Related
Alright, So I'm trying to enable JIT on my phone, but I'm running into a problem where when I cd into /sdcard and try to ls, the directory shows as empty. Trying to cd into anything gives me this
Code:
/sbin/sh: cd: can't cd to /sdcard/dusted
My question is, what are the commands to mount my sdcard with -rw permissions?
abcdfv said:
Alright, So I'm trying to enable JIT on my phone, but I'm running into a problem where when I cd into /sdcard and try to ls, the directory shows as empty. Trying to cd into anything gives me this
Code:
/sbin/sh: cd: can't cd to /sdcard/dusted
My question is, what are the commands to mount my sdcard with -rw permissions?
Click to expand...
Click to collapse
try mount -a
or
try mount /sdcard/
mount -a returns
Code:
mount: mounting /dev/block/mmcblk0p2 on /system/sd failed: no such file or directory
mount /sdcard returns
Code:
mount: mounting /dev/block/mmcblk0p1 on /sdcard failed: device or resource busy
Then try:
Code:
mkdir /system/sd
mount -a
Code:
mkdir /system/sd
mkdir: canot create directory '/system/sd': File exists
Tried a different SDcard. Same problem.
Also, the JIT guide can be misleading. At first I thought it meant to do all of this while the phone is in recovery. Needless to say, that does not work.
I got the same results as you, so maybe that is the problem.
The phone needs to be fully booted.
whats happens when you do a 'adb remount'?
Code:
remount failed: invalid argument
Tried killing the adb server and restarting it. Still a no go.
abcdfv said:
Code:
mkdir /system/sd
mkdir: canot create directory '/system/sd': File exists
Tried a different SDcard. Same problem.
Click to expand...
Click to collapse
Looks like the ext partition on the SD card is missing. Did you repartition adding both ext and swap?
I don't run a2sd
abcdfv said:
I don't run a2sd
Click to expand...
Click to collapse
Then it's not going to mount /system/sd since that is a2sd.
I'm not trying to mount an ext partition. I'm trying to mount the sdcard itself.
abcdfv said:
I'm not trying to mount an ext partition. I'm trying to mount the sdcard itself.
Click to expand...
Click to collapse
Your errors above seem to indicate that the sd card is mounted. As to wether its readable is another matter. What do you get when your do a:
Code:
ls /sdcard
Have you tried rebooting into recovery?
Boot the phone into Android.
Open ADB and type mount.
Paste the results here.
From Android
Code:
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\Administrator>cd /android/tools
C:\android\tools>adb shell
# mount
mount
rootfs / rootfs ro 0 0
tmpfs /dev tmpfs rw,mode=755 0 0
devpts /dev/pts devpts rw,mode=600 0 0
proc /proc proc rw 0 0
sysfs /sys sysfs rw 0 0
tmpfs /sqlite_stmt_journals tmpfs rw,size=4096k 0 0
none /dev/cpuctl cgroup rw,cpu 0 0
/dev/block/mtdblock3 /system yaffs2 ro 0 0
/dev/block/mtdblock5 /data yaffs2 rw,nosuid,nodev 0 0
/dev/block/mtdblock4 /cache yaffs2 rw,nosuid,nodev 0 0
/dev/block//vold/179:1 /sdcard vfat rw,dirsync,nosuid,nodev,noexec,uid=1000,gid=
1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,s
hortname=mixed,utf8,errors=remount-ro 0 0
#
From recovery
Code:
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\Administrator>cd /android/tools
C:\android\tools>adb shell
/ # mount
mount
rootfs on / type rootfs (rw)
tmpfs on /dev type tmpfs (rw,mode=755)
devpts on /dev/pts type devpts (rw,mode=600)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
/dev/block/mtdblock4 on /cache type yaffs2 (rw,nodev,noatime,nodiratime)
/ #
this seems simple enough since we can do it with all other android devices that have root. but it isnt, apparently. because we're running with a stock bootloader/SPL/recovery/ROM, adb wont run with SU permissions. this means abd remount doesnt work.
also, we dont know what the directory is to mount from /dev (i.e. on the G1 it was /dev/block/mtdblock3) to get system to mount as rw.
my point in asking is that i'm trying to do something i'm sure a lot of other people would like as well. custom ringtones in /system/media/audio instead of on the SD card. why? because with the ringtones on the SD card, media scanner picks them up every time and lumps them in with the actual music you have on your sd card. ugh.
so, as soon as someone can figure this out, i'd love to know how to do it so I can push the ringtones or cp them using busybox. anyone who can help...well, lets get it going.
Code:
C:\android-sdk-windows\tools>adb shell
$ su -
su -
#
# mount
mount
rootfs / rootfs ro 0 0
tmpfs /dev tmpfs rw,mode=755 0 0
devpts /dev/pts devpts rw,mode=600 0 0
proc /proc proc rw 0 0
sysfs /sys sysfs rw 0 0
/dev/block/stl6 /mnt/.lfs j4fs rw 0 0
tmpfs /sqlite_stmt_journals tmpfs rw,size=4096k 0 0
none /dev/cpuctl cgroup rw,cpu 0 0
/dev/block/stl9 /system rfs rw,vfat,llw,check=no,gid/uid/rwx,iocharset=utf8 0 0
/dev/block/mmcblk0p2 /data rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iocharset=utf8 0 0
/dev/block/mmcblk0p3 /data_tmo rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iocharset=utf8 0 0
/dev/block/stl10 /dbdata rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iocharset=utf8 0 0
/dev/block/stl11 /cache rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iocharset=utf8 0 0
/dev/block/stl3 /efs rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iocharset=utf8 0 0
#
busybox mount -o rw,remount /dev/block/stl9 /system
#
once you get there, just copy whatever you want wherever you want
something like
Code:
busybox cp /sdcard/sd/myfile.mp3 /system/media/audio/
mucho kudos! i have a feeling this will come in handy for a lot of people in the future.
cojonesx said:
Code:
C:\android-sdk-windows\tools>adb shell
$ su -
su -
#
# mount
mount
rootfs / rootfs ro 0 0
tmpfs /dev tmpfs rw,mode=755 0 0
devpts /dev/pts devpts rw,mode=600 0 0
proc /proc proc rw 0 0
sysfs /sys sysfs rw 0 0
/dev/block/stl6 /mnt/.lfs j4fs rw 0 0
tmpfs /sqlite_stmt_journals tmpfs rw,size=4096k 0 0
none /dev/cpuctl cgroup rw,cpu 0 0
/dev/block/stl9 /system rfs rw,vfat,llw,check=no,gid/uid/rwx,iocharset=utf8 0 0
/dev/block/mmcblk0p2 /data rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iocharset=utf8 0 0
/dev/block/mmcblk0p3 /data_tmo rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iocharset=utf8 0 0
/dev/block/stl10 /dbdata rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iocharset=utf8 0 0
/dev/block/stl11 /cache rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iocharset=utf8 0 0
/dev/block/stl3 /efs rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iocharset=utf8 0 0
#
busybox mount -o rw,remount /dev/block/stl9 /system
#
once you get there, just copy whatever you want wherever you want
something like
Code:
busybox cp /sdcard/sd/myfile.mp3 /system/media/audio/
Click to expand...
Click to collapse
Whoa... Do I need to do all this just to push a apk as system app?
No, all you need to do is:
adb shell (ony if you're using adb, if you're using terminal, skip this command)
su
busybox mount -o rw,remount /dev/block/stl9 /system
busybox cp /(location of the app here)/app.apk /system/app/
reboot
now, depending on where you have the app:
if its on the 14gb storage, it'll just be /sdcard/app.apk
if its on your actual sd card, it'll be /sdcard/sd/app.apk
all the stuff in the code post between # mount and the next # is what gets printed from the mount command. not actual commands.
adb remount doesn't work? I have been using it to delete stuff out of the /system/app directory... Maybe I am not getting what you are referring to.
??
hah2110 said:
Whoa... Do I need to do all this just to push a apk as system app?
Click to expand...
Click to collapse
Didn't mean to scare anyone with all that text, kusotare is right, the mount command shows what is currently mounted and where, its how I knew where to remount /system. Just used it as an example to teach as well
ahh, never mind, I see the issue now
So adb push to /system/* is never going to work until we get some custom roms then?
precisely t1n0m3n.
I used buysbox to try and re-install dlna.apk/odex and my phone boots normal, but wont every "wake up" after the Galaxy s screen, it just stays black, but the home keys are responsive? Did i screw something up?
kusotare said:
No, all you need to do is:
adb shell (ony if you're using adb, if you're using terminal, skip this command)
su
busybox mount -o rw,remount /dev/block/stl9 /system
busybox cp /(location of the app here)/app.apk /system/app/
reboot
now, depending on where you have the app:
if its on the 14gb storage, it'll just be /sdcard/app.apk
if its on your actual sd card, it'll be /sdcard/sd/app.apk
all the stuff in the code post between # mount and the next # is what gets printed from the mount command. not actual commands.
Click to expand...
Click to collapse
Tried doing this. I have com.neevo.mobiledefense.apk in my adb folder so on my N1, I never actually had to type a location of the file but whether I use the location or not, I get file not found... Will my N1 mobiledefense system app *.zip work on this phone or no since the directories are different?
Greeting,
Here's the details.
FIXED....
here's how.
as you may see in the post i stopped in the step of trying to format \efs partation.
but instead.
I went to my friend phone and make this command
Code:
dd if=/dev/block/mmcblk0p1 of=/sdcard/ilostit.dd
this backup the mmcblk0p1 which is \efs to a file.
then move it to my phone \sdcard
and did this commands.
Code:
umount /efs "unmount /efs
dd if=/sdcard/ilostit.dd of=/dev/block/mmcblk0p1 "relfash mmcblk0p1 with the backup.
reboot
this reflash mmcblk0p1 block with the backup,
then copy my \efs backup to \efs.
and no more IO error..
and violaa...
my IMIE is back and the Signal is OK.
Big thank goes to KciNicK who helped me alot and earn it.
_________
The Original Problem :
Tonight I flashed a kernel to my phone, just\ lost the Singal and my phone show no sim card inserted!.
anyway, i figure it out that... the IMEI lost.
in \efs there's no nv_data.bin file!!
So i went to restore the \efs.
but something not right here!
Hope someone can help here.
i tried these commands but no chance tel now!.
here to restore nv_data.bin
Code:
su
# cp /sdcard/nv_data.bin /efs/nv_data.bin
cp /sdcard/nv_data.bin /efs/nv_data.bin
[COLOR="red"]cp: can't stat '/efs/nv_data.bin': Input/output error[/COLOR]
and here to restore \efs
Code:
# busybox tar zxvf /sdcard/efs/efs-backup.tar.gz -C /
busybox tar zxvf /sdcard/efs/efs-backup.tar.gz -C /
efs/
efs/cryptprop_rebootMode
[COLOR="Red"]tar: can't remove old file efs/cryptprop_rebootMode: Read-only file system[/COLOR]
#
Code:
su
# mount -o rw,remount /dev/block/mmcblk0p1 /efs
mount -o rw,remount /dev/block/mmcblk0p1 /efs
# cp /sdcard/nv_data.bin /efs/nv_data.bin
cp /sdcard/nv_data.bin /efs/nv_data.bin
cp: can't stat '/efs/nv_data.bin': Input/output error
tried to flash back to many FWs but no chance,
---
time for some sleep, hope to find something later
the input output error is coz disk full, try deleting/moving some .bak files to sdcard then try the copy again
KciNicK said:
the input output error is coz disk full, try deleting/moving some .bak files to sdcard then try the copy again
Click to expand...
Click to collapse
\efs is read only!, i see members here can you root explorer to delete and move files.
If i can just copy the backup nv_data.bin to \efs that's will be good!.
but i don't know what's to do!.
Can't you use root explorer (don't forget to mount r/w), I find I can get all sorts of errors using adb+cli but root explorer will just do the job.
Another suggestion would be to flash an insecure kernel
copy paste the output of this please...
# busybox cat /proc/mounts
I got this
Code:
su
# ls
ls
acct fota.rc res
app-cache init sbin
cache init.goldfish.rc sdcard
config init.rc sys
d init.smdkc210.rc system
data init_kernel_only.rc tmp
dbdata lib ueventd.goldfish.rc
default.prop lpm.rc ueventd.rc
dev mnt ueventd.smdkc210.rc
efs proc vendor
etc recovery.rc
# cd efs
cd efs
# ls
ls
[COLOR="Red"]ls: ./nv_data.bin: I/O error
ls: ./nv.log: I/O error
ls: ./nv_data.bin.md5: I/O error
ls: ./dmp: I/O error[/COLOR]
cryptprop_applied_result cryptprop_securewipedata
cryptprop_onetimeboot edk_p
cryptprop_persist.sys.language imei
cryptprop_persist.sys.timezone redata.bin
cryptprop_rebootMode
#
Re flash the kernel
Sent from my HTC Vision using XDA App
KciNicK said:
copy paste the output of this please...
# busybox cat /proc/mounts
Click to expand...
Click to collapse
Code:
# busybox cat /proc/mounts
busybox cat /proc/mounts
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/usb tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /app-cache tmpfs rw,relatime,size=7168k 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/mmcblk0p9 /system ext4 ro,relatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p7 /cache ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered
0 0
/dev/block/mmcblk0p1 /efs ext4 ro,nosuid,nodev,noatime,barrier=1,data=ordered 0
0
nil /sys/kernel/debug debugfs rw,relatime 0 0
/dev/block/mmcblk0p10 /data ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered,
noauto_da_alloc,discard 0 0
/dev/block/mmcblk0p4 /mnt/.lfs j4fs rw,relatime 0 0
/dev/block/vold/179:11 /mnt/sdcard vfat rw,dirsync,nosuid,nodev,noexec,noatime,n
odiratime,uid=1000,gid=1015,fmask=0002,dmask=0002,allow_utime=0020,codepage=cp43
7,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro,discard 0 0
#
see http://forum.xda-developers.com/showthread.php?t=1103357
ok
# mount -o remount,rw /dev/block/mmcblk0p1 /efs
# busybox cp /sdcard/nv_data.bin /efs/nv_data.bin
also check the free space on the efs partition:
# busybox df -h
if that fails, it seems that the FS is screwed, try this (with efs mounted as ro, or not mounted at all):
# busybox fsck.ext4 /dev/block/mmcblk0p1
Here the result.
Code:
# mount -o remount,rw /dev/block/mmcblk0p1 /efs
mount -o remount,rw /dev/block/mmcblk0p1 /efs
mount: Read-only file system
# busybox cp /sdcard/nv_data.bin /efs/nv_data.bin
busybox cp /sdcard/nv_data.bin /efs/nv_data.bin
cp: can't stat '/efs/nv_data.bin': Input/output error
# busybox df -h
busybox df -h
Filesystem Size Used Available Use% Mounted on
tmpfs 416.5M 32.0K 416.5M 0% /dev
tmpfs 416.5M 0 416.5M 0% /mnt/asec
tmpfs 416.5M 0 416.5M 0% /mnt/obb
tmpfs 416.5M 0 416.5M 0% /mnt/usb
tmpfs 7.0M 0 7.0M 0% /app-cache
/dev/block/mmcblk0p9 503.9M 474.9M 29.0M 94% /system
/dev/block/mmcblk0p7 98.4M 4.1M 94.4M 4% /cache
/dev/block/mmcblk0p1 19.7M 8.2M 11.5M 42% /efs
/dev/block/mmcblk0p10
2.0G 64.8M 1.9G 3% /data
df: /mnt/.lfs: Function not implemented
/dev/block/vold/179:11
11.5G 8.9M 11.5G 0% /mnt/sdcard
# busybox fsck.ext4 /dev/block/mmcblk0p1
busybox fsck.ext4 /dev/block/mmcblk0p1
fsck.ext4: applet not found
#
n I9100XEKE1 Rom with GT-I9100_XWKE1_insecure kernel /SuperOneClickv1.9.1
Why i can't mount it as read write!!!
ps: KciNicK if you would, we can try via msn.
try mounting / as RW as well
# mount -o remount,rw rootfs /
then
# mount -o remount,rw /dev/block/mmcblk0p1 /efs
I flashed with CF-Root v4.0 kernel
and this is my result.
Code:
# mount -o remount,rw /dev/block/mmcblk0p1 /efs
mount -o remount,rw /dev/block/mmcblk0p1 /efs
# busybox cp /sdcard/nv_data.bin /efs/nv_data.bin
busybox cp /sdcard/nv_data.bin /efs/nv_data.bin
cp: can't stat '/efs/nv_data.bin': Input/output error
# busybox fsck.ext4 /dev/block/mmcblk0p1
busybox fsck.ext4 /dev/block/mmcblk0p1
fsck.ext4: applet not found
# mount -o remount,rw rootfs /
mount -o remount,rw rootfs /
# mount -o remount,rw /dev/block/mmcblk0p1 /efs
mount -o remount,rw /dev/block/mmcblk0p1 /efs
# cp /sdcard/nv_data.bin /efs/nv_data.bin
cp /sdcard/nv_data.bin /efs/nv_data.bin
cp: can't stat '/efs/nv_data.bin': Input/output error
# rm /efs/nv_data.bin
rm /efs/nv_data.bin
rm: can't stat '/efs/nv_data.bin': I/O error
#
tried to delete /efs/nv_data.bin!..
hemmm. i think here's the problem can't stat '/efs/nv_data.bin': Input/output error
all that happened after flashing to the kernel i mention in the OP. ehh.
the ext4 fs on /efs is screwed, try umounting it then format it again, but i don't know if you have the tools to doit, reflashing the efs partition may solve it, feel free to contact me by msn, i sent my address by pm
KciNicK said:
the ext4 fs on /efs is screwed, try umounting it then format it again, but i don't know if you have the tools to doit, reflashing the efs partition may solve it, feel free to contact me by msn, i sent my address by pm
Click to expand...
Click to collapse
Yes, i think i need to reFormat it to solve this IO error but how!
I added you the same name here. "Majed.y"
Thank you
with odin and a .pit file, you can get the correct .pit from samfirmware
KciNicK said:
try mounting / as RW as well
# mount -o remount,rw rootfs /
then
# mount -o remount,rw /dev/block/mmcblk0p1 /efs
Click to expand...
Click to collapse
fsck cannot run on mounted file systems, you need to umount
godutch said:
with odin and a .pit file, you can get the correct .pit from samfirmware
Click to expand...
Click to collapse
I did it with "u1_02_20110310_emmc_EXT4.pit" and still..
godutch said:
fsck cannot run on mounted file systems, you need to umount
Click to expand...
Click to collapse
maybe i need step by step, i don't want to break my phone for good
Ok,
unmount \efs
but what's missing to format it?
here's what i got
Code:
# umount /efs
umount /efs
# busybox fsck.ext4 /dev/block/mmcblk0p1
busybox fsck.ext4 /dev/block/mmcblk0p1
[COLOR="Red"]fsck.ext4: applet not found[/COLOR]
# fsck.ext4 /dev/block/mmcblk0p1
fsck.ext4 /dev/block/mmcblk0p1
[COLOR="Red"]fsck.ext4: not found[/COLOR]
# fsck
fsck
[COLOR="Red"]fsck (busybox 1.17.2, 2010-09-05 03:37:08 CDT)
fsck: can't read '/etc/fstab': No such file or directory[/COLOR]
Problem Fixed....
Look at the OP for the solution.
Hey all. I have a 32 GB US TPT that was on 0075. I rooted it using djrbliss's method, and at some point managed to screw up my systemui.apk. I couldn't get it working again, so I attempted a factory reset. For some reason, that left Superuser in my list of apps, and Superuser will say that it has granted apps superuser permission, but whenever I try to do anything that would require root (like delete a system app), it doesn't work.
Also, I've tried to reinstall stock 0075 from a zip, but when I did that it said something about the update check failing on account of missing system apps.
So I'm kind of stuck. How do I fix this? I want to get the tablet fully re-rooted so I can install CWM and that 0075 no bloat nandroid backup.
I would first try to run the root script from djrbliss again.
Without root you are not able to restore the system-apps but they are mandatory for any update.
I forgot to mention that I did try re-running the root script. It gave me error messages saying it was unable to copy any of the stuff like superuser.apk.
Try the following. As you still can do su and promt changes to #.
Copy busybox to your device:
1. adb push busybox /data/local/tmp (busybox is located in djrbliss root script)
2. adb shell
3. su
4. cd /data/local/tmp
5. ls (to see if busybox is there)
6. busybox mount -o rw,remount /system
7. mount (to see if /system is mounted as RW)
Did all that, busybox is there, but I don't see /system at all in the list that comes up after mount. Did you mean sysfs? That one says rw.
PS: sorry for being generally clueless about this stuff. This is my first time doing anything much under the hood with Android.
Edit: another curious issue I just noticed: the tablet connects to my computer just fine via MTP, and shows up under adb devices, but when I select mount the SD card, the tablet immediately reboots. Also, it doesn't show up under adb devices if I don't select either, but that might be normal.
qdmcgraw said:
Did all that, busybox is there, but I don't see /system at all in the list that comes up after mount. Did you mean sysfs? That one says rw.
PS: sorry for being generally clueless about this stuff. This is my first time doing anything much under the hood with Android.
Click to expand...
Click to collapse
Please post output from mount.
It should look like this for system:
/dev/block/mmcblk0p3 /system ext4 rw,relatime,barrier=1,data=ordered 0 0
Exe557 said:
Please post output from mount.
It should look like this for system:
/dev/block/mmcblk0p3 /system ext4 rw,relatime,barrier=1,data=ordered 0 0
Click to expand...
Click to collapse
Oh, yeah, that's there, but it's listed as ro. Everything else the same as what you wrote.
Quiet hard to help without supplying output from shell.
What do you get after typing busybox mount -o rw,remount /system?
Code:
C:\Program Files (x86)\Android\android-sdk\platform-tools>adb devices
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
List of devices attached
43c71c543bf7457 device
C:\Program Files (x86)\Android\android-sdk\platform-tools>adb push busybox /data
/local/tmp
1317 KB/s (1867568 bytes in 1.384s)
C:\Program Files (x86)\Android\android-sdk\platform-tools>adb shell
$ su
su
# cd /data/local/tmp
cd /data/local/tmp
# ls
ls
busybox
# busybox mount -o rw,remount /system
busybox mount -o rw,remount /system
# mount
mount
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/mmcblk0p3 /system ext4 ro,relatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p4 /cache ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered
0 0
/dev/block/mmcblk0p6 /mnt/pia ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordere
d 0 0
/dev/block/mmcblk0p9 /mnt/persdata ext4 rw,nosuid,nodev,noatime,barrier=1,data=o
rdered 0 0
/dev/block/mmcblk0p10 /data ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered
0 0
/dev/fuse /mnt/sdcard fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,d
efault_permissions,allow_other 0 0
/dev/block/loop0 /persdata/absolute ext4 rw,relatime,barrier=1,data=ordered 0 0
/dev/block/vold/179:9 /mnt/external_sd vfat rw,dirsync,nosuid,nodev,noexec,relat
ime,uid=1000,gid=1015,fmask=0002,dmask=0002,allow_utime=0020,codepage=cp437,ioch
arset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
Looks ok and it accept the command without any errors.
Try this please and post output:
busybox mount -o remount,rw /system; mv system/bin/aba system/bin/aba_bak
Have you tried installing Titanium Backup and running it? I remember one time when I ran TB after running the YAREFTP script to get OTA2 rooted. Titanium Backup reported that SuperUser was installed but it's binaries were incorrect (or something to that effect) and offered to fix it for me. Root seemed fine after that.
Might be worth a try. Also, did you re-install superuser and then run it?
Exe557 said:
Looks ok and it accept the command without any errors.
Try this please and post output:
busybox mount -o remount,rw /system; mv system/bin/aba system/bin/aba_bak
Click to expand...
Click to collapse
Code:
C:\Program Files (x86)\Android\android-sdk\platform-tools>adb devices
List of devices attached
43c71c543bf7457 device
C:\Program Files (x86)\Android\android-sdk\platform-tools>adb shell
$ su
su
# cd /data/local/tmp
cd /data/local/tmp
# ls
ls
busybox
# busybox mount -o remount,rw /system; mv system/bin/aba system/bin/aba_bak
busybox mount -o remount,rw /system; mv system/bin/aba system/bin/aba_bak
failed on 'system/bin/aba' - No such file or directory
#
Mhm, so looks like it is not there and it will not prevent your /system to remount as rw.
I'm out of ideas.
pwstein said:
Have you tried installing Titanium Backup and running it? I remember one time when I ran TB after running the YAREFTP script to get OTA2 rooted. Titanium Backup reported that SuperUser was installed but it's binaries were incorrect (or something to that effect) and offered to fix it for me. Root seemed fine after that.
Might be worth a try. Also, did you re-install superuser and then run it?
Click to expand...
Click to collapse
I installed Titanium Backup just now, but it didn't give me any error message like that. I don't know how I'd go about reinstalling Superuser.
Exe557 said:
Mhm, so looks like it is not there and it will not prevent your /system to remount as rw.
I'm out of ideas.
Click to expand...
Click to collapse
Damn, well thanks anyway. I appreciate you helping out.
Damn, I see the error now
As your are in /data/local/tmp mv system/bin/aba system/bin/aba_bak will not work.
So it should be:
busybox mount -o remount,rw /system; mv /system/bin/aba /system/bin/aba_bak
I think that one went through. It just accepted the command with no error message.
If it goes through it should be mounted as rw. Otherwise it is impossible to modify data on /system folder.
Check mount
Exe557 said:
If it goes through it should be mounted as rw. Otherwise it is impossible to modify data on /system folder.
Check mount
Click to expand...
Click to collapse
Yep, it appears to be mounted as rw now
Code:
C:\Program Files (x86)\Android\android-sdk\platform-tools>adb shell
$ su
su
# cd /data/local/tmp
cd /data/local/tmp
# ls
ls
busybox
# busybox mount -o remount,rw /system; mv /system/bin/aba /system/bin/aba_bak
busybox mount -o remount,rw /system; mv /system/bin/aba /system/bin/aba_bak
# mount
mount
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/mmcblk0p3 /system ext4 rw,relatime,barrier=1,data=ordered 0 0
/dev/block/mmcblk0p4 /cache ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered
0 0
/dev/block/mmcblk0p6 /mnt/pia ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordere
d 0 0
/dev/block/mmcblk0p9 /mnt/persdata ext4 rw,nosuid,nodev,noatime,barrier=1,data=o
rdered 0 0
/dev/block/mmcblk0p10 /data ext4 rw,nosuid,nodev,noatime,barrier=1,data=ordered
0 0
/dev/fuse /mnt/sdcard fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,d
efault_permissions,allow_other 0 0
/dev/block/loop0 /persdata/absolute ext4 rw,relatime,barrier=1,data=ordered 0 0
/dev/block/vold/179:9 /mnt/external_sd vfat rw,dirsync,nosuid,nodev,noexec,relat
ime,uid=1000,gid=1015,fmask=0002,dmask=0002,allow_utime=0020,codepage=cp437,ioch
arset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
#
So does that mean everything is working properly?
So far it looks ok. As it is mounted as RW you can install CWM recovery now.
Edit: Keep in mind to use correct CWM image for your TPT. It has to fit region and size.
Some people bricked the tablet while using the wrong image.
Exe557 said:
So far it looks ok. As it is mounted as RW you can install CWM recovery now.
Click to expand...
Click to collapse
I did just now. It worked! Thank you so much!
**UPDATE**
Here is my collection of scripts for rooting, blocking updates, and all kinds of stuff for ALL fire tv:
https://github.com/pwntrik/firetv/
Here's the video (2 parts) on howto root Fire TV 1st gen using soldering:
https://youtu.be/yhwYfudGiM8
https://youtu.be/Kn7zmXf08bk
**/UPDATE**
Greetings, AFTV hackers!
I have successfully soldered an emmc reader to the Fire TV 1st Gen, and I have complete r/w access. However, the tutorial for rooting appears to be a bit dated as the hacker (@maximus64) at the time was able to just copy the su binary to /system/xbin, modify the permissions, and run it.
Since FireOS 5.2.0.0, however, SELinux now prevents the binary from being executed:
(At this point, I have already copied su binary, chmod 6755 it, chown 0:0 it)
Code:
[email protected]:/ $ ls -la /system/xbin/su
ls -la /system/xbin/su
/system/xbin/su: Permission denied
1|[email protected]:/ $ su
su
/system/bin/sh: su: not found
127|[email protected]:/ $ ls -ld /system/xbin
ls -ld /system/xbin
drwxr-xr-x root shell 2017-01-05 01:35 xbin
[email protected]:/ $ ls -l /system/xbin/
ls -l /system/xbin/
-rwxr-xr-x root shell 63880 2016-05-27 17:00 dexdump
-rwxr-xr-x root shell 49816 2016-05-27 17:00 sqlite3
lstat '/system/xbin//su' failed: Permission denied
-rwxr-xr-x root shell 813248 2016-05-27 17:00 tcpdump
-rwxr-xr-x root shell 9384 2016-05-27 17:00 trapz
-rwxr-xr-x root shell 46456 2016-05-27 17:00 vitals_collection_agent
And just to make sure I did everything correctly, I hooked it up again then checked the binary:
Code:
[email protected]:/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b1/xbin# ls -la
total 1092
drwxr-xr-x. 2 root 2000 4096 Jan 5 04:35 .
drwxr-xr-x. 16 root root 4096 Jan 6 17:07 ..
-rwxr-xr-x. 1 root 2000 63880 May 27 2016 dexdump
-rwxr-xr-x. 1 root 2000 49816 May 27 2016 sqlite3
-rwsr-sr-x 1 root root 112576 Jan 5 04:31 su
-rwxr-xr-x. 1 root 2000 813248 May 27 2016 tcpdump
-rwxr-xr-x. 1 root 2000 9384 May 27 2016 trapz
-rwxr-xr-x. 1 root 2000 46456 May 27 2016 vitals_collection_agent
So at this point, I did some research and it seems that SELinux prevents this from being run. Does anyone have a workaround or could tell me how to give this binary permission? I have zero experience with SELinux, and even if anyone can point me to a similar thread for rooting when you have full r/w access, that'd be excellent..
Thanks!
cancelyourcable said:
Greetings, AFTV hackers!
I have successfully soldered an emmc reader to the Fire TV 1st Gen, and I have complete r/w access. However, the tutorial for rooting appears to be a bit dated as the hacker (@maximus64) at the time was able to just copy the su binary to /system/xbin, modify the permissions, and run it.
Since FireOS 5.2.0.0, however, SELinux now prevents the binary from being executed:
(At this point, I have already copied su binary, chmod 6755 it, chown 0:0 it)
Code:
[email protected]:/ $ ls -la /system/xbin/su
ls -la /system/xbin/su
/system/xbin/su: Permission denied
1|[email protected]:/ $ su
su
/system/bin/sh: su: not found
127|[email protected]:/ $ ls -ld /system/xbin
ls -ld /system/xbin
drwxr-xr-x root shell 2017-01-05 01:35 xbin
[email protected]:/ $ ls -l /system/xbin/
ls -l /system/xbin/
-rwxr-xr-x root shell 63880 2016-05-27 17:00 dexdump
-rwxr-xr-x root shell 49816 2016-05-27 17:00 sqlite3
lstat '/system/xbin//su' failed: Permission denied
-rwxr-xr-x root shell 813248 2016-05-27 17:00 tcpdump
-rwxr-xr-x root shell 9384 2016-05-27 17:00 trapz
-rwxr-xr-x root shell 46456 2016-05-27 17:00 vitals_collection_agent
And just to make sure I did everything correctly, I hooked it up again then checked the binary:
Code:
[email protected]:/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b1/xbin# ls -la
total 1092
drwxr-xr-x. 2 root 2000 4096 Jan 5 04:35 .
drwxr-xr-x. 16 root root 4096 Jan 6 17:07 ..
-rwxr-xr-x. 1 root 2000 63880 May 27 2016 dexdump
-rwxr-xr-x. 1 root 2000 49816 May 27 2016 sqlite3
-rwsr-sr-x 1 root root 112576 Jan 5 04:31 su
-rwxr-xr-x. 1 root 2000 813248 May 27 2016 tcpdump
-rwxr-xr-x. 1 root 2000 9384 May 27 2016 trapz
-rwxr-xr-x. 1 root 2000 46456 May 27 2016 vitals_collection_agent
So at this point, I did some research and it seems that SELinux prevents this from being run. Does anyone have a workaround or could tell me how to give this binary permission? I have zero experience with SELinux, and even if anyone can point me to a similar thread for rooting when you have full r/w access, that'd be excellent..
Thanks!
Click to expand...
Click to collapse
bueller_recovery_v2.zip begins with a shell script. If you open it in a text editor, you can see it. mkdir /system/recovery, unzip the contents of that zip to /system/recovery, and do the mv and ln commands. Make sure the selinux contexts of /system/recovery and it's contents match the other contents of /systems.
And also make sure the contents are chmod 755.
rbox said:
bueller_recovery_v2.zip begins with a shell script. If you open it in a text editor, you can see it. mkdir /system/recovery, unzip the contents of that zip to /system/recovery, and do the mv and ln commands. Make sure the selinux contexts of /system/recovery and it's contents match the other contents of /systems.
And also make sure the contents are chmod 755.
Click to expand...
Click to collapse
Thanks, rbox! I've managed to rewrite the script to do all that, but how do I make sure the SELinux contexts match? Sorry, not familiar with SELinux.
Is this the ACTUAL partition table, or is this the way the eMMC reader loads it?
Code:
[email protected]:/media/root# ls 5*
57f8f4bc-abf4-655f-bf67-946fc0f9f25b:
adb backup hostapd property system?
anr bugreports key_provisioning prReset time
app connectivity local radio tombstones
app-asec dalvik-cache logd resource-cache user
app_ext data lost+found securedStorageLocation vitals
app-lib debug_service media securestop webcrypto
app_ms dontpanic mediadrm security wiper
app-private dpm misc shared wpstiles
audio drm playready ssh
autotrace fota proffline system
57f8f4bc-abf4-655f-bf67-946fc0f9f25b1:
data lost+found usf
57f8f4bc-abf4-655f-bf67-946fc0f9f25b2:
com.amazon.avod.apk lost+found
com.amazon.venezia.apk recovery
com.amazon.vizzini-550901810.apk signed_com.amazon.kso.blackbird-1550000810.apk
dalvik-cache signed_CSAppFireTV-fireOs-release_v112.apk
57f8f4bc-abf4-655f-bf67-946fc0f9f25b3:
data lost+found usf
57f8f4bc-abf4-655f-bf67-946fc0f9f25b4:
app etc lib priv-app sqfs vendor
bin fonts lost+found recovery-from-boot.p tts xbin
build.prop framework media security usr
I ask because /system/bin is actually on a completely separate partition using this method. Is it possible to copy the actual init2stub in place of e2fsck instead of symlinking it? (in case the symlink doesn't work)
Here's my modified version of your script:
Code:
# Put your `recovery' folder in here, unzipped
SHARED="/media/sf_Shared"
# This is the directory created by the MMC reader
LABEL="/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b"
SYSTEM="${LABEL}/system"
BIN="${LABEL}4/bin"
echo "Copying recovery..."
cp -rf $SHARED/recovery $SYSTEM
echo "Chmodding..."
chmod -R 755 $SYSTEM/recovery
echo "Backup the old e2fsck..."
mv $BIN/e2fsck $BIN/e2fsck.real
echo "Symlink e2fsck to 2ndinitstub..."
# If symlink doesn't work, can I copy 2ndinitstub completely?
ln -sf ../recovery/2ndinitstub $BIN/e2fsck
echo "Done."
Thanks for your help otherwise I'd be so SCREWED! :laugh:
cancelyourcable said:
Thanks, rbox! I've managed to rewrite the script to do all that, but how do I make sure the SELinux contexts match? Sorry, not familiar with SELinux.
Is this the ACTUAL partition table, or is this the way the eMMC reader loads it?
Code:
[email protected]:/media/root# ls 5*
57f8f4bc-abf4-655f-bf67-946fc0f9f25b:
adb backup hostapd property system?
anr bugreports key_provisioning prReset time
app connectivity local radio tombstones
app-asec dalvik-cache logd resource-cache user
app_ext data lost+found securedStorageLocation vitals
app-lib debug_service media securestop webcrypto
app_ms dontpanic mediadrm security wiper
app-private dpm misc shared wpstiles
audio drm playready ssh
autotrace fota proffline system
57f8f4bc-abf4-655f-bf67-946fc0f9f25b1:
data lost+found usf
57f8f4bc-abf4-655f-bf67-946fc0f9f25b2:
com.amazon.avod.apk lost+found
com.amazon.venezia.apk recovery
com.amazon.vizzini-550901810.apk signed_com.amazon.kso.blackbird-1550000810.apk
dalvik-cache signed_CSAppFireTV-fireOs-release_v112.apk
57f8f4bc-abf4-655f-bf67-946fc0f9f25b3:
data lost+found usf
57f8f4bc-abf4-655f-bf67-946fc0f9f25b4:
app etc lib priv-app sqfs vendor
bin fonts lost+found recovery-from-boot.p tts xbin
build.prop framework media security usr
I ask because /system/bin is actually on a completely separate partition using this method. Is it possible to copy the actual init2stub in place of e2fsck instead of symlinking it? (in case the symlink doesn't work)
Here's my modified version of your script:
Code:
# Put your `recovery' folder in here, unzipped
SHARED="/media/sf_Shared"
# This is the directory created by the MMC reader
LABEL="/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b"
SYSTEM="${LABEL}/system"
BIN="${LABEL}4/bin"
echo "Copying recovery..."
cp -rf $SHARED/recovery $SYSTEM
echo "Chmodding..."
chmod -R 755 $SYSTEM/recovery
echo "Backup the old e2fsck..."
mv $BIN/e2fsck $BIN/e2fsck.real
echo "Symlink e2fsck to 2ndinitstub..."
# If symlink doesn't work, can I copy 2ndinitstub completely?
ln -sf ../recovery/2ndinitstub $BIN/e2fsck
echo "Done."
Thanks for your help otherwise I'd be so SCREWED! :laugh:
Click to expand...
Click to collapse
That is /data. Not /system. ls -lZ will show you contexts.
rbox said:
That is /data. Not /system. ls -lZ will show you contexts.
Click to expand...
Click to collapse
Well, not sure exactly what happened but I booted it back up and /system/recovery doesn't exist. Even if that's normal behavior, it didn't run TWRP.
The shell script I pasted above, it runs chcon and chmod, but perhaps chcon has no effect since it's being run on a host system (linux), instead of the actual android system (I kinda expected that.)
Code:
[email protected]:/system/bin $ ls -Z e2*
ls -Z e2*
e2fsck: Permission denied
e2fsck.real: Permission denied
Is there an init file I can edit to run chcon or completely disable selinux? Seems like that's probably preventing it. I can't see log files as user, but I feel like that might be part of it.
Thanks
cancelyourcable said:
Well, not sure exactly what happened but I booted it back up and /system/recovery doesn't exist. Even if that's normal behavior, it didn't run TWRP.
The shell script I pasted above, it runs chcon and chmod, but perhaps chcon has no effect since it's being run on a host system (linux), instead of the actual android system (I kinda expected that.)
Code:
[email protected]:/system/bin $ ls -Z e2*
ls -Z e2*
e2fsck: Permission denied
e2fsck.real: Permission denied
Is there an init file I can edit to run chcon or completely disable selinux? Seems like that's probably preventing it. I can't see log files as user, but I feel like that might be part of it.
Thanks
Click to expand...
Click to collapse
Did you properly unmount the filesystem after you were done changing it? That's really the only way the changes wouldn't stick and recovery wouldn't be there. You definitely need to verify all the permissions and contexts manually before booting back in. Don't just assume a script worked. Also, I think chcon isn't going to work, now that I think about it. I remember when I was messing around with this stuff with the Fire TV 2 I wound up having to use extended attributes manually. This page: http://unix.stackexchange.com/quest...on-mounted-ext4-image-from-non-selinux-system explains how to do. As for disabling selinux... that's half the whole point of 2ndinit
rbox said:
Did you properly unmount the filesystem after you were done changing it? That's really the only way the changes wouldn't stick and recovery wouldn't be there. You definitely need to verify all the permissions and contexts manually before booting back in. Don't just assume a script worked. Also, I think chcon isn't going to work, now that I think about it. I remember when I was messing around with this stuff with the Fire TV 2 I wound up having to use extended attributes manually. This page: http://unix.stackexchange.com/quest...on-mounted-ext4-image-from-non-selinux-system explains how to do. As for disabling selinux... that's half the whole point of 2ndinit
Click to expand...
Click to collapse
Ya, definitely unmounted it. I'm like 99% sure it's because of this selinux thing. Ideally if I can get these extended attributes to work and run either `su' or get the recovery to load, that'd be best.
But /system and /recovery are on two separate partitions. When I look at the layout from linux when I mount it using the soldering method, it looks like this:
Code:
# /dev/sdb1 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b3 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb19 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b2 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb2 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b1 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb20 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb18 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
And from the firetv using adb shell, here's all the mounts:
Code:
[email protected]:/ $ mount
mount
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,seclabel,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,seclabel,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,seclabel,relatime 0 0
selinuxfs /sys/fs/selinux selinuxfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
none /sys/fs/cgroup tmpfs rw,seclabel,relatime,mode=750,gid=1000 0 0
tmpfs /mnt/asec tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/platform/msm_sdcc.1/by-name/system /system ext4 ro,seclabel,relatime,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/cache /cache ext4 rw,seclabel,nosuid,nodev,noatime,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/userdata /data ext4 rw,seclabel,nosuid,nodev,noatime,nomblk_io_submit,nobarrier,commit=20,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/modem /firmware vfat ro,context=u:object_r:firmware_file:s0,relatime,uid=1000,gid=1000,fmask=0337,dmask=0227,codepage=cp437,iocharset=iso8859-1,shortname=lower,errors=remount-ro 0 0
/dev/block/loop0 /mnt/sqfs squashfs ro,context=u:object_r:squashfs_file:s0,relatime 0 0
/dev/block/platform/msm_sdcc.1/by-name/persist /persist ext4 rw,context=u:object_r:persist_file:s0,nosuid,nodev,noatime,data=ordered 0 0
/dev/fuse /mnt/shell/emulated fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
/dev/fuse /mnt/shell/emulated/0 fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
It looks very different. Like the /bin that appears in /system on the fire tv is actually on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4, yet /system appears on a completely separate partition /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b it's weird. Copying e2fsck did make it appear there, yet adding /system/recovery did nothing:
Code:
[email protected]:/ $ cd /system/recovery
cd /system/recovery
/system/bin/sh: cd: /system/recovery: No such file or directory
Not sure whether this is the firetv or the emmc reader which is displaying it oddly.
I'll wire it back up tomorrow and see if I can get extended permissions as well as try to figure out why the recovery dir is not showing up at all.
Thanks!
cancelyourcable said:
Ya, definitely unmounted it. I'm like 99% sure it's because of this selinux thing. Ideally if I can get these extended attributes to work and run either `su' or get the recovery to load, that'd be best.
But /system and /recovery are on two separate partitions. When I look at the layout from linux when I mount it using the soldering method, it looks like this:
Code:
# /dev/sdb1 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b3 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb19 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b2 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb2 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b1 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb20 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb18 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
And from the firetv using adb shell, here's all the mounts:
Code:
[email protected]:/ $ mount
mount
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,seclabel,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,seclabel,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,seclabel,relatime 0 0
selinuxfs /sys/fs/selinux selinuxfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
none /sys/fs/cgroup tmpfs rw,seclabel,relatime,mode=750,gid=1000 0 0
tmpfs /mnt/asec tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/platform/msm_sdcc.1/by-name/system /system ext4 ro,seclabel,relatime,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/cache /cache ext4 rw,seclabel,nosuid,nodev,noatime,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/userdata /data ext4 rw,seclabel,nosuid,nodev,noatime,nomblk_io_submit,nobarrier,commit=20,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/modem /firmware vfat ro,context=u:object_r:firmware_file:s0,relatime,uid=1000,gid=1000,fmask=0337,dmask=0227,codepage=cp437,iocharset=iso8859-1,shortname=lower,errors=remount-ro 0 0
/dev/block/loop0 /mnt/sqfs squashfs ro,context=u:object_r:squashfs_file:s0,relatime 0 0
/dev/block/platform/msm_sdcc.1/by-name/persist /persist ext4 rw,context=u:object_r:persist_file:s0,nosuid,nodev,noatime,data=ordered 0 0
/dev/fuse /mnt/shell/emulated fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
/dev/fuse /mnt/shell/emulated/0 fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
It looks very different. Like the /bin that appears in /system on the fire tv is actually on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4, yet /system appears on a completely separate partition /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b it's weird. Copying e2fsck did make it appear there, yet adding /system/recovery did nothing:
Code:
[email protected]:/ $ cd /system/recovery
cd /system/recovery
/system/bin/sh: cd: /system/recovery: No such file or directory
Not sure whether this is the firetv or the emmc reader which is displaying it oddly.
I'll wire it back up tomorrow and see if I can get extended permissions as well as try to figure out why the recovery dir is not showing up at all.
Thanks!
Click to expand...
Click to collapse
You're not looking for a partition with a directory called system in it. The partition IS /system. So the partition with 'bin' and 'xbin' is the /system partition. That other one is /data.
rbox said:
You're not looking for a partition with a directory called system in it. The partition IS /system. So the partition with 'bin' and 'xbin' is the /system partition. That other one is /data.
Click to expand...
Click to collapse
Alright, so I made some big progress
Here's my script which successfully installed your TWRP zip:
Code:
# Put your `recovery' folder in here, unzipped
SHARED="/media/sf_Shared"
# This is the directory created by the MMC reader
LABEL="/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b"
# WARNING: this CHANGED from 4 to 3. Always CHECK FIRST
SYSTEM="${LABEL}3"
if [ ! -e "${SYSTEM}/xbin" ]; then
echo "ERROR: couldn't find /system/xbin - is the mount point correct?"
exit 1
fi
echo "Copying recovery..."
cp -rf $SHARED/recovery $SYSTEM
echo "Backup the old e2fsck..."
cp -i $SYSTEM/bin/e2fsck $SHARED/e2fsck.real
mv -i $SYSTEM/bin/e2fsck $SYSTEM/bin/e2fsck.real
echo "Chmodding and chconing RECOVERY..."
chown -R 0:2000 $SYSTEM/recovery
chmod -R 755 $SYSTEM/recovery
chcon -R --reference=$SYSTEM/bin $SYSTEM/recovery
echo "Copying, chmodding and chconing SU (in case recovery doesn't work out)..."
cp $SHARED/su $SYSTEM/xbin/
chown 0:2000 $SYSTEM/xbin/su
chmod 6755 $SYSTEM/xbin/su
chcon --reference=$SYSTEM/xbin/trapz $SYSTEM/xbin/su
echo "Symlink e2fsck to 2ndinitstub..."
ln -sf ../recovery/2ndinitstub $SYSTEM/bin/e2fsck
echo "Done."
Then I booted into TWRP successfully.
However, when I tried to install your bueller-5.2.1.1-rooted_r1 I got this:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
After a long time it was clearly hung, so I rebooted and now it's bricked. But I did do a `dd if=/dev/sdb123 of=system.img` so i have that.
Would it be possible to just overwrite that partition with your system prerooted image while I have it connected to the emmc reader?
Thanks again for all the help!
cancelyourcable said:
Alright, so I made some big progress
Here's my script which successfully installed your TWRP zip:
Code:
# Put your `recovery' folder in here, unzipped
SHARED="/media/sf_Shared"
# This is the directory created by the MMC reader
LABEL="/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b"
# WARNING: this CHANGED from 4 to 3. Always CHECK FIRST
SYSTEM="${LABEL}3"
if [ ! -e "${SYSTEM}/xbin" ]; then
echo "ERROR: couldn't find /system/xbin - is the mount point correct?"
exit 1
fi
echo "Copying recovery..."
cp -rf $SHARED/recovery $SYSTEM
echo "Backup the old e2fsck..."
cp -i $SYSTEM/bin/e2fsck $SHARED/e2fsck.real
mv -i $SYSTEM/bin/e2fsck $SYSTEM/bin/e2fsck.real
echo "Chmodding and chconing RECOVERY..."
chown -R 0:2000 $SYSTEM/recovery
chmod -R 755 $SYSTEM/recovery
chcon -R --reference=$SYSTEM/bin $SYSTEM/recovery
echo "Copying, chmodding and chconing SU (in case recovery doesn't work out)..."
cp $SHARED/su $SYSTEM/xbin/
chown 0:2000 $SYSTEM/xbin/su
chmod 6755 $SYSTEM/xbin/su
chcon --reference=$SYSTEM/xbin/trapz $SYSTEM/xbin/su
echo "Symlink e2fsck to 2ndinitstub..."
ln -sf ../recovery/2ndinitstub $SYSTEM/bin/e2fsck
echo "Done."
Then I booted into TWRP successfully.
However, when I tried to install your bueller-5.2.1.1-rooted_r1 I got this:
View attachment 3996750
After a long time it was clearly hung, so I rebooted and now it's bricked. But I did do a `dd if=/dev/sdb123 of=system.img` so i have that.
Would it be possible to just overwrite that partition with your system prerooted image while I have it connected to the emmc reader?
Thanks again for all the help!
Click to expand...
Click to collapse
UPDATE...
I flashed my original system.img and brought it back to a working state. After that, I set up recovery again then tried to install bueller-5.2.1.1-rooted_r1.zip. Same as before, it froze, but this time at 80%:
Here's the only "log" I could find:
Code:
[email protected]:/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4/recovery# cat log
Installing new recovery image: failed
So now I have the emmc reader connected again, and I'm *hoping* I can just flash the image in your bueller-5.2.1.1-rooted_r1.zip directly to the mmc using `dd if=system.new.dat of=/dev/sdb19`
But I thought I'd run it by your first before I brick it again :laugh:
Thanks again, @rbox
cancelyourcable said:
UPDATE...
I flashed my original system.img and brought it back to a working state. After that, I set up recovery again then tried to install bueller-5.2.1.1-rooted_r1.zip. Same as before, it froze, but this time at 80%:
View attachment 3997946
Here's the only "log" I could find:
Code:
[email protected]:/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4/recovery# cat log
Installing new recovery image: failed
So now I have the emmc reader connected again, and I'm *hoping* I can just flash the image in your bueller-5.2.1.1-rooted_r1.zip directly to the mmc using `dd if=system.new.dat of=/dev/sdb19`
But I thought I'd run it by your first before I brick it again :laugh:
Thanks again, @rbox
Click to expand...
Click to collapse
The thread for TWRP talks about what to do if it hangs. You can use adb. You'll need to check the log while it's running. /tmp/recovery.log. The image in the rom is sparse, so you'll have to run sdat2img.py on it. And then you'll have to do all the steps listed in the updater-script. The image itself is 100% pure stock.
rbox said:
The thread for TWRP talks about what to do if it hangs. You can use adb. You'll need to check the log while it's running. /tmp/recovery.log. The image in the rom is sparse, so you'll have to run sdat2img.py on it. And then you'll have to do all the steps listed in the updater-script. The image itself is 100% pure stock.
Click to expand...
Click to collapse
I discovered your "updater-script" so I understand the process a lot better now (wish I had found this earlier)
How do I know which image to use for boot: boot.img or boot_unlocked.img? I'm running from a host system so I can't check the value of ro.boot.unlocked_kernel from within linux.
Thanks!
P.S. Almost finished a bash script others can use to flash your image from an emmc reader - I will post a guide on here!
cancelyourcable said:
I discovered your "updater-script" so I understand the process a lot better now (wish I had found this earlier)
How do I know which image to use for boot: boot.img or boot_unlocked.img? I'm running from a host system so I can't check the value of ro.boot.unlocked_kernel from within linux.
Thanks!
P.S. Almost finished a bash script others can use to flash your image from an emmc reader - I will post a guide on here!
Click to expand...
Click to collapse
Since it's running OS5, you have to use the regular boot.img, since your bootloader isn't unlocked.
cancelyourcable said:
P.S. Almost finished a bash script others can use to flash your image from an emmc reader - I will post a guide on here!
Click to expand...
Click to collapse
I would really appreciate this.
zexma said:
I would really appreciate this.
Click to expand...
Click to collapse
It's almost done! Will post very soon
cancelyourcable said:
It's almost done! Will post very soon
Click to expand...
Click to collapse
Don't want to bother, you
Is there any progress to expect, cause I'm stuck at the very same point, SELinux prevents loading su
(/system/xbin//su' failed: Permission denied)
Thanks in advance.
pwntrik said:
It's almost done! Will post very soon
Click to expand...
Click to collapse
Any progress on this?
zexma said:
Any progress on this?
Click to expand...
Click to collapse
Yes, it works 100%. Literally just ordered an overhead camera tripod for recording a video of the whole process. Sit tight -- I promise it's coming soon!
@pwntrik : any tricks to have your Linux (Ubuntu) box recognizing the FireTV in fastboot mode?
I can get it to connect in fastboot with Win7 on the same machine, but in Ubuntu 16.04 I'm not able to.
I did add ATTR{idVendor}== "1949" and ATTR{idProduct}=="0401" to /etc/udev/51-android.rules and rebooted, but no luck...
My FireTV (1st gen, last firmware was 5.0.5, rooted) is currently , after unsuccessful flash of "rooted-5.0.5_r1" ROM in TWRP stuck at this screen:
.
I know it's a longshot to recover it, but I have patience....
Sent from space
kozmo2k4 said:
@pwntrik : any tricks to have your Linux (Ubuntu) box recognizing the FireTV in fastboot mode?
I can get it to connect in fastboot with Win7 on the same machine, but in Ubuntu 16.04 I'm not able to.
I did add ATTR{idVendor}== "1949" and ATTR{idProduct}=="0401" to /etc/udev/51-android.rules and rebooted, but no luck...
My FireTV (1st gen, last firmware was 5.0.5, rooted) is currently , after unsuccessful flash of "rooted-5.0.5_r1" ROM in TWRP stuck at this screen:
.
I know it's a longshot to recover it, but I have patience....
Sent from space
Click to expand...
Click to collapse
I've been using Win10 for that. I only use Linux for writing the images.