aN
Click to expand...
Click to collapse
Tried that already, afraid it might not be so easy...
Gave the audiomanager -20 or so, and the battery service +20 or so, no effect, still stuttering...
But maybe your mileage may vary, did you try this on your build?
Cheers,
Robbert

Stickman89 said:
If you have a working adb setup then type: "adb shell ps -w"
or download a mobile terminal and type: "ps -w"
Ok here are the processes running, PID 28 is krpcserversd in our case which is incorrect so we need to look for the battery service which is PID 29 for me.
Click to expand...
Click to collapse
Also for me, number 29 it is.
Stickman89 said:
Once the battery service has been located so in my case PID 29 then to kill that PID via adb simply issue "adb shell kill 29" (PID number may vary so please check) and to start the PID issue "--locating-process--".
So if you want to use the application i linked you to over at the G1 thread then simply assign the commands "kill 29" to kill the service and "--locating-process--" (remember that the PID number may vary so please check) to start the service again.
Click to expand...
Click to collapse
Huh?
Something must have gotten "lost in translation" here, I have really no idea what is meant by the command "--locating-process--", I guess it's not literally typing in this phrase, what am I missing?
Ah, just noticed your statement in an earlier post "I would have to check out the process name to be able to start it again", I guess that's what you meant by "--locating-process--" in the next post...?
Well, to be continued...
Cheers,
Robbert

The service isn't successfully starting after being killed, I initially thought it had but it appears it failed to kill on first try therefore it was still running. I will keep looking into this though, stuttering isn't that bad on my build. I will upload it soon, it is there but isn't too bad.
Best Regards,
ST1Cl<^^aN

Stickman89 said:
The service isn't successfully starting after being killed, I initially though it had but it appears it failed to kill on first try therefore it was still running. I will keep looking into this though, stuttering isn't that bad on my build. I will upload it soon, it is there but isn't too bad.
Best Regards,
ST1Cl<^^aN
Click to expand...
Click to collapse
Yeah, noticed that too, sometimes the service takes a few seconds to unload (or at least "ps" still shows it.)
Maybe someone else has some bright ideas, posted it also at Neopeek, some good guys over there, too
I just hoped someone had a quick solution, but we may have to wait for some more kernel development. I'll keep my eyes open, if something pops up I'll update.
Cheers,
Robbert

May I ask what application you guys are using to kill the process? I downloaded the terminal emulator app, however when I type "kill 29" it says operation not allowed.
I'm assuming this is because of a rights issue. I am using Android 2.2 (FroYo) by the Brilliant Mistake [03 Sep 2010] (V1.6) with the latest kernel, zimage, rootfs along with FRX03 update.
I'm a bit confuse as to how I can "root" my device in order kill the battery process so I too can listen to my music without the annoying stuttering.
Any info would be appreciated. Thanks

Just type "su" first

g3rm0 said:
Just type "su" first
Click to expand...
Click to collapse
Thank you for your reply.
I type "su" then enter...
I get a "#" prompt
then I type "kill 29" enter
I don't get any type of confirmation just another "#" prompt
I try listening to my music, stuttering is still there... What am I doing wrong?

James62370 said:
Thank you for your reply.
I type "su" then enter...
I get a "#" prompt
then I type "kill 29" enter
I don't get any type of confirmation just another "#" prompt
I try listening to my music, stuttering is still there... What am I doing wrong?
Click to expand...
Click to collapse
"kill -9 29" has a better chance
Did you check before killing it, that [battery] is process 29 for you? (use "ps" command in shell)
Did you check afterwards that process 29 [battery] is indeed gone?

Just wait for viruscrazy submit the patch to phh to be merge in the main tree.It already in Jerome tree HERE
Code:
/* Patch to fix "audpp DMA missed" messages on AMSS version 52.62.25.34 */
1423 if ( machine_is_htcdiamond() || machine_is_htcblackstone() ) {
1424 if( !(snd_state & SND_STATE_PLAYBACK) ) {
1425 dex.cmd = PCOM_GET_BATTERY_DATA;
1426 msm_proc_comm_wince(&dex, 0);
1427 } /* else {
1428 printk("Skipping battery pcom call to avoid audppp DMA miss\n");
1429 } */
1430 }

odd storage speed discoveries (adb push is the slowest!)

test 1
$ adb push myfile.m4v /sdcard
1299 KB/s (943944330 bytes in 709.453s)
test 2
# time dd if=/dev/zero of=/sdcard/test.out bs=1024 count=1000000
1000000+0 records in
1000000+0 records out
1024000000 bytes transferred in 74.120 secs (13815434 bytes/sec)
real 1m 14.54s
user 0m 1.15s
sys 0m 15.08s
(~13mbyte/sec)
test 3
ubuntu box -> usb mounted xoom
$ ls -lsk test2
1145138 -rwxrwxrwx 1 me me 1145138 1969-12-31 19:00 test2
$ time cp test2 /media/xoom/test2
real 0m14.956s
user 0m0.000s
sys 0m4.580s
~80mb/sec! something is not right... and indeed it wasnt.
something odd happened... immediately after the cp finished the /media/xoom mountpoint became unresponsive for ~60 seconds. I could open astro and browse from my xoom, but doing this from my pc:
$ ls /media/xoom
just hung for a long while
I suspect the write was committed to memory and then synched to /media/xoom so one more test
*same file size as above test2*
$ time cp test3 /media/xoom/test3 ; time ls /media/xoom/test3
real 0m14.980s
user 0m0.010s
sys 0m4.720s
test3
real 1m29.438s
user 0m0.000s
sys 0m0.000s
Which means ~113 seconds total (cp+ls timing) and ~10mbyte/sec
Which if you factor in mtpfs+usb copying (compared to the dd write above) sounds about right.
I am guessing a commit to memory is happening somewhere, but my dekstop is running Linux and Linux doesn't commit a write to memory so cp wouldn't have come back until the write was synced to the disk...
Does this have something to do with mtpfs? Is this a usb'ism? android'ism?
Any thoughts/ideas?

No idea the technically info, but on my evo my memory drops way down as I copy files to to the sdcard. It then goes backup when I'm done coping. So what you say is happening appears to happen on other android devices also.
Sent from my Xoom using Tapatalk

From my experience.. ADB (USB) is the slowest. I have tested ADB over TCP but I cannot remember the results.. CIFS is a step up... and then.. FTPd via filexpert (sdcard access only) is the fastest by far..
get a hold of iwmulticall binary and 'ln iwmulticall iwconfig' to get access to iwconfig.. then iwconfig <name of wlan device> power off to turn off power management for the wlan card.. That boosts transfer speeds quite a bit in some scenarios.. ionice <pid> rt 1 and renice -20 <pid> of the process <pid> doing the copying can also help.
one I forgot is sftp which is somewhere between cifs and adb.. not as fast as FTP.. Thats done by setting up dropbear and getting ahold of the sftpserver binary.. then mounting the tablet via sshfs.. The upside of this is that you can mount / of the device on a computer and have access wirelessly..
You'll need a linux distro for this (but I believe WinSCP will work for windows as long as you can tell it where the sftp-server binary is).. Heres my little script for mounting a device running dropbear (dropbear -v -s -g)
sudo sshfs [email protected]$1:/ /media/sshfs/ -o allow_other,sftp_server=/data/dropbear/sftp-server
its run like this ./<nameofscript> <ipaddress>
this assumes you have dropbear setup correctly with all the appropriate rsa keys generated for your clients and the sftp-server is where you say it is.
btw.. Android REALLY sucks when it comes to making use of the hardware.. I was able to choke up my viewsonic gtab by using its 100mbit eth connection to serve files to a wireless windows client via ftp.. 9-10 MB/sec too much for you, Android OS? Ugh. pathetic. and 9-10 MB/sec peak when it wasn't falling on its face and delivering 0 bytes/sec.. completely frozen.. (but not actually dead/kernel crash)..
another edit: In response to the OP.. 80 MB/sec is beyond the usb 2.0 bus spec..so thats strange too. See whats up when its transfering.. what process is active and how much resources its using.. you could kill all the other unused processes too, but chances are.. they'll just launch again cuz android is ****ty like that.

onicrom said:
but my dekstop is running Linux and Linux doesn't commit a write to memory
Click to expand...
Click to collapse
Uh, yeah it does- but you're not eventually writing to slow-ass NAND flash on your desktop, either.

The Xoom apparently suffers from the burst..pause..burst issue when transferring as well. OCing helped slightly. I don't think this is an issue of slow ass nand.. but then again it could be transferring to a ram buffer on the device.. the device flushes the buffer (or it gets full) and that's when the freezing happens...
Renice/ionice-ing the sdcard process did not help much. That's /system/bin/sdcard binary for those wondering.
Cifs speeds done with 'cp' via terminal emulator are terrible. 600 KB/sec. Gotta love it when the OS is the bottleneck to your internet connection. Power Management turned off (wlan0), priority increased for cifsd,cp, and a dhd related process.. and the speeds jumped up to a blazing 800KB/sec when clock was locked at 1504... meaning my wireless network speed scaled with my processor clock. How screwed is that? Last time I checked, 'we' were only oc'ing the cpu and gpu..

this would depend on what filesystem you are using and if the default behavior is to write sync or async, i don't recall what the default for ext4 is, but mounting /sdcard via mtpfs over usb, which is a fuse mount of /data sure does make fore determining the type of write difficult.
kcrudup said:
Uh, yeah it does- but you're not eventually writing to slow-ass NAND flash on your desktop, either.
Click to expand...
Click to collapse

Blades said:
Cifs speeds done with 'cp' via terminal emulator are terrible. 600 KB/sec. Gotta love it when the OS is the bottleneck to your internet connection. Power Management turned off (wlan0), priority increased for cifsd,cp, and a dhd related process.. and the speeds jumped up to a blazing 800KB/sec when clock was locked at 1504... meaning my wireless network speed scaled with my processor clock. How screwed is that? Last time I checked, 'we' were only oc'ing the cpu and gpu..
Click to expand...
Click to collapse
Interesting finds! I wonder if http transfers would be the same as ftp... the only problem I have with http transfers would be getting the browser to open the files with the appropriate application.
Ideally I wouldn't need to transfer data to/from my xoom at all I just want to play over the air, but if cifs is really the bad I might need to test alternatives.

onicrom said:
but mounting /sdcard via mtpfs over usb, which is a fuse mount of /data sure does make fore determining the type of write difficult.
Click to expand...
Click to collapse
Looks like the underlying FS is ext4 with data=ordered and barriers on (of course). I can't imagine the fuse FS (or MTPfs) being the bottleneck:
Code:
# cat /proc/mounts
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/platform/sdhci-tegra.3/by-name/system /system ext4 ro,relatime,barrier=1,data=ordered 0 0
/dev/block/platform/sdhci-tegra.3/by-name/userdata /data ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered 0 0
/dev/block/platform/sdhci-tegra.3/by-name/cache /cache ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered 0 0
/dev/block/platform/sdhci-tegra.3/by-name/pdsb /pds ext2 ro,relatime 0 0
/dev/fuse /mnt/sdcard fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
# df
Filesystem Size Used Free Blksize
/dev 359M 32K 359M 4096
/mnt/asec 359M 0K 359M 4096
/mnt/obb 359M 0K 359M 4096
/system 236M 180M 55M 4096
/data 28G 17G 11G 2048
/cache 166M 4M 162M 4096
/pds 1M 106K 1M 2048
/mnt/sdcard 28G 17G 11G 2048
#

The way in which the Xoom rxs data over USB reminds me of a program I use on my Windows comp called FancyCache. It allows you to set a r/w buffer in RAM, specifying the size and write delay. I just wonder if the Xoom starts to write to nand when the men buffer is full, or after a given time.
I hope it doesn't just wait for the buffer to be full/transfer to finish to start 'flushing' the ram/cache.

[APP] midnight-commander 4.7.0.3 for Android (updated to 4.7.5.4, with APK Installer)

Introduction
Here's the classic Midnight Commander for Android!
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Features
a) Function keys work (F3 - view, F5 - copy, F8 - delete, F10 - exit, etc...)
b) Very stable, doesn't crash.
c) Much easier installation than the previous one version (which needed an additional apt-get clone, named ipkg, etc). More about this below.
d) comes bundled with xterm (terminfo) and syntax highlighting for major languages.
e) I kept the wrapper script 4.6.2 but updated it so that function keys work.
Reasons
There is an one year old version floating around (version 4.6.2) and even if does start, it crashed every time I pressed the arrow keys in the search panels:
Code:
/system/xbin/mc.real: libc/misc/ctype/ctype.c: 290: tolower: Assertion `((((unsigned int)((c) - 0)) <= ((127 * 2 + 1) - 0)) || ((c) == (-1)))' failed.
Not only this, but I had to restart Putty, since the whole screen became garbled.
Installation
You need a rooted phone with busybox.
Installation is easy:
click Install and allow root access.​
If everything is ok, you will see an output like in the screenshot below:
To use mc, you could connect with a terminal emulator (but it looks ugly). A good alternative is if you use DroidSSHd as SSH server on the phone and Putty as client from your PC (or connect-bot as client on the phone).
For now, there is no uninstaller for the native MC that is extracted on the phone. Thus, feel free to uninstall the app as you don't need it anymore once MC native is copied to the phone.
Download
Use it at your own risk! (License is GPLv2)
NativnuxInstaller_1.1.apk

cp cannot create 'mc-4.0.7................
read only file system.
How to solve this ?
I tried to remount /system as rw but didn´t help.
How to get write access to / ?
I tried to extract the archive on a linux machine and copy the folders to device via QtADB but when I tried to run mc from terminal emulator I get error run xterm.
So I think there was some permission errors.

1. Become super user:
su
2. Check output of current mounts:
cat /proc/mounts
You will see something like:
Code:
...
/dev/block/mtdblock0 /system yaffs2 rw,relatime 0 0
Remember the number after mtdblock! Important. In case above is 0, but it might be 3 also etc...
3. Execute command:
mount -o rw,remount -t yaffs2 /dev/block/mtdblock[PUT_HERE_THE_NUMBER] /

viulian said:
1. Become super user:
su
2. Check output of current mounts:
cat /proc/mounts
You will see something like:
Code:
...
/dev/block/mtdblock0 /system yaffs2 rw,relatime 0 0
Remember the number after mtdblock! Important. In case above is 0, but it might be 3 also etc...
3. Execute command:
mount -o rw,remount -t yaffs2 /dev/block/mtdblock[PUT_HERE_THE_NUMBER] /
Click to expand...
Click to collapse
Seems that /system is in /dev/block/mmcblk0p12 . I tried your command with mmcblk0p12 but again I get the same error. So, something I'm doing wrong. Here is the output of cat /proc/mounts:
Code:
# cat /proc/mounts
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
/dev/block/mmcblk0p12 /system ext3 rw,relatime,errors=continue,data=writeback 0 0
/dev/block/mmcblk0p13 /data ext3 rw,nosuid,nodev,relatime,errors=continue,data=ordered 0 0
/dev/block/mmcblk0p6 /cache ext3 rw,nosuid,nodev,relatime,errors=continue,data=ordered 0 0
/dev/block/mmcblk0p1 /cust_backup vfat ro,relatime,fmask=0000,dmask=0000,allow_utime=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro 0 0
/dev/block/mmcblk0p14 /HWUserData vfat rw,relatime,fmask=0000,dmask=0000,allow_utime=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
/dev/block/vold/179:17 /mnt/sdcard vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0602,dmask=0602,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/block/vold/179:17 /mnt/secure/asec vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0602,dmask=0602,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
tmpfs /mnt/sdcard/.android_secure tmpfs ro,relatime,size=0k,mode=000 0 0
/dev/block/dm-0 /mnt/asec/com.junglesoft.calc-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/block/dm-1 /mnt/asec/com.aldiko.android-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/block/dm-2 /mnt/asec/com.jiubang.android.euphorialite-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/block/dm-3 /mnt/asec/com.gamestar.idiottest-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/block/dm-4 /mnt/asec/com.svox.classic.langpack.ell_grc_fem-1 vfat ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
Can this helps you to give me, a specific to my system, command?
Thanks in advance

As you can see, your device has ext3 type partition, unlike mine which has yaffs2.
Your custom command is:
mount -o rw,remount -t ext3 /dev/block/mmcblk0p12 /
In future, please search your device specific forum for device specific questions - I found the answer myself here: http://forum.xda-developers.com/archive/index.php/t-928727.html

No, this doesn't work eather, I've already tried.
I figure it out myself though, needed to remount rw my / partition which is rootfs.
After that the extarction worked without any error.
But still I get:
Error opening terminal: xterm
when I try to execute mc.

Make sure you have the following file copied over from the .tar.gz archive:
/etc/terminfo/x/xterm
I suggest to copy all files (/etc/mc and /system/share .. ) because they contain a lot of .ini files / syntax etc, without which mc will look black and white
Better if you untar in / directly ...

I did this already, and xterm is in correct place.

Please post screenshot of the following commands executed in same terminal:
Code:
cls
ls -l /etc/terminfo/x/xterm
cat /system/xbin/mc
ls -l /system/xbin/mc.real

I execute them via adb:
Code:
# ls -l /etc/terminfo/x/xterm
-rw-r--r-- 1 system system 3213 Jul 5 2010 /etc/terminfo/x/xterm
# cat /system/xbin/mc
#!/system/bin/sh
export TMPDIR=/data/local/tmp
if [ ! -e $TMPDIR ]; then
mkdir $TMPDIR
fi
# So that F1, ... works
export TERM=xterm
/system/xbin/mc.real $*
# ls -l /system/xbin/mc.real
-rwxr-xr-x 1 system system 3508114 Aug 31 19:51 /system/xbin/mc.real

Looks good.
What kind of terminal are you using adb in ? I suggest http://code.google.com/p/droidsshd/ and ssh to the phone - and bypass adb completly.

I'm on linux machine and use tilda as terminal, but I execute the command and on device with terminal emulator with the same results

Try copying over your Linux /etc/terminfo (or depending on the distro, it might be somewhere else - my Ubuntu says to check /lib/terminfo then /usr/share/terminfo).
Copy all the single letter folder onto /etc/terminfo on the phone, and then change /system/xbin/mc to export a different type of terminal, for example:
export TERM=linux
Of course, make sure that /etc/terminfo/l/linux is there before this.
With TERM=linux, the function keys do not seem to work in my case, they are rendered like ~13 etc .. However, it might work in your case ?

I get the same error, but now for "linux"
linux is there on letter l

I'm curious, why does your phone shows the /etc contents are owned by system / system, instead root / root ?

I don't know, but I think that is the reason for this error.

viulian said:
As you can see, your device has ext3 type partition, unlike mine which has yaffs2.
Your custom command is:
mount -o rw,remount -t ext3 /dev/block/mmcblk0p12 /
In future, please search your device specific forum for device specific questions - I found the answer myself here: http://forum.xda-developers.com/archive/index.php/t-928727.html
Click to expand...
Click to collapse
To be strict - you don't have to use anything but this:
mount mountpoint -o remount,rw
which means in this case:
mount / -o remount,rw
Writing the filesystem type or device name for such a command in a guide for everyone is quite an error.
And to be complete - only thing you have to write to see all mounted filesystems is: mount<enter>
Cat'ting /proc is NOT safe (one of the reasons: it can be switched off, whole proc filesystem, and there are many more reasons to be honest)

viulian said:
Make sure you have the following file copied over from the .tar.gz archive:
/etc/terminfo/x/xterm
Click to expand...
Click to collapse
it's not correct place ) /usr/share/terminfo is compiled inside mc.real binary(to ensure strings -a mc.real | grep terminfo or winhex it), so to run we need to create /usr/share/terminfo/x/xterm, but it's not possibly to create such path on any device. the easest way to fix - recompile mc with hacked terminfo path. if you could compile mc can't you please?
ps: my english is baaad, sorry )
ok, it's solution - add export TERMINFO_DIRS=/system/etc/terminfo to mc script

Nice find.
I remember specifying the prefix to be /system and I removed /system/etc/terminfo and it failed to start, then I put it back and it executed.
There might also be some hardcoded paths too that strings finds, some failover defaults.
On my phone, /etc is a link to /system/etc in fact.
I will double later a bit, no access to PC now

Hi at all, basicly it works for me on cm7-nightly - but i get problems with loading the default skin
has anybody a solution for it ?
Uploaded with ImageShack.us
THX !

Soldering Method: How do I disable SE Linux restrictions?

**UPDATE**
Here is my collection of scripts for rooting, blocking updates, and all kinds of stuff for ALL fire tv:
https://github.com/pwntrik/firetv/
Here's the video (2 parts) on howto root Fire TV 1st gen using soldering:
https://youtu.be/yhwYfudGiM8
https://youtu.be/Kn7zmXf08bk
**/UPDATE**
Greetings, AFTV hackers!
I have successfully soldered an emmc reader to the Fire TV 1st Gen, and I have complete r/w access. However, the tutorial for rooting appears to be a bit dated as the hacker (@maximus64) at the time was able to just copy the su binary to /system/xbin, modify the permissions, and run it.
Since FireOS 5.2.0.0, however, SELinux now prevents the binary from being executed:
(At this point, I have already copied su binary, chmod 6755 it, chown 0:0 it)
Code:
[email protected]:/ $ ls -la /system/xbin/su
ls -la /system/xbin/su
/system/xbin/su: Permission denied
1|[email protected]:/ $ su
su
/system/bin/sh: su: not found
127|[email protected]:/ $ ls -ld /system/xbin
ls -ld /system/xbin
drwxr-xr-x root shell 2017-01-05 01:35 xbin
[email protected]:/ $ ls -l /system/xbin/
ls -l /system/xbin/
-rwxr-xr-x root shell 63880 2016-05-27 17:00 dexdump
-rwxr-xr-x root shell 49816 2016-05-27 17:00 sqlite3
lstat '/system/xbin//su' failed: Permission denied
-rwxr-xr-x root shell 813248 2016-05-27 17:00 tcpdump
-rwxr-xr-x root shell 9384 2016-05-27 17:00 trapz
-rwxr-xr-x root shell 46456 2016-05-27 17:00 vitals_collection_agent
And just to make sure I did everything correctly, I hooked it up again then checked the binary:
Code:
[email protected]:/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b1/xbin# ls -la
total 1092
drwxr-xr-x. 2 root 2000 4096 Jan 5 04:35 .
drwxr-xr-x. 16 root root 4096 Jan 6 17:07 ..
-rwxr-xr-x. 1 root 2000 63880 May 27 2016 dexdump
-rwxr-xr-x. 1 root 2000 49816 May 27 2016 sqlite3
-rwsr-sr-x 1 root root 112576 Jan 5 04:31 su
-rwxr-xr-x. 1 root 2000 813248 May 27 2016 tcpdump
-rwxr-xr-x. 1 root 2000 9384 May 27 2016 trapz
-rwxr-xr-x. 1 root 2000 46456 May 27 2016 vitals_collection_agent
So at this point, I did some research and it seems that SELinux prevents this from being run. Does anyone have a workaround or could tell me how to give this binary permission? I have zero experience with SELinux, and even if anyone can point me to a similar thread for rooting when you have full r/w access, that'd be excellent..
Thanks!

cancelyourcable said:
Greetings, AFTV hackers!
I have successfully soldered an emmc reader to the Fire TV 1st Gen, and I have complete r/w access. However, the tutorial for rooting appears to be a bit dated as the hacker (@maximus64) at the time was able to just copy the su binary to /system/xbin, modify the permissions, and run it.
Since FireOS 5.2.0.0, however, SELinux now prevents the binary from being executed:
(At this point, I have already copied su binary, chmod 6755 it, chown 0:0 it)
Code:
[email protected]:/ $ ls -la /system/xbin/su
ls -la /system/xbin/su
/system/xbin/su: Permission denied
1|[email protected]:/ $ su
su
/system/bin/sh: su: not found
127|[email protected]:/ $ ls -ld /system/xbin
ls -ld /system/xbin
drwxr-xr-x root shell 2017-01-05 01:35 xbin
[email protected]:/ $ ls -l /system/xbin/
ls -l /system/xbin/
-rwxr-xr-x root shell 63880 2016-05-27 17:00 dexdump
-rwxr-xr-x root shell 49816 2016-05-27 17:00 sqlite3
lstat '/system/xbin//su' failed: Permission denied
-rwxr-xr-x root shell 813248 2016-05-27 17:00 tcpdump
-rwxr-xr-x root shell 9384 2016-05-27 17:00 trapz
-rwxr-xr-x root shell 46456 2016-05-27 17:00 vitals_collection_agent
And just to make sure I did everything correctly, I hooked it up again then checked the binary:
Code:
[email protected]:/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b1/xbin# ls -la
total 1092
drwxr-xr-x. 2 root 2000 4096 Jan 5 04:35 .
drwxr-xr-x. 16 root root 4096 Jan 6 17:07 ..
-rwxr-xr-x. 1 root 2000 63880 May 27 2016 dexdump
-rwxr-xr-x. 1 root 2000 49816 May 27 2016 sqlite3
-rwsr-sr-x 1 root root 112576 Jan 5 04:31 su
-rwxr-xr-x. 1 root 2000 813248 May 27 2016 tcpdump
-rwxr-xr-x. 1 root 2000 9384 May 27 2016 trapz
-rwxr-xr-x. 1 root 2000 46456 May 27 2016 vitals_collection_agent
So at this point, I did some research and it seems that SELinux prevents this from being run. Does anyone have a workaround or could tell me how to give this binary permission? I have zero experience with SELinux, and even if anyone can point me to a similar thread for rooting when you have full r/w access, that'd be excellent..
Thanks!
Click to expand...
Click to collapse
bueller_recovery_v2.zip begins with a shell script. If you open it in a text editor, you can see it. mkdir /system/recovery, unzip the contents of that zip to /system/recovery, and do the mv and ln commands. Make sure the selinux contexts of /system/recovery and it's contents match the other contents of /systems.
And also make sure the contents are chmod 755.

rbox said:
bueller_recovery_v2.zip begins with a shell script. If you open it in a text editor, you can see it. mkdir /system/recovery, unzip the contents of that zip to /system/recovery, and do the mv and ln commands. Make sure the selinux contexts of /system/recovery and it's contents match the other contents of /systems.
And also make sure the contents are chmod 755.
Click to expand...
Click to collapse
Thanks, rbox! I've managed to rewrite the script to do all that, but how do I make sure the SELinux contexts match? Sorry, not familiar with SELinux.
Is this the ACTUAL partition table, or is this the way the eMMC reader loads it?
Code:
[email protected]:/media/root# ls 5*
57f8f4bc-abf4-655f-bf67-946fc0f9f25b:
adb backup hostapd property system?
anr bugreports key_provisioning prReset time
app connectivity local radio tombstones
app-asec dalvik-cache logd resource-cache user
app_ext data lost+found securedStorageLocation vitals
app-lib debug_service media securestop webcrypto
app_ms dontpanic mediadrm security wiper
app-private dpm misc shared wpstiles
audio drm playready ssh
autotrace fota proffline system
57f8f4bc-abf4-655f-bf67-946fc0f9f25b1:
data lost+found usf
57f8f4bc-abf4-655f-bf67-946fc0f9f25b2:
com.amazon.avod.apk lost+found
com.amazon.venezia.apk recovery
com.amazon.vizzini-550901810.apk signed_com.amazon.kso.blackbird-1550000810.apk
dalvik-cache signed_CSAppFireTV-fireOs-release_v112.apk
57f8f4bc-abf4-655f-bf67-946fc0f9f25b3:
data lost+found usf
57f8f4bc-abf4-655f-bf67-946fc0f9f25b4:
app etc lib priv-app sqfs vendor
bin fonts lost+found recovery-from-boot.p tts xbin
build.prop framework media security usr
I ask because /system/bin is actually on a completely separate partition using this method. Is it possible to copy the actual init2stub in place of e2fsck instead of symlinking it? (in case the symlink doesn't work)
Here's my modified version of your script:
Code:
# Put your `recovery' folder in here, unzipped
SHARED="/media/sf_Shared"
# This is the directory created by the MMC reader
LABEL="/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b"
SYSTEM="${LABEL}/system"
BIN="${LABEL}4/bin"
echo "Copying recovery..."
cp -rf $SHARED/recovery $SYSTEM
echo "Chmodding..."
chmod -R 755 $SYSTEM/recovery
echo "Backup the old e2fsck..."
mv $BIN/e2fsck $BIN/e2fsck.real
echo "Symlink e2fsck to 2ndinitstub..."
# If symlink doesn't work, can I copy 2ndinitstub completely?
ln -sf ../recovery/2ndinitstub $BIN/e2fsck
echo "Done."
Thanks for your help otherwise I'd be so SCREWED! :laugh:

cancelyourcable said:
Thanks, rbox! I've managed to rewrite the script to do all that, but how do I make sure the SELinux contexts match? Sorry, not familiar with SELinux.
Is this the ACTUAL partition table, or is this the way the eMMC reader loads it?
Code:
[email protected]:/media/root# ls 5*
57f8f4bc-abf4-655f-bf67-946fc0f9f25b:
adb backup hostapd property system?
anr bugreports key_provisioning prReset time
app connectivity local radio tombstones
app-asec dalvik-cache logd resource-cache user
app_ext data lost+found securedStorageLocation vitals
app-lib debug_service media securestop webcrypto
app_ms dontpanic mediadrm security wiper
app-private dpm misc shared wpstiles
audio drm playready ssh
autotrace fota proffline system
57f8f4bc-abf4-655f-bf67-946fc0f9f25b1:
data lost+found usf
57f8f4bc-abf4-655f-bf67-946fc0f9f25b2:
com.amazon.avod.apk lost+found
com.amazon.venezia.apk recovery
com.amazon.vizzini-550901810.apk signed_com.amazon.kso.blackbird-1550000810.apk
dalvik-cache signed_CSAppFireTV-fireOs-release_v112.apk
57f8f4bc-abf4-655f-bf67-946fc0f9f25b3:
data lost+found usf
57f8f4bc-abf4-655f-bf67-946fc0f9f25b4:
app etc lib priv-app sqfs vendor
bin fonts lost+found recovery-from-boot.p tts xbin
build.prop framework media security usr
I ask because /system/bin is actually on a completely separate partition using this method. Is it possible to copy the actual init2stub in place of e2fsck instead of symlinking it? (in case the symlink doesn't work)
Here's my modified version of your script:
Code:
# Put your `recovery' folder in here, unzipped
SHARED="/media/sf_Shared"
# This is the directory created by the MMC reader
LABEL="/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b"
SYSTEM="${LABEL}/system"
BIN="${LABEL}4/bin"
echo "Copying recovery..."
cp -rf $SHARED/recovery $SYSTEM
echo "Chmodding..."
chmod -R 755 $SYSTEM/recovery
echo "Backup the old e2fsck..."
mv $BIN/e2fsck $BIN/e2fsck.real
echo "Symlink e2fsck to 2ndinitstub..."
# If symlink doesn't work, can I copy 2ndinitstub completely?
ln -sf ../recovery/2ndinitstub $BIN/e2fsck
echo "Done."
Thanks for your help otherwise I'd be so SCREWED! :laugh:
Click to expand...
Click to collapse
That is /data. Not /system. ls -lZ will show you contexts.

rbox said:
That is /data. Not /system. ls -lZ will show you contexts.
Click to expand...
Click to collapse
Well, not sure exactly what happened but I booted it back up and /system/recovery doesn't exist. Even if that's normal behavior, it didn't run TWRP.
The shell script I pasted above, it runs chcon and chmod, but perhaps chcon has no effect since it's being run on a host system (linux), instead of the actual android system (I kinda expected that.)
Code:
[email protected]:/system/bin $ ls -Z e2*
ls -Z e2*
e2fsck: Permission denied
e2fsck.real: Permission denied
Is there an init file I can edit to run chcon or completely disable selinux? Seems like that's probably preventing it. I can't see log files as user, but I feel like that might be part of it.
Thanks

cancelyourcable said:
Well, not sure exactly what happened but I booted it back up and /system/recovery doesn't exist. Even if that's normal behavior, it didn't run TWRP.
The shell script I pasted above, it runs chcon and chmod, but perhaps chcon has no effect since it's being run on a host system (linux), instead of the actual android system (I kinda expected that.)
Code:
[email protected]:/system/bin $ ls -Z e2*
ls -Z e2*
e2fsck: Permission denied
e2fsck.real: Permission denied
Is there an init file I can edit to run chcon or completely disable selinux? Seems like that's probably preventing it. I can't see log files as user, but I feel like that might be part of it.
Thanks
Click to expand...
Click to collapse
Did you properly unmount the filesystem after you were done changing it? That's really the only way the changes wouldn't stick and recovery wouldn't be there. You definitely need to verify all the permissions and contexts manually before booting back in. Don't just assume a script worked. Also, I think chcon isn't going to work, now that I think about it. I remember when I was messing around with this stuff with the Fire TV 2 I wound up having to use extended attributes manually. This page: http://unix.stackexchange.com/quest...on-mounted-ext4-image-from-non-selinux-system explains how to do. As for disabling selinux... that's half the whole point of 2ndinit

rbox said:
Did you properly unmount the filesystem after you were done changing it? That's really the only way the changes wouldn't stick and recovery wouldn't be there. You definitely need to verify all the permissions and contexts manually before booting back in. Don't just assume a script worked. Also, I think chcon isn't going to work, now that I think about it. I remember when I was messing around with this stuff with the Fire TV 2 I wound up having to use extended attributes manually. This page: http://unix.stackexchange.com/quest...on-mounted-ext4-image-from-non-selinux-system explains how to do. As for disabling selinux... that's half the whole point of 2ndinit
Click to expand...
Click to collapse
Ya, definitely unmounted it. I'm like 99% sure it's because of this selinux thing. Ideally if I can get these extended attributes to work and run either `su' or get the recovery to load, that'd be best.
But /system and /recovery are on two separate partitions. When I look at the layout from linux when I mount it using the soldering method, it looks like this:
Code:
# /dev/sdb1 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b3 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb19 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b2 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb2 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b1 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb20 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb18 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
And from the firetv using adb shell, here's all the mounts:
Code:
[email protected]:/ $ mount
mount
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,seclabel,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,seclabel,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,seclabel,relatime 0 0
selinuxfs /sys/fs/selinux selinuxfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
none /sys/fs/cgroup tmpfs rw,seclabel,relatime,mode=750,gid=1000 0 0
tmpfs /mnt/asec tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/platform/msm_sdcc.1/by-name/system /system ext4 ro,seclabel,relatime,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/cache /cache ext4 rw,seclabel,nosuid,nodev,noatime,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/userdata /data ext4 rw,seclabel,nosuid,nodev,noatime,nomblk_io_submit,nobarrier,commit=20,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/modem /firmware vfat ro,context=u:object_r:firmware_file:s0,relatime,uid=1000,gid=1000,fmask=0337,dmask=0227,codepage=cp437,iocharset=iso8859-1,shortname=lower,errors=remount-ro 0 0
/dev/block/loop0 /mnt/sqfs squashfs ro,context=u:object_r:squashfs_file:s0,relatime 0 0
/dev/block/platform/msm_sdcc.1/by-name/persist /persist ext4 rw,context=u:object_r:persist_file:s0,nosuid,nodev,noatime,data=ordered 0 0
/dev/fuse /mnt/shell/emulated fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
/dev/fuse /mnt/shell/emulated/0 fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
It looks very different. Like the /bin that appears in /system on the fire tv is actually on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4, yet /system appears on a completely separate partition /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b it's weird. Copying e2fsck did make it appear there, yet adding /system/recovery did nothing:
Code:
[email protected]:/ $ cd /system/recovery
cd /system/recovery
/system/bin/sh: cd: /system/recovery: No such file or directory
Not sure whether this is the firetv or the emmc reader which is displaying it oddly.
I'll wire it back up tomorrow and see if I can get extended permissions as well as try to figure out why the recovery dir is not showing up at all.
Thanks!

cancelyourcable said:
Ya, definitely unmounted it. I'm like 99% sure it's because of this selinux thing. Ideally if I can get these extended attributes to work and run either `su' or get the recovery to load, that'd be best.
But /system and /recovery are on two separate partitions. When I look at the layout from linux when I mount it using the soldering method, it looks like this:
Code:
# /dev/sdb1 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b3 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb19 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b2 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb2 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b1 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb20 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb18 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
And from the firetv using adb shell, here's all the mounts:
Code:
[email protected]:/ $ mount
mount
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,seclabel,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,seclabel,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,seclabel,relatime 0 0
selinuxfs /sys/fs/selinux selinuxfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
none /sys/fs/cgroup tmpfs rw,seclabel,relatime,mode=750,gid=1000 0 0
tmpfs /mnt/asec tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/platform/msm_sdcc.1/by-name/system /system ext4 ro,seclabel,relatime,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/cache /cache ext4 rw,seclabel,nosuid,nodev,noatime,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/userdata /data ext4 rw,seclabel,nosuid,nodev,noatime,nomblk_io_submit,nobarrier,commit=20,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/modem /firmware vfat ro,context=u:object_r:firmware_file:s0,relatime,uid=1000,gid=1000,fmask=0337,dmask=0227,codepage=cp437,iocharset=iso8859-1,shortname=lower,errors=remount-ro 0 0
/dev/block/loop0 /mnt/sqfs squashfs ro,context=u:object_r:squashfs_file:s0,relatime 0 0
/dev/block/platform/msm_sdcc.1/by-name/persist /persist ext4 rw,context=u:object_r:persist_file:s0,nosuid,nodev,noatime,data=ordered 0 0
/dev/fuse /mnt/shell/emulated fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
/dev/fuse /mnt/shell/emulated/0 fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
It looks very different. Like the /bin that appears in /system on the fire tv is actually on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4, yet /system appears on a completely separate partition /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b it's weird. Copying e2fsck did make it appear there, yet adding /system/recovery did nothing:
Code:
[email protected]:/ $ cd /system/recovery
cd /system/recovery
/system/bin/sh: cd: /system/recovery: No such file or directory
Not sure whether this is the firetv or the emmc reader which is displaying it oddly.
I'll wire it back up tomorrow and see if I can get extended permissions as well as try to figure out why the recovery dir is not showing up at all.
Thanks!
Click to expand...
Click to collapse
You're not looking for a partition with a directory called system in it. The partition IS /system. So the partition with 'bin' and 'xbin' is the /system partition. That other one is /data.

rbox said:
You're not looking for a partition with a directory called system in it. The partition IS /system. So the partition with 'bin' and 'xbin' is the /system partition. That other one is /data.
Click to expand...
Click to collapse
Alright, so I made some big progress
Here's my script which successfully installed your TWRP zip:
Code:
# Put your `recovery' folder in here, unzipped
SHARED="/media/sf_Shared"
# This is the directory created by the MMC reader
LABEL="/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b"
# WARNING: this CHANGED from 4 to 3. Always CHECK FIRST
SYSTEM="${LABEL}3"
if [ ! -e "${SYSTEM}/xbin" ]; then
echo "ERROR: couldn't find /system/xbin - is the mount point correct?"
exit 1
fi
echo "Copying recovery..."
cp -rf $SHARED/recovery $SYSTEM
echo "Backup the old e2fsck..."
cp -i $SYSTEM/bin/e2fsck $SHARED/e2fsck.real
mv -i $SYSTEM/bin/e2fsck $SYSTEM/bin/e2fsck.real
echo "Chmodding and chconing RECOVERY..."
chown -R 0:2000 $SYSTEM/recovery
chmod -R 755 $SYSTEM/recovery
chcon -R --reference=$SYSTEM/bin $SYSTEM/recovery
echo "Copying, chmodding and chconing SU (in case recovery doesn't work out)..."
cp $SHARED/su $SYSTEM/xbin/
chown 0:2000 $SYSTEM/xbin/su
chmod 6755 $SYSTEM/xbin/su
chcon --reference=$SYSTEM/xbin/trapz $SYSTEM/xbin/su
echo "Symlink e2fsck to 2ndinitstub..."
ln -sf ../recovery/2ndinitstub $SYSTEM/bin/e2fsck
echo "Done."
Then I booted into TWRP successfully.
However, when I tried to install your bueller-5.2.1.1-rooted_r1 I got this:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
After a long time it was clearly hung, so I rebooted and now it's bricked. But I did do a `dd if=/dev/sdb123 of=system.img` so i have that.
Would it be possible to just overwrite that partition with your system prerooted image while I have it connected to the emmc reader?
Thanks again for all the help!

cancelyourcable said:
Alright, so I made some big progress
Here's my script which successfully installed your TWRP zip:
Code:
# Put your `recovery' folder in here, unzipped
SHARED="/media/sf_Shared"
# This is the directory created by the MMC reader
LABEL="/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b"
# WARNING: this CHANGED from 4 to 3. Always CHECK FIRST
SYSTEM="${LABEL}3"
if [ ! -e "${SYSTEM}/xbin" ]; then
echo "ERROR: couldn't find /system/xbin - is the mount point correct?"
exit 1
fi
echo "Copying recovery..."
cp -rf $SHARED/recovery $SYSTEM
echo "Backup the old e2fsck..."
cp -i $SYSTEM/bin/e2fsck $SHARED/e2fsck.real
mv -i $SYSTEM/bin/e2fsck $SYSTEM/bin/e2fsck.real
echo "Chmodding and chconing RECOVERY..."
chown -R 0:2000 $SYSTEM/recovery
chmod -R 755 $SYSTEM/recovery
chcon -R --reference=$SYSTEM/bin $SYSTEM/recovery
echo "Copying, chmodding and chconing SU (in case recovery doesn't work out)..."
cp $SHARED/su $SYSTEM/xbin/
chown 0:2000 $SYSTEM/xbin/su
chmod 6755 $SYSTEM/xbin/su
chcon --reference=$SYSTEM/xbin/trapz $SYSTEM/xbin/su
echo "Symlink e2fsck to 2ndinitstub..."
ln -sf ../recovery/2ndinitstub $SYSTEM/bin/e2fsck
echo "Done."
Then I booted into TWRP successfully.
However, when I tried to install your bueller-5.2.1.1-rooted_r1 I got this:
View attachment 3996750
After a long time it was clearly hung, so I rebooted and now it's bricked. But I did do a `dd if=/dev/sdb123 of=system.img` so i have that.
Would it be possible to just overwrite that partition with your system prerooted image while I have it connected to the emmc reader?
Thanks again for all the help!
Click to expand...
Click to collapse
UPDATE...
I flashed my original system.img and brought it back to a working state. After that, I set up recovery again then tried to install bueller-5.2.1.1-rooted_r1.zip. Same as before, it froze, but this time at 80%:
Here's the only "log" I could find:
Code:
[email protected]:/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4/recovery# cat log
Installing new recovery image: failed
So now I have the emmc reader connected again, and I'm *hoping* I can just flash the image in your bueller-5.2.1.1-rooted_r1.zip directly to the mmc using `dd if=system.new.dat of=/dev/sdb19`
But I thought I'd run it by your first before I brick it again :laugh:
Thanks again, @rbox

cancelyourcable said:
UPDATE...
I flashed my original system.img and brought it back to a working state. After that, I set up recovery again then tried to install bueller-5.2.1.1-rooted_r1.zip. Same as before, it froze, but this time at 80%:
View attachment 3997946
Here's the only "log" I could find:
Code:
[email protected]:/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4/recovery# cat log
Installing new recovery image: failed
So now I have the emmc reader connected again, and I'm *hoping* I can just flash the image in your bueller-5.2.1.1-rooted_r1.zip directly to the mmc using `dd if=system.new.dat of=/dev/sdb19`
But I thought I'd run it by your first before I brick it again :laugh:
Thanks again, @rbox
Click to expand...
Click to collapse
The thread for TWRP talks about what to do if it hangs. You can use adb. You'll need to check the log while it's running. /tmp/recovery.log. The image in the rom is sparse, so you'll have to run sdat2img.py on it. And then you'll have to do all the steps listed in the updater-script. The image itself is 100% pure stock.

rbox said:
The thread for TWRP talks about what to do if it hangs. You can use adb. You'll need to check the log while it's running. /tmp/recovery.log. The image in the rom is sparse, so you'll have to run sdat2img.py on it. And then you'll have to do all the steps listed in the updater-script. The image itself is 100% pure stock.
Click to expand...
Click to collapse
I discovered your "updater-script" so I understand the process a lot better now (wish I had found this earlier)
How do I know which image to use for boot: boot.img or boot_unlocked.img? I'm running from a host system so I can't check the value of ro.boot.unlocked_kernel from within linux.
Thanks!
P.S. Almost finished a bash script others can use to flash your image from an emmc reader - I will post a guide on here!

cancelyourcable said:
I discovered your "updater-script" so I understand the process a lot better now (wish I had found this earlier)
How do I know which image to use for boot: boot.img or boot_unlocked.img? I'm running from a host system so I can't check the value of ro.boot.unlocked_kernel from within linux.
Thanks!
P.S. Almost finished a bash script others can use to flash your image from an emmc reader - I will post a guide on here!
Click to expand...
Click to collapse
Since it's running OS5, you have to use the regular boot.img, since your bootloader isn't unlocked.

cancelyourcable said:
P.S. Almost finished a bash script others can use to flash your image from an emmc reader - I will post a guide on here!
Click to expand...
Click to collapse
I would really appreciate this.

zexma said:
I would really appreciate this.
Click to expand...
Click to collapse
It's almost done! Will post very soon

cancelyourcable said:
It's almost done! Will post very soon
Click to expand...
Click to collapse
Don't want to bother, you
Is there any progress to expect, cause I'm stuck at the very same point, SELinux prevents loading su
(/system/xbin//su' failed: Permission denied)
Thanks in advance.

pwntrik said:
It's almost done! Will post very soon
Click to expand...
Click to collapse
Any progress on this?

zexma said:
Any progress on this?
Click to expand...
Click to collapse
Yes, it works 100%. Literally just ordered an overhead camera tripod for recording a video of the whole process. Sit tight -- I promise it's coming soon!

@pwntrik : any tricks to have your Linux (Ubuntu) box recognizing the FireTV in fastboot mode?
I can get it to connect in fastboot with Win7 on the same machine, but in Ubuntu 16.04 I'm not able to.
I did add ATTR{idVendor}== "1949" and ATTR{idProduct}=="0401" to /etc/udev/51-android.rules and rebooted, but no luck...
My FireTV (1st gen, last firmware was 5.0.5, rooted) is currently , after unsuccessful flash of "rooted-5.0.5_r1" ROM in TWRP stuck at this screen:
.
I know it's a longshot to recover it, but I have patience....
Sent from space

kozmo2k4 said:
@pwntrik : any tricks to have your Linux (Ubuntu) box recognizing the FireTV in fastboot mode?
I can get it to connect in fastboot with Win7 on the same machine, but in Ubuntu 16.04 I'm not able to.
I did add ATTR{idVendor}== "1949" and ATTR{idProduct}=="0401" to /etc/udev/51-android.rules and rebooted, but no luck...
My FireTV (1st gen, last firmware was 5.0.5, rooted) is currently , after unsuccessful flash of "rooted-5.0.5_r1" ROM in TWRP stuck at this screen:
.
I know it's a longshot to recover it, but I have patience....
Sent from space
Click to expand...
Click to collapse
I've been using Win10 for that. I only use Linux for writing the images.