Database Users

Unpack stock System.img?

Hello Moto
I've just downloaded Verizon Jelly Bean 4.1.1 by "Firmware Team".
Just to play with it a little, extract apks and test them on Galaxy SII Skyrocket.
The thing is i'm having a hard time opening system.img.
Now i've tried LinuxReader, Unyaffs and ext2explore/read but none of these can open it, they all say that it's an unrecognized image.
Do you guys know how to properly open a stock moto System.img?

lingowistico said:
Hello Moto
I've just downloaded Verizon Jelly Bean 4.1.1 by "Firmware Team".
Just to play with it a little, extract apks and test them on Galaxy SII Skyrocket.
The thing is i'm having a hard time opening system.img.
Now i've tried LinuxReader, Unyaffs and ext2explore/read but none of these can open it, they all say that it's an unrecognized image.
Do you guys know how to properly open a stock moto System.img?
Click to expand...
Click to collapse
Google for a tool called simg2img (I used the python script that appears in get first few results, there should be other versions as well). That will unpack the image into a plain ext4 image that you can mount with any Linux pc (I recommend using a virtual machine if you have windows or mac).
Happy hacking!
Sent from my XT907

aslomagic, did you try this with the firmware lingowistico is talking about? I also tried before to unpack system.img from this package, and system.img.ext4 from ICS package, and another ICS soft for XT897, and all of them give "Bad magic" error in simg2img. All of those softs are published by the same "Firmware Team" - maybe that's the case? I also tried dsixda kitchen (which also uses simg2img, but anyway...) and it also didn't work. Might be also some custom Motorola's approach to system.img....
Could you possibly help? Thanks.

micx_pl said:
aslomagic, did you try this with the firmware lingowistico is talking about? I also tried before to unpack system.img from this package, and system.img.ext4 from ICS package, and another ICS soft for XT897, and all of them give "Bad magic" error in simg2img. All of those softs are published by the same "Firmware Team" - maybe that's the case? I also tried dsixda kitchen (which also uses simg2img, but anyway...) and it also didn't work. Might be also some custom Motorola's approach to system.img....
Could you possibly help? Thanks.
Click to expand...
Click to collapse
Well, I know for a fact that those images are packed ext4, but I haven't tried specifically with that one.
Now that you mention, I think I remember signed images (like those ones) have some additional header, maybe that needs to be removed with an hex editor, or with dd of you like
If I get a chance, I'll try and report back...
Sent from my XT907

aslomagic said:
Well, I know for a fact that those images are packed ext4, but I haven't tried specifically with that one.
Now that you mention, I think I remember signed images (like those ones) have some additional header, maybe that needs to be removed with an hex editor, or with dd of you like
If I get a chance, I'll try and report back...
Click to expand...
Click to collapse
Ok, I tried, and yes, it complains it cannot find the magic (again, I'm using the python script). I modified the script to look for the magic value in the first 50Mb of the file, and if it finds it, it starts unpacking from there. Python scripts are very easy to play with
It seems to work for me, but I don't have a linux vm handy to see if it mounts correctly (I'm currently on a mac). micx_pl, can you give it a try and let me know?
I had to zip the file even though it's very small because the forum won't let me upload a .py file... who knows, just unzip it.

Holy cow! It works! You're the master I was looking for such solution everywhere, and was stunned to see barely few topics with similar problem, and no solution at all. Thanks!

micx_pl said:
Holy cow! It works! You're the master I was looking for such solution everywhere, and was stunned to see barely few topics with similar problem, and no solution at all. Thanks!
Click to expand...
Click to collapse
You're welcome, glad I could help!
Sent from my XT907

aslomagic said:
Ok, I tried, and yes, it complains it cannot find the magic (again, I'm using the python script). I modified the script to look for the magic value in the first 50Mb of the file, and if it finds it, it starts unpacking from there. Python scripts are very easy to play with
It seems to work for me, but I don't have a linux vm handy to see if it mounts correctly (I'm currently on a mac). micx_pl, can you give it a try and let me know?
I had to zip the file even though it's very small because the forum won't let me upload a .py file... who knows, just unzip it.
Click to expand...
Click to collapse
HOLY $#!+ THANKS!!! I've been trying to decompress the moto images for awhile and have never been able to do it until now

Would it be possible to modify make_ext4fs to re-sparse the image and copy the original signature?

Q9Nap said:
Would it be possible to modify make_ext4fs to re-sparse the image and copy the original signature?
Click to expand...
Click to collapse
You're welcome to try ... my guess is that it could be made to work if the image was an official, originally signed image that was unpacked by the script above or equivalent, but if you want to modify it, re-pack it and re-attach the signature, most likely the signature won't match the content. But I may be wrong, so if somebody is willing to try, best of luck to you
If your goal is just to create a packed image, but not necessarily signed (needs bootloader unlock), then I'd say it's definitely possible, search around here.

aslomagic said:
You're welcome to try ... my guess is that it could be made to work if the image was an official, originally signed image that was unpacked by the script above or equivalent, but if you want to modify it, re-pack it and re-attach the signature, most likely the signature won't match the content. But I may be wrong, so if somebody is willing to try, best of luck to you
If your goal is just to create a packed image, but not necessarily signed (needs bootloader unlock), then I'd say it's definitely possible, search around here.
Click to expand...
Click to collapse
i'm sure you're right about the signature not working on a modified image; it was just wishful thinking. the idea of course would be to inject superuser.apk and su, which wouldn't be necessary on a bootloader unlocked device.
for bootloader unlocked devices though, the ability to repack a modified image does give you another way to build custom roms. here's the code to unpack and repack images with simg2img.py and make_ext4fs:
Code:
mkdir system
./simg2img.py system.img.ext4 system.raw
sudo mount -t ext4 -o loop system.raw system/
#make changes, then:
wc -c system.raw #lists size in bytes of system.raw
sudo make_ext4fs -s -l 1234567890 -a system system.img system/ #where 1234567890 is output from wc -c
sudo umount system
rm -rf system
i've used this proecess with samsung system images, should work for moto images now too (bootloader unlocked, of course)

Yep, it's a good cheat sheet reference
Besides, on razr m and hd at least, you can also use this with safestrap without unlocking the bootloader.

aslomagic said:
Besides, on razr m and hd at least, you can also use this with safestrap without unlocking the bootloader.
Click to expand...
Click to collapse
Not sure what you mean by this; do you mean you could mount a modified system.img with safestrap? I guess it's possible since safestrap uses a system.img on the emmc, interesting idea

Q9Nap said:
Not sure what you mean by this; do you mean you could mount a modified system.img with safestrap? I guess it's possible since safestrap uses a system.img on the emmc, interesting idea
Click to expand...
Click to collapse
Yes, that's what I mean, more or less. You don't need safestrap to just mount it (use the terminal and "mount"), but you can use it to boot from it and try it.
I did this to try the Telstra image that pjcons dumped, which is pre-rooted and not signed (there it's no official signed image to date), and with a few tricks it worked without me having to unlock the bootloader.
Sent from my XT907

aslomagic said:
Google for a tool called simg2img (I used the python script that appears in get first few results, there should be other versions as well). That will unpack the image into a plain ext4 image that you can mount with any Linux pc (I recommend using a virtual machine if you have windows or mac).
Happy hacking!
Sent from my XT907
Click to expand...
Click to collapse
hello, i cant find anything on the basics of how this works, could you point me somewhere that explains it step by step or do one here. sorry of the noob question

TheWhiteChallenger said:
hello, i cant find anything on the basics of how this works, could you point me somewhere that explains it step by step or do one here. sorry of the noob question
Click to expand...
Click to collapse
http://forum.xda-developers.com/showthread.php?t=1588461

CNexus said:
http://forum.xda-developers.com/showthread.php?t=1588461
Click to expand...
Click to collapse
Thanks for the link I need to go learn Linux now. Lol I dontbgt the virtual machine thing at all. Its basically a Linux emulator right?
Sent from my XT1080 using XDA Premium 4 mobile app

TheWhiteChallenger said:
Thanks for the link I need to go learn Linux now. Lol I dontbgt the virtual machine thing at all. Its basically a Linux emulator right?
Sent from my XT1080 using XDA Premium 4 mobile app
Click to expand...
Click to collapse
No need to
http://sourceforge.net/projects/androidicsjbext/

CNexus said:
No need to
http://sourceforge.net/projects/androidicsjbext/
Click to expand...
Click to collapse
oh damn it. ok first i do appreciate the help. but that sucked. that was the frist program i tryed and it gives me "unknown file format" have i just been screwing up from the begining?

{TUTORIAL} Bodhi Linux on a500

EDIT:
Now you can follow the same process into rogro82's kernel, thanks to Forzaferrarileo. Note that you can just flash the kernel, if you already put it to work with sp3dev's kernel. There's no need to repeat all process.
I've, also, changed some structures for better visualization.
This tutorial is using the sp3dev's precompiled kernel from here or rogro82's precompiled kernel from here. If you want to use rogro82's from scratch or from internal storage, please look, also, some instructions at here. Please note that you will have to build that kernel from sources before proceed. You should be able to use internal storage also, with some changes into this tutorial.
I used a phisical usb keyboard into this tutorial, but bodhi offers an onscreen keyboard into tablet profile. To change into this profile, look at here.
It's partially based into this tutorial. I'll refer to number of steps on that, so please open it. Please read everything before doing anything, and make sure you have no doubts about the process before doing anything. I'm not responsable if it damages your tablet!
First of all, download the Bodhi rootfs from here.
Then, run the first 3 steps from the tutorial above. Please note that if you'll run the rogro82's kernel, the step 2 should be flashing that kernel. For infos about how to flash the second kernel image, please read this thread's first post.
After, extract the Bodhi rootfs into the ext4 partition from your sdcard (I needed to be logged as root or use sudo for doing this step). Make sure to extract directly into the root of the partition (the result of a ls into the root of the partition should be just like running ls /).
Now, you need to donwload the zip file from step 6 from the tutorial. Note that it's not needed to install the packages asked by the step 6, just extract the donwloaded files and copy them into your sdcard's /lib/firmware folder. I just copied the brcm folder into /lib/firmware/brcm and it worked.
Now you are able to boot into the image. Put sdcard into the tablet and then boot from second kernel (hold VOL UP while powering on until it shows bootmenu and select boot into second kernel).
After complete booting, you should have the E17 home screen. For tutorials about this interface, please look into Bodhi website.
For being able to connect into wifi, I needed to open terminology (terminal application into bodhi) and run, as root, the following. Please note that it may not be necessary, but recommended:
- rfkill unblock all
- ifconfig
Now please see what number your wifi got loaded, for me, it was wlan2. I'll call it wlanx, so just change x for the number you got.
- ifconfig wlanx up
To make sure it worked, run "iwlist wlanx scan". It should bring some network details into terminology.
Now open wicd, open preferences and make sure the wifi network is correctly set into wlanx. The default value is wlan0. Then, close preferences and click into reload. Now you should be able to select your network, set up the network preferences and then connect into it.
Now you should be able to install everything you want. As I read, bodhi uses a debian base for armhf version, so you can install anything you can install from debian. Chromium web browser is broken, and firefox is named iceweasel. The default midori web browser works fine, but I personally prefer iceweasel.
Thanks:
sp3dev, rogro82, Kevin Roscom, Forzaferrarileo (if I forgot someone, please tell me, I'll put your name here!)

i'd love to try this! does this run fairly well?:good:

For me it does. I have a class 10 sdcard.

guimendes said:
For me it does. I have a class 10 sdcard.
Click to expand...
Click to collapse
root password?

Tautvaldas said:
root password?
Click to expand...
Click to collapse
Please take a look at here: http://jeffhoogland.blogspot.nl/2012/12/bodhi-linux-armhf-rootfs.html
You can use sudo bash to root access. The password is bodhilinux. Then you can set root password.

Hey this is my first time installing linux on a tablet. Ive got the partitioned sd card, rootfs, kernel ready to go. just not famaliar with how to flash the kernel. Could you maybe give me an idea of those steps? For a first timer as far as android is concerned, the instructions can be a little vague. Thanks

adrock74 said:
Hey this is my first time installing linux on a tablet. Ive got the partitioned sd card, rootfs, kernel ready to go. just not famaliar with how to flash the kernel. Could you maybe give me an idea of those steps? For a first timer as far as android is concerned, the instructions can be a little vague. Thanks
Click to expand...
Click to collapse
Please, first, make sure you're using this bootloader for dualboot. Into the thread there are all instructions for flashing the kernel into secboot, on dualboot section, into first post.

Ive been on v8 unlbootloader for awhile. Just never flashed a sec kernel before.

adrock74 said:
Ive been on v8 unlbootloader for awhile. Just never flashed a sec kernel before.
Click to expand...
Click to collapse
download the fastboot package ( from xda , or search on google ) , next connect the tablet with usb to the pc , reboot the tablet with the bootloader menu and select fastboot ...... the pc will install drivers , when it finish , go in the fastboot folder click SHIFT + right click and select "open command window here " and type this :
fastboot flash secboot <nameofkernel> ex : fastboot flash secboot boot.img

Forzaferrarileo said:
download the fastboot package ( from xda , or search on google ) , next connect the tablet with usb to the pc , reboot the tablet with the bootloader menu and select fastboot ...... the pc will install drivers , when it finish , go in the fastboot folder click SHIFT + right click and select "open command window here " and type this :
fastboot flash secboot <nameofkernel> ex : fastboot flash secboot boot.img
Click to expand...
Click to collapse
Thanks for the reply! Ive flashed this tablet seven ways to sunday within android, but this is kinda new to me. Recently installed 12.04 on my desktop as my intro to linux without a hiccup. I cant seem to get the tablet to respond to my computer. Have the sd card setup ready to go, terminal only says file does not exist ( in regards to secboot) should sd be in tablet or usb? Ive been at it all day. Should i rename anything? Thanks again.
---------- Post added at 04:43 PM ---------- Previous post was at 04:35 PM ----------
I Simply cant seem to get the kernel flashed. Once i get past that, i believe its smooth sailing..

adrock74 said:
Thanks for the reply! Ive flashed this tablet seven ways to sunday within android, but this is kinda new to me. Recently installed 12.04 on my desktop as my intro to linux without a hiccup. I cant seem to get the tablet to respond to my computer. Have the sd card setup ready to go, terminal only says file does not exist ( in regards to secboot) should sd be in tablet or usb? Ive been at it all day. Should i rename anything? Thanks again.
---------- Post added at 04:43 PM ---------- Previous post was at 04:35 PM ----------
I Simply cant seem to get the kernel flashed. Once i get past that, i believe its smooth sailing..
Click to expand...
Click to collapse
Please look if fastboot recognized your tablet. Run fastboot devices. If there's an answer, then your tablet was recognized. It can be missing drivers. From acer site it's possible to find the correct drivers.

ok. so not having the acer drivers seems to be my issue. But, Im trying to do this using my pc running ubuntu, and I'm not sure how to get the acer drivers installed on it. I'm sure there is a trick, but the downloads are for windows. And also the downloads are for honeycomb and ics and im running 4.2.2.

Well I cannot help you installing drivers into ubuntu, I made it into Windows.

on android terminal emulator:
cat /proc/mounts
make sure that data is on /dev/block/mmcblk0p8 not p7
if so then:
dd if=your_second_boot.img of=/dev/block/mmcblk0p7
do it within android, not within linux or initial ramdisk console on you tablet, because linux recognize data as /dev/mmcblk0p7. sorry for bad English.

Tautvaldas said:
on android terminal emulator:
cat /proc/mounts
make sure that data is on /dev/block/mmcblk0p8 not p7
if so then:
dd if=your_second_boot.img of=/dev/block/mmcblk0p7
do it within android, not within linux or initial ramdisk console on you tablet, because linux recognize data as /dev/mmcblk0p7. sorry for bad English.
Click to expand...
Click to collapse
thanks for the response, what will this be doing??

adrock74 said:
thanks for the response, what will this be doing??
Click to expand...
Click to collapse
It'll flash the kernel into the correct partition, via android.

guimendes said:
It'll flash the kernel into the correct partition, via android.
Click to expand...
Click to collapse
ok gotcha. Sorry to be a bother, but i want to do this. Right now ive got my kernel and rootfs on a partitioned sd card in my extsd slot. If I flash the kernel using terminal, where should it be?

adrock74 said:
ok gotcha. Sorry to be a bother, but i want to do this. Right now ive got my kernel and rootfs on a partitioned sd card in my extsd slot. If I flash the kernel using terminal, where should it be?
Click to expand...
Click to collapse
If you follow strict what Tautvaldas said, it'll be placed in the right place for dualbooting, the same if you use fastboot tool.

Thanks for your help guys. But mixing and matching this and that, i give up. Ive flashed the sh*t out of this tab, but without a unified tutorial, i cant make sense of this. Ive been running linux on my pc and laptop, so this isnt foreign to me, but i need a more straight forward tutorial. Thanks though again. We all have to learn sometime:good:

I ran a dist-upgrade on it and my wifi now seems broken - rfkill can unblock it but ifconfig returns SIOsomething something error, permission denied. Ideas?

Root without PC (boot loader already unlocked)

Hey
So I WAS rooted until KitKat update and now I'm not. Wasn't a problem as I wasn't doing things that needed root access for a while, but I need to now.
Only issue is that I don't have access to any PC/laptop right now.
Is there a way I can root/gain superuser without a PC? I could have sworn I did this once before but it eludes me now.
Bootloader is already unlocked
Sent from my Nexus 7 using xda app-developers app

Xiorell said:
Hey
So I WAS rooted until KitKat update and now I'm not. Wasn't a problem as I wasn't doing things that needed root access for a while, but I need to now.
Only issue is that I don't have access to any PC/laptop right now.
Is there a way I can root/gain superuser without a PC? I could have sworn I did this once before but it eludes me now.
Bootloader is already unlocked
Sent from my Nexus 7 using xda app-developers app
Click to expand...
Click to collapse
Framaroot? Dunno if it works with KitKat but u could try it out.
Merry Christmas!
Smack that thanks button If I helped!
Always make a nandroid backup before trying anything risky.
I do respond to questions (most) via PM.
Sent from my fabulous N7105 powered by Illusion ROM and Plasma Kernel.
Sent from dat small country called Singapore.
P.S. Quote my post for replies ASAP.

If you still have a custom recovery installed, download SuperSU from http://download.chainfire.eu/supersu and flash it in recovery.

farmerbb said:
If you still have a custom recovery installed, download SuperSU from http://download.chainfire.eu/supersu and flash it in recovery.
Click to expand...
Click to collapse
How the heck are u getting custom recovery without root?
Smack that thanks button If I helped!
Always make a nandroid backup before trying anything risky.
I do respond to questions (most) via PM.
Sent from my fabulous N7105 powered by Illusion ROM and Plasma Kernel.
Sent from dat small country called Singapore.
P.S. Quote my post for replies ASAP.

Irwenzhao said:
How the heck are u getting custom recovery without root?
Smack that thanks button If I helped!
Always make a nandroid backup before trying anything risky.
I do respond to questions (most) via PM.
Sent from my fabulous N7105 powered by Illusion ROM and Plasma Kernel.
Sent from dat small country called Singapore.
P.S. Quote my post for replies ASAP.
Click to expand...
Click to collapse
custom recovery can be installed without root too... after going to recovery it gives option to root

IF you do not have a custom recovery installed and you have no access to fastboot then you need to find a root exploit to run under the installed OS which gives you a privilege escalation.
If I was aware of one, I would say so, but I really haven't been looking around. Seems like it might be easier to "borrow" a PC to get the job done.
One of the curiosities of working with devices like the Nexus series is that because they are so easily unlocked & flashed using sanctioned vendor methods, there are few N7 devs/hackers that concern themselves with "rooting" the factory ROM. Why bother, right?
So, when there is a widespread linux kernel exploit or generic Android exploit, the Nexus series owners get the benefit of devs developing working exploits for other devices, but not usually until then.
BTW, if you can "borrow" a friend's machine, you don't need to screw it up installing the SDK and a bunch of drivers - you can simply put the linux version of fastboot (plus your "flashables") onto a thumbdrive, boot that PC into a linux "live CD" distro, and run fastboot from linux. No drivers needed; just run fastboot as the "root" user. Hopefully it's not a UEFI-only BIOS.
That sidesteps having to muck someone else's Win-doze box up. You just borrow their hardware, not their operating system. Just mount the USB key, copy the fastboot executable someplace ( /tmp ?), chmod 755 it) and run it as root.* A lot of those "live" CDs (e.g. Ubuntu) have a file explorer on the desktop that allow you to mount different media devices it detects (including USB sticks, etc), so you don't really need to be much of linux wizard to use this approach.
good luck
* some time ago, it seemed that you may have needed to make sure to also grab supporting link-libraries along with the linux fastboot executable, as it is dynamically linked. I remember doing this in the past, e.g.
assuming you have "fastboot" executable, it's supporting libs and your custom recovery image on the root folder of a USB key:
Code:
$ sudo /bin/bash
# mkdir /tmp/foo
# cp /mnt/usbstorage/* /tmp/foo
# chmod 755 /tmp/foo/fastboot
# export LD_LIBRARY_PATH=/tmp/foo:/lib:/usr/lib:/usr/lib/i386-linux-gnu
# cd /tmp/foo
# ./fastboot devices
# ./fastboot flash recovery ./custom-recovery-image.img
I just checked fastboot on my Ubuntu 12.04 VM, and
Code:
$ objdump -x `which fastboot` | grep NEEDED
NEEDED libstdc++.so.6
NEEDED libm.so.6
NEEDED libgcc_s.so.1
NEEDED libc.so.6
all of those libs are included in various places in the distro, so even though the fastboot binary is dynamically linked, you don't need to provide the dynamic link libraries (or use LD_LIBRARY_PATH) in that case.

Newbie One-Click (actually terminal command) root!

<rant> I am annoyed at how many Windows users there are lurking here -- I mean, you can't even develop Android with Windows!!! Why is everything I find Windows oriented with no Linux option? </rant>
Here is the one click root zip with a (less verbose) Linux sh script. To quote the other thread,
Credit goes to the creator of the Zenfone 2 installer: @29y6145 Thread
You need ADB and fastboot installed first. Your distro has it, Google it.
Just unzip, and run:
Code:
chmod +x root.sh
./root.sh
And that's literally it. Thanks to the other people who found the files and wrote the commands
Download here: https://steelcowboy.me/zenfone_root.zip

hello..may explain further on how to do this method? is it terminal on the phone or on linux or on the windows (cmd)? and where's the zip file?

Not a newbie tutorial at all. You might want to appropriately title this or add instructions to make it newbie friendly.

cangcan said:
hello..may explain further on how to do this method? is it terminal on the phone or on linux or on the windows (cmd)? and where's the zip file?
Click to expand...
Click to collapse
It's a Linux sh script, so you run it in the Linux terminal. It's the same directions as the other tools, just for Linux

Jhdoubleoseven said:
<rant> I am annoyed at how many Windows users there are lurking here -- I mean, you can't even develop Android with Windows!!! Why is everything I find Windows oriented with no Linux option? </rant>
Here is the one click root zip with a (less verbose) Linux sh script. To quote the other thread,
Credit goes to the creator of the Zenfone 2 installer: @29y6145 Thread
You need ADB and fastboot installed first. Your distro has it, Google it.
Just unzip, and run:
Code:
chmod +x root.sh
./root.sh
And that's literally it. Thanks to the other people who found the files and wrote the commands
Download here: https://steelcowboy.me/zenfone_root.zip
Click to expand...
Click to collapse
I'm stuck in "waiting for devices" but at the start when i check my adb devices, my phone is there.
what's wrong ?

AceHa92 said:
I'm stuck in "waiting for devices" but at the start when i check my adb devices, my phone is there.
what's wrong ?
Click to expand...
Click to collapse
The phone takes a moment to reboot into fastboot mode, so the script has it wait for 30 seconds. Can you confirm that still nothing happens after 30 seconds? And the phone does boot into bootloader mode? If so, type
Code:
adb reboot bootloader
fastboot devices
into your terminal and see if it shows up. If it's not showing up you may have a problem with fastboot itself.

This seems to work (though the fastboot in Debian is too old, I needed to download a newer version) - but I end up with no Superuser app. What's wrong?

Worked perfectly for my memo pad 7 (176cx) Thank you so much!!

drbobb said:
This seems to work (though the fastboot in Debian is too old, I needed to download a newer version) - but I end up with no Superuser app. What's wrong?
Click to expand...
Click to collapse
Sorry for the late reply -- XDA didn't seem to notify me of a new post :/
Did you see all of the fastboot messages go by in both the terminal and the phone's screen? Did everything say "OKAY"? Did you try installing SuperSU from the Play Store to see if it rooted?

Jhdoubleoseven said:
Sorry for the late reply -- XDA didn't seem to notify me of a new post :/
Did you see all of the fastboot messages go by in both the terminal and the phone's screen? Did everything say "OKAY"? Did you try installing SuperSU from the Play Store to see if it rooted?
Click to expand...
Click to collapse
Yep, I think it was OKAY on all commands. I pulled in SuperSU from the store and all root functionality seems okay as well.
I don't understand much of what the script does, especially how
Code:
fastboot flash /system/bin/partlink supersu.tgz
is supposed to work - but then, I haven't looked too closely.

Awesome, really glad it worked out for you! And yeah, I'm not entirely sure -- usually gaining root is based on an exploit so I'd guess that it replaces system binaries with modified ones to allow root access, but haven't rooted many phones so not sure how it generally works. Especially
Code:
fastboot oem start_partitioning

Thanks for this. I tried other one clicks on my fedora 22 box and kept getting fastboot errors. This one worked flawlessly.

Interesting...
The approach is quite a bit different to the usual tethered TWRP suspects as the exploit tries to overwrite quite a few binaries. Naturally I had to try it on my ME572C and unfortunately it couldn't write a single one of those binaries.

therealprof said:
The approach is quite a bit different to the usual tethered TWRP suspects as the exploit tries to overwrite quite a few binaries. Naturally I had to try it on my ME572C and unfortunately it couldn't write a single one of those binaries.
Click to expand...
Click to collapse
That's not a Zenfone though my friend... this is only for Zenfone 2

Jhdoubleoseven said:
That's not a Zenfone though my friend... this is only for Zenfone 2
Click to expand...
Click to collapse
I know, but at some point I would hope that Asus gets an f'ing clue to develop things once and use that across multiple devices running similar hardware. It's already funny how my ME176C and ME572C run completely different Android implementations (one rootable, the other not) despite being somewhat similar.

It's probably a too obvious question, but as the tutorial is for newbies I feel allowed to do:
Do I need to have an unlocked bootloader to succeed in the rooting ? The reason for asking is that the script successfully restart the phone but then the fastboot commands don't work, I get stuck at "waiting for device".
Thanks.

Outdated security
Hey, your HTTPS certs are out of date. I added a temporary exception, then found the redirect failed. I think you server needs some updating...
Any chance of a mediafire or dropbox link?

[Thor][Apollo] Unlocking bootloader with any firmware

Hello. At first, I did not invent anything new, just checked some my guess on a other motherboard. All thanks and credits to our great developers. As always, all at your own risk.
It does not work on the Fire HDX 8.9 (Saturn)!
All steps in this manual are not necessary but they are present for maximum safety. So I highly recommend do anything exactly in this way. Sorry my English as always =)
Update2 - actual method is https://forum.xda-developers.com/showpost.php?p=75284993&postcount=1006
Update: now you can use updated draxie's utility - http://forum.xda-developers.com/kindle-fire-hdx/general/multi-platform-1-click-bootloader-t3241014
Prerequisites for Installation
- Root
- Installed adb and fastboot drivers - official - https://drive.google.com/open?id=0B2twXJIOgv-UWWdwRl9TQS11b0k (if your system language not English, after fail navigate to "Program Files (x86)\Lab126\drivers" and run dpinst.exe /EL or switch to English =) for x64 need to disable driver signature verification before install ) also you can use pdanet drivers - http://forum.xda-developers.com/showpost.php?p=59268023&postcount=8
Manual:
1. Create unlock file following this instruction - https://forum.xda-developers.com/ki...r-firmware-t3463982/post70881555#post70881555
2. Flash old vulnarable aboot and cubed twrp (just in case). Check that all these commands executed without errors. If you'll get one - read second post below. If your firmware <=13(14)3.2.3.2 skip this step.
Download aboot and twrp for Thor (Kindle Fire HDX 7) https://drive.google.com/open?id=0B2twXJIOgv-UMGxXMUZPZTlZTUk or for Apollo (Kindle Fire HDX 8.9) - https://drive.google.com/open?id=0B2twXJIOgv-URzJDQkczNzRLaHM - and put this two files (twrp_cubed.img and aboot_vuln.mbn) into root of your kindle internal storage.
Run:
Code:
adb shell
su
dd if=/sdcard/twrp_cubed.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery
dd if=/sdcard/aboot_vuln.mbn of=/dev/block/platform/msm_sdcc.1/by-name/aboot
Now you have working twrp recovery. It already works even without unlocked bootloader. You could boot into it by holding volUP during grey kindle logo. But no need to flash anything until unlock. At this point this is just emergency tool if something goes wrong =)
3. Flash unlock file.
Now, if you reboot, you will go straight into fastboot because of old aboot - newest boot.img can't load with it. If your firmware <13(14).4.1.1 you need run "adb reboot bootloader" to boot into fastboot.
Time to flash your unlock file.
Code:
fastboot -i 0x1949 flash unlock 0xmmssssssss.unlock
You must obtain "unlock code is correct".
Grats. You are perfect =)
You can flash:
CM13 - http://forum.xda-developers.com/kin...ment/rom-cm-13-kindle-hdx-2015-11-29-t3259732
CM 12.1 - http://forum.xda-developers.com/kin...ent/rom-cm-12-unofficial-apollo-thor-t3050199
Or stock repacked latest 4.5.5.2 rom - https://drive.google.com/open?id=0B2twXJIOgv-UVFFtN2RYNXNUZ0k (13.x - thor, 14.x - apollo)
Do not flash original stock firmwares.
Regards and thank to all - @dpeddi, @vortox, @draxie, @ggow, @Ralekdev, @jcase, @Hashcode
And greatest thanks for motherboard for my experiments to @MahmudS !

FAQ:​1. if your get "not such file or directory" after su in step 2 (this is SAFESTRAP related possibly)- try to use next commands:
Code:
adb shell
su
dd if=/storage/emulated/0/twrp_cubed.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery
dd if=/storage/emulated/0/aboot_vuln.mbn of=/dev/block/platform/msm_sdcc.1/by-name/aboot
http://forum.xda-developers.com/showpost.php?p=68751981&postcount=35

I think you can use greatest @draxie tool - http://forum.xda-developers.com/kindle-fire-hdx/general/multi-platform-1-click-bootloader-t3241014 with doing step2 only. But it need to test. Anyway I highly recommend get your hw id's before any actions.

Daredevil
ONYXis said:
Code:
dd if=/sdcard/aboot_vuln.mbn of=/dev/block/platform/msm_sdcc.1/by-name/aboot
Click to expand...
Click to collapse
Great job! So, simply flashing the vulnerable bootloader "just works"...
Are you absolutely positive?
Although I've been expecting this all along
[but wouldn't dare trying, since the HDX is *still* my only tablet],
I'm wondering what the supposed "rollback protection" after 3.2.8 really covers.
Fixed issue (now hidden)
BTW: I get the exact same MD5 hash for both versions of 'aboot_vuln.mbn' (the two 'cubed_twrp.img' are different).
Code:
66b7df0db97c7c2905d1d61199c816a5 13-aboot_vuln.mbn
66b7df0db97c7c2905d1d61199c816a5 14-aboot_vuln.mbn
087e7125c48fcbebcc2f51a9c46379f2 13-twrp_cubed.img
c06799a4a8d48d9dd55aea002def1caf 14-twrp_cubed.img
H[66b7df0db97c7c2905d1d61199c816a5]=aboot-13.3.2.3.2_user_323001720.mbn
Please double-check to make sure Apollo users won't get fried.
You do say that not all steps are necessary. Can you advise if my thinking below sounds correct?
I'm considering adding this to 1-Click; that's why I'm asking.. (If I could also include a surefire way
to root the device beforehand, we'd be all set for a truly 1-Click experience from scratch, modulo
strange Windows behaviour. [if anybody still cares ;-P])
I suppose getting rid of the potentially dangerous anti-rollback-related files is good measure,
but if they had been making any difference, this method shouldn't really work, right?
So, this may not be needed at all.
I'm also thinking that flashing TWRP in the same step -although nice- is not strictly needed.
Would you agree?

Are you absolutely positive?
Click to expand...
Click to collapse
I tried this with two devices with two firmwares at each after rollback-upgrade proccess to be sure.
Although I've been expecting this
Click to expand...
Click to collapse
Same as I. Just need to be checked.
: I get the exact same MD5 hash for both versions of 'aboot_vuln.mbn
Click to expand...
Click to collapse
Strange, I use same aboots in this tool - http://forum.xda-developers.com/kin...-to-unbrick-kindle-fire-hdx-firmware-t3277197 =) need to fix=)
Re-uploaded aboot from 14.3.2.3.2 - 4A2BE8E374C8D1FCE8E6743AC2D09BB0
Thank you.
'm also thinking that flashing TWRP in the same step -although nice- is not strictly needed.
Click to expand...
Click to collapse
Of course. But... why not? and sometimes fastboot flash recovery at very first time don't work.
but if they had been making any difference, this method shouldn't really work, right?
So, this may not be needed at all.
Click to expand...
Click to collapse
This is need to check. I really do not like that factory_provision_tool.
But I agree that all magic is just dd'ing of old aboot.

ONYXis said:
I tried this with two devices with two firmwares at each after rollback-upgrade proccess to be sure.
Click to expand...
Click to collapse
Sounds good.
ONYXis said:
Same as I. Just need to be checked.
Click to expand...
Click to collapse
Indeed! And, that's quite a daring achievement. Big thanks for that!
ONYXis said:
Strange, I use same aboots in this tool - http://forum.xda-developers.com/kin...-to-unbrick-kindle-fire-hdx-firmware-t3277197 =) need to fix=)
Re-uploaded aboot from 14.3.2.3.2 - 4A2BE8E374C8D1FCE8E6743AC2D09BB0
Thank you.
Click to expand...
Click to collapse
I also verified this, just to be sure; and, chose to hide the issue in my post above.
H[4a2be8e374c8d1fce8e6743ac2d09bb0]=aboot-14.3.2.3.2_user_323001720.mbn
ONYXis said:
Of course. But... why not? and sometimes fastboot flash recovery at very first time don't work.
Click to expand...
Click to collapse
I'll see if including the TWRP images in 1-Click pushes the size of the ZIP over the XDA limit.
I suppose I could opt to fetch from the net if it doesn't, but then I need to enable networking for the VM.
ONYXis said:
This is need to check. I really do not like that factory_provision_tool.
But I agree that all magic is just dd'ing of old aboot.
Click to expand...
Click to collapse
Yes. Please check!

draxie said:
Yes. Please check!
Click to expand...
Click to collapse
Ok. So... Another motherboard with stock 3.2.3.2
Updated it through OTA to 3.2.5 > 4.1.1 > 4.5.2 > 4.5.4 > 4.5.5 > 4.5.5.1 > 4.5.5.2
Rollbacked to 3.2.8, updated to 4.5.5.1, Kingroot.
Code:
adb shell
su
dd if=/sdcard/aboot_vuln.mbn of=/dev/block/platform/msm_sdcc.1/by-name/aboot
reboot
Boot into fastboot. At this point need to have id's already!!!
Flash unlock, flash recovery, flash upHDXed 4.5.5.2 rom. Succesfully booted up. :fingers-crossed:
OP edited.

ONYXis said:
Rollbacked to 3.2.8, updated to 4.5.5.1, Kingroot.
Click to expand...
Click to collapse
I don't suppose this rollback is essential, is it?
It should work just as well to stop the update before the currently unrootable 4.5.5.2, right?
ONYXis said:
Flash unlock, flash recovery, flash upHDXed 4.5.5.2 rom. Succesfully booted up. :fingers-crossed:
Click to expand...
Click to collapse
Nice. I'll PM you soon with an updated 1-Click, for testing, if you don't mind.
(I cannot [and don't even want to] test this on my only tablet.)

draxie said:
I don't suppose this rollback is essential, is it?
Click to expand...
Click to collapse
just checked all variations.
I'll PM you soon with an updated 1-Click, for testing, if you don't mind.
Click to expand...
Click to collapse
Of course.

Can it work on hdx 8.9?

Although I have registered my 'thanks' on various posts it seems hollow to not explicitly recognize @ONYXis and @draxie for their tremendous contributions supporting this device both past and present. The ability to unlock virtually any rooted 3rd gen HDX is a true game changer that will revive interest in this discontinued gem that still competes nicely with contemporary offerings. Well done, gents!

wizard_mini said:
Can it work on hdx 8.9?
Click to expand...
Click to collapse
You mean Saturn? No, sorry.

Hi, i cant get the adb driver to work with my german Win 10 64bit
dpinst.exe /EL starts fine but throws an error while installing.
So i wanted to try the pdanet drivers but im not sure how to get my fire into fastboot mode ("- connect your kindle already waiting in fastboot mode with usb cable to pc").
Any help? :>

Maybe you need to disable driver signature verification before install. Google it.
fastboot -
Code:
adb reboot bootloader

ONYXis said:
Maybe you need to disable driver signature verification before install. Google it.
fastboot -
Code:
adb reboot bootloader
Click to expand...
Click to collapse
Thanks, that worked. Now i have the following problem when trying "python.exe cuberHDX.py 0xmmssssssss": (tried with 64 and 32bit Python + gmpy2, because that seems to be the problem sometimes)
File "cuberHDX.py", line 7, in <module>
from gmpy2 import iroot, mpz
ImportError: DLL load failed: %1 ist keine zulõssige Win32-Anwendung. [last part means not a valid win 32 application]
Thanks for your help!

It is python installation related problem, I really not familar with that. You could post your id's and I'll create and attach your unlock-file.

ONYXis said:
It is python installation related problem, I really not familar with that. You could post your id's and I'll create and attach your unlock-file.
Click to expand...
Click to collapse
0x000015
0x1022b00d
Thank you!

RambaaZambaa said:
0x000015
0x1022b00d
Thank you!
Click to expand...
Click to collapse
Welcome.
Need to unarchive.

ONYXis said:
Welcome.
Need to unarchive.
Click to expand...
Click to collapse
Next problem :silly:
As long as im not su i can cd to sdcard folder (or storage/sdcard0). But then i cant use the "dd if=/sdcard/twrp_cubed.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery" command.
So when im SU the command fails and i also cant enter the sdcard folder (no such file or directory). Strange...

RambaaZambaa said:
Next problem :silly:
As long as im not su i can cd to sdcard folder (or storage/sdcard0). But then i cant use the "dd if=/sdcard/twrp_cubed.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery" command.
So when im SU the command fails and i also cant enter the sdcard folder (no such file or directory). Strange...
Click to expand...
Click to collapse
Sorry, really don't understand )
Pls, provide screenshot of cmd with your error.
And try to follow instructions directly.There is no any cd command.