Database Users

[GUIDE][ICS/JB/common] Definitive FAQ for newest miui porting

I know there is a Proxuser's guide - "How to Port MIUI v4 for your device" and GREAT thread intended to eliminate porting quirks.
My goal is to collect all the experience we got in that thread, which could be helpful for new users porting newest releases of miui.
FAQ assumes questionaire, but my format will be more look like a guide but as collection, it could be treated as FAQ.
Structure will be Stage-divided to ease of use.
Stage 1. Initial port
Let's start with first moment - bases choice.
Under base I will mean rom which could be used to port miui and also miui release you choose.
Let's assume - just "Base" will mean rom for your device with ICS/JellyBean, such as Cyanogen Mod or AOKP or AOSP and their variations(I don't know if it is possible to use stock rom for porting and wouldn't recommend it), when "MIUI base" means any miui rom you prefer (my preference and advice - MIUIandroid crespo [nexus S] or MIUIandroid maguro (Galaxy Nexus) release). You could use any miui base but results will be unpredictable and may very vary from guide stands, for those cases I prepared common debugging stage, which will help to eliminate bugs I haven't listed.
MIUI for nexus S and Galaxy Nexus are now upgraded to Jelly Bean. That actually means - you couldn't use their miui bases to port ICS roms(which still under support).
For those who stuck at ICS the situation is as follows:
If version number is not crucial, you might just stick at MIUI 2.8.10 http://weedy.ca/miuiandroid/ and use old kind Nexus S/Galaxy Nexus roms. In guide I will describe steps right for you with mark "ICS-only".
If for you version number is crucial - stop reading this guide and just use PatchROM (though rom will be based on Stock rom).
There is third variant, but it needs a device with nearly same specs:
you might just replace some files in miui-supported device rom with files from your stock rom. For now that case is only tested on xperia 2011 products (play,live with walkman,ray, mini, pro, mini pro etc) - arc s [lt18i] miui base and xperia 2012 (u,p, sola etc) - S miui base.
When base choosen, start to port:
Copy unpacked base rom (so set of folders) to any folder you prefer (let's name it "MIUI"), it usually contains:
system - folder on which we will work more often
data - may contain something necessary such as first boot scripts, config files etc.
META-INF - contains certificates and signature for signcheck, updater-script(we also will work on it) update-binary (updater-script command processor)
boot.img, kernel and ramdisk packed together, touch only if kernel should be changed to something more recent or if your preference is not similar with base rom maker's, but keep in mind that you have to place modules that provided with kernel to lib/modules [or in place where .ko files are]
Starting with system:
delete:
app
framework
media
fonts
then open miui archive and extract those folders to system. Don't close archive.
Open lib folder in system to add from the same archive:
content-types.properties [for themes]
liblbesec.so [for LBE Guard - MIUI superuser]
liblocSDK_2.2.so [for baidu location service, prevents network location provider FC]
JellyBean-only:
libjni_resource_drm.so [themes DRM, actually involves download online themes screen]
Open etc folder in system to add from the same archive:
yellowpage.db [Phone calls ability]
ICS-only
telocation.td (as for nexus S and telocation.db in others) [location provider dependency]
JellyBean-only:
telocation.idf (possible new telocation.db)
go to permissions folder in etc to add:
com.nxp.mifare.xml [NFC]
miui-framework.xml [activates miui framework, near all apps won't work without that]
com.google.android.media.effects.xml [gallery]
com.google.widevine.software.drm.xml [something also related to google may affect play market]
com.google.android.maps.xml [gmaps]
Open xbin folder in system to add from the same archive:
su [replace, don't even use base one!]
invoke-as [binary with near busybox and toolbox functionality, need everywhere in system, mostly in themes and SU]
that's all about additional files. Devices which don't have NFC(Near Field Communication chip) also shouldn't have Nfc.apk in app folder!
Let's modify build.prop then, to add:
Code:
ro.build.id=MIUI
ro.build.display.id=MIUI
ro.build.version.incremental=2.x.x
ro.config.ringtone=MI.ogg
ro.config.notification_sound=FadeIn.ogg
ro.config.alarm_alert=GoodMorning.ogg
ro.config.sms_received_sound=FadeIn.ogg
ro.config.sms_delivered_sound=MessageComplete.ogg
ro.build.version.incremental points to MIUI you port, so specify it.
At your base you will most likely see these lines
Code:
ro.config.ringtone=
ro.config.notification_sound=
ro.config.alarm_alert=
ro.config.sms_received_sound=
ro.config.sms_delivered_sound=
are filled with ringtones that only base have, soo just change them as MIUI do have different ringtone set.
Initial port done, in system part, let's talk about Updater-script:
any release of miui you port should have that line:
Code:
set_perm(0, 0, 06755, "/system/xbin/invoke-as");
for example you have that bunch of code [which is mostly common for CM9 release]:
Code:
set_perm_recursive(0, 0, 0755, 0644, "/system");
set_perm_recursive(0, 2000, 0755, 0755, "/system/bin");
set_perm(0, 3003, 06755, "/system/bin/ip");
set_perm(0, 3003, 02750, "/system/bin/netcfg");
set_perm(0, 3004, 02755, "/system/bin/ping");
set_perm(0, 2000, 06750, "/system/bin/run-as");
set_perm_recursive(1002, 1002, 0755, 0440, "/system/etc/bluetooth");
set_perm(0, 0, 0755, "/system/etc/bluetooth");
set_perm(1000, 1000, 0640, "/system/etc/bluetooth/auto_pairing.conf");
set_perm(3002, 3002, 0444, "/system/etc/bluetooth/blacklist.conf");
set_perm(1002, 1002, 0440, "/system/etc/dbus.conf");
set_perm(1014, 2000, 0550, "/system/etc/dhcpcd/dhcpcd-run-hooks");
set_perm(0, 2000, 0550, "/system/etc/init.goldfish.sh");
set_perm_recursive(0, 0, 0755, 0555, "/system/etc/ppp");
set_perm_recursive(0, 2000, 0755, 0644, "/system/vendor");
set_perm_recursive(0, 2000, 0755, 0755, "/system/xbin");
set_perm(0, 0, 06755, "/system/xbin/librank");
set_perm(0, 0, 06755, "/system/xbin/procmem");
set_perm(0, 0, 06755, "/system/xbin/procrank");
set_perm(0, 0, 06755, "/system/xbin/su");
set_perm(0, 0, 06755, "/system/xbin/tcpdump");
set_perm_recursive(0, 0, 0755, 0644, "/system/vendor/firmware");
set_perm(0, 2000, 0755, "/system/vendor/firmware");
set_perm_recursive(0, 0, 0755, 0555, "/system/etc/init.d");
So line I pointed should be somewhere there, for example:
Code:
set_perm(0, 0, 06755, "/system/xbin/librank");
set_perm(0, 0, 06755, "/system/xbin/procmem");
set_perm(0, 0, 06755, "/system/xbin/procrank");
set_perm(0, 0, 06755, "/system/xbin/su");
[B][SIZE="4"]set_perm(0, 0, 06755, "/system/xbin/invoke-as");[/SIZE][/B]
set_perm(0, 0, 06755, "/system/xbin/tcpdump");
IF you have problems with SU, that line may help:
Code:
symlink("/system/xbin/su", "/system/bin/su");
paste it somewhere after
Code:
symlink("busybox"[B][COLOR="YellowGreen"][later big code bunch like "/system/xbin/[" etc][/COLOR][/B]
but before
Code:
unmount("/system");
Your own MIUI is now ready to be flashed, but only, if your device is SOOO near on hardware part with MIUI base
For those who didn't met that rule I prepared next parts - framework mods and common debugging and troubleshooting. See next 2 posts.

Stage 2
Recently I had an Acer Liquid MT[now bricked], which is Qualcomm S2 device(msm7x30) and my guide defines also assume you have device with Qualcomm inside. But some of guide moments[first stage is not exception] are common for most devices with other chips.
I also used Cyanogen Mod 9 as base, so some of these defines wouldn't be applicable to your porting using AOSP base.
That was on ICS, and I will count that in while describing for those who don't care about miui version and porting something before MIUI 2.8.10.
Now I have MIUI-supported Xperia Arc S. But its MIUI is based on stock rom (such a shame). So as FXP provides us CM 10, I started to port over it to bring latest and greatest of MIUI jellybean on that device. So again Qualcomm, but with stock ICS, which means lesser quirks on porting. I again will assume you are on Qualcomm but I have to say that all defines of this stage are nomore device-specific.
Returning to guide:
Stage 2. Framework mods to make it boot
Rom not booting? - that is most likely a framework issue, that is remained from Nexus S/Galaxy Nexus. But don't run to base to grab all framework and paste it to base, else you will have a base rom instead of miui
My suggestion is port.
For those who are new in apktool disassembling, I suggest to read something like that http://forum.xda-developers.com/showthread.php?t=1511730 or that http://forum.xda-developers.com/showthread.php?t=1752201 or google it to understand common principles of work.
For framework-res.apk mods we will use Connor-apktool and scripts for ease of use: http://code.google.com/p/android-apktool/downloads/list (choose only dependencies for your platform, don't replace AAPT from them). Always choose latest one!
Let's assume again:
disassemble something - usually means issuing
Code:
apktool d [[COLOR="YellowGreen"]full name of apk or jar[/COLOR]]
command on file I specify if more info not specified
assemble something - usually means issuing
Code:
apktool b [[COLOR="YellowGreen"]disassembled apk or jar folder without .apk in name or with ".out" at the end for jars[/COLOR] ]
command on file I specify
better way to assemble is drag assembled classes.dex(or resources.arsc and xmls at rest folders in case of assembling framework-res.apk) from [file you modified]/build/apk to original file, opened as archive (in windows you also have to check out a compression rate to make it the same as there were before dragging, which prompts to you as compression method like "Normal" and "Store")
smali - piece of code on dalvik bytecode language, are part of nearly any disassembled file
smali tree/just "tree"/"*.smali" - usually means set of files with the same name in the beginning but with different end(usually with $ before), for example
Code:
RIL*.smali means:
[LIST]
[*]RIL.smali
[*]RIL$1.smali
[*]RIL$RILReceiver.smali
[*]RIL$RILSender.smali
[/LIST]
Let's start with framework mods:
All frameworks are located at system/framework.
framework.jar
Mostly issues are produced there.
Disassemble framework.jar from MIUI port you are working so you will see framework.jar.out. Go to smali folder in it. Later all actions we will produce from there (except assembling).
First replace some files from your base framework.jar (fist disassemble base rom's framework.jar and move all files I will specify, replace if asked).
Listing all smali I had to replace in framework.jar:
ICS-only:
Code:
[B]android/os/Power.smali[/B]
org/codeaurora/Performance.smali
[B]android/media/MediaRecorder*.smali[/B]
android/graphics/Paint.smali
android/os/Environment.smali
android/view/HardwareCanvas.smali
[B]android/net/wifi/WifiNative.smali[/B]
Common:
Code:
android/view/Gles20*.smali (not only canvas but all with gles20 at the beginning)
[B]android/hardware/Camera*.smali[/B]
[B]android/server/BluetoothA2dpService*.smali[/B]
[B]android/content/res/PackageRedirectionMap*.smali[/B]
[B]com/android/internal/telephony/RIL*.smali[/B]
JellyBean Only:
Code:
[B]android/bluetooth/HeadsetBase*.smali[/B]
[B]com/android/internal/app/ActivityTrigger.smali[/B]
[B]android/webkit/HTML5*.smali[/B]
[B]android/webkit/SelectActionModeCallback[/B]
I highlighted those could be common for all chips, not only for Qualcomm ones.
But some of smalis are not following common rules.
The weirdest exception of that - WebviewCore. If you replace only WebViewCore tree, Gmail, Facebook, Browser, HTML viewer and all that is using this class WON'T WORK. What was my solution is to replace Webview*.smali tree, so I met all dependencies that class may work with.
ICS-only:
That class, and Sound Recorder are in need of one property from SystemProperties.smali, which is located at android/os/.
But don't run to base to take it and replace immediately as you read It have to be patched
end of ICS-only
I highlighted it as ICS-only as you will just replace it on JellyBean - it's now hard to patch, but easy to replace.
>>Common Remark about patching smalis
Patching (usually named diffing, diff, that means "find differences and eliminate them") in our context is a process of comparing two files and adding contents of one of them to another and not replacing anything. Our diff process will consist of base->miui content addition so smali we modify could live in dual life - for your base and for MIUI remained framework. For start of diff you should have both base and miui files you want to modify, and a diff tool (in windows - beyond compare,total commander, winmerge or notepad++), my preference - Meld diff viewer[really simple and visual-oriented], the only thing - it's running on linux environment and I don't know if there is a windows version. Then just open files in tool and start adding. Sometimes you have to add all entries are not present in miui one from base, sometimes you should be smart enough to mod only part which needed and nothing more and also sometimes to replace pieces of code which are actually safe to do so. That's a whole process.
>>
Example - our SystemProperties.smali:
Actually after opening you see it is full of differences from base:
http://minus.com/mbmfprmG4K/
you see those green blocks? Each of them signs a missing part of code you should add, in Meld it's just about of clicking little arrow that represents that block. As for windows tools, they should have something like "add all" and many other things could do it in a batch way.
A little piece of smartness:
that file is the only one I discovered which allow replacing .line with big code pieces, see that:
http://minus.com/mdnAholnL/
do you see ".line 126" and HUGE code block against it? you may forget about ".line 126" and copy block against it with no doubt. Note that line numbers etc could change, always check before doing something.
That line also became a dealbreaker on JellyBean, that's why we decided it would be better to just replace it. Ecample will give you a clue just about common patch process.
>>
Another file has to be modified in same way - AssetManager.smali, which is located at android/content/res.
Beware of replacing anything on it[only add, as stand before], if something went wrong, it might produce awful logcat nobody could understand so you have to re-port rom again to catch a causer.
Another interesting patch you should perform if you have different than RIL telephony class.
To determine which ril class you have, seek for following line in your build.prop:
Code:
ro.telephony.ril_class=
If you don't have such, mostly it means you are using RIL class and don't need a patch.
in my case it was:
Code:
ro.telephony.ril_class=LGEQualcommRIL
so I'll describe a process for it, pointing what is common.
All ril classes located at com/android/internal/telephony, so go to it.
LGEqualcommRIL have a single smali, so copy only that one[if your class also have another smali with the same name, for example LGEStarRIL$1.smali, copy them too], Also, unlike most classes in CM, LGEQualcommRIL have a dependency - QualcommSharedRIL, which tree you should also move to that folder near LGE one.
Classes that are also have that dependency:
LGEQualcommUiccRIL
HTCQualcommRIL
SamsungQualcommUiccRIL
Others are dervied from RIL and don't have any dependencies like that. As CM involves more and more devices, to determine what dependencies you actually need, ask source code:
Code:
public class LGEQualcommRIL extends QualcommSharedRIL implements CommandsInterface
extends means your dependency you have to also add to MIUI, if it is "RIL", go ahead and continue porting.
To make your class work instead of RIL, you should modify MIUI' PhoneFactory.smali located at the same folder in following way:
Code:
.line 136
new-instance v8, Lcom/android/internal/telephony/RIL;
invoke-direct {v8, p0, v4, v0}, Lcom/android/internal/telephony/RIL;-><init>(Landroid/content/Context;II)V
->
Code:
.line 136
new-instance v8, Lcom/android/internal/telephony/[B]LGEQualcomm[/B]RIL;
invoke-direct {v8, p0, v4, v0}, Lcom/android/internal/telephony/[B]LGEQualcomm[/B]RIL;-><init>(Landroid/content/Context;II)V
it changes a constructor of RIL class to LGEQualcommRIL class. If my lines incorrect, just type RIL in search in Phonefactory, it will show you exactly 2 defines with "RIL" involved.
Another case for patching is android/media/AudioFormat.smali.
Copy all missing lines from base to miui, it would be enough. I have decide to not replacing it coz of constructor that is differ and might one day turn into bomb.
The most complicated smali case, WebSettingsClassic. It do contains lines that should be added, also lines that should be slightly modified.
Let's try to make the process bit easier with these steps:
first of all, find those fields:
Code:
.field private mMediaPreloadEnabled
.field private mWebGLEnabled:Z
they are at the beginning of file, marked as green blocks. Attention: then there is a listing that asks you about default value, like that:
Code:
.line 91
iput-boolean v2, p0, Landroid/webkit/WebSettingsClassic;->mMediaPreloadEnabled:Z
DON'T EVEN TOUCH THEM! Even if you know what are you doing - it will fail on boot if you placed that lines in miui file.
interesting place here.. when you will search for webgl from the beginning, you will hit such block, marked as blue (incompatible):
Code:
goto/16 :goto_1
.end method
.method private native nativeIsWebGLAvailable()Z
.end method
while miui file will show just that:
Code:
goto :goto_1
and ".end method" after. "You f***n kiddng?" - will you ask.. yeah, pure cheat. Let's fix it up:
paste only:
Code:
.end method
.method private native nativeIsWebGLAvailable()Z
before ".end_method" but after "goto :goto_1", so that full block will be instantly turned to whie:
Code:
goto :goto_1
.end method
.method private native nativeIsWebGLAvailable()Z
.end method
except "goto", which will show as differ, but who cares?
After searching "webgl" on base file you will possibly see a code block starting with:
Code:
.method public declared-synchronized isWebGLAvailable()Z
add it without any thought. You should do the same with following methods:
Code:
.method public declared-synchronized setMediaPreloadEnabled(Z)V
.method public declared-synchronized setWebGLEnabled(Z)V
btw, those methods are so-called "setters" - methods in class that intended to adjust value to class field.
DON'T ADD ANYTHING ELSE, IT WILL POSSIBLY BREAK BOOTING AGAIN! You've been warned.
Framework.jar port done!
the only thing to do - assemble it.
services.jar
Unlike framework.jar, there are lesser things to do. But they are also significant for porting process.
ICS-only:
InputManager*.smali - the only thing should be replaced [and located in com/android/server/wm/].
On JellyBean it is located at com/android/server/Input ands also have to be replaced.
You may also replace usb folder, but actually those who have MTP(devices with kernel 3.0 or so, that are having new "USB gadget framework" drivers, consult with development branch for details) are in no need to do so, as for others (as of mine instance on MT development) you have to replace it. In stage 4 I will present my ways to make usb subsystem work on miui.
Also, there is a new smali on Jellybean: watchdog*.smali. Just replace whole tree of this in com/android/server/.
As for diff files, there is one: PowerManagerService.smali(may I shorten its name to PMS?)
there is no matter to diff it like others as it have too much dependencies to resolve and may cause your system crash.
ICS-only:
So, it only asks about nativeStartSurfaceFlingerOffAnimation method. but hey, PMS do have such method, but its name is nativeStartSurfaceFlingerAnimation, so without "Off"; my solution is to add "Off" to it, see that stack:
http://minus.com/lY4DiQfJ451Aq
that's where you should find you first entry (there are 2)
second entry showed there:
http://minus.com/lchMVcHtKe46T
after editing , you should see a huge block to add:
http://minus.com/lbmNygeJBs9klv
add it, and that smali is ported.
end of ICS-only
On jellybean porting it more trivial:
nativeCPUBoost is missing. You will have some defines in base file. Use search by keyword "cpuboost" in base file to determine where they are and just add them to miui one.
defines will be:
Code:
.method private static native nativeCpuBoost(I)V
-method definition.
Code:
.method public cpuBoost(I)V
-method code block.
and nothing extra.
Assemble new services.jar.out to services.jar when complete.
Done those but still not boots or boots but functions improperly? see next Stages- 3 and 4, I will enlighten all moments of debugging what's wrong and also additional tweaks for specific devices that faced problems with porting [It's just impossible to do that for each device, so there is a great thread you could always ask what's wrong if my advices didn't help].

Stage 3
Third part mostly touches cases where tuto above didn't resolved boot problems, also cases where there is no confidence 2nd stage will work/cases when people are trying to investigate themselves but mostly not xperienced in such(the most respectable case). To understand what's going on with your build it would be better to be CM/AOSP/AOKP dev, so you will most likely know where to find an answer. But if it is not about you, let me point on some moments could help.
Stage 3. Understanding logs and debugging
Yes, exactly understanding. Most likely people are going to forum and just posting logcat (that might contain common error). My goal is show you - logcat is not shuch thing you should fear to investigate!
First of all, let's assume something:
adb - powerful tool, in our case the must have thing to make a log. Article on android devs most likely describes all the moments about adb power: http://developer.android.com/tools/help/adb.html
logcat/log - one of the android advantages that allows you to debug what's going on with your system. by "make log" I will assume issuing
Code:
adb logcat >log.txt
command, last argument - log.txt is a text file with log system provided to you (you could use any name).
sometimes we need an answer about things that are going on with baseband (so-called radio). In those cases I usually asking to take radiolog. That's how it could be produced:
Code:
adb logcat -b radio >log.txt
reading it might be a pain, as terms of it are too much hardware-specific, but it anyway complies with principles I will put below.
debug/debugging - process of analyzing code which helps to eliminate bugs (that's why de-bug)
Some people experiencing problems with log, most common are:
-wrong MIUI base which prevents usb subsytem to start (nexus S base most likely allows you to use log)
-no/corrupted/wrong usb drivers on PC
-Windows :crying: most likely is about new usb subsystems etc, so advice is the only one - try on ubuntu (not working without udev rules)
-somewhat corrupted/inconsistent usb port
-lack of "persist.sys.usb.config= mass_storage,adb" in build.prop, specifically "adb" in this line.
Note: if your log only consists of:
Code:
link system/bin/sh failed: no such file or directory
or something like that, you should contact a CM dev, else, you are most likely know what happened ;]
Alright when we got a log, it consist of many many lines that are looping if your system not boots. That's why that kind of situation is sometimes called bootloop. System may repeat a error eternal time it lives, so log might be huge.
To parse what's going on there are some advice:
keywords:
search in log you got some keywords, that might be useful on debugging boot issue;
most common keywords are:
"E/" - error
"E/dalvikvm" - possibly crucial system error
"No such file or directory" - says it all
"couldn't" - android likes that, mostly shows faulty things.
"fail"/"failed" - mostly crucial error
"W/"/"warning" - says it all, but not always warn could be a boot failure cause
"exception"(especially NullPointerException) - points you that something went wrong in framework or application work
I/ tags could be also useful at debugging, but most helpful are errors and warnings.
Most common constructs:
"couldn't find native method", the most common reason of a bootloop.
For instance:
Code:
E/dalvikvm( 100): ERROR: couldn't find native method
E/dalvikvm( 100): Requested: Landroid/view/GLES20Canvas;.nStartTileRendering:(IIIII)V
E/JNIHelp ( 100): RegisterNatives failed for 'android/view/GLES20Canvas', aborting
Let's parse that construct to extract parts we will fix.
First of all. smali path might be extracted from that line:
Code:
E/JNIHelp ( 100): RegisterNatives failed for 'android/view/GLES20Canvas', aborting
->
Code:
android/view/GLES20Canvas
that's it, smali we are looking for is GLES20Canvas.smali. But.. android/view.. where it is? Answer comes from android source, it took some time to analyze frameworks.. Just let's assume: all that starting with "android" in path belongs to framework,jar.
What if path doesn't contain "android" at the beginning?
Again the answer is in source. Paths like"org/" are belong to framework.jar.
"com/android/server" - services.jar (there is the same folder at framework.jar but most likely you don't need to touch it).
another place we could be mixed up:
"com/android/internal" - framework.jar
"com/android/internal/policy/impl/" - android.policy.jar
for framework.jar path ends up on internal, which represents telephony folder. policy/impl is the only android.policy.jar folder.
Other frameworks are actually not used in port as they contain core android functionality which is common.
Note about smali you found:
it might be not smali you are looking for, most likely when code points you to android functionality and widgets (control elements) like combobox or listview, it's a sign to think twice what have you done on your system to port it
it might be tree of smali(remember 2nd stage assumes?), to ease of use, always replace smali with its tree, and only if error becomes worse, think about single smali or about diff(2nd stage assumes again )
from
Code:
E/dalvikvm( 100): Requested: Landroid/view/GLES20Canvas;.nStartTileRendering:(IIIII)V
we could extract a method which is missing - nStartTileRendering. In some cases only that method should be added and nothing more.
" android.content.res.Resources$NotFoundException: Resource ID #XXX"
Example:
Code:
E/AndroidRuntime( 3047): *** FATAL EXCEPTION IN SYSTEM PROCESS: WindowManagerPolicy
E/AndroidRuntime( 3047): android.content.res.Resources$NotFoundException: Resource ID #0x3060008
E/AndroidRuntime( 3047): at android.content.res.Resources.getValue(Resources.j ava:1022)
E/AndroidRuntime( 3047): at android.content.res.MiuiResources.getValue(MiuiRes ources.java:56)
E/AndroidRuntime( 3047): at miui.util.ResourceMapper.resolveReference(Resource Mapper.java:9)
E/AndroidRuntime( 3047): at miui.util.HapticFeedbackUtil.updateSettings(Haptic FeedbackUtil.java:109)
E/AndroidRuntime( 3047): at miui.util.HapticFeedbackUtil$SettingsObserver.obse rve(HapticFeedbackUtil.java:92)
E/AndroidRuntime( 3047): at miui.util.HapticFeedbackUtil.<init>(HapticFeedback Util.java:75)
E/AndroidRuntime( 3047): at com.android.internal.policy.impl.MiuiPhoneWindowMa nager.init(MiuiPhoneWindowManager.java:108)
E/AndroidRuntime( 3047): at com.android.server.wm.WindowManagerService$PolicyT hread.run(WindowManagerService.java:733)
Wrong MIUI base, mostly. Appear when something changed by previous porter (miui) which affects resources you won't have, banal link error.
" Fatal signal 11 (SIGSEGV) at 0xdeadbaad (code=1)"
Hope all of you heared about C language. That error is a form of C "exceptional case"(in other words - exception).
You will see if it happen:
Code:
F/libc ( 2698): Fatal signal 11 (SIGSEGV) at 0xdeadbaad (code=1)
I/DEBUG ( 130): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
I/DEBUG ( 130): Build fingerprint: 'tmous/htc_doubleshot/doubleshot:4.0.3/IML
74K/275847.101:user/release-keys'
I/DEBUG ( 130): pid: 2698, tid: 2698 >>> zygote <<<
I/DEBUG ( 130): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr deadbaa
d
I/DEBUG ( 130): r0 deadbaad r1 00000001 r2 a0000000 r3 00000000
I/DEBUG ( 130): r4 00000000 r5 00000027 r6 4086fbfd r7 00000036
I/DEBUG ( 130): r8 40253f04 r9 40233a7e 10 0000904c fp 00009062
I/DEBUG ( 130): ip 4028b240 sp befcfa60 lr 401043c1 pc 40100adc cpsr 600
00030
I/DEBUG ( 130): d0 2f64696f72646e61 d1 2f746e65746e6f63
I/DEBUG ( 130): d2 657373412f736572 d3 726567616e614d74
I/DEBUG ( 130): d4 0000d4cc0000d4b1 d5 0000d4e80000d4cd
yaa.. ENORMOUS code block, build fingerprint, fatal signal and stack trace.. welcome to hell
One little thing: error is right above that block, don't even try to parse its contents, ignore it.
WE ALL DIE!!!111
yaa, series of "died" errors:
Code:
I/ServiceManager( 1478): service 'media.audio_flinger' died
I/ServiceManager( 1478): service 'media.player' died
I/ServiceManager( 1478): service 'media.camera' died
I/ServiceManager( 1478): service 'media.audio_policy' died
IGNORE them, it's a result of exception right above(no matter C exception or java one), it's better to see it instead of posting "WE ALL DIE!!!111"
"Unable to extract+optimize DEX from '/system/framework/framework.jar'" and other WTF cases
examples:
Code:
D/dalvikvm( 103): DexOpt: --- BEGIN 'framework.jar' (bootstrap=1) ---
E/dalvikvm( 172): Duplicate class definition: 'Landroid/media/MediaRecorder;'
E/dalvikvm( 172): Trouble with item 2900 @ offset 0x17a86c
E/dalvikvm( 172): Cross-item verify of section type 0006 failed
E/dalvikvm( 172): ERROR: Byte swap + verify failed
E/dalvikvm( 172): Optimization failed
W/dalvikvm( 103): DexOpt: --- END 'framework.jar' --- status=0xff00, process failed
E/dalvikvm( 103): Unable to extract+optimize DEX from '/system/framework/framework.jar'
D/dalvikvm( 103): Unable to process classpath element '/system/framework/framework.jar'
E/JNIHelp ( 103): Native registration unable to find class 'android/debug/JNITest', aborting
Code:
05-30 14:15:15.970: E/NetworkLocationRealOs(2304): no android ID; can't access encrypted cache
05-30 14:15:15.970: E/NetworkLocationRealOs(2304): java.io.IOException: no android ID; can't access encrypted cache
Code:
1012: 07-03 03:28:21.350: E/System(1538): ************ Failure starting core service
07-03 03:28:21.350: E/System(1538): java.lang.NullPointerException
07-03 03:28:21.350: E/System(1538): at com.android.server.pm.PackageManagerService.grantPermissionsLPw(PackageManagerService.java:4299)
07-03 03:28:21.350: E/System(1538): at com.android.server.pm.PackageManagerService.updatePermissionsLPw(PackageManagerService.java:4247)
07-03 03:28:21.350: E/System(1538): at com.android.server.pm.PackageManagerService.<init>(PackageManagerService.java:1170)
07-03 03:28:21.350: E/System(1538): at com.android.server.pm.PackageManagerService.main(PackageManagerService.java:858)
07-03 03:28:21.350: E/System(1538): at com.android.server.ServerThread.run(SystemServer.java:167)
07-03 03:28:21.350: I/SystemServer(1538): Input Method Service
07-03 03:28:21.360: W/SystemServer(1538): ***********************************************
1021: 07-03 03:28:21.370: A/SystemServer(1538): BOOT FAILURE starting Input Manager Service
1022: 07-03 03:28:21.370: A/SystemServer(1538): java.lang.NullPointerException
1023: 07-03 03:28:21.370: A/SystemServer(1538): at android.app.PendingIntent.getBroadcast(PendingIntent.java:293)
1024: 07-03 03:28:21.370: A/SystemServer(1538): at com.android.server.InputMethodManagerService.<init>(InputMethodManagerService.java:548)
1025: 07-03 03:28:21.370: A/SystemServer(1538): at com.android.server.ServerThread.run(SystemServer.java:271)
1026: 07-03 03:28:21.400: E/AndroidRuntime(1538): Error reporting WTF
1027: 07-03 03:28:21.400: E/AndroidRuntime(1538): java.lang.NullPointerException
1028: 07-03 03:28:21.400: E/AndroidRuntime(1538): at com.android.internal.os.RuntimeInit.wtf(RuntimeInit.java:345)
1029: 07-03 03:28:21.400: E/AndroidRuntime(1538): at android.util.Log$1.onTerribleFailure(Log.java:103)
1030: 07-03 03:28:21.400: E/AndroidRuntime(1538): at android.util.Log.wtf(Log.java:278)
1031: 07-03 03:28:21.400: E/AndroidRuntime(1538): at com.android.server.ServerThread.reportWtf(SystemServer.java:77)
1032: 07-03 03:28:21.400: E/AndroidRuntime(1538): at com.android.server.ServerThread.run(SystemServer.java:274)
mostly likely is about way assembling framework files. Also some of them might be just corrupted by accident. Sometimes these errors caused by wrong smali replacement or wrong diff methodology. Or it might be just banal reason - no place in system or cache partitions.
English []
Most log parts are in mere, not technician English,log might be read as little book with bright characters. Find what you are looking for and fix it..
Source code is your best friend in porting
I'd recommend to have an android source code [from internet or on your local PC] to port something that outstands of rules I listed. For example CM frameworks source could be found here: https://github.com/CyanogenMod/android_frameworks_base .
That mostly affect cases in which hardware that is not working/working but not perfect/working incorrect on MIUI but worked like a charm on base.
Any log line represents a line of code in source, that one could search and debug from there (as source is mostly common, that miui ports possibility proove). Each smali represents a java source code or its part(- subclass which signed by $), each java is in frameworks folder on source (mostly frameworks/base). Log line is a message, which formed with C rules about these rules, so you have to avoid ciphers or guess how could code represent that message. You may search guessed line in source to locate java file, or locate it manually according to smali location and my advice and search in it.
Happy debugging

Stage 4
Last part. We recently ported miui, all is great and mostly functions, But.. am I the only one or that one looks incomplete? One could make its port complete by following next stage:
Stage 4. Advanced tweaks and specific hardware fixes
USB subsystem(mass storage/tether/debugging sign)
First of all, little self - check:
you have to be on old USB Gadget framework kernel source. Those you could clarify by talking with cm dev. Also I'm not rejecting it could work for others but in slightly modified sequence.
Starting from framework-res.apk.
You have to disassemble it first, but before you use actual "apktool d", you should also issue:
Code:
apktool if framework-res.apk
that is necessary for decoding internal resources correctly.
Disassemble base and MIUI frameworks and leave base one as we will work with MIUI one and will use base as a reference.
After disassembling, let's go to res/values in it:
As old usb gadget needs old mass storage path which was applicable to gingerbread, we should add that path to strings.xml.
If you only disassembled that file, you should see something like that:
Code:
<string name="launchBrowserDefault">Launch Browser?</string>
<string name="SetupCallDefault">Accept Call?</string>
</resources>
exact line to add at the near end:
Code:
<string name="config_legacyUmsLunFile">/sys/devices/platform/usb_mass_storage/lun0/file</string>
so that you will get something like that:
Code:
<string name="launchBrowserDefault">Launch Browser?</string>
<string name="SetupCallDefault">Accept Call?</string>
<string name="config_legacyUmsLunFile">/sys/devices/platform/usb_mass_storage/lun0/file</string>
</resources>
Remark:
that case is the only applicable to devices which have old kind SD card only. Look at the framework-res on your device, it also might have different LUN file path(actually it is a file, which collects all your SD data to be mounted as usb drive), that you should always replace in mind my defines with yours to make actual usb work.
Devices with flash memory(also called EMMC or embedded SD on flash) and SD[or without SD support at all], should be treat in custom way unfortunately I don't know, consult with your device CM devs for more details. And hey, most of these devices are on new usb gadget, so don't need my guide at all
<<
After addition, save strings.xml and go to res/xml in the same framework-res.That's where you also should use base framework-res.
copy from base to miui storage_list.xml and replace when prompted. That file provides only your device-specific SD support, not nexus S or whatever miui base you use.
Assemble miui framework-res.apk and, attention! disassemble it again. That action allows you to see resource ID-s for each line exactly in manner they will be used in living rom.
Remark:
Each resource-drawable, string, boolean switcher etc is treated by its ID - personal identificator. Resources are used in other frameworks and APK to identify something necessary for them. framework-res.apk is a resource storage, which handled by android.content.res package classes like ResourceManager.
USB subsystem also uses some resource to provide to user actual USB status and right mass storage.
<<
Make sure you have both base and miui framework-res, then open both: res/values/public.xml.
Now, we could start the main part - services.jar mod
After adding line "config_legacyUmsLunFile" there will be its id in public.xml after compiling. That's why I stand you should disassemble assembled framework-res again. Remember both ID-s from base and from miui.
Also you need ID-s from both base and miui for following resources:
"stat_sys_adb" - usb debugging icon
"adb_active_notification_title" - usb debugging short message
"adb_active_notification_message" - usb debugging long message
JellyBean-specific:
"config_oemUsbModeOverride" - usb mode override flag
Remark:
public.xml is a resource dictionary, example of line:
Code:
<public type="drawable" name="stat_sys_adb" id="0x010804f8" />
means as follows: public type="drawable", drawable - mere picture for different resolution, drawn on the screen, public type subsequently is a type of resource. name="stat_sys_adb" - name of resource, that may be name of acual file or string or bool define etc. id="0x010804f8" - hexadecimal resource identifier. Important note: most resource users are treat resource name without leading zero, for example, 0x010804f8 in usb smalis presented as 0x10804f8, that fact will be necessary on finding and replacing resources(I'd call it matching process), exactly what we are going to do with USB folder smalis.
<<
Open USB folder in miui services.jar (smali/com/android/server/usb), you will see smalis, as usual. Replace its contents with those in base services.jar' usb folder.
Then we are going to match resources: each ID you found in public.xml should be bound to resource call in smali. Let's start:
we will work with miui usb folder smalis. Open UsbService.smali, now remember what id was bound to config_legacyUmsLunFile in base public.xml, for example it was 0x01040029, eliminate leading zero and search file contents for resource 0x1040029, so you will find its entry. Replace that entry with resource you got from public.xml in miui, again, without leading zero. Search for the same ID in LegacyUsbDeviceManager.smali and replace it to miui one.
If you got how that process work, remaining task is match other resource id-s that listed above (usb debugging icon, long and short message). They will be in following files
LegacyUsbDeviceManager$LegacyUsbHandler
UsbDeviceManager$UsbHandler
JellyBean-specific:
UsbDeviceManager.smali also contains necessary switch - config_oemUsbModeOverride, also match ID-s with miui framework and here you go.
USB debugging message is not so necessary as mass storage [coz if resource of mass storage file not found, you won't get usb subsystem to work].
After matching is done, assemble services.jar.
Done! USB subsystem now works.
Another moment could be necessary is to change USB tether interface device to usb0 (as Nexus S is using rndis0 instead, and base whatever you choosed may also have another tether interface)
To change it, you again need a disassembled framework-res.apk(don't forget "apktool if") In it navigate to res/values/arrays.xml.
find the following:
Code:
<string-array name="config_tether_usb_regexs">
in nexus S full block will look like that:
Code:
<string-array name="config_tether_usb_regexs">
<item>[COLOR="Orange"]rndis0[/COLOR]</item>
</string-array>
Look, I highlighted interface name for you! So the only part you should do it is just replace it to yours. Example for usb0:
Code:
<string-array name="config_tether_usb_regexs">
<item>[COLOR="Orange"]usb0[/COLOR]</item>
</string-array>
Interface name could be seen in the same file but in base rom.
By The Way, do you see
Code:
<string-array name="config_tether_wifi_regexs">
<item>[COLOR="Orange"]wl0.1[/COLOR]</item>
</string-array>
right after usb one? That is the interface for wifi tether, that you also should change to yours (one your base needed) and that is it! I saw somewhere following interface variant:
Code:
<string-array name="config_tether_wifi_regex[/B]">
<item>[COLOR="orange"]tiap//d[/COLOR]</item>
</string-array>
which is for Sony [Ericsson] devices with Texas Instruments wifi chip, just see yours in base to check this out.
in the same file you may also fix Autobrightness levels, I mean those ones:
Code:
<integer-array name="config_autoBrightnessLevels">
<integer-array name="config_autoBrightnessLcdBacklightValues">
<integer-array name="config_autoBrightnessButtonBacklightValues">
<integer-array name="config_autoBrightnessKeyboardBacklightValues">
MIUI doesn't have autobrightness tweaks so that is the only way those levels could be applied.
To fully close framework-res and don't come back no more, let's see other things you could do with it:
Minimal brightness too low
There is a bug with brightness: when you regulating it to minmal, screen comes black and won't come back until wipe.
Reason is banal - screen highlight couldn't handle so low value (in nexus S it's 10), first of all find a line at res/values/integers.xml:
Code:
<integer name="config_screenBrightnessDim">10</integer>
in most cases value "20" will be reliable, so change "10" to "20":
Code:
<integer name="config_screenBrightnessDim">20</integer>
Fix "Network won't automatically picks up"
The problem on some devices like HTC on 7x30 QC architecture, is in one little switch [res/values/bools.xml] :
Code:
<bool name="skip_restoring_network_selection">[COLOR="orange"]true[/COLOR]</bool>
just change it to "false":
Code:
<bool name="skip_restoring_network_selection">[COLOR="orange"]false[/COLOR]</bool>
and network will come up.
Fix "Deep sleep issue on some devices"
Problem reported Wildfire S users resolved by that little define [res/values/bools.xml] :
Code:
<bool name="config_bluetooth_adapter_quick_switch">[COLOR="orange"]true[/COLOR]</bool>
change it to "false":
Code:
<bool name="config_bluetooth_adapter_quick_switch">[COLOR="orange"]false[/COLOR]</bool>
and issue will be resolved.
Also, it might be interesting to check out all bools.xml defines to see if something should be changed.
Fixing wrong hardware-software keyboard relationship [auto-rotate and showing issues] (also for galaxy tab 7)
Those with built-in hardware keyboard may experiencing following issue: when hardware keyboard opened, you also see a software keyboard and when you just need a software keyboard, it won't show. Also auto-rotate won't work properly when keyboard is activated.
Seems on Galaxy Tab 7 Samsung(or maybe Cyanogen Mod?) handles software keyboard in relation of some kind of dummy hardware keyboard, so it's our case too.
ICS-only:
To fix that issue, disassemble miui android.policy.jar and navigate to smali/com/android/internal/policy/impl/PhoneWindowManager.smali
there are three constants, according to the source: 0(0x0) - lid closed, 1(0x1) - lid open, and -1(-0x1) - lid absent.
they are located after a function "GetSwitchState".
Original idea was to swap these constants so that system gets fooled about your keyboard state:
code that exists:
Code:
const/4 v1, 0x1
-> code that you will get after mod:
Code:
const/4 v1, 0x0
the same you should proceed with zero:
Code:
const/4 v1, 0x0
->
Code:
const/4 v1, 0x1
you might also have to change
Code:
const/4 v1, -0x1
->
Code:
const/4 v1, 0x1
to get rid of absent state.
another ways to fix this up:
res/values/bools.xml
change
Code:
<bool name="config_forceDisableHardwareKeyboard">[COLOR="Orange"]false[/COLOR]</bool>
->
Code:
<bool name="config_forceDisableHardwareKeyboard">[COLOR="Orange"]true[/COLOR]</bool>
as we see, it force-disables hardware keyboard so that only soft one will show up.
for devices with hardware keyboard that might also be a deal:
res/values/integers.xml
change the following two line:
Code:
<integer name="config_lidOpenRotation">90</integer>
<integer name="config_lidKeyboardAccessibility">1</integer>
Next questions will be related to various APK fixes:
before we start you need to know that all apk are depend on framework-res resources, so before you start disassembling them, let's clarify steps: "apktool if" each framework with resources you have in miui, in stock there are two:
Code:
apktool if framework-res.apk
Code:
apktool if framework-miui-res.apk
then each apk could be disassembled as usual.
Getting rid of MIUI start screen
Have you mentioned it? Ya, that annoying setup wizard.. In the end it suggests you to input your XIAOMI account which some users may never had and won't create. Keep them out of stress - get rid of that wizard!
Let me show how:
there are 2 ways, one - fully infiltrate that wizard from user's eye, second - will let you choose a language(useful in multilanguage releases) and setup wifi, then go right to homescreen.
Common moment: disassemble Provision.apk and go to smali contents - com/android/provision and choose DefaultActivity.smali
First method - codename "infiltration":
we will modify contents of "isProvisioned" method.
Kill all except "const/4 v1" and "return v1" in it, change const/4 v1 to 0x1 so you will get something like that:
Code:
.method private deviceIsProvisioned()Z
.locals 3
.prologue
const/4 v1, 0x1
return v1
.end method
actually, we are just saying to setup wizard that device is already passed its steps and don't need them anymore. So that setup wizard won't even be showed.
Second method - codename "multilang":
it is based on exploit, which is as follows: one could bypass xiaomi account prompt if before flashing miui he pull off sim card and then on setupwizard won't set up wifi. Wizard will send you to "sim not found" dialog, which then will allow one to "dismiss" account request.
Line which asks about SIM state is as follows:
Code:
invoke-virtual {v1}, Landroid/telephony/TelephonyManager;->getSimState()I
then
Code:
move-result v1
const/4 v2, 0x5
some variable now consists of returned value.
To initialte that value to fail a check, I've just changed constant value to one that telephony manager will never return: -0x5
Code:
const/4 v2, -0x5
Now its time to point fail to logical end of wizard, we are going to change label..
Code:
if-ne v1, v2, :[COLOR="DarkOrange"]cond_5[/COLOR]
if not equals v1, v2 (if (v1!=v2) in С manner ) go to label cond_5. As we stated, v1 won't be equal v2,so it will go to cond_5, which is not a place we wish to go (coz of unbelieveable hardcode). But there is a wishable place - cond_6:
Code:
invoke-direct {p0}, Lcom/android/provision/DefaultActivity;->finishSetup()V
yyyyeah, right to finish
so we are changing cond_5 to cond_6:
Code:
if-ne v1, v2, :[COLOR="DarkOrange"]cond_6[/COLOR]
that's it! In the end you will get: language selection->wifi setup->homescreen, almost briliant!
Whether you choosed first or second method - assemble apk you got after all things done.
Fixing not working mic in calls
Disassemble Phone.apk and navigate to res/values/bools.xml to change:
Code:
<bool name="send_mic_mute_to_AudioManager">[COLOR="Orange"]false[/COLOR]</bool>
->
Code:
<bool name="send_mic_mute_to_AudioManager">[COLOR="orange"]true[/COLOR]</bool>
Fixing pin code prompt on xperia devices
Disassemble Phone.apk and navigate to res/values/bools.xml to change:
Code:
<bool name="ignore_sim_network_locked_events">[COLOR="orange"]false[/COLOR]</bool>
->
Code:
<bool name="ignore_sim_network_locked_events">[COLOR="orange"]true[/COLOR]</bool>
Enabling hidden settings
Did you know that you may activate LEDs settings? Or maybe use camera key to trigger some useful functions? If not, follow the next little tuto.
Disassemble Settings.apk, navigate to bools.xml in res/values.
Activating LED settings
It would be enough to change
Code:
<bool name="has_led">[COLOR="orange"]false[/COLOR]</bool>
->
Code:
<bool name="has_led">[COLOR="orange"]true[/COLOR]</bool>
As you may got, other hidden settings are also there, I'll just list them and assume all of them needs just replacement false to true to make them activated
Multitouch gestures
Still didn't mentioned how they works, but, xiaomi wouldn't make something just for its appearence in settings.
Code:
<bool name="has_multi_touch">[COLOR="orange"]false[/COLOR]</bool>
MI button
Mi button on any device that has camera button!
What is MI button? It's a tweak that allows dedicated button to do something instead of its mere function (for example-issuing camera app as for cam button). You may adjust any app in rom to be executed, any switch from miui switchers and also trigger some actions like "menu", "call", "screen off toggle"(allows you to switch screen on and off, so possibly replace power button which is mostly weak) and "screenshot".
how to activate it? - the same:
Code:
<bool name="has_camera_key">[COLOR="orange"]false[/COLOR]</bool>
change to "true"
Dock settings
mere dock station settings dialog.
Code:
<bool name="has_dock_settings">[COLOR="orange"]false[/COLOR]</bool>
Trackball settings
for devices such as nexus one with active trackball.
Code:
<bool name="has_track_ball">[COLOR="orange"]false[/COLOR]</bool>
"Black bar" fix
more details - https://www.dropbox.com/s/6u63tozthmj6xa9/Screenshot_2012-08-07-09-49-09.png
Let's get MiuiSystemUI.apk and disassemble it.
Locate to res/values/drawables.xml and delete first line:
Code:
<item type="drawable" name="notification_header_bg">#ff000000</item>
it might vary but always contains black colour (#ff000000). Recompile modified systemUI.
Least but hope not last define for that guide, hope it will fill up with latest and greatest from MIUI devices users and porters around the world.
Cheers, L_F.

Finally Come up with great Tut.. Thanks Alot Brother

Very detailed and good written tutorial! Thanks and good job!

Thanks

AS my device bricked, you could always tell me what to replace/add on my guide, so it will look up-to-date
ADD: added Stage 3.

Done. Have something to add? Write here, I'll form a new guide branch for you. Found a mistake? Contact me.
BTW, if somebody have more time than I, It would be great you could support that guide to keep it up-to-date.

Thanks for the detailed guide. I just started porting for my device. I have one question though. Once I successfully port to one version, what are the files I need to consider for next version? I think some files I can just use from the previous port (like hardware related files). If you have any suggestions on the files I have to look for while porting next version of miui, it will be very helpful. Not sure whether I am asking the right question. Looks like once I do this I can reuse all the files for next port

raj_k_r said:
Thanks for the detailed guide. I just started porting for my device. I have one question though. Once I successfully port to one version, what are the files I need to consider for next version? I think some files I can just use from the previous port (like hardware related files). If you have any suggestions on the files I have to look for while porting next version of miui, it will be very helpful. Not sure whether I am asking the right question. Looks like once I do this I can reuse all the files for next port
Click to expand...
Click to collapse
I replace all the files from last build on next and try to boot.
If I get errors, I look if I have to replace more files or re-replace some.

what are the files I need to consider for next version? I
Click to expand...
Click to collapse
All the same, you have to repeat guide for each release coz frameworks are changing each release.
I'd form a patch kit with all smalis you want to replace and patch remaining each time.

here is my logcat
what the things need to change
assetmanager.smali ??? and/or any other things ????
Code:
$ adb logcat
I/miui ( 1113): Welcome to Android 4.0.4 /
I/miui ( 1114): .-.-.-..-..-..-..-. .-..-..---.
I/miui ( 1115): | | | || || || || | | || | \ \
I/miui ( 1116): '-'-'-''-''----''-'O'----''---'
I/miui ( 1117):
I/run-parts( 1108): dealing with default theme
I/mountext( 1129): Checking /dev/block/mmcblk0p2 for errors...
I/run-parts( 1108): e2fsck 1.41.12 (17-May-2010)
I/run-parts( 1108): /dev/block/mmcblk0p2: clean, 11/1050624 files, 132591/420099 7 blocks
I/run-parts( 1108): mount: mounting /dev/block/mmcblk0p2 on /sd-ext failed: No s uch file or directory
E/mountext( 1133): Unable to mount filesystem for /sd-ext!
I/mountext( 1136): No swap partition found.
I/apps2sd ( 1139): /sd-ext not mounted...nothing to do
I/run-parts( 1108): cp: can't stat '/system/etc/wifi/hostapd.conf': No such file or directory
I/run-parts( 1108): chown: /data/misc/wifi/hostapd.conf: No such file or directo ry
I/run-parts( 1108): chmod: /data/misc/wifi/hostapd.conf: No such file or directo ry
I/DEBUG ( 1158): debuggerd: Jul 14 2012 05:52:57
I/Vold ( 1156): Vold 2.1 (the revenge) firing up
D/Vold ( 1156): Volume sdcard state changing -1 (Initializing) -> 0 (No-Media )
I/Netd ( 1157): Netd 1.0 starting
D/Vold ( 1156): Volume sdcard state changing 0 (No-Media) -> 2 (Pending)
D/DirectVolume( 1156): DirectVolume::handlePartitionAdded -> MAJOR 179, MINOR 1, PARTN 1
D/DirectVolume( 1156): DirectVolume::handlePartitionAdded -> MAJOR 179, MINOR 2, PARTN 2
D/Vold ( 1156): Volume sdcard state changing 2 (Pending) -> 1 (Idle-Unmounted )
E/Netd ( 1157): Unable to bind netlink socket: No such file or directory
E/Netd ( 1157): Unable to open quota2 logging socket
D/AndroidRuntime( 1161):
D/AndroidRuntime( 1161): >>>>>> AndroidRuntime START com.android.internal.os.Zyg oteInit <<<<<<
D/AndroidRuntime( 1161): CheckJNI is OFF
I/SurfaceFlinger( 1160): SurfaceFlinger is starting
I/SurfaceFlinger( 1160): SurfaceFlinger's main thread ready to run. Initializing graphics H/W...
E/qsd8k.gralloc( 1160): We support 2 buffers
I/qsd8k.gralloc( 1160): using (fd=9)
I/qsd8k.gralloc( 1160): id = msmfb31_1ffff
I/qsd8k.gralloc( 1160): xres = 480 px
I/qsd8k.gralloc( 1160): yres = 854 px
I/qsd8k.gralloc( 1160): xres_virtual = 480 px
I/qsd8k.gralloc( 1160): yres_virtual = 1708 px
I/qsd8k.gralloc( 1160): bpp = 16
I/qsd8k.gralloc( 1160): r = 11:5
I/qsd8k.gralloc( 1160): g = 5:6
I/qsd8k.gralloc( 1160): b = 0:5
I/qsd8k.gralloc( 1160): width = 76 mm (160.421051 dpi)
I/qsd8k.gralloc( 1160): height = 136 mm (159.497055 dpi)
I/qsd8k.gralloc( 1160): refresh rate = 0.00 Hz
D/CALCFPS ( 1160): DEBUG_CALC_FPS: 0
D/CALCFPS ( 1160): period: 10
D/CALCFPS ( 1160): ignorethresh_us: 500000
D/CALCFPS ( 1160): DEBUG_CALC_FPS: 0
D/CALCFPS ( 1160): period: 10
D/CALCFPS ( 1160): ignorethresh_us: 500000
D/FramebufferNativeWindow( 1160): mNumBuffers = 2
D/libEGL ( 1160): loaded /system/lib/egl/libGLES_android.so
D/libEGL ( 1160): loaded /system/lib/egl/libEGL_adreno200.so
D/libEGL ( 1160): loaded /system/lib/egl/libGLESv1_CM_adreno200.so
D/libEGL ( 1160): loaded /system/lib/egl/libGLESv2_adreno200.so
I/AudioFlinger( 1163): Loaded primary audio interface from LEGACY Audio HW HAL ( audio)
I/AudioFlinger( 1163): Using 'LEGACY Audio HW HAL' (audio.primary) as the primar y audio interface
I/AudioFlinger( 1163): Loaded a2dp audio interface from A2DP Audio HW HAL (audio )
D/AudioHardwareInterface( 1163): setMode(NORMAL)
I/AudioHardwareQSD( 1163): Set master volume to 1.000000.
I/CameraService( 1163): CameraService started (pid=1163)
E/CameraService( 1163): Could not load camera HAL module
I/SurfaceFlinger( 1160): EGL informations:
I/SurfaceFlinger( 1160): # of configs : 35
I/SurfaceFlinger( 1160): vendor : Android
I/SurfaceFlinger( 1160): version : 1.4 Android META-EGL
I/SurfaceFlinger( 1160): extensions: EGL_KHR_image EGL_KHR_image_base EGL_KHR_fe nce_sync EGL_ANDROID_image_native_buffer EGL_ANDROID_image_native_buffer EGL_AND ROID_get_render_buffer
I/SurfaceFlinger( 1160): Client API: OpenGL ES
I/SurfaceFlinger( 1160): EGLSurface: 5-6-5-0, config=0x0
I/SurfaceFlinger( 1160): OpenGL informations:
I/SurfaceFlinger( 1160): vendor : Qualcomm
I/SurfaceFlinger( 1160): renderer : Adreno (TM) 200
I/SurfaceFlinger( 1160): version : OpenGL ES-CM 1.1
I/SurfaceFlinger( 1160): extensions: GL_AMD_compressed_ATC_texture GL_AMD_perfor mance_monitor GL_APPLE_texture_2D_limited_npot GL_ARB_vertex_buffer_object GL_EX T_texture_filter_anisotropic GL_EXT_texture_format_BGRA8888 GL_EXT_texture_type_ 2_10_10_10_REV GL_OES_blend_equation_separate GL_OES_blend_func_separate GL_OES_ blend_subtract GL_OES_compressed_ETC1_RGB8_texture GL_OES_compressed_paletted_te xture GL_OES_depth_texture GL_OES_draw_texture GL_OES_EGL_image GL_OES_EGL_image _external GL_OES_framebuffer_object GL_OES_matrix_palette GL_OES_packed_depth_st encil GL_OES_point_size_array GL_OES_point_sprite GL_OES_read_format GL_OES_rgb8 _rgba8 GL_OES_stencil_wrap GL_OES_texture_cube_map GL_OES_texture_env_crossbar G L_OES_texture_float GL_OES_texture_half_float GL_OES_texture_half_float_linear G L_OES_texture_npot GL_OES_texture_mirrored_repeat GL_QCOM_binning_control GL_QCO M_extended_get GL_QCOM_tiled_rendering GL_AMD_compressed_3DC_texture
I/SurfaceFlinger( 1160): GL_MAX_TEXTURE_SIZE = 4096
I/SurfaceFlinger( 1160): GL_MAX_VIEWPORT_DIMS = 4096 x 4096
I/SurfaceFlinger( 1160): flags = 00200000
D/CALCFPS ( 1160): DEBUG_CALC_FPS: 0
D/CALCFPS ( 1160): period: 10
D/CALCFPS ( 1160): ignorethresh_us: 500000
D/libEGL ( 1273): loaded /system/lib/egl/libGLES_android.so
D/libEGL ( 1273): loaded /system/lib/egl/libEGL_adreno200.so
D/libEGL ( 1273): loaded /system/lib/egl/libGLESv1_CM_adreno200.so
D/libEGL ( 1273): loaded /system/lib/egl/libGLESv2_adreno200.so
E/dalvikvm( 1161): ERROR: couldn't find native method
E/dalvikvm( 1161): Requested: Landroid/content/res/AssetManager;.splitThemePacka ge:(Ljava/lang/String;Ljava/lang/String;[Ljava/lang/String;)I
E/JNIHelp ( 1161): RegisterNatives failed for 'android/content/res/AssetManager' , aborting
F/libc ( 1161): Fatal signal 11 (SIGSEGV) at 0xdeadbaad (code=1)
I/AudioFlinger( 1163): AudioFlinger's thread 0x105c8 ready to run
W/AudioFlinger( 1163): Thread AudioOut_1 cannot connect to the power manager ser vice
I/AudioHardwareQSD( 1163): Routing audio to Speakerphone
D/AudioHardwareQSD( 1163): Switching audio device to
D/AudioHardwareQSD( 1163): Speakerphone
I/AudioPolicyService( 1163): Loaded audio policy from LEGACY Audio Policy HAL (a udio_policy)
I/DEBUG ( 1158): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** * **
I/DEBUG ( 1158): Build fingerprint: 'SEMC/LT18i_0000-0000/LT18i:4.0.3/4.1.C.0. 7/-H9_3w:user/release-keys'
I/DEBUG ( 1158): pid: 1161, tid: 1161 >>> zygote <<<
I/DEBUG ( 1158): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr deadbaa d
I/DEBUG ( 1158): r0 deadbaad r1 00000001 r2 a0000000 r3 00000000
I/DEBUG ( 1158): r4 00000000 r5 00000027 r6 40838acd r7 00000036
I/DEBUG ( 1158): r8 401aca80 r9 4018d722 10 0000904c fp 00009062
I/DEBUG ( 1158): ip 401f7240 sp beedba60 lr 4001f881 pc 4001bbcc cpsr 600 00030
I/DEBUG ( 1158): d0 2f64696f72646e61 d1 2f746e65746e6f63
I/DEBUG ( 1158): d2 657373412f736572 d3 726567616e614d74
I/DEBUG ( 1158): d4 0000d4cc0000d4b1 d5 0000d4e80000d4cd
I/DEBUG ( 1158): d6 0000d5040000d4e9 d7 0000d5200000d505
I/DEBUG ( 1158): d8 0000000000000000 d9 0000000000000000
I/DEBUG ( 1158): d10 0000000000000000 d11 0000000000000000
I/DEBUG ( 1158): d12 0000000000000000 d13 0000000000000000
I/DEBUG ( 1158): d14 0000000000000000 d15 0000000000000000
I/DEBUG ( 1158): d16 7265747369676552 d17 207365766974614e
I/DEBUG ( 1158): d18 0000d5740000d559 d19 0000d5900000d575
I/DEBUG ( 1158): d20 0000d5ac0000d591 d21 0000d5c80000d5ad
I/DEBUG ( 1158): d22 0000d5e40000d5c9 d23 0000d6000000d5e5
I/DEBUG ( 1158): d24 0000000000000000 d25 0000000000000000
I/DEBUG ( 1158): d26 0000000000000000 d27 0000000000000000
I/DEBUG ( 1158): d28 0000000000000000 d29 0000000000000000
I/DEBUG ( 1158): d30 0000000000000000 d31 0000000000000000
I/DEBUG ( 1158): scr 60000010
I/DEBUG ( 1158):
I/AudioHardwareQSD( 1163): AudioHardware pcm playback is going to standby.
I/DEBUG ( 1158): #00 pc 00017bcc /system/lib/libc.so
I/DEBUG ( 1158): #01 pc 0000c282 /system/lib/libnativehelper.so (jn iRegisterNativeMethods)
I/DEBUG ( 1158): #02 pc 00044778 /system/lib/libandroid_runtime.so (_ZN7android14AndroidRuntime21registerNativeMethodsEP7_JNIEnvPKcPK15JNINativeMet hodi)
I/DEBUG ( 1158): #03 pc 0005e0a6 /system/lib/libandroid_runtime.so (_ZN7android37register_android_content_AssetManagerEP7_JNIEnv)
I/DEBUG ( 1158): #04 pc 00044884 /system/lib/libandroid_runtime.so
I/DEBUG ( 1158): #05 pc 000448b6 /system/lib/libandroid_runtime.so (_ZN7android14AndroidRuntime8startRegEP7_JNIEnv)
I/DEBUG ( 1158): #06 pc 000449ac /system/lib/libandroid_runtime.so (_ZN7android14AndroidRuntime5startEPKcS2_)
I/DEBUG ( 1158): #07 pc 00008f0a /system/bin/app_process
I/DEBUG ( 1158): #08 pc 00016bd0 /system/lib/libc.so (__libc_init)
I/DEBUG ( 1158):
I/DEBUG ( 1158): code around pc:
I/DEBUG ( 1158): 4001bbac 4623b15c 2c006824 e026d1fb b12368db \.#F$h.,..&..h# .
I/DEBUG ( 1158): 4001bbbc 21014a17 6011447a 48124798 24002527 .J.!zD.`.G.H'%. $
I/DEBUG ( 1158): 4001bbcc f7f47005 2106edda ee86f7f5 460aa901 .p.....!....... F
I/DEBUG ( 1158): 4001bbdc f04f2006 94015380 94029303 ea32f7f5 . O..S........2 .
I/DEBUG ( 1158): 4001bbec 4622a905 f7f52002 f7f4ea3c 2106edc6 .."F. ..<...... !
I/DEBUG ( 1158):
I/DEBUG ( 1158): code around lr:
I/DEBUG ( 1158): 4001f860 41f0e92d 46804c0c 447c2600 68a56824 -..A.L.F.&|D$h. h
I/DEBUG ( 1158): 4001f870 e0076867 300cf9b5 dd022b00 47c04628 gh.....0.+..(F. G
I/DEBUG ( 1158): 4001f880 35544306 37fff117 6824d5f4 d1ee2c00 .CT5...7..$h.,. .
I/DEBUG ( 1158): 4001f890 e8bd4630 bf0081f0 00028c7e 41f0e92d 0F......~...-.. A
I/DEBUG ( 1158): 4001f8a0 fb01b086 9004f602 461f4815 4615460c .........H.F.F. F
I/DEBUG ( 1158):
I/DEBUG ( 1158): memory map around addr deadbaad:
I/DEBUG ( 1158): beec7000-beedc000 [stack]
I/DEBUG ( 1158): (no map for address)
I/DEBUG ( 1158): (no map above)
I/DEBUG ( 1158):
I/DEBUG ( 1158): stack:
I/DEBUG ( 1158): beedba20 4019702a /system/lib/libandroid_runtime.so
I/DEBUG ( 1158): beedba24 4b9f7e00 /dalvik-LinearAlloc (deleted)
I/DEBUG ( 1158): beedba28 4b9f75e8 /dalvik-LinearAlloc (deleted)
I/DEBUG ( 1158): beedba2c 0000002b
I/DEBUG ( 1158): beedba30 40048780 /system/lib/libc.so
I/DEBUG ( 1158): beedba34 40048718 /system/lib/libc.so
I/DEBUG ( 1158): beedba38 00000000
I/DEBUG ( 1158): beedba3c 4001f881 /system/lib/libc.so
I/DEBUG ( 1158): beedba40 00000000
I/DEBUG ( 1158): beedba44 beedba74 [stack]
I/DEBUG ( 1158): beedba48 40838acd /system/lib/libdvm.so
I/DEBUG ( 1158): beedba4c 00000036
I/DEBUG ( 1158): beedba50 401aca80 /system/lib/libandroid_runtime.so
I/DEBUG ( 1158): beedba54 4001e9ed /system/lib/libc.so
I/DEBUG ( 1158): beedba58 df0027ad
I/DEBUG ( 1158): beedba5c 00000000
I/DEBUG ( 1158): #00 beedba60 1d200031
I/DEBUG ( 1158): beedba64 52010c85
I/DEBUG ( 1158): beedba68 40196926 /system/lib/libandroid_runtime.so
I/DEBUG ( 1158): beedba6c 0000f2c8 [heap]
I/DEBUG ( 1158): beedba70 40196926 /system/lib/libandroid_runtime.so
I/DEBUG ( 1158): beedba74 fffffbdf
I/DEBUG ( 1158): beedba78 00000036
I/DEBUG ( 1158): beedba7c 0000f2c8 [heap]
I/DEBUG ( 1158): beedba80 40196926 /system/lib/libandroid_runtime.so
I/DEBUG ( 1158): beedba84 401d0285 /system/lib/libnativehelper.so
I/DEBUG ( 1158): #01 beedba88 0000f2c8 [heap]
I/DEBUG ( 1158): beedba8c 1d200031
I/DEBUG ( 1158): beedba90 0000f2c8 [heap]
I/DEBUG ( 1158): beedba94 4018dbb8 /system/lib/libandroid_runtime.so
I/DEBUG ( 1158): beedba98 40196926 /system/lib/libandroid_runtime.so
I/DEBUG ( 1158): beedba9c 4019365b /system/lib/libandroid_runtime.so
I/DEBUG ( 1158): beedbaa0 1d200025
I/DEBUG ( 1158): beedbaa4 4015177b /system/lib/libandroid_runtime.so
I/ServiceManager( 1155): service 'media.audio_flinger' died
I/ServiceManager( 1155): service 'media.player' died
I/ServiceManager( 1155): service 'media.camera' died
I/ServiceManager( 1155): service 'media.audio_policy' died

what the things need to change
assetmanager.smali ???
Click to expand...
Click to collapse
right you are. Read third stage, you will orient on those logs more fluently ;]

Ленс, у меня при декомпиляции frasmework.jar от miui.us(Desire HD) появляются ошибки: http://yadi.sk/d/8ylx4nI504DD
Подскажи,это нормально или нет?

Lens, mind you translate that to russian or ukrainian and share with me? My mail [email protected]
Click to expand...
Click to collapse
I'm not planning such translation in near future, sorry.
пока нет времени на подобный перевод, извините.

lens! log attached
http://sebsauvage.net/paste/?c0dc044424fe8df6#mlqLGewvWaQYfr2e/iPyiMotdNf1+oE50qBIn5IGPNA=

Hello,
Can same one help me out? My MIUI port has two mayor issue. First is sometimes my device not boot. Seems totally random for me. The logcat simple stops at a point, and it not continue the reboot process, but the boot animation just going and going. After I reboot my device it boot up without any problem... Sometimes boot up at the first time... sometimes not... Seems totally random.
Here is the log: http://pastebin.com/XVMBQS8L
As I mentioned it just stop at this and not go any further until I reset with the reset button.
My other problem with it is, after I receive an email and MIUI send a notification to the statusbar soon after it crash. And keeps crash (reboot) until I remove those notifacations. Here is the log: http://pastebin.com/Fn2zhAxL
Any idea how to fix it? Thank you very much in advance!

log attached
http://sebsauvage.net/paste/?c0dc044...E50qBIn5IGPNA=
Click to expand...
Click to collapse
that one:
Code:
E/AndroidRuntime(1305): java.lang.NoClassDefFoundError: com.android.server.CpuGovernorService
check your services.jar for CpuGovernorService I almost sure it's not there
sometimes my device not boot. Seems totally random for me. The logcat simple stops at a point, and it not continue the reboot process, but the boot animation just going and going
Click to expand...
Click to collapse
Sounds like there are codecs which faulty when talk with miui frameworks. Could you wipe out them?
after I receive an email and MIUI send a notification to the statusbar soon after it crash. And keeps crash (reboot) until I remove those notifacations.
Click to expand...
Click to collapse
yess, again faulty codecs..
Hey flytouch users, why you want miui for that MONSTER?

I could boot but it says SystemUI has stopped, updater has stopped. There is no status bar. But I can make calls, send SMS, wifi works, can apply themes. What could be the problem for SystemUI stopped error? Nowhere I could get the answer. In some thread I read that I have to copy framework-res-miui.xml to etc/permissions but I could not find this file anywhere.
Attaching the log file.

[REF|R&D|RF] RF/Radio properties of Samsung ServiceMode

RF/Radio properties of the ServiceMode Application
Thread Difficulty: HARD
Thread Noob Patience: LOW
Thread Topic
This thread is a Reference and Research & Development thread for
investigating and to better document the various radio related variables
as found and displayed by the ServiceMode application. Here we are
particularly concerned with those found in Samsung phones, but as
you will see, this is more modem (BP/CP) dependent than phone model
dependent. So much of this info should also apply to other devices
using the same modem.
Off Topic?
If you have questions that does not directly concern the main focus
of this thread, please ask in the general forum. If you ask support
questions here, they will be deleted without warning.
If you're just looking for info how to enter the Service Menu on a recent
Samsung, look in this thread:
[REF][ServiceMode] How to make your Samsung perform dog tricks
Background
Because the ServiceMode (SM) application is really running in the
Modem under its own RTOS, it is limited in the presentation. So what
you see running in the AOS ServiceMode application is really just a
Java wrapper to code that is running in the RTOS. This severely
limits the information presented, if accessible at all.
Most mobile device manufacturers doesn't want their users to have
access to the ServiceMode functions, for various and good reasons.
Perhaps the best reason is that you can easily hard-brick your
device and/or mess up all the internal radio related settings.
However, we are already used to this, so why not have a better look
at the mobile network parameters within our devices. These can be
extremely useful from identifying network problems to detect and
prevent illegal or clandestine mobile network monitoring.
So what are the limiting factors of the ServiceMode Application?
It is a Java wrapper application that is usually made by
the device manufacturer (Samsung, HTC, Nokia etc) that
need to be present and compatible with your AOS FW.
(API, RIL etc)
The actual code is running in Modem RTOS and usually queried
by ServiceMode.apk by the use of a RIL_REQUEST_OEM_HOOK_RAW request,
that allows requests to circumvent the normal RIL filter.
The parameters present depends on the Modem FW versions.
(You will find many misspellings and other FUBAR objects in
various modem SM presentations.)
The displayed RF related parameters depend on the Modem HW,
and are thus completely different in an Intel XMM modem, than
for an Qualcomm MSM type modem/processor SoC, and so on.
The displayed RF related parameters depend on the network
you are currently using and connected to.
But the mobile network interface is transparent from the AOS AP point
of view, so a large set of radio parameters must comply to the 3GPP
standards in order for your device to function properly. But only a
very small subset of these RF parameters are part of the non-internal AOS API.
We want more!
By carefully looking at all the details and information that is
presented by the SM application, we can find out many more and
useful network details, such as ciphering modes, network types,
bands, and technology used. But to do this we need to understand
the language used. Unfortunately, many times the language does
not reflect the current 3GPP standards, so we are left to guess,
until some anonymous modem RF-expert/developer come along and
correct us.
So if you happen to know anything specific, this is where you
can really help this thread...
ServiceMode Vocabulary
Here I try to resolve some of the more obscure sounding items,
as found in the SM of mainly two devices.
(a) Samsung Galaxy S2 (GT-I9100, XXKI1 with Intel XMM6260 modem)
(b) Samsung Galaxy S4-mini (GT-I9195, XXUBML4 with Qualcomm MSM8930AB SoC)
In post#2 you will find an almost complete menu structure for
the UMTS MENU items as found in (b). I have not posted the items
for the LTE or CDMA menus, since I don't have that network, which
means I don't know how they would look. So feel free to post your
own findings, if you use those.
Also, remember that the end-point/detailed view of the menu
items, depend on your current network. I.e. you will see
different items, when connected to GSM vs. WCDMA, and so on.
In post#3 I show the detailed explanations of the various
3GPP defined RR timers as shown under the NAS/MM items.
In post#4 I attempt to describe the specific end-point menu items:
Code:
[SIZE=2] [1] BASIC INFORMATION
[1] MM INFORMATION
[2] MM REJECT CAUSE
[3] GMM REJECT CAUSE
[3] AS INFORMATION
[4] NEIGHBOUR CELL
[/SIZE]
I still need help deciphering some of those values.
(What exactly do they represent and mean?)
​

The root MAIN MENU
Code:
MAIN MENU
[1] [B]UMTS[/B]
[2] CDMA
[3] LTE
[4] SIM- Not Used. ==> <E>
[5] DOCOMO DEBUG SCREEN
[6] run EFS SYNC()
[7] DEBUG SCREEN
The UMTS MENU tree
Here is an almost complete menu structure for the UMTS MENU items
found in a GT-I9195. I have not posted the items for the LTE or CDMA
menus, since I don't have that network, which means I don't know how
they would look. So please post your own findings, if you use those.
Code:
[SIZE=2][1] UMTS MAIN MENU
[1] DEBUG SCREEN
[2] VERSION INFORMATION
[3] UMTS RF NV
[4] GSM RF NV
[5] AUDIO
[6] COMMON
[7] LTE BAND CONFIG CHECK
------------------------------
[1] DEBUG SCREEN
[1] BASIC INFORMATION ==> <E> Code: 0011
[2] NAS INFORMATION
[3] AS INFORMATION
[4] NEIGHBOUR CELL
[5] GPRS INFORMATION
[6] SIM INFORMATION
[7] HANDOVER
[8] PHONE CONTROL
[9] ANTENNA/ADC
[1] // BASIC INFORMATION ==> <E>
RRC: IDLE, Band1
MCC-MNC:nnn-01
RX: 10663, RI: -59, CID: hhhhh
TX: 9713, PSC: 394
EcIo: -4, RSCP: -63
SpeechVER: FR FR FR
L1: PCH_Sleep
Drx cycle: 64
SIB19 is received
therm: 162 LNA: 0
Service: Available
[2] NAS INFORMATION
[1] MM INFORMATION
[2] MM REJECT CAUSE
[3] GMM REJECT CAUSE
[4] PS REJECT CAUSE
[5] RESET MM&GMM REJECT List
[6] EF_RAT INFORMATION
[7] SAT REFRESH INFO
[8] SMC RESULT INFO
[9] CALL END CAUSE
[1] // MM INFORMATION
mm: Idle
MCC-MNV: nnn-01
LAC: hhh, RAC: nn
TIMER_T32: 10(S) 11(S) 12(A)
13(S) 20(S) 30(S) 40(S)
GmmState: Registered(3)
SubState: normal(0)
PmmMode: IDLE(1)
rej_cause: 0, IuAttCnt: 0
TMSI: hhhhhhh
[2] // MM REJECT CAUSE
MM reject Information List
1. Time: 1M 6D 0h00m00s
Type: 0, Cause:0 000-000, GSM
2. Time: 1M 6D 0h00m00s
Type: 0, Cause:0 000-000, GSM
3. Time: 1M 6D 0h00m00s
Type: 0, Cause:0 000-000, GSM
4. Time: 1M 6D 0h00m00s
Type: 0, Cause:0 000-000, GSM
5. Time: 1M 6D 0h00m00s
Type: 0, Cause:0 000-000, GSM
6. Time: 1M 6D 0h00m00s
Type: 0, Cause:0 000-000, GSM
[3] // GMM REJECT CAUSE
GMM reject Information List
1. Time: 4M 9D 14h19m02s
Type: 4, Cause:7 nnn-01, UMTS
2. Time: 1M 6D 0h00m00s
Type: 0, Cause:0 000-000, GSM
3. Time: 1M 6D 0h00m00s
Type: 0, Cause:0 000-000, GSM
4. Time: 1M 6D 0h00m00s
Type: 0, Cause:0 000-000, GSM
5. Time: 1M 6D 0h00m00s
Type: 0, Cause:0 000-000, GSM
[4] // PS REJECT CAUSE
PDP and PDN recet List
- No Data
[5] // RESET MM&GMM REJECT List <== Immediately clears reject list!
[6] // EF_RAT INFORMATION
Boot-up EF_RAT
NONE(-1)
Refreshed EF_RAT
1.GSM_WCDMA(1), 000-000
2.GSM_WCDMA(1), 000-000
3.GSM_WCDMA(1), 000-000
4.GSM_WCDMA(1), 000-000
5.GSM_WCDMA(1), 000-000
[7] // SAT REFRESH INFO
<exactly the same as above>
[8] // SMC RESULT INFO --> <E>
RRC: IDLE, Band1
MCC-MNC: nnn-01
RX: 10663, RI: -59, CID: hhhhh
TX: 9713, PSC: 394
EcIo: -4, RSCP: -63
SpeechVER: FR FR FR
L1: PCH_Sleep
Drx cycle: 64
SIB19 is received
therm: 162 LNA: 0
Service: Available
[9] // CALL END CAUSE --> <E>
<exactly the same as above>
[3] // AS INFORMATION
RRC: IDLE, Band1
WCDMA: IDLE
RX: 10663, RI: -59, CID: hhhhh
TX: 9713, PSC: 394
EcIo: -4, RSCP: -63
VOC: FR FR FR, 0
L1: PCH_Sleep
CQI: 0, Sam: 0
[4] // NEIGHBOUR CELL
Aset: [/SIZE][SIZE=2][SIZE=2]10663[/SIZE] 394 -60 -7 53 29 <== rapid changes
Sych: [/SIZE][SIZE=2][SIZE=2]10663[/SIZE] 403 -83 -51 31 -15
Sych: [/SIZE][SIZE=2][SIZE=2]10663[/SIZE] 403 -83 -51 31 -15
Sych: [/SIZE][SIZE=2][SIZE=2]10663[/SIZE] 403 -83 -51 31 -15
Asych: [/SIZE][SIZE=2][SIZE=2]10663[/SIZE] 422 -121 -49 29 -1
Asych: [/SIZE][SIZE=2][SIZE=2]10663[/SIZE] 262 -121 -49 0 0
Asych: [/SIZE][SIZE=2][SIZE=2]10663[/SIZE] 102 -121 -49 0 0
Asych: [/SIZE][SIZE=2][SIZE=2]10663[/SIZE] 450 -121 -49 0 0
[5] GPRS INFORMATION
FUNCTION:ds_gprs_information
[6] SIM INFORMATION
[1] General Info
[2] QMI UIM status
[3] CHECK NV
[1] // General Info
SIM Phase: 0
Card Capability: USIM
SIM voltage class: 1.8V SIM
None
None
Proactive command:
00 00 00 00 00 00 00 00 00 00 - ^^ (10 Hex)
[2] // QMI UIM status
CARD_STATE: Present
CARD_ERROR: Unknown
APP_TYPE: USIM
APP_STATE: Ready
PERSO_STATE: Ready
PERSO_FEATURE: Unsupported
PIN1_STATE: Enabled_Verified
pin1_num(3), puk1_num(10)
PIN2_STATE: Enabled_Not_Verified
pin2_num(3), puk2_num(10)
[3] // CHECK NV
CHECK NV
Band pref: Unexpected value
RTRE Configuration: SIM based
FTM Mode: Online Mode
ENS: Disabled
UIM CLASS: UMTS
[7] HANDOVER
[1] HANDOVER GtoG
[2] HANDOVER GtoW
[3] HANDOVER WtoG
[4] HANDOVER TEST
[8] PHONE CONTROL
[1] DRX CONTROL
[2] FAKE SECURITY CONTROL
[3] NAS CONTROL
[4] UE STATE CONTROL
[5] SIMULATION
[6] NETWORK LOCK
[7] NETWORK CONTROL
[1] // DRX CONTROL
DRX: Not Active
[1] DRX: ON
[2] DRX: OFF
[2] // FAKE SECURITY CONTROL
FAKE SECURITY: OFF
[1] FAKE SECURITY: ON
[2] FAKE SECURITY: OFF
[3] NAS CONTROL
[1] CIPHERING CONTROL
[2] INTEGRITY CONTROL
[3] SIM CLASS CONTROL
[4] REVISION CONTROL
[5] RRC(HSPA) CONTROL
[6] DUALMODE IMPROVEMENT CONTROL
[7] NAS AVOID SECURITY CONTROL
[1] // CIPHERING CONTROL
CIPHERING CONTROL: ON
[1] CIPHERING: ON
[2] CIPHERING: OFF
[2] // INTEGRITY CONTROL
INTEGRITY CONTROL: ON
[1] INTEGRITY: ON
[2] INTEGRITY: OFF
[3] // SIM CLASS CONTROL
UIM CLASS: UMTS
[1] UIM CLASS: UMTS
[2] UIM CLASS: GSM
[4] REVISION CONTROL
[1] DISPLAY REVISION
[2] CHENGE REVISION
[5] RRC(HSPA) CONTROL
[1] DISPLAY RRC REVISION
[2] CHANGE RRC REVISION
[6] // DUALMODE IMPROVEMENT CONTROL
DUALMODE IMPROVEMENT: NOT ACT
[1] DUALMODE IMPROVEMENT: ON
[2] DUALMODE IMPROVEMENT: OFF
[7] NAS AVOID SECURITY CONTROL
AVOID_SECURITY_CHECK: NOT ACT
[1] SECURITY_CHECK: ON
[2] SECURITY_CHECK: OFF
[4] UE STATE CONTROL
[1] CALL CONNECT STATE
[2] CHANGE RAT TO WCDMA
[3] CHANGE RAT TO GSM
[5] SIMULATION
[1] Modem Assert (Reset)
[2] SW WATCHDOG
[3] HW WATCHDOG
[4] CP Logging (Started)
[5] Realtime Log(OFF) - Don't! <== WTF?
[6] NETWORK LOCK
[1] PERSO SHA256 Info
SHA256_ENABLE_FLAG [1]
[7] NETWORK CONTROL
[1] GCF
[2] BAND SELECTION ==> Code: [B]2263[/B] "BAND"
[3] SERVICE DOMAIN
[4] AQUISITION ORDER
[5] PLMN(AUTO/MANUAL) SELECTIO
[6] FPLMN
[7] IMSI replacement
[1] GCF
[1] GSM/(E)GPRS/WCDMA REL8
[2] GSM/(E)GPRS/WCDMA REL7
[3] GSM/(E)GPRS/WCDMA REL6
[4] GSM/(E)GPRS/WCDMA REL5
[5] SETTING CANCELLATION
[2] BAND SELECTION
[1] Automatic
[2] WCDMA Band Preference
[3] GSM Band Preference
[4] LTE Band Preference
[3] // SERVICE DOMAIN
[1] CS + PS (*)
[2] CS ONLY
[3] PS ONLY
[4] // AQUISITION ORDER
[1] Automatic
[2] GSM_UMTS
[3] UMTS_GSM (*)
[4] No Change
[5] // PLMN(AUTO/MANUAL) SELECTIO
[1] AUTOMATIC (*)
[2] MANUAL
[6] FPLMN
[1] FPLMN READ
[2] FPLMN DELETE ALL
[3] FPLMN DELETE EXCL DOM
[7] // IMSI replacement
[1] Enable
[2] Disable (*)
[9] ANTENNA/ADC
ds_antenna_adc
------------------------------
[2] VERSION INFORMATION
[1] SW VERSION
[2] HW VERSION
[3] UMTS RF
[1] RF NV READ
[2] RF NV WRITE
[3] UMTS DIVERSITY CONTROL
[4] RF CALIBRATION CHECK
[4] GSM RF
[1] RF NV READ
[2] RF NV WRITE
[5] AUDIO ==> Locked! See Note (a)
...
[6] COMMON
[1] FTM
[2] DEBUG INFO
[3] RF SCANNING
[4] DIAG CONFIG
[5] WCDMA SET CHANNEL
[6] NV REBUILD
[7] FACTORY TEST
[8] FORCE SLEEP
[9] GPS
[1] FTM : OFF ==> Locked! See Note (b)
[1] NOT SUPPORT
[2] FTM : OFF
[2] DEBUG INFO
[1] MM REJECT CAUSE
[2] LOG DUMP
[3] UI DEBUG POPUP - N/S
[3] RF SCANNING
[1] SETTING
[2] START RF SCANNING
[3] RESULT TO PC
[4] RESULT TO SCREEN
[4] DIAG CONFIG
[1] USB ( )
[2] UART (*)
[3] DBG MSG ON (*)
[4] DBG MSG OFF ( )
[5] WCDMA SET CHANNEL
[6] NV REBUILD
[7] FACTORY TEST
[8] FORCE SLEEP
[9] GPS
co_gps_menu
[7] LTE BAND CONFIG CHECK --> <E>
[/SIZE]
(Where I have replaced my LAC/CID with "nnnnn" and "hhhhh", respectively)
Note that the end-point/detailed view of the menu items, depend on your
current network. I.e. you will see different items, when connected to GSM vs. WCDMA.
For example. Here is a picture comparing the BASIC INFORMATION view for LTE, CDMA and GSM/UMTS, respectively.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
(Picture stolen from THIS website. Sorry, there is no owner/contact info there to ask for permission.)
So what does all those numbers mean?
That's what we will try to figure out in the next posts and in this thread! But first I will show you
another menu view. The menu that concerns the MM (Mobile Management) MENU items.
To get to the picture below:
MAIN MENU > [1] UMTS MAIN MENU > [1] DEBUG SCREEN > [2] NAS INFORMATION > [1] MM INFORMATION
Which should result in:
Code:
[SIZE=2]mm: Idle
MCC-MNV: nnn-01
LAC: hhh, RAC: nn
[B]TIMER_T32[/B]: [B]10[/B](S) [B]11[/B](S) [B]12[/B](A)
[B]13[/B](S) [B]20[/B](S) [B]30[/B](S) [B]40[/B](S)
GmmState: Registered(3)
SubState: normal(0)
PmmMode: IDLE(1)
rej_cause: 0, IuAttCnt: 0
TMSI: hhhhhhh[/SIZE]
< placeholder >
As you can see, these include the values of a few important RR timers used. In the menu above they are
marked with (S) or (A), for STOPPED and ACTIVE, respectively. These timers are discussed further in
the next section.

The Mobility Management (MM) Timers: MS-side
All the MM timers are defined and thorough;y explained in [1]. But here I
summarize the timers we have found in our SM as shown above. Where we
have the following timers clearly visible:
Code:
[SIZE=2]T3210
T3211
T3212
T3213
T3220
T3230
T3240
[/SIZE]
Here's a summary table also taken and edited from [1].
The very brief 3GPP summary for T3210/11/12/13 is:
< WIP placeholder>
The very brief 3GPP summary for T3220/30/40 is:
Code:
[SIZE=2][B]T3220[/B] Timer is used during the MM states of:
- IMSI Detach Initiated
Timer is started at IMSI Detach.
Timer is stopped when: release from RM-sublayer
At expiry it: "enter Null or Idle, ATTEMPTING TO UPDATE" ??
[B]T3230[/B] Timer is used during the MM states of:
- Wait For Outgoing MM Connection
- Wait For Additional Outgoing MM Connection
- Wait TO Re-establish MM connection
Timer is started in the mobile station when:
- the MS makes a Ciphering Mode (CM) service request
- the MS makes a Ciphering Mode (CM) re-establishment request
Timer is stopped when:
- the MS makes a CM setting
- the MS receives a CM Service Reject
- the MS receives a CM Service Accept
At expiry it provides a release indicator.
[B]T3240[/B] Timer is started in the mobile station when:
- the mobile station receives a LOCATION UPDATING ACCEPT message completing a location updating procedure in the cases specified in subclauses 4.4.4.6 and 4.4.4.8;
- the mobile station receives a LOCATION UPDATING REJECT message in the cases specified in subclause 4.4.4.7;
- the mobile station has sent a CM SERVICE ABORT message as specified in subclause 4.5.1.7;
- the mobile station has released or aborted all MM connections in the cases specified in 4.3.2.5, 4.3.5.2, 4.5.1.1, and 4.5.3.1;
- the mobile station receives the paging message from network and enter the MM state 9 (WAIT FOR NETWORK COMMAND).
Timer is stopped, reset, and started again at receipt of an MM message.
Timer is stopped and reset (but not started) at receipt of a CM message that initiates establishment of an CM connection (an appropriate SETUP, REGISTER, or CP-DATA message as defined in 3GPP TS 24.008, 3GPP TS 24.010 [21] or 3GPP TS 24.011 [22]).
If timer expires, the MS shall abort the RR connection and enter the MM state MM IDLE.
[/SIZE]
References:
[1] "Mobile Radio Interface Layer 3 specification, Core Network Protocols"
3GPP TS 24.008 V12.5.0 (2014-03): (678 pages)
[2]

The Variable Vocabulary
Here is a list of variable names, and their inferred meaning, as found in the SM shown above.
Code:
[SIZE=2]
RX : Receive/Down-Link Channel aka "DL CH"
TX : Transmit/Up-Link Channel aka "UL CH"
RI : [dBm] RSSI (Receive Signal Strength Indicator)
CID : Cell ID
PSC : Primary Synchronization Code
EcIo : [1] Ec/Io = RSCP / RSSI = Eb/No - Gp
RSCP : [dBm] Received Signal Code Power [2,3] RSCP = RSSI + Ec/No
SpeechVER : The Voice Codec in use [EFR/FR/HR/AMR]
L1 : [FACH,DCH,BCH,PCH_Sleep]
Drx cycle : Discontinuous Reception (DRX) Cycle
therm : Thermal Power (
LNA : Low Noise Amplifier ???
mm: Idle : Mobile Management connection status ??
lu: Upda :
SS: Avail : Subsystem System Simulator ?? Secondary Synchronization Signal ??
RAC : Routing Area Code
TIMER_T32: 10 (S) : Really refers to the T3210 timer, and where
GmmState: Registered(3) :
SubState: normal(0) :
PmmMode: IDLE(1) :
rej_cause:0 :
luAttCnt:0 : Location Update (IMSI Attach?)/(Attempts?) Count
TMSI: 9xxxxxxd : Temporary Mobile Subscriber Identity
AS INFORMATION: : Access Stratum
VOC :
CQI : Channel-Quality Indication
Sam :
"Specific Anthropomorphic Mannequin" ??
"Service Aware Manager" (Alcatel/Lucent) ??
[/SIZE]
As you can see there are many not yet clearly defined items.
To clarify these (and others) is the main purpose of this thread!
< more crazy dragons to be >

< more crazy dragons to be >

A very nice book chapter and collection of useful baseband info and document links.
Benoit Michau, 2014
"Analyse de sécurité des modems mobiles"
[French]
Click to expand...
Click to collapse

LNA
E:V:A said:
The Variable Vocabulary
Here is a list of variable names, and their inferred meaning, as found in the SM shown above.
Code:
[SIZE=2]
LNA : Low Noise Amplifier ???
Click to expand...
Click to collapse
LNA = Line Noise Attenuator/Attenuation

oddball3 said:
LNA = Line Noise Attenuator/Attenuation
Click to expand...
Click to collapse
Thanks for your attention, but I don't think that is correct, because this is a radio device and not an ADSL-router or other "line" dependent device. You'll have to try harder to convince me. Links to a reliable source, helps.

E:V:A said:
Thanks for your attention, but I don't think that is correct, because this is a radio device and not an ADSL-router or other "line" dependent device. You'll have to try harder to convince me. Links to a reliable source, helps.
Click to expand...
Click to collapse
Not spot on, but proof of concept:
http://www.w3eee.com/Noiz .html
I had the perfect site I wanted to post here for you, and just to prove what a crappy country this is, our power utility decided to cut supply to our area :-\ I reckon I was about two sentences away from perfection haha!! Was so disappointed it's taken me since then to work up the enthusiasm to try again!!
Edit: Good Reference source - http://ieeexplore.ieee.org/xpl/logi...re.ieee.org/xpls/abs_all.jsp?arnumber=6471543

Few from me
PSC : Primary Scrambling Code (not synchronization)
L1 : RRC State [FACH,DCH,BCH,PCH_Sleep]
GmmState: Registered(3) : GPRS Mobiity Management status
PmmMode: IDLE(1) : Packet Mobiity Management status

E:V:A said:
Code:
[SIZE=2]mm: Idle
MCC-MNV: nnn-01
LAC: hhh, RAC: nn
[B]TIMER_T32[/B]: [B]10[/B](S) [B]11[/B](S) [B]12[/B](A)
[B]13[/B](S) [B]20[/B](S) [B]30[/B](S) [B]40[/B](S)
GmmState: Registered(3)
SubState: normal(0)
PmmMode: IDLE(1)
rej_cause: 0, IuAttCnt: 0
TMSI: hhhhhhh[/SIZE]
As you can see, these include the values of a few important RR timers used. In the menu above they are
marked with (S) or (A), for STOPPED and ACTIVE, respectively. These timers are discussed further in
the next section.
Click to expand...
Click to collapse
Interesting. But that way we can only know if a Timer is Stopped or Active.
How can we know the Value of these Timers?
Thanks.

vndnguyen said:
How can we know the Value of these Timers?
Click to expand...
Click to collapse
We can try to read its value from one of the SIM card EF files. I forgot which. We can also read it from the /dev/diag RF diagnostics device or possibly from the QMI (Qualcomm) debug ports. Or we can leave phone still and read the start/stop flags when they change. Or you can call the technicians of the MNO and ask.

E:V:A said:
We can try to read its value from one of the SIM card EF files. I forgot which.
Click to expand...
Click to collapse
I can read the EF files on the SIM cards. But the problem is that we don't know which EF files store those timers?
We can also read it from the /dev/diag RF diagnostics device or possibly from the QMI (Qualcomm) debug ports.
Click to expand...
Click to collapse
Can you give some detailed instruction about it? I have no idea on it.
Or we can leave phone still and read the start/stop flags when they change.
Click to expand...
Click to collapse
This is not a good way to read.
Or you can call the technicians of the MNO and ask.
Click to expand...
Click to collapse
Yes, I'm working at that MNO. But I still want to read those timers directly from the phone.

problem with gsm
hi gays.
i`ve a prblem with my phone.
in gsm(2g) don`t have signal but in 3g yes.
with this service menu... can i reparair?
please help me
hola chicos, tengo un problema: teniendo mi cel en gsm 2g no me toma señal, se queda sin servicio, pero al cambiar a 3g tengo altiro señal.
puedo con este menu repararlo y como? se agradece la ayuda

sirkuazar said:
hi gays.
i`ve a prblem with my phone.
in gsm(2g) don`t have signal but in 3g yes.
with this service menu... can i reparair?
please help me
hola chicos, tengo un problema: teniendo mi cel en gsm 2g no me toma señal, se queda sin servicio, pero al cambiar a 3g tengo altiro señal.
puedo con este menu repararlo y como? se agradece la ayuda
Click to expand...
Click to collapse
Gays? I'm not a gay LOL
You would rather check your sim card as well as the mobile service before playing around with your phone. You can put the sim card into another phone to see if it works, etc...

:laugh::laugh::laugh::laugh:
vndnguyen said:
Gays? I'm not a gay LOL
You would rather check your sim card as well as the mobile service before playing around with your phone. You can put the sim card into another phone to see if it works, etc...
Click to expand...
Click to collapse
HHHHHHHHH

Android Head Unit Software Questions

Okay, so once again I am diving head-first into finding a factory replacement radio for 2015+ Mustangs, and after spending a few months talking with a manufacturer in China, I was able to get a Test unit. What I'm trying to find out is, since they sent me a pile of software (what they claim is everything they have on the unit) is there anyone who might be able to help me figure out a method to gain ROOT access?
All I know about it is that it's based on the MediaTek MT3561 with 2GB RAM, 32GB ROM. I have the entire image used to install the software on the device (at least I think I do.)
If someone is interested in assisting me with it long-term after ROOT, to eliminate "Engrish," misspellings, and updating some images, I would definitely compensate them for it!
Here's a link to the software I have:
https://drive.google.com/file/d/1LGMAm2IcDlbEa3sW-w3aK5GIN8rutPqQ/view?usp=drivesdk

I'm surprised that nobody is interested in a bounty...?

Bump!

Okay, so I tried some of the methods I've found on the forum to no avail, and decided to adb over WiFi into my unit, and list the contents of /system/bin/ I don't know if this is even useful information, but I'm REALLY looking for some kind of help.
View attachment 4418899

cool

Can anyone at least tell me what information I need to get from this device physically, or the build.prop (or whatever) to work on taking steps to gain ROOT?

PatrickHenninger said:
Can anyone at least tell me what information I need to get from this device physically, or the build.prop (or whatever) to work on taking steps to gain ROOT?
Click to expand...
Click to collapse
A long shot possibility here. It might be worthwhile to look at techniques used by people to root similar devices to your radio running the same version of Android. For example, the Ownice C500 head unit. It appears that unit uses the same MediaTek CPU as yours. Also perhaps do a little searching for other brand name head units using that CPU and see if/how those units can be rooted. You may be able to find the answer that you need.
Good luck finding root for your unit.

PoppaRoxie1986 said:
A long shot possibility here. It might be worthwhile to look at techniques used by people to root similar devices to your radio running the same version of Android. For example, the Ownice C500 head unit. It appears that unit uses the same MediaTek CPU as yours. Also perhaps do a little searching for other brand name head units using that CPU and see if/how those units can be rooted. You may be able to find the answer that you need.
Good luck finding root for your unit.
Click to expand...
Click to collapse
Hey, I appreciate the reply- I've actually already done that as far as I know how. The only method I've seen so far involves using a command in the terminal involving "Forfan guoboneedav -" and another running "[email protected]" but neither of those work. I don't know if forfan is a file name/command or what, but it gives me the error "forfan not found" or something like that.

PatrickHenninger said:
Hey, I appreciate the reply- I've actually already done that as far as I know how. The only method I've seen so far involves using a command in the terminal involving "Forfan guoboneedav -" and another running "[email protected]" but neither of those work. I don't know if forfan is a file name/command or what, but it gives me the error "forfan not found" or something like that.
Click to expand...
Click to collapse
My pleasure. My first guess would be that forfan is a script/executable found in the system folder on the Ownice units maybe not on yours perhaps. Not sure what it does or supposed to do, but the rest of their method seems reasonable enough.
Did you by chance get that arm64.zip, extract the contents to sd card, and try the rest of that method involving terminal past the forfan line? I have an Intel Sofia based head unit which is different from yours but I am familiar enough with the command prompt/shell scripts to try to help.

PoppaRoxie1986 said:
My pleasure. My first guess would be that forfan is a script/executable found in the system folder on the Ownice units maybe not on yours perhaps. Not sure what it does or supposed to do, but the rest of their method seems reasonable enough.
Did you by chance get that arm64.zip, extract the contents to sd card, and try the rest of that method involving terminal past the forfan line? I have an Intel Sofia based head unit which is different from yours but I am familiar enough with the command prompt/shell scripts to try to help.
Click to expand...
Click to collapse
Yeah, I did try that to no avail, I get permission denied as soon as I try to run the mount command. If I could connect to the stupid thing with USB, I'd use my laptop, or bring it in the house and power it up on my counter to use fastboot or something.
If any of this stuff helps, here's the build.prop and some pictures I took during installing an update via USB, and the screen when I gave the terminal command to reboot recovery.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
127|[email protected]_66_m0:/ $ getprop
[af.rf_info]: [273]
[anim.allapps]: [0]
[anim.workspace]: [0]
[bgw.current3gband]: [0]
[bluetooth.fw.adv.num]: [40]
[bluetooth.fw.energyreport]: [true]
[bluetooth.fw.irk.num]: [40]
[bluetooth.fw.rpa]: [true]
[bluetooth.fw.scanfilter.num]: [40]
[bluetooth.fw.scanresult.size]: [8160]
[camera.disable_zsl_mode]: [1]
[cdma.operator.ltmoffset]: [-20]
[cdma.operator.sid]: [1541]
[cdma.ril.eboot]: [0]
[cdma.simswitch.offmd3]: [0]
[cdma.version.baseband]: [SIXTH.CBP.MD.MP2.V47_P3, 2017/03/06 17:11]
[curlockscreen]: [0]
[cycle.allapps]: [false]
[cycle.workspace]: [false]
[dalvik.vm.dex2oat-Xms]: [4m]
[dalvik.vm.dex2oat-Xmx]: [512m]
[dalvik.vm.dex2oat-swap]: [false]
[dalvik.vm.heapgrowthlimit]: [192m]
[dalvik.vm.heapmaxfree]: [8m]
[dalvik.vm.heapminfree]: [512k]
[dalvik.vm.heapsize]: [512m]
[dalvik.vm.heapstartsize]: [16m]
[dalvik.vm.heaptargetutilization]: [0.75]
[dalvik.vm.image-dex2oat-Xms]: [64m]
[dalvik.vm.image-dex2oat-Xmx]: [64m]
[dalvik.vm.isa.arm.features]: [default]
[dalvik.vm.isa.arm.variant]: [cortex-a53]
[dalvik.vm.isa.arm64.features]: [default]
[dalvik.vm.isa.arm64.variant]: [cortex-a53]
[dalvik.vm.lockprof.threshold]: [500]
[dalvik.vm.mtk-stack-trace-file]: [/data/anr/mtk_traces.txt]
[dalvik.vm.stack-trace-file]: [/data/anr/traces.txt]
[debug.MB.running]: [0]
[debug.atrace.tags.enableflags]: [0]
[debug.force_rtl]: [0]
[debug.hwc.bq_count]: [4]
[debug.hwc.compose_level]: [0]
[debug.hwc.dump_level]: [0]
[debug.hwui.render_dirty_regions]: [false]
[debug.md_monitor.ModemSuffix]: [1_lwg_n]
[debug.mdlogger.Running]: [0]
[debug.mdlogger.log2sd.path]: [internal_sd]
[debug.mtk.aee.db]: [4:/data/aee_exp/db.fatal.03.JE <http://db.fatal.03.JE> ]
[debug.mtklog.netlog.Running]: [0]
[debug.program_binary.enable]: [1]
[dev.bootcomplete]: [1]
[dhcp.ipv6.wlan0.dns1]: []
[dhcp.ipv6.wlan0.dns2]: []
[dhcp.ipv6.wlan0.ipaddress]: []
[dhcp.ipv6.wlan0.leasetime]: []
[dhcp.ipv6.wlan0.result]: []
[dhcp.wlan0.result]: [failed]
[drm.service.enabled]: [true]
[fmradio.driver.enable]: [1]
[gps.clock.type]: [20]
[gps.gps.version]: [0x3561]
[gsm.baseband.capability]: [503]
[gsm.current.phone-type]: [2,,,,,,,,,,1]
[gsm.gcf.testmode]: [0]
[gsm.network.type]: [1xRTT]
[gsm.nitz.time]: [1518610430487]
[gsm.operator.alpha]: []
[gsm.operator.idpstring]: [011]
[gsm.operator.iso-country]: [us]
[gsm.operator.isroaming]: [false]
[gsm.operator.numeric]: [31003]
[gsm.project.baseband]: [ATC6737M_65_M0_HW(LWG_DSDS)]
[gsm.project.baseband.2]: [ATC6737M_65_M0_HW(LWG_DSDS)]
[gsm.ril.cardtypeset]: [1]
[gsm.ril.cardtypeset.2]: []
[gsm.ril.ct3g]: [0]
[gsm.ril.ct3g.2]: [0]
[gsm.ril.eboot]: [-1]
[gsm.ril.fulluicctype]: []
[gsm.ril.fulluicctype.2]: []
[gsm.ril.init]: [0]
[gsm.ril.uicctype]: []
[gsm.ril.uicctype.2]: []
[gsm.serial]: [06C18V03000180100012 10P]
[gsm.sim.operator.alpha]: []
[gsm.sim.operator.iso-country]: []
[gsm.sim.operator.numeric]: []
[gsm.sim.retry.pin1]: [-1]
[gsm.sim.retry.pin1.2]: []
[gsm.sim.retry.pin2]: [-1]
[gsm.sim.retry.pin2.2]: []
[gsm.sim.retry.puk1]: [-1]
[gsm.sim.retry.puk1.2]: []
[gsm.sim.retry.puk2]: [-1]
[gsm.sim.retry.puk2.2]: []
[gsm.sim.ril.mcc.mnc]: []
[gsm.sim.ril.mcc.mnc.2]: []
[gsm.sim.ril.phbready]: []
[gsm.sim.ril.phbready.2]: []
[gsm.sim.state]: [ABSENT]
[gsm.simswitch.offmd1]: [0]
[gsm.version.baseband]: [MOLY.LR9.W1444.MD.LWTG.MP.V94.P6, 2017/09/06 21:43]
[gsm.version.ril-impl]: [Viatelecom-cdma-ril suffix Version-temp]
[init.svc.MtkCodecService]: [running]
[init.svc.NvRAMAgent]: [running]
[init.svc.PPLAgent]: [running]
[init.svc.adbd]: [running]
[init.svc.adbec]: [running]
[init.svc.adbusbmuxd]: [running]
[init.svc.agpsd]: [running]
[init.svc.atc_ipod_core]: [running]
[init.svc.auto_recovery]: [stopped]
[init.svc.baidu_carlife]: [stopped]
[init.svc.bootanim]: [stopped]
[init.svc.bootlogoupdater]: [stopped]
[init.svc.ccci_fsd]: [running]
[init.svc.ccci_mdinit]: [running]
[init.svc.cmddumper]: [running]
[init.svc.conn_launcher]: [running]
[init.svc.console]: [running]
[init.svc.debuggerd]: [running]
[init.svc.debuggerd64]: [running]
[init.svc.dhcpcd_wlan0]: [stopped]
[init.svc.didisrv]: [stopped]
[init.svc.drm]: [running]
[init.svc.emdlogger1]: [running]
[init.svc.emsvr_user]: [running]
[init.svc.enableswap]: [stopped]
[init.svc.flash_recovery]: [stopped]
[init.svc.gas_srv]: [running]
[init.svc.gatekeeperd]: [running]
[init.svc.ged_srv]: [running]
[init.svc.gsm0710muxd]: [running]
[init.svc.guiext-server]: [running]
[init.svc.healthd]: [running]
[init.svc.installd]: [running]
[init.svc.key_learn]: [stopped]
[init.svc.keystore]: [running]
[init.svc.lmkd]: [running]
[init.svc.logd]: [running]
[init.svc.logd-reinit]: [stopped]
[init.svc.mcu-daemon]: [running]
[init.svc.md_monitor]: [running]
[init.svc.media]: [running]
[init.svc.mnld]: [running]
[init.svc.mobile_log_d]: [running]
[init.svc.netd]: [running]
[init.svc.netdiag]: [running]
[init.svc.nvram_daemon]: [stopped]
[init.svc.p2p_supplicant]: [running]
[init.svc.perfprofd]: [running]
[init.svc.pq]: [running]
[init.svc.program_binary]: [running]
[init.svc.ril-daemon]: [stopped]
[init.svc.ril-daemon-mtk]: [running]
[init.svc.servicemanager]: [running]
[init.svc.slpd]: [running]
[init.svc.sn <http://init.svc.sn> ]: [running]
[init.svc.statusd]: [running]
[init.svc.stp_dump]: [running]
[init.svc.surfaceflinger]: [running]
[init.svc.terservice]: [stopped]
[init.svc.thermal]: [running]
[init.svc.thermal_manager]: [stopped]
[init.svc.thermald]: [running]
[init.svc.ueventd]: [running]
[init.svc.vold]: [running]
[init.svc.vtservice]: [running]
[init.svc.wifi2agps]: [running]
[init.svc.wmtLoader]: [stopped]
[init.svc.xlogboot]: [stopped]
[init.svc.xlogdebugchanged]: [stopped]
[init.svc.zygote]: [running]
[init.svc.zygote_secondary]: [running]
[media.wfd.portrait]: [0]
[media.wfd.video-format]: [5]
[mediatek.wlan.chip]: [CONSYS_MT3561]
[mediatek.wlan.ctia]: [0]
[mediatek.wlan.module.postfix]: [_consys_mt3561]
[mtk.md1.starttime]: [1s Wed Feb 14 12:13:02 2018 ]
[mtk.md1.status]: [ready]
[mtk.md3.status]: [ready]
[mtk.vdec.waitkeyframeforplay]: [1]
[mtk_wifi.fwpath]: [STA]
[net.bt.name <http://net.bt.name> ]: [Android]
[net.cdma.boottimes]: [1]
[net.cdma.mdmstat]: [ready]
[net.cdma.poker]: [red.joker]
[net.cdma.via.card.state]: [locked_or_absent]
[net.cdma.via.service.state]: [in service]
[net.change]: [net.dns1]
[net.dns1]: [192.168.0.1]
[net.hostname]: [android-475de8eb01454016]
[net.nsiot_pending]: [false]
[net.qtaguid_enabled]: [1]
[net.tcp.default_init_rwnd]: [60]
[persist.af.hac_on]: [0]
[persist.atc.bt.inbandringtone]: [disable]
[persist.current.usb.mode]: [host2_0]
[persist.current.usb.protocol]: [usb2_0]
[persist.gemini.sim_num]: [1]
[persist.log.tag]: [D]
[persist.logd.enabled]: [1]
[persist.mediascanner.thread.no <http://persist.mediascanner.thread.no> ]: [1]
[persist.meta.dumpdata]: [0]
[persist.mtk.aee.dal]: [0]
[persist.mtk.sf.fps.upper_bound]: [60]
[persist.mtk.volte.enable]: [1]
[persist.mtk.wcn.combo.chipid]: [0x0321]
[persist.radio.actual.svlte_slot]: [3]
[persist.radio.cfu.change.0]: [0]
[persist.radio.cfu.iccid.0]: [8901260751781527894f]
[persist.radio.cfu.timeslot.0]: []
[persist.radio.default.sim]: [0]
[persist.radio.fd.counter]: [15]
[persist.radio.fd.off.counter]: [5]
[persist.radio.fd.off.r8.counter]: [5]
[persist.radio.fd.r8.counter]: [15]
[persist.radio.flashless.fsm]: [0]
[persist.radio.flashless.fsm_cst]: [1]
[persist.radio.flashless.fsm_rw]: [1]
[persist.radio.gprs.prefer]: [1]
[persist.radio.ia]: []
[persist.radio.ia-apn]: []
[persist.radio.ia-pwd-flag]: [0]
[persist.radio.mobile.data]: [8901260751781527894f,0]
[persist.radio.multisim.config]: [ss]
[persist.radio.new.sim.slot]: []
[persist.radio.reset_on_switch]: [true]
[persist.radio.sim.status]: []
[persist.radio.simswitch]: [1]
[persist.radio.simswitch.iccid]: [8901260751781527894f]
[persist.radio.svlte.mode]: [svlte]
[persist.radio.svlte_slot]: [3]
[persist.radio.terminal-based.cw]: [disabled_tbcw]
[persist.radio.unlock]: [false]
[persist.radio.ut.cfu.mode]: [disabled_ut_cfu_mode]
[persist.ril.bip.disabled]: [0]
[persist.service.acm.enable]: [0]
[persist.service.bdroid.bdaddr]: [22:22:6f:2d:d4:4b]
[persist.sys.bootanimation]: [0]
[persist.sys.can.version]: [SF02V1.44.011BYPT6]
[persist.sys.dalvik.vm.lib.2]: [libart.so]
[persist.sys.debug.multi_window]: [false]
[persist.sys.door.not.hide]: [1]
[persist.sys.first_time_boot]: [false]
[persist.sys.handbrake.reverse]: [1]
[persist.sys.led.settings]: [0]
[persist.sys.mobilenet]: [easyconn]
[persist.sys.music.type]: [local_music]
[persist.sys.mute.state]: [2]
[persist.sys.navi.state]: [stopped]
[persist.sys.override]: [true]
[persist.sys.pq.adl.idx]: [0]
[persist.sys.pq.brightidx]: [2]
[persist.sys.pq.contrastidx]: [3]
[persist.sys.pq.gsatidx]: [9]
[persist.sys.pq.shp.idx]: [4]
[persist.sys.profiler_ms]: [0]
[persist.sys.radio.type]: [local_radio]
[persist.sys.reverse]: [normal]
[persist.sys.sd.defaultpath]: [/storage/emulated/0]
[persist.sys.timezone]: [America/New_York]
[persist.sys.usb.activation]: [yes]
[persist.sys.usb.config]: [mass_storage,adb]
[persist.sys.video.channel]: [3]
[qemu.hw.mainkeys]: [1]
[ril.active.md <http://ril.active.md> ]: [5]
[ril.cardtype.cache]: [255]
[ril.cdma.emdstatus.send]: [1]
[ril.cdma.report]: [0]
[ril.cdma.report.case]: [0]
[ril.cdma.switching]: [0]
[ril.current.share_modem]: [1]
[ril.data.allow]: [0]
[ril.ecc.service.category.list]: []
[ril.ecclist]: []
[ril.ecclist1]: []
[ril.external.md <http://ril.external.md> ]: [1]
[ril.fd.mode]: [1]
[ril.first.md <http://ril.first.md> ]: [1]
[ril.flightmode.poweroffMD]: [1]
[ril.ia.iccid]: []
[ril.iccid.sim1]: [N/A]
[ril.iccid.sim1_c2k]: [N/A]
[ril.iccid.sim2]: [N/A]
[ril.imsi.status.sim1]: [0]
[ril.ipo.radiooff]: [0]
[ril.ipo.radiooff.2]: [0]
[ril.mux.ee.md1]: [0]
[ril.mux.report.case]: [0]
[ril.pid.1]: [799]
[ril.radio.ia]: []
[ril.radio.ia-apn]: []
[ril.radiooff.poweroffMD]: [0]
[ril.read.imsi]: [1]
[ril.ready.sim]: [false]
[ril.specific.sm_cause]: [0]
[ril.switch.modem.cause.type]: [255]
[ril.switch.modem.delay.info <http://ril.switch.modem.delay.info> ]: ["FFFFFF",255,0]
[ril.telephony.mode]: [0]
[rild.libargs]: [-d /dev/ttyC0]
[rild.libpath]: [mtk-ril.so]
[rild.mark_switchuser]: [0]
[ro.adb.secure]: [0]
[ro.aee.build.info <http://ro.aee.build.info> ]: [mtk]
[ro.allow.mock.location]: [0]
[ro.audio.silent]: [0]
[ro.aux.disabled]: [com.clw.aux]
[ro.avin.disabled]: [com.clw.avin]
[ro.baseband]: [unknown]
[ro.board.platform]: [mt3561t]
[ro.boot.bootreason]: [wdt_by_pass_pwk]
[ro.boot.hardware]: [mt3561]
[ro.boot.mode]: [normal]
[ro.boot.name <http://ro.boot.name> ]: [android]
[ro.boot.serialno]: [59Z58TCIBQINSCSW]
[ro.bootimage.build.date]: [Wed Jan 10 01:28:58 CST 2018]
[ro.bootimage.build.date.utc]: [1515518938]
[ro.bootimage.build.fingerprint]: [alps/evb3561t_66_m0:6.0/MRA58K/V1.00.00-20180110:userdebug/test-keys]
[ro.bootloader]: [unknown]
[ro.bootmode]: [normal]
[ro.build.characteristics]: [default]
[ro.build.date]: [Wed Jan 10 01:15:59 CST 2018]
[ro.build.date.utc]: [1515518159]
[ro.build.description]: [full_evb3561t_66_m0-userdebug 6.0 MRA58K V1.00.00-20180110 test-keys] [ro.build.display.id <http://ro.build.display.id> ]: [full_evb3561t_66_m0-userdebug 6.0 MRA58K V1.00.00-20180110 test-keys]
[ro.build.fingerprint]: [alps/evb3561t_66_m0:6.0/MRA58K/V1.00.00-20180110:userdebug/test-keys]
[ro.build.flavor]: [full_evb3561t_66_m0-userdebug]
[ro.build.host]: [ubuntu-server]
[ro.build.id <http://ro.build.id> ]: [MRA58K]
[ro.build.product]: [evb3561t_66_m0]
[ro.build.product.id <http://ro.build.product.id> ]: [10]
[ro.build.tags]: [test-keys]
[ro.build.type]: [userdebug]
[ro.build.user]: [imotor]
[ro.build.version.all_codenames]: [REL]
[ro.build.version.base_os]: []
[ro.build.version.codename]: [REL]
[ro.build.version.incremental]: [V1.00.00-20180110]
[ro.build.version.preview_sdk]: [0]
[ro.build.version.release]: [7.1.2]
[ro.build.version.sdk]: [23]
[ro.build.version.security_patch]: [2016-06-01]
[ro.c2k.irat.support]: [1]
[ro.calculator.disabled]: [com.android.calculator2]
[ro.camera.sound.forced]: [0]
[ro.carrier]: [unknown]
[ro.cdma.cfall.disable]: [*730]
[ro.cdma.cfb.disable]: [*900]
[ro.cdma.cfb.enable]: [*90]
[ro.cdma.cfdf.disable]: [*680]
[ro.cdma.cfdf.enable]: [*68]
[ro.cdma.cfnr.disable]: [*920]
[ro.cdma.cfnr.enable]: [*92]
[ro.cdma.cfu.disable]: [*720]
[ro.cdma.cfu.enable]: [*72]
[ro.cdma.cw.disable]: [*740]
[ro.cdma.cw.enable]: [*74]
[ro.com.android.mobiledata]: [true]
[ro.config.alarm_alert]: [Alarm_Classic.ogg]
[ro.config.notification_sound]: [pixiedust.ogg]
[ro.config.ringtone]: [Ring_Synth_04.ogg]
[ro.config.time_12_24]: [12]
[ro.config.version]: [InteNavi-F_002_180110_V3.1.033-180110-14:27]
[ro.config.wallpaper]: [/bootlogo/config/wallpaper]
[ro.crypto.state]: [unencrypted]
[ro.dalvik.vm.native.bridge]: [0]
[ro.debuggable]: [1]
[ro.default.bootlogo]: [general]
[ro.dialer.disabled]: [com.android.dialer]
[ro.dvb.disabled]: [com.imotor.dvb]
[ro.dvr.type]: [ir]
[ro.email.disabled]: [com.android.email]
[ro.expect.recovery_id]: [0x439d02fc2a478a35a3cddd82069ded6e6e5bff5b000000000000000000000000]
[ro.frp.pst]: [/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/frp]
[ro.gemini.smart_sim_switch]: [false]
[ro.hardware]: [mt3561]
[ro.have_aacencode_feature]: [1]
[ro.have_aee_feature]: [1]
[ro.imdvr.disabled]: [com.imotor.camera]
[ro.kernel.zio]: [38,108,105,16]
[ro.manual.disabled]: [com.imotor.help]
[ro.mediatek.chip_ver]: [S01]
[ro.mediatek.gemini_support]: [false]
[ro.mediatek.platform]: [MT3561T]
[ro.mediatek.project.path]: [device/atc/evb3561t_66_m0]
[ro.mediatek.version.branch]: [alps-mp-m0.mp1]
[ro.mediatek.version.release]: [android-trunk-m0-V0.0.2]
[ro.mediatek.version.sdk]: [4]
[ro.mediatek.wlan.p2p]: [1]
[ro.mediatek.wlan.wsc]: [1]
[ro.mount.fs]: [EXT4]
[ro.mtk.c2k.slot2.support]: [1]
[ro.mtk_agps_app]: [1]
[ro.mtk_antibricking_level]: [2]
[ro.mtk_audenh_support]: [1]
[ro.mtk_audio_ape_support]: [1]
[ro.mtk_audio_change_support]: [1]
[ro.mtk_audio_tuning_tool_ver]: [V1]
[ro.mtk_besloudness_support]: [1]
[ro.mtk_bessurround_support]: [1]
[ro.mtk_bg_power_saving_support]: [1]
[ro.mtk_bg_power_saving_ui]: [1]
[ro.mtk_bip_scws]: [1]
[ro.mtk_bt_support]: [1]
[ro.mtk_c2k_support]: [1]
[ro.mtk_cam_lomo_support]: [1]
[ro.mtk_cam_mfb_support]: [3]
[ro.mtk_cam_vfb]: [1]
[ro.mtk_cta_drm_support]: [1]
[ro.mtk_cta_set]: [1]
[ro.mtk_default_data_off]: [1]
[ro.mtk_dhcpv6c_wifi]: [1]
[ro.mtk_dialer_search_support]: [1]
[ro.mtk_dual_mic_support]: [1]
[ro.mtk_eap_sim_aka]: [1]
[ro.mtk_emmc_support]: [1]
[ro.mtk_enable_md1]: [1]
[ro.mtk_enable_md3]: [1]
[ro.mtk_external_sim_support]: [1]
[ro.mtk_fd_support]: [1]
[ro.mtk_flight_mode_power_off_md]: [1]
[ro.mtk_flv_playback_support]: [1]
[ro.mtk_fm_recording_support]: [1]
[ro.mtk_gps_support]: [1]
[ro.mtk_ipo_support]: [1]
[ro.mtk_is_tablet]: [0]
[ro.mtk_lte_support]: [1]
[ro.mtk_md_sbp_custom_value]: [1]
[ro.mtk_md_world_mode_support]: [0]
[ro.mtk_miravision_image_dc]: [1]
[ro.mtk_miravision_support]: [1]
[ro.mtk_mobile_management]: [1]
[ro.mtk_modem_monitor_support]: [1]
[ro.mtk_perf_response_time]: [1]
[ro.mtk_perf_simple_start_win]: [1]
[ro.mtk_perfservice_support]: [1]
[ro.mtk_pq_support]: [2]
[ro.mtk_privacy_protection_lock]: [1]
[ro.mtk_rild_read_imsi]: [1]
[ro.mtk_search_db_support]: [1]
[ro.mtk_send_rr_support]: [1]
[ro.mtk_shared_sdcard]: [1]
[ro.mtk_sim_hot_swap]: [1]
[ro.mtk_slow_motion_support]: [1]
[ro.mtk_subtitle_support]: [1]
[ro.mtk_svlte_support]: [1]
[ro.mtk_tetheringipv6_support]: [1]
[ro.mtk_thumbnail_play_support]: [1]
[ro.mtk_umts_tdd128_mode]: [1]
[ro.mtk_usb_cba_support]: [1]
[ro.mtk_volte_support]: [1]
[ro.mtk_wappush_support]: [1]
[ro.mtk_wfd_sink_support]: [1]
[ro.mtk_wfd_sink_uibc_support]: [1]
[ro.mtk_wfd_support]: [1]
[ro.mtk_widevine_drm_l3_support]: [1]
[ro.mtk_wifi_mcc_support]: [1]
[ro.mtk_wlan_support]: [1]
[ro.mtk_wmv_playback_support]: [1]
[ro.mtk_world_phone]: [1]
[ro.mtk_world_phone_policy]: [0]
[ro.opengles.version]: [196608]
[ro.otaupdate.disabled]: [com.imotor.upgrade]
[ro.personal.disabled]: [com.imotor.personal]
[ro.product.board]: []
[ro.product.brand]: [alps]
[ro.product.cpu.abi]: [arm64-v8a]
[ro.product.cpu.abilist]: [arm64-v8a,armeabi-v7a,armeabi]
[ro.product.cpu.abilist32]: [armeabi-v7a,armeabi]
[ro.product.cpu.abilist64]: [arm64-v8a]
[ro.product.device]: [evb3561t_66_m0]
[ro.product.locale]: [zh-CN]
[ro.product.locale.language]: [en]
[ro.product.locale.region]: [US]
[ro.product.manufacturer]: [alps]
[ro.product.model]: [MT3561]
[ro.product.name <http://ro.product.name> ]: [full_evb3561t_66_m0]
[ro.rcc.disabled]: [com.imotor.rcctransfer]
[ro.recognition.disabled]: [com.clw.recognition]
[ro.recovery_id]: [0x439d02fc2a478a35a3cddd82069ded6e6e5bff5b000000000000000000000000]
[ro.revision]: [0]
[ro.runtime.firstboot]: [1518628404619]
[ro.secure]: [1]
[ro.serialdemo.disabled]: [com.clw.serial]
[ro.serialno]: [59Z58TCIBQINSCSW]
[ro.sf.hwrotation]: [0]
[ro.sf.lcd_density]: [240]
[ro.sim_me_lock_mode]: [0]
[ro.sim_refresh_reset_by_modem]: [1]
[ro.software.ui]: [UIA101]
[ro.steeringwheel.disabled]: [com.android.steerwheel]
[ro.sys.usb.bicr]: [yes]
[ro.sys.usb.charging.only]: [yes]
[ro.sys.usb.mtp.whql.enable]: [0]
[ro.sys.usb.storage.type]: [mtp]
[ro.telephony.default_network]: [4]
[ro.telephony.sim.count]: [2]
[ro.tpms.disabled]: [com.imotor.tpms.main]
[ro.tv.type]: [2]
[ro.update.disabled]: [com.google.android.gsf/com.google.android.gsf.update.SystemUpdateService$Receiver]
[ro.weather.disabled]: [com.autochips.weather]
[ro.wifi.channels]: []
[ro.wlan.mtk.wifi.5g]: [1]
[ro.zygote]: [zygote64_32]
[ro.zygote.preload.enable]: [0]
[security.perf_harden]: [1]
[selinux.reload_policy]: [1]
[service.adbec.enable]: [1]
[service.adbusbmuxd.enable]: [1]
[service.bootanim.exit]: [1]
[service.nvram_init]: [Ready]
[service.wcn.coredump.mode]: [2]
[service.wcn.driver.ready]: [yes]
[sys.boot.reason]: [0]
[sys.boot_completed]: [1]
[sys.ipo.autotest]: [1]
[sys.ipo.pwrdncap]: [2]
[sys.ipowin.done]: [1]
[sys.oem_unlock_allowed]: [1]
[sys.settings_system_version]: [4]
[sys.sysctl.extra_free_kbytes]: [7200]
[sys.sysctl.tcp_def_init_rwnd]: [60]
[sys.usb.config]: [mass_storage,adb]
[sys.usb.ffs.ready]: [1]
[sys.usb.state]: [mass_storage,adb]
[sys.usb.vid]: [0E8D]
[viatel.device.asci]: [uart.4.ttyMT]
[viatel.device.at <http://viatel.device.at> ]: [sdio.4.ttySDIO]
[viatel.device.at2]: [sdio.6.ttySDIO]
[viatel.device.at3]: [sdio.7.ttySDIO]
[viatel.device.data]: [sdio.1.ttySDIO]
[viatel.device.ets]: [sdio.2.ttySDIO]
[viatel.device.excp.data]: [sdio.12.ttySDIO]
[viatel.device.excp.msg]: [sdio.11.ttySDIO]
[viatel.device.fls]: [sdio.3.ttySDIO]
[viatel.device.gps]: [sdio.5.ttySDIO]
[viatel.device.pcv]: [sdio.0.ttySDIO]
[vold.has_adoptable]: [1]
[vold.path.internal_storage]: [/storage/emulated/0]
[vold.post_fs_data_done]: [1]
[vold.support_external_sd]: [1]
[wfd.dummy.enable]: [1]
[wifi.direct.interface]: [p2p0]
[wifi.interface]: [wlan0]
[wifi.tethering.interface]: [ap0]
[wlan.driver.status]: [ok]
[wlan.wfd.security.image]: [1]
[email protected]_66_m0:/ $

Bump, I'm relentless!

Okay, I made some potential progress last night. I used the update files I got from the manufacturer and Magisk to patch the Boot.IMG file. I tried to put that patched BOOT.IMG into the update.zip and use the auro-recovery feature of the Head Unit to load it, and it fails the signature verification. That tells me I need to unlock the bootloader somehow. In Dev Options, I have a button for "Allow OEM Unlock" that I turned on, I just have to figure out the process. I'm going to keep trying to get this done! My first 2 things to try are just using ADB over WiFi and sending "fastboot oem unlock" and see what happens. Then I'll try rebooting with a USB keyboard attached into a weird "fastboot" screen the unit has built in. I just know it doesn't connect to my PC via USB, regardless of what I try.

Did you try to type "su" at the command prompt when you logged into it via adb? Most chinese car radios are root right out of the box.
As far as a bounty goes (or actually what you are proposing sounds more like a support contract than a bounty), I certainly wouldn't want to assume any kind of responsibility for those things. Not without source code (your link is just to a system update package, which is basically worthless).
Your first post is interesting. Are you a car dealer? Would you consider supporting a project that is better than low end locked down chinese crap?
https://github.com/HiKey960-Car

luciusfox said:
Did you try to type "su" at the command prompt when you logged into it via adb? Most chinese car radios are root right out of the box.
As far as a bounty goes (or actually what you are proposing sounds more like a support contract than a bounty), I certainly wouldn't want to assume any kind of responsibility for those things. Not without source code (your link is just to a system update package, which is basically worthless).
Your first post is interesting. Are you a car dealer? Would you consider supporting a project that is better than low end locked down chinese crap?
https://github.com/HiKey960-Car
Click to expand...
Click to collapse
I'm not a car dealer, no. I'm not looking for a support contract, just someone to help me root it, and perhaps clean up some Engrish from the few places I've found it.
I did try running su but I get permission denied. That was via adb over wifi and from the terminal.
Tomorrow I'll be putting it on my bench to try using fastboot and adb via USB.

USB woes
Well, I spent the weekend with it on my kitchen counter, trying to access it via ADB, but no matter what I do, my PC doesn't acknowledge that it's even connected to anything. In fact, none of the laptops in my house did. It just straight-up ignores the fact that something was just plugged into the USB port. -and yes, USB Debugging mode is turned on, and I have the ADB drivers installed on my laptop as well as Android Studio. I also tried everything below while connected to my laptop in various order.
Now, the head unit has options for USB mode, HOST and DEVICE. (As well as the option to use USB 2.0 or 1.1 for some reason?) When it's in HOST mode, it reads USB drives just fine for files, and lets me use a USB Keyboard but in Device mode, it doesn't. In fact, it does nothing via USB in Device mode. So, I'm wondering if maybe it's related to USB OTG settings that I can't access via the UI or something. Thoughts are appreciated.
Also, I can run terminal commands on it, and I can navigate through just fine, but get permission denied when I type "su" the prompt. I can use "reboot" just fine, and "reboot recovery" tries to launch some integrated auto-installation of recovery on the USB drive. If I run "reboot bootloader" it just goes to a black screen and says "FASTBOOT" at the bottom. It doesn't respond to keyboard or anything in that state though.
Anyone have any thoughts?

Well, it would definitely have to be in device mode for ADB to work over USB. Probably has a USB hub in between the port and the socket though, so you would need to figure out where the hub IC is, and how to connect to the SoC side of it.
Have you tried ADB over IP?
Try running "setprop persist.adb.tcp.port 5555" and then reboot, then try to "adb connect <ip address of radio>" and then "adb shell".
Fastboot has the same requirement as adb... device mode, and wiring.
Not sure what you mean by "ADB drivers installed on my laptop". ADB does not require drivers.
What does your host machine's kernel say when you try plugging in? Check the bottom of dmesg just after plugging in. Also check what "lsusb" outputs.
You starting to get a good picture of what makes chinese radios suck?

luciusfox said:
Well, it would definitely have to be in device mode for ADB to work over USB. Probably has a USB hub in between the port and the socket though, so you would need to figure out where the hub IC is, and how to connect to the SoC side of it.
Have you tried ADB over IP?
Try running "setprop persist.adb.tcp.port 5555" and then reboot, then try to "adb connect <ip address of radio>" and then "adb shell".
Fastboot has the same requirement as adb... device mode, and wiring.
Not sure what you mean by "ADB drivers installed on my laptop". ADB does not require drivers.
What does your host machine's kernel say when you try plugging in? Check the bottom of dmesg just after plugging in. Also check what "lsusb" outputs.
You starting to get a good picture of what makes chinese radios suck?
Click to expand...
Click to collapse
Yes, if you read my earlier posts, you'd see I can adb via ssh. My laptop detects nothing in any way, shape or form.
I have the MediaTek USB drivers installed for ADB.
Also, if you have a way to manufacture a unit en masse that does everything this one does for under $300USD, feel free to tell me more.
The fact that I'm trying to gain access that I'm not intended to have doesn't make it suck.
As for finding the hub, I've got a picture of the guts, but that's not much help.

PatrickHenninger said:
Yes, if you read my earlier posts, you'd see I can adb via ssh. My laptop detects nothing in any way, shape or form.
I have the MediaTek USB drivers installed for ADB.
Also, if you have a way to manufacture a unit en masse that does everything this one does for under $300USD, feel free to tell me more.
The fact that I'm trying to gain access that I'm not intended to have doesn't make it suck.
As for finding the hub, I've got a picture of the guts, but that's not much help.View attachment 4428019
Click to expand...
Click to collapse
One of the reasons why my first question to you was if you are a car dealer or not, is because if you were and wanted to build something that was good and not too terribly expensive, I could certainly arrange it, but not if you just want to buy one for you and one for your wife/gf. Are you interested in placing an order for... say 10,000 units? Also understanding that they won't look like the prototype in the picture. I would happily stick them in a nice DDIN box and switch some of the external USB parts to more integrated, specifically the AMFM radio and sound card. Switch those over to integrated i2s+i2c.
Your statement "The fact that I'm trying to gain access that I'm not intended to have doesn't make it suck." doesn't make any sense. Did you buy it or not? If you did, then I would think that it BELONGS TO YOU, and therefore it is INTENDED for you to actually use in whatever way you see fit. And there is no valid reason whatsoever that it should be locked out of your (the owner's) access. In fact, the very notion that anyone would believe that this kind of configuration is in any way acceptable makes me sick to my stomach.
Not to mention the fact that the manufacturer is in violation of software licensing agreements (GPL on the kernel, and proprietary on the google applications and other software that is pirated).

luciusfox said:
One of the reasons why my first question to you was if you are a car dealer or not, is because if you were and wanted to build something that was good and not too terribly expensive, I could certainly arrange it, but not if you just want to buy one for you and one for your wife/gf. Are you interested in placing an order for... say 10,000 units? Also understanding that they won't look like the prototype in the picture. I would happily stick them in a nice DDIN box and switch some of the external USB parts to more integrated, specifically the AMFM radio and sound card. Switch those over to integrated i2s+i2c.
Your statement "The fact that I'm trying to gain access that I'm not intended to have doesn't make it suck." doesn't make any sense. Did you buy it or not? If you did, then I would think that it BELONGS TO YOU, and therefore it is INTENDED for you to actually use in whatever way you see fit. And there is no valid reason whatsoever that it should be locked out of your (the owner's) access. In fact, the very notion that anyone would believe that this kind of configuration is in any way acceptable makes me sick to my stomach.
Not to mention the fact that the manufacturer is in violation of software licensing agreements (GPL on the kernel, and proprietary on the google applications and other software that is pirated).
Click to expand...
Click to collapse
I'm not a car dealer. I am working directly with a manufacturer in China to custom build these units for at least 50 people to start, and onward into the hundreds. Will it reach thousands, or tens-of-thousands? No idea. It's all part of a group-buy.
Anyhow, a DDIN will not work in these cars. It has to include everything shown in the picture, with the exception of my bench power supply. Even a regular dash kit for our cars (by Metra, Spectre, whoever) is in the $350-$450 range, NOT including the radio- ergo, this is the best current solution. Long story short, whatever you can build just won't work for what I'm doing.
Yes, my statement DOES make sense. 99% of what this unit is designed to do, it does an amazing job of. The 1% of failure comes from 1 screen that has a poor English translation, and it's part of a system app that I can't replace with my modified version without root access to replace it. Considering it's using open source, I'm not sure what they're pirating, since the only apps it comes with (aside from their in-house music player, radio app, and HVAC controller) would be Google Play and Adobe Reader.
I decided to look through some of your posts, and see you singing the same song in the majority of them. You talk smack about every device you don't like, you're condescending, and the only opinion that seems to matter to you is yours. In fact, the only help (and I use that term loosely) that you've offered here, is to attempt things that I already stated I had tried, but perhaps you were too preoccupied by your own inflated ego to bother reading all the details, and went straight to attempted condescension. While I appreciate your potential intent of assistance, I don't believe you're capable of offering any kind of helpful input, or information with any kind of value- with that, I say "Good day, sir."
Enjoy your Batman comics.

PatrickHenninger said:
I'm not a car dealer. I am working directly with a manufacturer in China to custom build these units for at least 50 people to start, and onward into the hundreds. Will it reach thousands, or tens-of-thousands? No idea. It's all part of a group-buy.
Anyhow, a DDIN will not work in these cars. It has to include everything shown in the picture, with the exception of my bench power supply. Even a regular dash kit for our cars (by Metra, Spectre, whoever) is in the $350-$450 range, NOT including the radio- ergo, this is the best current solution. Long story short, whatever you can build just won't work for what I'm doing.
Yes, my statement DOES make sense. 99% of what this unit is designed to do, it does an amazing job of. The 1% of failure comes from 1 screen that has a poor English translation, and it's part of a system app that I can't replace with my modified version without root access to replace it. Considering it's using open source, I'm not sure what they're pirating, since the only apps it comes with (aside from their in-house music player, radio app, and HVAC controller) would be Google Play and Adobe Reader.
I decided to look through some of your posts, and see you singing the same song in the majority of them. You talk smack about every device you don't like, you're condescending, and the only opinion that seems to matter to you is yours. In fact, the only help (and I use that term loosely) that you've offered here, is to attempt things that I already stated I had tried, but perhaps you were too preoccupied by your own inflated ego to bother reading all the details, and went straight to attempted condescension. While I appreciate your potential intent of assistance, I don't believe you're capable of offering any kind of helpful input, or information with any kind of value- with that, I say "Good day, sir."
Enjoy your Batman comics.
Click to expand...
Click to collapse
Whatever you say. When those chinese pieces of trash set a bunch of cars on fire, don't come crying to me.

Windows 10 Mobile Installer! New! Version 1.0

Hello everyone!
Today I am publishing my second program!
It's called...
the...
Windows 10 Mobile Installer!!!
Version 1.0!!!
It's easy to use!
It will be constantly updated via this forum!
It comes as .wim package
Extract it and you will find another .wim package
Extract it too and you will find a folder called W10M_Installer !
WARNING! COPY THE FOLDER W10M_Installer TO THE C: DRIVE!!! OTHERWISE THE PROGRAM WILL FAIL TO FIND THE PACKAGES!!!!!
Now after copying the folder to the C: Drive, open it
Open the W10M_Installer.exe as administrator!
Click "List of devices"
Find your model in there
for ex. I have an Lumia 925
so I should write the following package name in the text field:
Lumia920T,925T,928,1020 - DON'T WORRY!! IF THERE IS A (T) THERE IT MEANS THAT IT'S ALSO COMPATIBLE
WITH THE T VERSION!!!
After that click START
Firstly it will detect your device
Then it will prompt - "If you see your device, click 1, if not, reconnect your device and press 2"
If you press 2 it will retry to detect your device
Once it detects you should press 1
and it will start updating!
WARNING! YOUR DEVICE FIRMWARE VERSION SHOULD BE 8.10.14219 OR LATER OTHERWISE THE PROGRAM WILL FAIL TO INSTALL THE UPGRADE!
After finishing the upgrade, it will prompt you
"If the upgrade succeed and now your phone is running Windows 10 Mobile then press 1, if not make sure you are running Lumia Denim (8.10.14219 or later) or upgrade to Lumia Denim and press 2 to restart the upgrade! "
If the upgrade succeeds and you press 1, it will install IME packages, as the update packages have broken IME!
(Bug from Win10 Mobile Update offline package V4.1)
If you see an error, don't worry it's all normal!
Press any key to exit
And delete all keyboards from your Lumia, except English (US)!
Now install Interop Tools and modify the registry to update to a later version of Windows 10 Mobile!
After upgrade the IME error will be fixed!
THIS PROGRAM USES FILES FROM Win10 Mobile Offline Update Package v4.1 published by hikari_calyx! THIS PROGRAM ALSO USES IUTOOLS by Microsoft Corp.
WARNING! THIS PROGRAM IS MADE FOR LUMIAS ONLY!!!!
For help you can click "HELP" button in the program!
Version 1.1 Update!
[FIXED] IME patch not installing after finishing update
[FIXED] detect.exe requires PRO subscription
Here's the download link
https://mega.nz/#!gR4lTYzB!ptxTakr3klj-EFdpHCR6LZDhLwKV9ETdpikp7865hWc

detect.exe error
It looks like you get a message saying it was made with an unlicensed compiler. So, it's not working yet.

C--Dog said:
It looks like you get a message saying it was made with an unlicensed compiler. So, it's not working yet.
Click to expand...
Click to collapse
Well.... Now I have fixed it!
You just need to redownload again!

Please donate to me, if you like my work and want just to support! I will be very happy! Here's the credit card number where to donate to: 4890494450664545. Thank you very much for your support![/SIZE]

This works for Lumia 520 (RM-915)?

TBM 13 said:
This works for Lumia 520 (RM-915)?
Click to expand...
Click to collapse
Yes!
All compatible devices will be available in the program

I'm on lumia 520 and started the update, he copied 132 files and now is stopped for 30 minutes on the word "update started" .... what should I do?

Angyone1 said:
I'm on lumia 520 and started the update, he copied 132 files and now is stopped for 30 minutes on the word "update started" .... what should I do?
Click to expand...
Click to collapse
The phone should restart and show you spinning gears, WAIT AND DO NOT DISCONNECT YOUR DEVICE! IT WILL TAKE 1 HOUR OR MORE TO COMPLETE!

I really need this.. Thankyou so much

gmirz2005 said:
The phone should restart and show you spinning gears, WAIT AND DO NOT DISCONNECT YOUR DEVICE! IT WILL TAKE 1 HOUR OR MORE TO COMPLETE!
Click to expand...
Click to collapse
yep.... finally 3 hours later has finish.... lol
thanks

Angyone1 said:
yep.... finally 3 hours later has finish.... lol
thanks
Click to expand...
Click to collapse

ovinitas said:
I really need this.. Thankyou so much
Click to expand...
Click to collapse
I need this too!

kjjjjj

help me!!
When I connect my Lumia cell phone to my computer, I get a message that an Android device was detected and I can not restore it to Window Phone. Can someone help me?

Not detect Nokia 1320
Hi,
Program does not detect the cell phone...detect.exe?
I write cell type Nokia 1320, and nothing happens?

mic5463 said:
Hi,
Program does not detect the cell phone...detect.exe?
I write cell type Nokia 1320, and nothing happens?
Click to expand...
Click to collapse
You may check the list of supported devices

Yes, Lumia 1320 is on check list.
Windows Device Recovery Tool, normal find phone.

:good::good:

mic5463 said:
Yes, Lumia 1320 is on check list.
Windows Device Recovery Tool, normal find phone.
Click to expand...
Click to collapse
Then the problem is in your device's connection with your computer (ex. Cable damaged, drivers are not installed)
Please check that all the drivers are installed by downloading Windows Device Recovery Tool (if you haven't downloaded it yet)
And also check the data connection of the phone and PC (maybe the cable is damaged)

930 crapy phone
Hey, I am trying 3rd day to upgrade from windows 8.1 to 10, most of the time I am downloading Gigabites of ****....
Can anyone simply answer: Is there a posibility to update Lumia 930?
I tried WPinternals to unlock bootloader, and found out that it is not supporting 930.
I tried this solution also, but it just fails no matter what i do.
Code:
STEP 1! Detecting the device!
MAKE SURE YOU HAVE CONNECTED YOUR DEVICE PROPERLY!
(IUTool Version: 11:52:10/Feb 7 2014)
Log file: C:\Users\zlq\AppData\Local\Temp\IUTool-{299338D7-E9AD-4D02-BD74-B341894FDEEF}.etl
Serial: f794abe740331d0e650d4f5f639ac41c
Friendly Name: Windows Phone
Manufacturer: NOKIA
Model: Lumia 930
Command executed successfully.
(IUTool Version: 11:52:10/Feb 7 2014)
Log file: C:\Users\zlq\AppData\Local\Temp\IUTool-{299338D7-E9AD-4D02-BD74-B341894FDEEF}.etl
Serial: f794abe740331d0e650d4f5f639ac41c
Friendly Name: Windows Phone
Manufacturer: NOKIA
Model: Lumia 930
Command executed successfully.
(IUTool Version: 11:52:10/Feb 7 2014)
Log file: C:\Users\zlq\AppData\Local\Temp\IUTool-{299338D7-E9AD-4D02-BD74-B341894FDEEF}.etl
Serial: f794abe740331d0e650d4f5f639ac41c
Friendly Name: Windows Phone
Manufacturer: NOKIA
Model: Lumia 930
Command executed successfully.
(IUTool Version: 11:52:10/Feb 7 2014)
Log file: C:\Users\zlq\AppData\Local\Temp\IUTool-{299338D7-E9AD-4D02-BD74-B341894FDEEF}.etl
Serial: f794abe740331d0e650d4f5f639ac41c
Friendly Name: Windows Phone
Manufacturer: NOKIA
Model: Lumia 930
Command executed successfully.
If your device has been detected then press 1, if not then reconnect your device and press 2 : 1
STEP 2! Updating the device!
(IUTool Version: 11:52:10/Feb 7 2014)
Log file: C:\Users\zlq\AppData\Local\Temp\IUTool-{299338D7-E9AD-4D02-BD74-B341894FDEEF}.etl
ERROR: Bad parameters
Command-Line Usage:
Command lines
-?
-p path [-s name] [-n name] [-m manufacturer] [-t model] [-a] [-v] [-V]
-l
Options
-? Show list of commands and usage
-V show VERY detailed progress messages
-a update all connected devices in parallel
-l list the connected devices
-m the phone's manufacturer
-n the phone's friendly name
-p directory path or semicolon-delimited list of package paths
-s the phone's serial number
-t the phone's type (model name)
-v show detailed progress messages
Install update files onto a device.
Command failed. (HRESULT = 0x80dd0001)
If the update has completed and your device is now running Windows 10 mobile then click 1! If you see error code 0x80188306, it means that your device is not running needed operating system! Update your Lumia to Denim and type 2 to restart operation! :
Code:
Update completed!
PART 3! Installing fixes!
(IUTool Version: 11:52:10/Feb 7 2014)
Log file: C:\Users\zlq\AppData\Local\Temp\IUTool-{299338D7-E9AD-4D02-BD74-B341894FDEEF}.etl
[1] Started device f794abe740331d0e650d4f5f639ac41c
[1] Transferring files started
[1] Transferred file 1/70
[1] Transferred file 2/70
[1] Transferred file 3/70
[1] Transferred file 4/70
[1] Transferred file 5/70
[1] Transferred file 6/70
[1] Transferred file 7/70
[1] Transferred file 8/70
[1] Transferred file 9/70
[1] Transferred file 10/70
[1] Transferred file 11/70
[1] Transferred file 12/70
[1] Transferred file 13/70
[1] Transferred file 14/70
[1] Transferred file 15/70
[1] Transferred file 16/70
[1] Transferred file 17/70
[1] Transferred file 18/70
[1] Transferred file 19/70
[1] Transferred file 20/70
[1] Transferred file 21/70
[1] Transferred file 22/70
[1] Transferred file 23/70
[1] Transferred file 24/70
[1] Transferred file 25/70
[1] Transferred file 26/70
[1] Transferred file 27/70
[1] Transferred file 28/70
[1] Transferred file 29/70
[1] Transferred file 30/70
[1] Transferred file 31/70
[1] Transferred file 32/70
[1] Transferred file 33/70
[1] Transferred file 34/70
[1] Transferred file 35/70
[1] Transferred file 36/70
[1] Transferred file 37/70
[1] Transferred file 38/70
[1] Transferred file 39/70
[1] Transferred file 40/70
[1] Transferred file 41/70
[1] Transferred file 42/70
[1] Transferred file 43/70
[1] Transferred file 44/70
[1] Transferred file 45/70
[1] Transferred file 46/70
[1] Transferred file 47/70
[1] Transferred file 48/70
[1] Transferred file 49/70
[1] Transferred file 50/70
[1] Transferred file 51/70
[1] Transferred file 52/70
[1] Transferred file 53/70
[1] Transferred file 54/70
[1] Transferred file 55/70
[1] Transferred file 56/70
[1] Transferred file 57/70
[1] Transferred file 58/70
[1] Transferred file 59/70
[1] Transferred file 60/70
[1] Transferred file 61/70
[1] Transferred file 62/70
[1] Transferred file 63/70
[1] Transferred file 64/70
[1] Transferred file 65/70
[1] Transferred file 66/70
[1] Transferred file 67/70
[1] Transferred file 68/70
[1] Transferred file 69/70
[1] Transferred file 70/70
[1] Transferring files complete: 70 files
[1] Update started
[1] Installation failed (HRESULT = 0x80188302)
[1] Failed (0x80188302)
ERROR: 0x80188302
Command failed. (HRESULT = 0x80188302)
(IUTool Version: 11:52:10/Feb 7 2014)
Log file: C:\Users\zlq\AppData\Local\Temp\IUTool-{299338D7-E9AD-4D02-BD74-B341894FDEEF}.etl
[1] Started device f794abe740331d0e650d4f5f639ac41c
[1] Transferring files started
[1] Transferred file 1/1
[1] Transferring files complete: 1 file
[1] Update started
[1] Installation failed (HRESULT = 0x801882c2)
[1] Failed (0x801882c2)
ERROR: 0x801882c2
Command failed. (HRESULT = 0x801882c2)
Done!
Don't worry if you see an error
Now do the following instructions!
1.Open Settings
2.Navigate to Time
'Language' is not recognized as an internal or external command,
operable program or batch file.
3.Remove all keyboards except English (US)
4. Reboot your device
UPDATED SUCCESSFULLY!
Press any key to exit
Press any key to continue . . .

How to restart a component after a partial crash (Android 6.0.1)

I have installed in my car a head unit coming from China, equiped with Android 6.0.1
Code:
[ro.build.date]: [2018-11-01 09:59:00 Thursday]
[ro.build.date.utc]: [1541037540]
[ro.build.description]: [sofia3gr_car_64-userdebug 6.0.1 MMB29M eng.bsp.20181101.095558 release-keys]
[ro.build.display.id]: [sofia3gr_car_64-userdebug 6.0.1 MMB29M eng.bsp.20181101.095558 release-keys]
[ro.build.fingerprint]: [Android/sofia3gr_car_64/sofia3gr_car:6.0.1/MMB29M/bsp11010956:userdebug/release-keys]
[ro.build.flavor]: [sofia3gr_car_64-userdebug]
[ro.build.fytfontsize]: []
[ro.build.fytid]: [FYGrp01]
[ro.build.fytinputmethod]: [com.google.android.inputmethod.pinyin/.PinyinIME]
[ro.build.fytlivewallpaper]: []
[ro.build.fytmanufacturer]: [39]
[ro.build.host]: [fyt]
[ro.build.id]: [MMB29M]
[ro.build.product]: [sofia3gr_car]
[ro.build.tags]: [release-keys]
[ro.build.type]: [userdebug]
[ro.build.user]: [bsp]
[ro.build.version.all_codenames]: [REL]
[ro.build.version.base_os]: []
[ro.build.version.codename]: [REL]
[ro.build.version.incremental]: [eng.bsp.20181101.095558]
[ro.build.version.preview_sdk]: [0]
[ro.build.version.release]: [6.0.1]
[ro.build.version.sdk]: [23]
[ro.build.version.security_patch]: [2016-06-01]
I've rooted it successfully using procedures described on XDA forum
I've installed SSH server, and I have a "su" access to unit over WiFi.
I also have adb access, but only over WiFi
I've installed Joying Extra Tools from hvdwolf (thanks to him !)
I've replaced the Radio frontend, for a version with RDS text correctly displayed...
I've tried to install/use a TWRP , using the procedure proposed by : https://github.com/superdavex/joyingsofia
But It seems impossible to boot in recovery mode : An error is displayed on screen, and after a long timeout, the unit reboot in normal mode.
So, without a safe method to backup the complete unit (through TWRP), I don't wish to install and run Xposed, modules, nor try to flash a GTX ROM, by example.
But I have a problem with actual installed software :
Sometimes, the backward camera does'nt work :
- That could be a black screen, with nothing displayed
- That could be a 'fix' image
Sometimes, I've a popup window : "Platform Server s'est arrêté" = Platform server has stopped in english,
but not for each crash.....
The radio is still working
The only way to retrieve a backward camera working fine is to reboot the unit.....
Is it possible to identify wich application / process has to be restarted (periodically, or in case of failure) , to don't have to totally reboot ?