Related
EDIT: NEVERMIND EVERYONE, I took the plunge and flashed with odin. Good a time as any to try out froyo JP3 optimism lol
As per title, I had an android noob moment...
I was going to try and copt over the feeds widget with vibrant version (cause it's black from a video i saw), and i figured i could prob copy over apk + odex into system/app and theyd work... but my phone froze and now it wont go past the boot screen...
Is there some way i can delete the system files i copied over from PC (adb?) or update.zip?
Nooooo X_X
Hope someone can help this noob!
EDIT: did some research and downloadiing the sdk now, hope i can fix this T_T. Advice still appreciated!
I had a similar issue trying to get a wildfire app working on my galaxy. I just used adb to push clockworkrecovery and then once booted into clockwork used adb shell and su to remove the files that I shouldn't have installed and it boots fine
how to push clockworkrecovery using adb? ive got adb up and running...
I would so much appreciate some more details on what you did please!
I tried standard adb rm -r, but it says permission denied. no doubt because su is needed...
i have su and root explorer installed before this happened, but how do I use it from recovery or .....?
I'd think you need to get the recovery .zip from Koush's site, rename it update.zip, do adb push update.zip /sdcard . Apply the update.zip in the standard recovery to get to ClockworkMod.
Thanks Mithent, but I've been trying that for the last 10 mins... and it keeps saying "permission denied"
I know my phone isn't bricked.. but i don't wanna have to lose data by reflash etc >_<
Somehow i just need to get permission... and undo my mistakes >_<
desperately want my phone back! lol
Hmm, seems like I can see the two drives in My computer (windows 7). I guess I might be able to mount them via adb? Im trying to find commands to do that now >_<
EDIT: KILL ME! still can't manage mount sd or do anything. please save me XDA!?
EDIT2: I can't even list /sdcard/!!!!
The only thing i've managed to do is "adb shell ls' to list the root directory. anything else just doesnt do anything 0_0
I used a card reader to get update.zip onto my external sd, but i can't even move it to the internal using adb "mv" wtf?
xfile087 seems like you might be my best hope!!! hope you reply again tomorrow :S
Can't mount anything either. the only thing that seems to give me a response is adb shell mount
C:\Users\Nirro\Desktop\sdk\tools>adb shell mount
rootfs / rootfs rw 0 0
tmpfs /dev tmpfs rw,mode=755 0 0
devpts /dev/pts devpts rw,mode=600 0 0
proc /proc proc rw 0 0
sysfs /sys sysfs rw 0 0
nodev /tmp tmpfs rw 0 0
/dev/block/stl6 /mnt/.lfs j4fs rw 0 0
/dev/block/stl3 /efs rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iocharset
=utf8 0 0
/dev/block/stl9 /system rfs rw,vfat,llw,check=no,gid/uid/rwx,iocharset=utf8 0 0
/dev/block/stl11 /cache rfs rw,vfat,llw,check=no,gid/uid/rwx,iocharset=utf8 0 0
C:\Users\Nirro\Desktop\sdk\tools>
I recently got the SGS G3 I5800 and tried uninstall the preinstalled apps. Because i do not trust closed source software on Android for several reasons i tried to remove the preinstalled apps with ConnectBot local. I did root the phone but i do not have the rights to remove or modify any .apk or .odex in /system/app.
If i try chown or chmod to set new user/group rights i just get the output that it is readonly. Is there some kind of special trick to remove those apps or change the rights? I mean, if i am root and the user and the group rights for a package are root:root i would guess that i am able to delete those files, at least that's how it works on linux. I checked the rights also by using the ls -l command, i should be able to.
I rooted the phone with the instructions from here but i did not update busybox, i wanted to build it myself.
Any idea how to uninstall without fancy applications?
Interested in this as well! I haven't tried anything so far but was thinking about just removing the files from system/app. Is that the way it's supposed to be done?
Sent from my Nexus One using XDA App
Ok i found out what the problem was and here is a solution, which i take no responsibility for when somebody f**ks up their phone.
You need the Android-SDK from Google to get adb shell and of course your phone must be rooted.
Your phone must be set to debugging mode which can be enabled by selecting the checkbox USB-debugging under Options->Applications-Development.
So this is how it works:
After installating the sdk, open command promt by pressing the Windows-key + R and typing "cmd". Go to the installation path of the android-sdk by typing:
cd c:\Program Files\Android\android-sdk-windows\platform-tools .
Code:
adb shell
su
Check your phone for popups if you gain root access via remote. There will be a popup-dialog from the superusers app.
Code:
mount
The result should look something like this:
Code:
rootfs / rootfs rw 0 0
tmpfs /dev tmpfs rw,mode=755 0 0
devpts /dev/pts devpts rw,mode=600 0 0
proc /proc proc rw 0 0
sysfs /sys sysfs rw 0 0
tmpfs /sqlite_stmt_journals tmpfs rw,size=4096k 0 0
/dev/block/stl6 /system rfs rw,vfat,llw,check=no,gid/uid/rwx,iocharset=cp437 0 0
/dev/block/stl7 /data rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iocharse
t=cp437 0 0
/dev/block/stl8 /cache rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iochars
et=cp437 0 0
/dev/block/stl4 /efs rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iocharset
=cp437 0 0
/dev/block//vold/179:1 /sdcard vfat rw,dirsync,nosuid,nodev,noexec,uid=1000,gid=
1015,fmask=0702,dmask=0602,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,s
hortname=mixed,utf8,errors=remount-ro 0 0
#
This is a bit complex for none average users. There are a few partitions, which basically means that the storage is split into pieces. Applications are stored in /system/app and /system is a partion itself, you need to look for it.
So my phone tells me it is /dev/block/stl6 but the problem is that it's mounted as read only, so there is no way to write on it without remounting it and that's what we do.
Code:
mount -o remount,rw /dev/block/stl6 /system
Now navigate to the application directory by writing
Code:
cd /systems/app
Now all you got to do is find the application you hate/don't want and delete it, but be carefull, you could screw up the phone.
As an example
Code:
rm Email.apk
If you are done deleting apps, mount the partion as readonly with
Code:
mount -o remount,ro /dev/block/stl6 /system
and to close the root-session type in
Code:
exit
Done
codeInTheShell said:
Code:
mount -o remount,rw /dev/block/stl6 /system
Click to expand...
Click to collapse
It suffices to issue
Code:
mount -o remount,rw /system
and
Code:
mount -o remount,ro /system
afterwards.
So it is not necessary to have a look first at the output of mount and to remember what is mounted where.
Code:
mount -o remount,rw /dev/block/stl6 /system
This is the only way to remount with ConnectBot local and with adb, the other way doesn't work at least it doesn't work local.
Buy and download RootExplorer from market and if you have a rooted phone u can delete preinstalled apps from /system/app.
In RE you must set rw filesystem by tap that option in /system/app folder.
Cheers
Sent from my GT-I5800 using Tapatalk
Dude ... srsly read before you post ...
and if I want to only temporarily remove an app? can I move the app to sd using root explorer and when I want to use it again just move it back to system/app?
Sent from my Nexus One using XDA App
Not sure, i just wanted to find out how to remove apps without an app like root explorer. You could probably move or copy them to your sdcard and if you want them back you could reinstall them ... give it a try, but before that backup your apps
Chrooting Linux on Android is a very popular topic, and you can find many tutorials online. I am not going to post a detailed how to here.. but, I will explain the generalized steps for the process! If anyone have any questions or need help, feel free to ask!
Get Root Access on your phone
There are many ways to get root access; Easiest will be using z4root or SuperOneClick ! Rooting is mandatory because: You need to install Busybox; Need to mount file system, etc..
Install SuperUser App from the Market
This application allows you to grant Root access to other applications (when needed). Depending on how you rooted your phone, superuser.apk may be already installed on your phone.
Install Busybox App from the Market
Depending on how you rooted your phone, Busybox may be already installed on your phone. In any case install this app from the market and update your busybox to the latest version. Busybox is a set of commonly used linux commands, which are not available in android by default. Eg: cp, chroot, etc.
Install Connectbot from Android market
Connect bot is a terminal client application for android. There are other alternatives but, I recommend Connectbot! Also Connectbot has SSH support, so if you are installing an SSH server on your Ubuntu, you can connect to it using connectbot and you may totally skip the VNC for GUI. Anyway, note that you need a terminal app to start the chroot daemon!
Install AndroidVNCViewer from Android market
With androidVNCViewer we can get GUI access to our ubuntu! This App works so fine in my Milestone 2 with Ubuntu; It even supports mouse pointer!
Download/build a Linux rootfs for your flavour of linux
Now, you need the Ubuntu/Debian/Other linux file system for your Phone's processor. Like most of the Android phones, Milestone 2 uses an ARM processor. And Ubuntu offers full support for ARM processors. It is so easy to build ubuntu for ARM(OMAP) platform using rootstock/bootstrap method. I used rootstock method for Ubuntu as explained here.
PS: For your first time, make sure you build, "Ubuntu Lucid" (just use the --seed/-s parameter of rootstock command. I was not able to use 11.04(Natty). Once you get Lucid to work, you can surely try yourself for the other versions! )
Create a mountable .img file with a size suited for you
From rootstock, you will get a .tgz file! You will need to convert this to a mountable .img file.
In order to create an empty ubuntu.img file, use the followed command in your ubuntu-desktop's terminal; the last arguement (2048) specifies size of the Ubuntu rootfs (If you need much disk space when you are in ubuntu, use a large value here. Normally 2GB will be sufficient for you; even with GUI/VNC).
Code:
dd if=/dev/zero of=ubuntu.img bs=1MB count=0 seek=2048
Next, format our empty ubuntu.img with a suitable ext2/ext3/ext4 file system!
For Milestone 2, you should use ext3 (I think it does not support ext2). ext4 is supported only in Gingerbird+. So, you should use the appropriate command based on your mobile
Code:
mkfs.ext2 -F ubuntu.img
mkfs.ext3 -F ubuntu.img
mkfs.ext4 -F ubuntu.img
You can find out the suitable file system by opening Connectbot in your mobile and entering the followed command. In the output, look for words ext2/ext3/ext4!
Code:
su
mount
Once you format ubuntu.img with appropriate file system. We should temporarily mount the ubuntu.img in a somewhere and we should extract the armel-rootfs-xx.tgz to it. You can use these commands
Code:
sudo mount -o loop ubuntu.img /mnt
sudo tar -C /mnt -zxf armel-rootfs--xx.tgz
sudo umount /mnt
Download(and modify) or create a Shell script for automatically mounting your Chroot image
This is the most important part, we have to run a set of commands in our android shell to get into the ubuntu. To make things easier, we will write these command-sequence in a shell script, and whenever we need we simple call this script. Cool isn't it?. Basically this is what this script should do:
Code:
1. Check if there exists an ubuntu.img file as we specify in command line
2. Create a loop device with the ubuntu.img - ie. Make android(linux) believe that ubuntu.img is a mountable device.
3. Mount the newly created loop device to a folder. My script mounts the image to /data/local/chrootos
4. Set some environment variables in the shell
5. Mount the [I]devpts, proc, sysfs[/I] for the ubuntu!
6. Run the Chroot command. This command actually changes the root of file system to a new directory we specify. ie. we fake [B]/data/local/chrootos[/B] as the rootfs![B]/[/B]
Create a folder in your Phone's SD Card and copy one or more(If you want to choose between: Debian/Ubuntu/Puppy/etc) .img files and your shell script for booting linux into it.
Create a folder named .chroot in your SD Card. If you have a "." as the first character, this folder will be hidden in the Android File Browser. And will avoid you accidentally modifying these files.
Get into your Phone's Shell through ConnectBot / USB-ADB / Terminal Emulator
Enter su in the terminal to get root access
Remount your Android filesystem to get write access to your phones
By default, the android file system is read only. So in order to write to the files sytem, we have to remount it with the following command.
Code:
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
Copy your bootscript to /system/bin so that you can easily start your LinuxIf you have downloaded my bootscript, the file name will be bl - short for boot linux. So, once you copied you will have your shell script at /system/bin/bl. Once we copy the shell script to the bin directory, it will work as a shell command.
Start your linux and customize it
If you have done everything correctly so far, you can now boot into your ubuntu.img with the following command. Note that you do not need to specify the full file name "ubuntu.img".
Code:
bl ubuntu
Start your linux and customize it
If Chroot was a success, you will see the ubuntu shell prompt. And then you can start installing more stuff, etc. [email protected]:
Downloads & Screenshots
Screenshots: http://goo.gl/PzVI0
My Shell Script for starting linux: http://goo.gl/il3nJ
My ubuntu.img: Coming SoonPassword
Code:
arunraj.in
Common Errors
The most common error will be when we are dealing with the "loop device". Because, according to the apps installed in your device, there may not be a free loop device available. If you are facing errors, feel free to ask me and I will try and help!
Thanks, man! When I have time I'm gonna try it out.
Sent from my Milestone 2 XDA App
thanks for tutorial. will try this soon
Script didn't work :/
Gongui20 said:
Script didn't work :/
Click to expand...
Click to collapse
Do you get any error message?
Thanks !
It's very interesting.I will try it when I have some free time.
echo "Linux Chrooter: Chroot!"
chroot $mnt /bin/bash
Click to expand...
Click to collapse
/bin/bash didnt exist or something like that.
Gongui20 said:
/bin/bash didnt exist or something like that.
Click to expand...
Click to collapse
I think there was no free loop device available for mounting the image.
could run these commands as root and send me the output(the txt files created)?
Code:
mount > mount-list.txt
losetup -f > losetup1.txt
losetup /dev/block/loop1 /sdcard/.chroot/ubuntu.img > losetup2.txt
losetup1.txt
/dev/loop0
Click to expand...
Click to collapse
mount-list.txt
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/mmcblk1p21 /system ext3 ro,noatime,nodiratime,barrier=1,data=ordered 0 0
/dev/block/userdata /data ext3 rw,nosuid,nodev,noatime,nodiratime,errors=continue,barrier=1,data=ordered 0 0
/dev/block/cache /cache ext3 rw,nosuid,nodev,noatime,nodiratime,errors=continue,barrier=1,data=ordered 0 0
tmpfs /tmp tmpfs rw,relatime,size=2048k 0 0
/dev/block/pds /pds ext3 rw,nosuid,nodev,noatime,nodiratime,barrier=1,data=ordered 0 0
/dev/block/preinstall /preinstall ext3 rw,nosuid,nodev,noatime,nodiratime,barrier=1,data=ordered 0 0
/dev/block/vold/179:1 /mnt/sdcard vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/block/vold/179:1 /mnt/secure/asec vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
tmpfs /mnt/sdcard/.android_secure tmpfs ro,relatime,size=0k,mode=000 0 0
/dev/block/dm-0 /mnt/asec/com.rovio.angrybirdsrio-1 vfat ro,dirsync,nosuid,nodev,noexec,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/block/dm-1 /mnt/asec/com.rovio.angrybirds-1 vfat ro,dirsync,nosuid,nodev,noexec,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/block/dm-2 /mnt/asec/org.xbmc.android.remote-2 vfat ro,dirsync,nosuid,nodev,noexec,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
Click to expand...
Click to collapse
losetup2.txt is empty.
Yeap, I faced the same error when I was doing it. If you notice the mount-list.txt, you can see that AngryBirds application is using /dev/block/dm-0 and /dev/block/dm-1. /dev/block/dm-2 is also in use.
You could try this:
Edit the script bl and replace /dev/block/loop1 in the script with /dev/block/dm-3. It might just do the trick.
Hey check this out:
http://androlinux.com/android-ubuntu-development/how-to-install-ubuntu-on-android/
Works on Asus TF101
Hi
Thanks for the guide. I got it running on my Asus TF101. I had to modify your script slightly :
The /system filesystem is mounted as ext4 (not yaffs)
The /system fs is mounted from /dev/block/mmcblk0p1
/dev/block/mmcblk0p1 /system ext4 rw,relatime,barrier=1,data=ordered 0 0
Click to expand...
Click to collapse
Apart from that no other changes were necessary.
Need Help!!!!
hi ~ I just put the img file in /sdcard/.chroot/.linux/ ,named ubuntu.img and edited the Script
but when I run the script ,there is a problem in line:
mount -t ext3 /dev/block/loop1 $mnt
it said:
Device or resourc busy
I have tried thousand ways and cost 5 days,but I can't solve it.....
can you help me?
sorry for my poor english...
losetup1.txt
/dev/loop0
I also replace /dev/block/loop1 in the script with /dev/block/dm-5,but I need use command :"mknod /dev/block/dm-5 b 7 0" first.
the error Screenshots and mount
echoeye said:
the error Screenshots and mount
Click to expand...
Click to collapse
Hi,
Which is your Mobile ?
Also -- Did you see reply #7, #8 on page 1 of this thread ?
There is another way to mount it without using the option -oloop
If you look into /dev/block you are going to find 8 loop devices, from loop0 to loop7. As android doesn't use that many loop devices it should be enough. You can mount it like this:
Code:
losetup /dev/block/loop7 /sdcard/ubuntu/ubuntu.img
mount -t ext3 /dev/block/loop7 /mnt/ubuntu
If your phone doesn't have a free loop device, you can create a new one, like this:
Code:
mknod /dev/block/loop99 b 7 99
losetup /dev/block/loop99 /sdcard/ubuntu/ubuntu.img
mount -t ext3 /dev/block/loop99 /mnt/ubuntu
The problem is you have apps installed to the sd card (and getting mount points busy), when it happens here I just open Titanium Backup and move External apps to internal.
No matter what I tried here, this script wouldn't work... So I used DebOnDroid app from defy forum, and when updated to GB. The app stopped working also, so I moved the ubuntu.img to /data/local/ and mounted from there, works like a charm!
This is the script I'm using /system/bin/buntu:
Code:
export mnt=/data/local/debian
export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin
export TERM=linux
export HOME=/root
export USER=root
echo "Linux Chrooter: Setup Networking"
sysctl -w net.ipv4.ip_forward=1
#necessary mount points
busybox mount -o loop $mnt/../debian.img $mnt
busybox mount -t devpts devpts $mnt/dev/pts
busybox mount -t sysfs sysfs $mnt/sys
busybox mount -t proc proc $mnt/proc
#extra mount points
busybox mount -o rw /system $mnt/mnt/s
busybox mount /data $mnt/mnt/d
busybox mount /sdcard $mnt/mnt/sd
echo "Linux Chrooter: Chroot!"
chroot $mnt /bin/bash
umount $mnt/sys
umount $mnt/proc
umount $mnt/dev/pts
umount $mnt/mnt/*
#somehow the commented lines didn't work...
#umount $mnt/mnt/d
#umount $mnt/mnt/s
umount $mnt
PS: when I copy a binary from ubuntu to /system/bin and chmod, it won't exec, why?
Sent from my Milestone 2 XDA App
r2beta0 said:
There is another way to mount it without using the option -oloop
If you look into /dev/block you are going to find 8 loop devices, from loop0 to loop7. As android doesn't use that many loop devices it should be enough. You can mount it like this:
Code:
losetup /dev/block/loop7 /sdcard/ubuntu/ubuntu.img
mount -t ext3 /dev/block/loop7 /mnt/ubuntu
If your phone doesn't have a free loop device, you can create a new one, like this:
Code:
mknod /dev/block/loop99 b 7 99
losetup /dev/block/loop99 /sdcard/ubuntu/ubuntu.img
mount -t ext3 /dev/block/loop99 /mnt/ubuntu
Click to expand...
Click to collapse
thank you very very very very very very very very very very very very very very very much!!!!
I made it!!!
oh yeah!~~~~
How is this different from using an app like linuxinstaller? Well, apart from doing it manually and the nerdy way of course?
Is it safer? I am intrigued by the possibility of having a working ubuntu in my pocket, but am wondering if I should go this way or try the app.
great guide though... i think this is the push i needed to finally try this.
Nice job! but i got this..
Nice job!
I got this
#bl ubuntu
bl: permission denied
#
;/
Hey all. I have a 32 GB US TPT that was on 0075. I rooted it using djrbliss's method, and at some point managed to screw up my systemui.apk. I couldn't get it working again, so I attempted a factory reset. For some reason, that left Superuser in my list of apps, and Superuser will say that it has granted apps superuser permission, but whenever I try to do anything that would require root (like delete a system app), it doesn't work.
Also, I've tried to reinstall stock 0075 from a zip, but when I did that it said something about the update check failing on account of missing system apps.
So I'm kind of stuck. How do I fix this? I want to get the tablet fully re-rooted so I can install CWM and that 0075 no bloat nandroid backup.
I would first try to run the root script from djrbliss again.
Without root you are not able to restore the system-apps but they are mandatory for any update.
I forgot to mention that I did try re-running the root script. It gave me error messages saying it was unable to copy any of the stuff like superuser.apk.
Try the following. As you still can do su and promt changes to #.
Copy busybox to your device:
1. adb push busybox /data/local/tmp (busybox is located in djrbliss root script)
2. adb shell
3. su
4. cd /data/local/tmp
5. ls (to see if busybox is there)
6. busybox mount -o rw,remount /system
7. mount (to see if /system is mounted as RW)
Did all that, busybox is there, but I don't see /system at all in the list that comes up after mount. Did you mean sysfs? That one says rw.
PS: sorry for being generally clueless about this stuff. This is my first time doing anything much under the hood with Android.
Edit: another curious issue I just noticed: the tablet connects to my computer just fine via MTP, and shows up under adb devices, but when I select mount the SD card, the tablet immediately reboots. Also, it doesn't show up under adb devices if I don't select either, but that might be normal.
qdmcgraw said:
Did all that, busybox is there, but I don't see /system at all in the list that comes up after mount. Did you mean sysfs? That one says rw.
PS: sorry for being generally clueless about this stuff. This is my first time doing anything much under the hood with Android.
Click to expand...
Click to collapse
Please post output from mount.
It should look like this for system:
/dev/block/mmcblk0p3 /system ext4 rw,relatime,barrier=1,data=ordered 0 0
Exe557 said:
Please post output from mount.
It should look like this for system:
/dev/block/mmcblk0p3 /system ext4 rw,relatime,barrier=1,data=ordered 0 0
Click to expand...
Click to collapse
Oh, yeah, that's there, but it's listed as ro. Everything else the same as what you wrote.
Quiet hard to help without supplying output from shell.
What do you get after typing busybox mount -o rw,remount /system?
Code:
C:\Program Files (x86)\Android\android-sdk\platform-tools>adb devices
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
List of devices attached
43c71c543bf7457 device
C:\Program Files (x86)\Android\android-sdk\platform-tools>adb push busybox /data
/local/tmp
1317 KB/s (1867568 bytes in 1.384s)
C:\Program Files (x86)\Android\android-sdk\platform-tools>adb shell
$ su
su
# cd /data/local/tmp
cd /data/local/tmp
# ls
ls
busybox
# busybox mount -o rw,remount /system
busybox mount -o rw,remount /system
# mount
mount
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/mmcblk0p3 /system ext4 ro,relatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p4 /cache ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered
0 0
/dev/block/mmcblk0p6 /mnt/pia ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordere
d 0 0
/dev/block/mmcblk0p9 /mnt/persdata ext4 rw,nosuid,nodev,noatime,barrier=1,data=o
rdered 0 0
/dev/block/mmcblk0p10 /data ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered
0 0
/dev/fuse /mnt/sdcard fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,d
efault_permissions,allow_other 0 0
/dev/block/loop0 /persdata/absolute ext4 rw,relatime,barrier=1,data=ordered 0 0
/dev/block/vold/179:9 /mnt/external_sd vfat rw,dirsync,nosuid,nodev,noexec,relat
ime,uid=1000,gid=1015,fmask=0002,dmask=0002,allow_utime=0020,codepage=cp437,ioch
arset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
Looks ok and it accept the command without any errors.
Try this please and post output:
busybox mount -o remount,rw /system; mv system/bin/aba system/bin/aba_bak
Have you tried installing Titanium Backup and running it? I remember one time when I ran TB after running the YAREFTP script to get OTA2 rooted. Titanium Backup reported that SuperUser was installed but it's binaries were incorrect (or something to that effect) and offered to fix it for me. Root seemed fine after that.
Might be worth a try. Also, did you re-install superuser and then run it?
Exe557 said:
Looks ok and it accept the command without any errors.
Try this please and post output:
busybox mount -o remount,rw /system; mv system/bin/aba system/bin/aba_bak
Click to expand...
Click to collapse
Code:
C:\Program Files (x86)\Android\android-sdk\platform-tools>adb devices
List of devices attached
43c71c543bf7457 device
C:\Program Files (x86)\Android\android-sdk\platform-tools>adb shell
$ su
su
# cd /data/local/tmp
cd /data/local/tmp
# ls
ls
busybox
# busybox mount -o remount,rw /system; mv system/bin/aba system/bin/aba_bak
busybox mount -o remount,rw /system; mv system/bin/aba system/bin/aba_bak
failed on 'system/bin/aba' - No such file or directory
#
Mhm, so looks like it is not there and it will not prevent your /system to remount as rw.
I'm out of ideas.
pwstein said:
Have you tried installing Titanium Backup and running it? I remember one time when I ran TB after running the YAREFTP script to get OTA2 rooted. Titanium Backup reported that SuperUser was installed but it's binaries were incorrect (or something to that effect) and offered to fix it for me. Root seemed fine after that.
Might be worth a try. Also, did you re-install superuser and then run it?
Click to expand...
Click to collapse
I installed Titanium Backup just now, but it didn't give me any error message like that. I don't know how I'd go about reinstalling Superuser.
Exe557 said:
Mhm, so looks like it is not there and it will not prevent your /system to remount as rw.
I'm out of ideas.
Click to expand...
Click to collapse
Damn, well thanks anyway. I appreciate you helping out.
Damn, I see the error now
As your are in /data/local/tmp mv system/bin/aba system/bin/aba_bak will not work.
So it should be:
busybox mount -o remount,rw /system; mv /system/bin/aba /system/bin/aba_bak
I think that one went through. It just accepted the command with no error message.
If it goes through it should be mounted as rw. Otherwise it is impossible to modify data on /system folder.
Check mount
Exe557 said:
If it goes through it should be mounted as rw. Otherwise it is impossible to modify data on /system folder.
Check mount
Click to expand...
Click to collapse
Yep, it appears to be mounted as rw now
Code:
C:\Program Files (x86)\Android\android-sdk\platform-tools>adb shell
$ su
su
# cd /data/local/tmp
cd /data/local/tmp
# ls
ls
busybox
# busybox mount -o remount,rw /system; mv /system/bin/aba /system/bin/aba_bak
busybox mount -o remount,rw /system; mv /system/bin/aba /system/bin/aba_bak
# mount
mount
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/mmcblk0p3 /system ext4 rw,relatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p4 /cache ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered
0 0
/dev/block/mmcblk0p6 /mnt/pia ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordere
d 0 0
/dev/block/mmcblk0p9 /mnt/persdata ext4 rw,nosuid,nodev,noatime,barrier=1,data=o
rdered 0 0
/dev/block/mmcblk0p10 /data ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered
0 0
/dev/fuse /mnt/sdcard fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,d
efault_permissions,allow_other 0 0
/dev/block/loop0 /persdata/absolute ext4 rw,relatime,barrier=1,data=ordered 0 0
/dev/block/vold/179:9 /mnt/external_sd vfat rw,dirsync,nosuid,nodev,noexec,relat
ime,uid=1000,gid=1015,fmask=0002,dmask=0002,allow_utime=0020,codepage=cp437,ioch
arset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
#
So does that mean everything is working properly?
So far it looks ok. As it is mounted as RW you can install CWM recovery now.
Edit: Keep in mind to use correct CWM image for your TPT. It has to fit region and size.
Some people bricked the tablet while using the wrong image.
Exe557 said:
So far it looks ok. As it is mounted as RW you can install CWM recovery now.
Click to expand...
Click to collapse
I did just now. It worked! Thank you so much!
**UPDATE**
Here is my collection of scripts for rooting, blocking updates, and all kinds of stuff for ALL fire tv:
https://github.com/pwntrik/firetv/
Here's the video (2 parts) on howto root Fire TV 1st gen using soldering:
https://youtu.be/yhwYfudGiM8
https://youtu.be/Kn7zmXf08bk
**/UPDATE**
Greetings, AFTV hackers!
I have successfully soldered an emmc reader to the Fire TV 1st Gen, and I have complete r/w access. However, the tutorial for rooting appears to be a bit dated as the hacker (@maximus64) at the time was able to just copy the su binary to /system/xbin, modify the permissions, and run it.
Since FireOS 5.2.0.0, however, SELinux now prevents the binary from being executed:
(At this point, I have already copied su binary, chmod 6755 it, chown 0:0 it)
Code:
[email protected]:/ $ ls -la /system/xbin/su
ls -la /system/xbin/su
/system/xbin/su: Permission denied
1|[email protected]:/ $ su
su
/system/bin/sh: su: not found
127|[email protected]:/ $ ls -ld /system/xbin
ls -ld /system/xbin
drwxr-xr-x root shell 2017-01-05 01:35 xbin
[email protected]:/ $ ls -l /system/xbin/
ls -l /system/xbin/
-rwxr-xr-x root shell 63880 2016-05-27 17:00 dexdump
-rwxr-xr-x root shell 49816 2016-05-27 17:00 sqlite3
lstat '/system/xbin//su' failed: Permission denied
-rwxr-xr-x root shell 813248 2016-05-27 17:00 tcpdump
-rwxr-xr-x root shell 9384 2016-05-27 17:00 trapz
-rwxr-xr-x root shell 46456 2016-05-27 17:00 vitals_collection_agent
And just to make sure I did everything correctly, I hooked it up again then checked the binary:
Code:
[email protected]:/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b1/xbin# ls -la
total 1092
drwxr-xr-x. 2 root 2000 4096 Jan 5 04:35 .
drwxr-xr-x. 16 root root 4096 Jan 6 17:07 ..
-rwxr-xr-x. 1 root 2000 63880 May 27 2016 dexdump
-rwxr-xr-x. 1 root 2000 49816 May 27 2016 sqlite3
-rwsr-sr-x 1 root root 112576 Jan 5 04:31 su
-rwxr-xr-x. 1 root 2000 813248 May 27 2016 tcpdump
-rwxr-xr-x. 1 root 2000 9384 May 27 2016 trapz
-rwxr-xr-x. 1 root 2000 46456 May 27 2016 vitals_collection_agent
So at this point, I did some research and it seems that SELinux prevents this from being run. Does anyone have a workaround or could tell me how to give this binary permission? I have zero experience with SELinux, and even if anyone can point me to a similar thread for rooting when you have full r/w access, that'd be excellent..
Thanks!
cancelyourcable said:
Greetings, AFTV hackers!
I have successfully soldered an emmc reader to the Fire TV 1st Gen, and I have complete r/w access. However, the tutorial for rooting appears to be a bit dated as the hacker (@maximus64) at the time was able to just copy the su binary to /system/xbin, modify the permissions, and run it.
Since FireOS 5.2.0.0, however, SELinux now prevents the binary from being executed:
(At this point, I have already copied su binary, chmod 6755 it, chown 0:0 it)
Code:
[email protected]:/ $ ls -la /system/xbin/su
ls -la /system/xbin/su
/system/xbin/su: Permission denied
1|[email protected]:/ $ su
su
/system/bin/sh: su: not found
127|[email protected]:/ $ ls -ld /system/xbin
ls -ld /system/xbin
drwxr-xr-x root shell 2017-01-05 01:35 xbin
[email protected]:/ $ ls -l /system/xbin/
ls -l /system/xbin/
-rwxr-xr-x root shell 63880 2016-05-27 17:00 dexdump
-rwxr-xr-x root shell 49816 2016-05-27 17:00 sqlite3
lstat '/system/xbin//su' failed: Permission denied
-rwxr-xr-x root shell 813248 2016-05-27 17:00 tcpdump
-rwxr-xr-x root shell 9384 2016-05-27 17:00 trapz
-rwxr-xr-x root shell 46456 2016-05-27 17:00 vitals_collection_agent
And just to make sure I did everything correctly, I hooked it up again then checked the binary:
Code:
[email protected]:/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b1/xbin# ls -la
total 1092
drwxr-xr-x. 2 root 2000 4096 Jan 5 04:35 .
drwxr-xr-x. 16 root root 4096 Jan 6 17:07 ..
-rwxr-xr-x. 1 root 2000 63880 May 27 2016 dexdump
-rwxr-xr-x. 1 root 2000 49816 May 27 2016 sqlite3
-rwsr-sr-x 1 root root 112576 Jan 5 04:31 su
-rwxr-xr-x. 1 root 2000 813248 May 27 2016 tcpdump
-rwxr-xr-x. 1 root 2000 9384 May 27 2016 trapz
-rwxr-xr-x. 1 root 2000 46456 May 27 2016 vitals_collection_agent
So at this point, I did some research and it seems that SELinux prevents this from being run. Does anyone have a workaround or could tell me how to give this binary permission? I have zero experience with SELinux, and even if anyone can point me to a similar thread for rooting when you have full r/w access, that'd be excellent..
Thanks!
Click to expand...
Click to collapse
bueller_recovery_v2.zip begins with a shell script. If you open it in a text editor, you can see it. mkdir /system/recovery, unzip the contents of that zip to /system/recovery, and do the mv and ln commands. Make sure the selinux contexts of /system/recovery and it's contents match the other contents of /systems.
And also make sure the contents are chmod 755.
rbox said:
bueller_recovery_v2.zip begins with a shell script. If you open it in a text editor, you can see it. mkdir /system/recovery, unzip the contents of that zip to /system/recovery, and do the mv and ln commands. Make sure the selinux contexts of /system/recovery and it's contents match the other contents of /systems.
And also make sure the contents are chmod 755.
Click to expand...
Click to collapse
Thanks, rbox! I've managed to rewrite the script to do all that, but how do I make sure the SELinux contexts match? Sorry, not familiar with SELinux.
Is this the ACTUAL partition table, or is this the way the eMMC reader loads it?
Code:
[email protected]:/media/root# ls 5*
57f8f4bc-abf4-655f-bf67-946fc0f9f25b:
adb backup hostapd property system?
anr bugreports key_provisioning prReset time
app connectivity local radio tombstones
app-asec dalvik-cache logd resource-cache user
app_ext data lost+found securedStorageLocation vitals
app-lib debug_service media securestop webcrypto
app_ms dontpanic mediadrm security wiper
app-private dpm misc shared wpstiles
audio drm playready ssh
autotrace fota proffline system
57f8f4bc-abf4-655f-bf67-946fc0f9f25b1:
data lost+found usf
57f8f4bc-abf4-655f-bf67-946fc0f9f25b2:
com.amazon.avod.apk lost+found
com.amazon.venezia.apk recovery
com.amazon.vizzini-550901810.apk signed_com.amazon.kso.blackbird-1550000810.apk
dalvik-cache signed_CSAppFireTV-fireOs-release_v112.apk
57f8f4bc-abf4-655f-bf67-946fc0f9f25b3:
data lost+found usf
57f8f4bc-abf4-655f-bf67-946fc0f9f25b4:
app etc lib priv-app sqfs vendor
bin fonts lost+found recovery-from-boot.p tts xbin
build.prop framework media security usr
I ask because /system/bin is actually on a completely separate partition using this method. Is it possible to copy the actual init2stub in place of e2fsck instead of symlinking it? (in case the symlink doesn't work)
Here's my modified version of your script:
Code:
# Put your `recovery' folder in here, unzipped
SHARED="/media/sf_Shared"
# This is the directory created by the MMC reader
LABEL="/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b"
SYSTEM="${LABEL}/system"
BIN="${LABEL}4/bin"
echo "Copying recovery..."
cp -rf $SHARED/recovery $SYSTEM
echo "Chmodding..."
chmod -R 755 $SYSTEM/recovery
echo "Backup the old e2fsck..."
mv $BIN/e2fsck $BIN/e2fsck.real
echo "Symlink e2fsck to 2ndinitstub..."
# If symlink doesn't work, can I copy 2ndinitstub completely?
ln -sf ../recovery/2ndinitstub $BIN/e2fsck
echo "Done."
Thanks for your help otherwise I'd be so SCREWED! :laugh:
cancelyourcable said:
Thanks, rbox! I've managed to rewrite the script to do all that, but how do I make sure the SELinux contexts match? Sorry, not familiar with SELinux.
Is this the ACTUAL partition table, or is this the way the eMMC reader loads it?
Code:
[email protected]:/media/root# ls 5*
57f8f4bc-abf4-655f-bf67-946fc0f9f25b:
adb backup hostapd property system?
anr bugreports key_provisioning prReset time
app connectivity local radio tombstones
app-asec dalvik-cache logd resource-cache user
app_ext data lost+found securedStorageLocation vitals
app-lib debug_service media securestop webcrypto
app_ms dontpanic mediadrm security wiper
app-private dpm misc shared wpstiles
audio drm playready ssh
autotrace fota proffline system
57f8f4bc-abf4-655f-bf67-946fc0f9f25b1:
data lost+found usf
57f8f4bc-abf4-655f-bf67-946fc0f9f25b2:
com.amazon.avod.apk lost+found
com.amazon.venezia.apk recovery
com.amazon.vizzini-550901810.apk signed_com.amazon.kso.blackbird-1550000810.apk
dalvik-cache signed_CSAppFireTV-fireOs-release_v112.apk
57f8f4bc-abf4-655f-bf67-946fc0f9f25b3:
data lost+found usf
57f8f4bc-abf4-655f-bf67-946fc0f9f25b4:
app etc lib priv-app sqfs vendor
bin fonts lost+found recovery-from-boot.p tts xbin
build.prop framework media security usr
I ask because /system/bin is actually on a completely separate partition using this method. Is it possible to copy the actual init2stub in place of e2fsck instead of symlinking it? (in case the symlink doesn't work)
Here's my modified version of your script:
Code:
# Put your `recovery' folder in here, unzipped
SHARED="/media/sf_Shared"
# This is the directory created by the MMC reader
LABEL="/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b"
SYSTEM="${LABEL}/system"
BIN="${LABEL}4/bin"
echo "Copying recovery..."
cp -rf $SHARED/recovery $SYSTEM
echo "Chmodding..."
chmod -R 755 $SYSTEM/recovery
echo "Backup the old e2fsck..."
mv $BIN/e2fsck $BIN/e2fsck.real
echo "Symlink e2fsck to 2ndinitstub..."
# If symlink doesn't work, can I copy 2ndinitstub completely?
ln -sf ../recovery/2ndinitstub $BIN/e2fsck
echo "Done."
Thanks for your help otherwise I'd be so SCREWED! :laugh:
Click to expand...
Click to collapse
That is /data. Not /system. ls -lZ will show you contexts.
rbox said:
That is /data. Not /system. ls -lZ will show you contexts.
Click to expand...
Click to collapse
Well, not sure exactly what happened but I booted it back up and /system/recovery doesn't exist. Even if that's normal behavior, it didn't run TWRP.
The shell script I pasted above, it runs chcon and chmod, but perhaps chcon has no effect since it's being run on a host system (linux), instead of the actual android system (I kinda expected that.)
Code:
[email protected]:/system/bin $ ls -Z e2*
ls -Z e2*
e2fsck: Permission denied
e2fsck.real: Permission denied
Is there an init file I can edit to run chcon or completely disable selinux? Seems like that's probably preventing it. I can't see log files as user, but I feel like that might be part of it.
Thanks
cancelyourcable said:
Well, not sure exactly what happened but I booted it back up and /system/recovery doesn't exist. Even if that's normal behavior, it didn't run TWRP.
The shell script I pasted above, it runs chcon and chmod, but perhaps chcon has no effect since it's being run on a host system (linux), instead of the actual android system (I kinda expected that.)
Code:
[email protected]:/system/bin $ ls -Z e2*
ls -Z e2*
e2fsck: Permission denied
e2fsck.real: Permission denied
Is there an init file I can edit to run chcon or completely disable selinux? Seems like that's probably preventing it. I can't see log files as user, but I feel like that might be part of it.
Thanks
Click to expand...
Click to collapse
Did you properly unmount the filesystem after you were done changing it? That's really the only way the changes wouldn't stick and recovery wouldn't be there. You definitely need to verify all the permissions and contexts manually before booting back in. Don't just assume a script worked. Also, I think chcon isn't going to work, now that I think about it. I remember when I was messing around with this stuff with the Fire TV 2 I wound up having to use extended attributes manually. This page: http://unix.stackexchange.com/quest...on-mounted-ext4-image-from-non-selinux-system explains how to do. As for disabling selinux... that's half the whole point of 2ndinit
rbox said:
Did you properly unmount the filesystem after you were done changing it? That's really the only way the changes wouldn't stick and recovery wouldn't be there. You definitely need to verify all the permissions and contexts manually before booting back in. Don't just assume a script worked. Also, I think chcon isn't going to work, now that I think about it. I remember when I was messing around with this stuff with the Fire TV 2 I wound up having to use extended attributes manually. This page: http://unix.stackexchange.com/quest...on-mounted-ext4-image-from-non-selinux-system explains how to do. As for disabling selinux... that's half the whole point of 2ndinit
Click to expand...
Click to collapse
Ya, definitely unmounted it. I'm like 99% sure it's because of this selinux thing. Ideally if I can get these extended attributes to work and run either `su' or get the recovery to load, that'd be best.
But /system and /recovery are on two separate partitions. When I look at the layout from linux when I mount it using the soldering method, it looks like this:
Code:
# /dev/sdb1 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b3 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb19 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b2 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb2 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b1 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb20 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb18 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
And from the firetv using adb shell, here's all the mounts:
Code:
[email protected]:/ $ mount
mount
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,seclabel,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,seclabel,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,seclabel,relatime 0 0
selinuxfs /sys/fs/selinux selinuxfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
none /sys/fs/cgroup tmpfs rw,seclabel,relatime,mode=750,gid=1000 0 0
tmpfs /mnt/asec tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/platform/msm_sdcc.1/by-name/system /system ext4 ro,seclabel,relatime,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/cache /cache ext4 rw,seclabel,nosuid,nodev,noatime,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/userdata /data ext4 rw,seclabel,nosuid,nodev,noatime,nomblk_io_submit,nobarrier,commit=20,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/modem /firmware vfat ro,context=u:object_r:firmware_file:s0,relatime,uid=1000,gid=1000,fmask=0337,dmask=0227,codepage=cp437,iocharset=iso8859-1,shortname=lower,errors=remount-ro 0 0
/dev/block/loop0 /mnt/sqfs squashfs ro,context=u:object_r:squashfs_file:s0,relatime 0 0
/dev/block/platform/msm_sdcc.1/by-name/persist /persist ext4 rw,context=u:object_r:persist_file:s0,nosuid,nodev,noatime,data=ordered 0 0
/dev/fuse /mnt/shell/emulated fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
/dev/fuse /mnt/shell/emulated/0 fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
It looks very different. Like the /bin that appears in /system on the fire tv is actually on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4, yet /system appears on a completely separate partition /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b it's weird. Copying e2fsck did make it appear there, yet adding /system/recovery did nothing:
Code:
[email protected]:/ $ cd /system/recovery
cd /system/recovery
/system/bin/sh: cd: /system/recovery: No such file or directory
Not sure whether this is the firetv or the emmc reader which is displaying it oddly.
I'll wire it back up tomorrow and see if I can get extended permissions as well as try to figure out why the recovery dir is not showing up at all.
Thanks!
cancelyourcable said:
Ya, definitely unmounted it. I'm like 99% sure it's because of this selinux thing. Ideally if I can get these extended attributes to work and run either `su' or get the recovery to load, that'd be best.
But /system and /recovery are on two separate partitions. When I look at the layout from linux when I mount it using the soldering method, it looks like this:
Code:
# /dev/sdb1 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b3 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb19 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b2 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb2 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b1 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb20 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb18 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
And from the firetv using adb shell, here's all the mounts:
Code:
[email protected]:/ $ mount
mount
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,seclabel,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,seclabel,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,seclabel,relatime 0 0
selinuxfs /sys/fs/selinux selinuxfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
none /sys/fs/cgroup tmpfs rw,seclabel,relatime,mode=750,gid=1000 0 0
tmpfs /mnt/asec tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/platform/msm_sdcc.1/by-name/system /system ext4 ro,seclabel,relatime,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/cache /cache ext4 rw,seclabel,nosuid,nodev,noatime,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/userdata /data ext4 rw,seclabel,nosuid,nodev,noatime,nomblk_io_submit,nobarrier,commit=20,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/modem /firmware vfat ro,context=u:object_r:firmware_file:s0,relatime,uid=1000,gid=1000,fmask=0337,dmask=0227,codepage=cp437,iocharset=iso8859-1,shortname=lower,errors=remount-ro 0 0
/dev/block/loop0 /mnt/sqfs squashfs ro,context=u:object_r:squashfs_file:s0,relatime 0 0
/dev/block/platform/msm_sdcc.1/by-name/persist /persist ext4 rw,context=u:object_r:persist_file:s0,nosuid,nodev,noatime,data=ordered 0 0
/dev/fuse /mnt/shell/emulated fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
/dev/fuse /mnt/shell/emulated/0 fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
It looks very different. Like the /bin that appears in /system on the fire tv is actually on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4, yet /system appears on a completely separate partition /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b it's weird. Copying e2fsck did make it appear there, yet adding /system/recovery did nothing:
Code:
[email protected]:/ $ cd /system/recovery
cd /system/recovery
/system/bin/sh: cd: /system/recovery: No such file or directory
Not sure whether this is the firetv or the emmc reader which is displaying it oddly.
I'll wire it back up tomorrow and see if I can get extended permissions as well as try to figure out why the recovery dir is not showing up at all.
Thanks!
Click to expand...
Click to collapse
You're not looking for a partition with a directory called system in it. The partition IS /system. So the partition with 'bin' and 'xbin' is the /system partition. That other one is /data.
rbox said:
You're not looking for a partition with a directory called system in it. The partition IS /system. So the partition with 'bin' and 'xbin' is the /system partition. That other one is /data.
Click to expand...
Click to collapse
Alright, so I made some big progress
Here's my script which successfully installed your TWRP zip:
Code:
# Put your `recovery' folder in here, unzipped
SHARED="/media/sf_Shared"
# This is the directory created by the MMC reader
LABEL="/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b"
# WARNING: this CHANGED from 4 to 3. Always CHECK FIRST
SYSTEM="${LABEL}3"
if [ ! -e "${SYSTEM}/xbin" ]; then
echo "ERROR: couldn't find /system/xbin - is the mount point correct?"
exit 1
fi
echo "Copying recovery..."
cp -rf $SHARED/recovery $SYSTEM
echo "Backup the old e2fsck..."
cp -i $SYSTEM/bin/e2fsck $SHARED/e2fsck.real
mv -i $SYSTEM/bin/e2fsck $SYSTEM/bin/e2fsck.real
echo "Chmodding and chconing RECOVERY..."
chown -R 0:2000 $SYSTEM/recovery
chmod -R 755 $SYSTEM/recovery
chcon -R --reference=$SYSTEM/bin $SYSTEM/recovery
echo "Copying, chmodding and chconing SU (in case recovery doesn't work out)..."
cp $SHARED/su $SYSTEM/xbin/
chown 0:2000 $SYSTEM/xbin/su
chmod 6755 $SYSTEM/xbin/su
chcon --reference=$SYSTEM/xbin/trapz $SYSTEM/xbin/su
echo "Symlink e2fsck to 2ndinitstub..."
ln -sf ../recovery/2ndinitstub $SYSTEM/bin/e2fsck
echo "Done."
Then I booted into TWRP successfully.
However, when I tried to install your bueller-5.2.1.1-rooted_r1 I got this:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
After a long time it was clearly hung, so I rebooted and now it's bricked. But I did do a `dd if=/dev/sdb123 of=system.img` so i have that.
Would it be possible to just overwrite that partition with your system prerooted image while I have it connected to the emmc reader?
Thanks again for all the help!
cancelyourcable said:
Alright, so I made some big progress
Here's my script which successfully installed your TWRP zip:
Code:
# Put your `recovery' folder in here, unzipped
SHARED="/media/sf_Shared"
# This is the directory created by the MMC reader
LABEL="/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b"
# WARNING: this CHANGED from 4 to 3. Always CHECK FIRST
SYSTEM="${LABEL}3"
if [ ! -e "${SYSTEM}/xbin" ]; then
echo "ERROR: couldn't find /system/xbin - is the mount point correct?"
exit 1
fi
echo "Copying recovery..."
cp -rf $SHARED/recovery $SYSTEM
echo "Backup the old e2fsck..."
cp -i $SYSTEM/bin/e2fsck $SHARED/e2fsck.real
mv -i $SYSTEM/bin/e2fsck $SYSTEM/bin/e2fsck.real
echo "Chmodding and chconing RECOVERY..."
chown -R 0:2000 $SYSTEM/recovery
chmod -R 755 $SYSTEM/recovery
chcon -R --reference=$SYSTEM/bin $SYSTEM/recovery
echo "Copying, chmodding and chconing SU (in case recovery doesn't work out)..."
cp $SHARED/su $SYSTEM/xbin/
chown 0:2000 $SYSTEM/xbin/su
chmod 6755 $SYSTEM/xbin/su
chcon --reference=$SYSTEM/xbin/trapz $SYSTEM/xbin/su
echo "Symlink e2fsck to 2ndinitstub..."
ln -sf ../recovery/2ndinitstub $SYSTEM/bin/e2fsck
echo "Done."
Then I booted into TWRP successfully.
However, when I tried to install your bueller-5.2.1.1-rooted_r1 I got this:
View attachment 3996750
After a long time it was clearly hung, so I rebooted and now it's bricked. But I did do a `dd if=/dev/sdb123 of=system.img` so i have that.
Would it be possible to just overwrite that partition with your system prerooted image while I have it connected to the emmc reader?
Thanks again for all the help!
Click to expand...
Click to collapse
UPDATE...
I flashed my original system.img and brought it back to a working state. After that, I set up recovery again then tried to install bueller-5.2.1.1-rooted_r1.zip. Same as before, it froze, but this time at 80%:
Here's the only "log" I could find:
Code:
[email protected]:/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4/recovery# cat log
Installing new recovery image: failed
So now I have the emmc reader connected again, and I'm *hoping* I can just flash the image in your bueller-5.2.1.1-rooted_r1.zip directly to the mmc using `dd if=system.new.dat of=/dev/sdb19`
But I thought I'd run it by your first before I brick it again :laugh:
Thanks again, @rbox
cancelyourcable said:
UPDATE...
I flashed my original system.img and brought it back to a working state. After that, I set up recovery again then tried to install bueller-5.2.1.1-rooted_r1.zip. Same as before, it froze, but this time at 80%:
View attachment 3997946
Here's the only "log" I could find:
Code:
[email protected]:/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4/recovery# cat log
Installing new recovery image: failed
So now I have the emmc reader connected again, and I'm *hoping* I can just flash the image in your bueller-5.2.1.1-rooted_r1.zip directly to the mmc using `dd if=system.new.dat of=/dev/sdb19`
But I thought I'd run it by your first before I brick it again :laugh:
Thanks again, @rbox
Click to expand...
Click to collapse
The thread for TWRP talks about what to do if it hangs. You can use adb. You'll need to check the log while it's running. /tmp/recovery.log. The image in the rom is sparse, so you'll have to run sdat2img.py on it. And then you'll have to do all the steps listed in the updater-script. The image itself is 100% pure stock.
rbox said:
The thread for TWRP talks about what to do if it hangs. You can use adb. You'll need to check the log while it's running. /tmp/recovery.log. The image in the rom is sparse, so you'll have to run sdat2img.py on it. And then you'll have to do all the steps listed in the updater-script. The image itself is 100% pure stock.
Click to expand...
Click to collapse
I discovered your "updater-script" so I understand the process a lot better now (wish I had found this earlier)
How do I know which image to use for boot: boot.img or boot_unlocked.img? I'm running from a host system so I can't check the value of ro.boot.unlocked_kernel from within linux.
Thanks!
P.S. Almost finished a bash script others can use to flash your image from an emmc reader - I will post a guide on here!
cancelyourcable said:
I discovered your "updater-script" so I understand the process a lot better now (wish I had found this earlier)
How do I know which image to use for boot: boot.img or boot_unlocked.img? I'm running from a host system so I can't check the value of ro.boot.unlocked_kernel from within linux.
Thanks!
P.S. Almost finished a bash script others can use to flash your image from an emmc reader - I will post a guide on here!
Click to expand...
Click to collapse
Since it's running OS5, you have to use the regular boot.img, since your bootloader isn't unlocked.
cancelyourcable said:
P.S. Almost finished a bash script others can use to flash your image from an emmc reader - I will post a guide on here!
Click to expand...
Click to collapse
I would really appreciate this.
zexma said:
I would really appreciate this.
Click to expand...
Click to collapse
It's almost done! Will post very soon
cancelyourcable said:
It's almost done! Will post very soon
Click to expand...
Click to collapse
Don't want to bother, you
Is there any progress to expect, cause I'm stuck at the very same point, SELinux prevents loading su
(/system/xbin//su' failed: Permission denied)
Thanks in advance.
pwntrik said:
It's almost done! Will post very soon
Click to expand...
Click to collapse
Any progress on this?
zexma said:
Any progress on this?
Click to expand...
Click to collapse
Yes, it works 100%. Literally just ordered an overhead camera tripod for recording a video of the whole process. Sit tight -- I promise it's coming soon!
@pwntrik : any tricks to have your Linux (Ubuntu) box recognizing the FireTV in fastboot mode?
I can get it to connect in fastboot with Win7 on the same machine, but in Ubuntu 16.04 I'm not able to.
I did add ATTR{idVendor}== "1949" and ATTR{idProduct}=="0401" to /etc/udev/51-android.rules and rebooted, but no luck...
My FireTV (1st gen, last firmware was 5.0.5, rooted) is currently , after unsuccessful flash of "rooted-5.0.5_r1" ROM in TWRP stuck at this screen:
.
I know it's a longshot to recover it, but I have patience....
Sent from space
kozmo2k4 said:
@pwntrik : any tricks to have your Linux (Ubuntu) box recognizing the FireTV in fastboot mode?
I can get it to connect in fastboot with Win7 on the same machine, but in Ubuntu 16.04 I'm not able to.
I did add ATTR{idVendor}== "1949" and ATTR{idProduct}=="0401" to /etc/udev/51-android.rules and rebooted, but no luck...
My FireTV (1st gen, last firmware was 5.0.5, rooted) is currently , after unsuccessful flash of "rooted-5.0.5_r1" ROM in TWRP stuck at this screen:
.
I know it's a longshot to recover it, but I have patience....
Sent from space
Click to expand...
Click to collapse
I've been using Win10 for that. I only use Linux for writing the images.