Database Users

[Q] How to uninstalling from console

I recently got the SGS G3 I5800 and tried uninstall the preinstalled apps. Because i do not trust closed source software on Android for several reasons i tried to remove the preinstalled apps with ConnectBot local. I did root the phone but i do not have the rights to remove or modify any .apk or .odex in /system/app.
If i try chown or chmod to set new user/group rights i just get the output that it is readonly. Is there some kind of special trick to remove those apps or change the rights? I mean, if i am root and the user and the group rights for a package are root:root i would guess that i am able to delete those files, at least that's how it works on linux. I checked the rights also by using the ls -l command, i should be able to.
I rooted the phone with the instructions from here but i did not update busybox, i wanted to build it myself.
Any idea how to uninstall without fancy applications?

Interested in this as well! I haven't tried anything so far but was thinking about just removing the files from system/app. Is that the way it's supposed to be done?
Sent from my Nexus One using XDA App

Ok i found out what the problem was and here is a solution, which i take no responsibility for when somebody f**ks up their phone.
You need the Android-SDK from Google to get adb shell and of course your phone must be rooted.
Your phone must be set to debugging mode which can be enabled by selecting the checkbox USB-debugging under Options->Applications-Development.
So this is how it works:
After installating the sdk, open command promt by pressing the Windows-key + R and typing "cmd". Go to the installation path of the android-sdk by typing:
cd c:\Program Files\Android\android-sdk-windows\platform-tools .
Code:
adb shell
su
Check your phone for popups if you gain root access via remote. There will be a popup-dialog from the superusers app.
Code:
mount
The result should look something like this:
Code:
rootfs / rootfs rw 0 0
tmpfs /dev tmpfs rw,mode=755 0 0
devpts /dev/pts devpts rw,mode=600 0 0
proc /proc proc rw 0 0
sysfs /sys sysfs rw 0 0
tmpfs /sqlite_stmt_journals tmpfs rw,size=4096k 0 0
/dev/block/stl6 /system rfs rw,vfat,llw,check=no,gid/uid/rwx,iocharset=cp437 0 0
/dev/block/stl7 /data rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iocharse
t=cp437 0 0
/dev/block/stl8 /cache rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iochars
et=cp437 0 0
/dev/block/stl4 /efs rfs rw,nosuid,nodev,vfat,llw,check=no,gid/uid/rwx,iocharset
=cp437 0 0
/dev/block//vold/179:1 /sdcard vfat rw,dirsync,nosuid,nodev,noexec,uid=1000,gid=
1015,fmask=0702,dmask=0602,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,s
hortname=mixed,utf8,errors=remount-ro 0 0
#
This is a bit complex for none average users. There are a few partitions, which basically means that the storage is split into pieces. Applications are stored in /system/app and /system is a partion itself, you need to look for it.
So my phone tells me it is /dev/block/stl6 but the problem is that it's mounted as read only, so there is no way to write on it without remounting it and that's what we do.
Code:
mount -o remount,rw /dev/block/stl6 /system
Now navigate to the application directory by writing
Code:
cd /systems/app
Now all you got to do is find the application you hate/don't want and delete it, but be carefull, you could screw up the phone.
As an example
Code:
rm Email.apk
If you are done deleting apps, mount the partion as readonly with
Code:
mount -o remount,ro /dev/block/stl6 /system
and to close the root-session type in
Code:
exit
Done

codeInTheShell said:
Code:
mount -o remount,rw /dev/block/stl6 /system
Click to expand...
Click to collapse
It suffices to issue
Code:
mount -o remount,rw /system
and
Code:
mount -o remount,ro /system
afterwards.
So it is not necessary to have a look first at the output of mount and to remember what is mounted where.

Code:
mount -o remount,rw /dev/block/stl6 /system
This is the only way to remount with ConnectBot local and with adb, the other way doesn't work at least it doesn't work local.

Buy and download RootExplorer from market and if you have a rooted phone u can delete preinstalled apps from /system/app.
In RE you must set rw filesystem by tap that option in /system/app folder.
Cheers
Sent from my GT-I5800 using Tapatalk

Dude ... srsly read before you post ...

and if I want to only temporarily remove an app? can I move the app to sd using root explorer and when I want to use it again just move it back to system/app?
Sent from my Nexus One using XDA App

Not sure, i just wanted to find out how to remove apps without an app like root explorer. You could probably move or copy them to your sdcard and if you want them back you could reinstall them ... give it a try, but before that backup your apps

[Q] Anyone use AdFree on CM7?

Got AdFree installed, but it says it can't find space to write the hosts file.
Using CM7 final on SD card installed with verygreen's method.

Same here
Sent from my PC36100 using XDA App

danbutter said:
Using CM7 final on SD card installed
Click to expand...
Click to collapse
There's your problem.
AdFree probably freaks out when it sees how you have Android setup on your sd card.
It runs flawlessly for me with CM7 emmc.

Paul22000 said:
There's your problem.
AdFree probably freaks out when it sees how you have Android setup on your sd card.
It runs flawlessly for me with CM7 emmc.
Click to expand...
Click to collapse
+1
Agreed, works perfect on emmc

Works fine on my uSD. It just copy the host file to /system/etc/ so running on SD or emmc makes no different.

Confirmed Functional
I used adfree on nightlies in the SD card...decided to install final release on emmc and also didn't have problems.

I'm running CM7 off SD card. Adfree can't find the right mount point to remount.
1) I pulled the Adfree hosts file off another Android device (I attached it in a zip).
2) I then made the NC system partition writeable by using 'adb remount'
3) I pushed the hosts file to the NC: 'adb push hosts /system/etc/hosts'
if step 2) doesn't work, here are manual instructions. You need adb or terminal emulator with root permissions (hence the # that precedes each command):
# alias mount="busybox mount"
# mount
rootfs on / type rootfs (ro)
tmpfs on /dev type tmpfs (rw,mode=755)
devpts on /dev/pts type devpts (rw,mode=600)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
tmpfs on /mnt/asec type tmpfs (rw,mode=755,gid=1000)
tmpfs on /mnt/obb type tmpfs (rw,mode=755,gid=1000)
/dev/block/mmcblk0p2 on /rom type vfat (rw,noatime,nodiratime,uid=1000,gid=1000,fmask=0117,dmask=0007,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,errors=remount-ro)
/dev/block/mmcblk1p2 on /system type ext4 (ro,barrier=1,data=ordered)
/dev/block/mmcblk1p3 on /data type ext4 (rw,nosuid,nodev,noatime,barrier=1,data=ordered)
/dev/block/mmcblk0p7 on /cache type ext4 (rw,nosuid,nodev,noatime,barrier=1,data=ordered)
/sys/kernel/debug on /sys/kernel/debug type debugfs (rw)
/dev/block/vold/179:20 on /mnt/sdcard type vfat (rw,dirsync,nosuid,nodev,noexec,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro)
/dev/block/vold/179:20 on /mnt/secure/asec type vfat (rw,dirsync,nosuid,nodev,noexec,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro)
tmpfs on /mnt/sdcard/.android_secure type tmpfs (ro,size=0k,mode=000)
/dev/block/vold/179:8 on /mnt/emmc type vfat (rw,dirsync,nosuid,nodev,noexec,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro)
/dev/block/dm-0 on /mnt/asec/dk.logisoft.aircontrol-1 type vfat (ro,dirsync,nosuid,nodev,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro)​
The red line is the one we care about. DO NOT PROCEED IF YOURS IS DIFFERENT.
To make it read-write:
# mount -o rw,remount -t ext4 /dev/block/mmcblk1p2 /system
To make it read-only:
# mount -o ro,remount -t ext4 /dev/block/mmcblk1p2 /system

joobu said:
I'm running CM7 off SD card. Adfree can't find the right mount point to remount.
1) I pulled the Adfree hosts file off another Android device (I attached it in a zip).
2) I then made the NC system partition writeable by using 'adb remount'
3) I pushed the hosts file to the NC: 'adb push hosts /system/etc/hosts'
Click to expand...
Click to collapse
Yep, this should work... I still see ads all over though. Same places I don't see them on my Nexus One.
Did this actually work for you? Although really I can't imagine why it wouldn't.

I replaced my hosts file the harder manual way.
Maybe check to see if the hosts file was actually replaced. The hosts file should be around 700 kB

I'm encountering a problem with adfree and the nook color running cm7. I see others have it installed and running fine. First time using this app.
I have downloaded adfree and when i try and download and install hosts by clicking the button it gives me an error stating" unable to locate a partition to remount to write the host files to"
Anybody know whats wrong and how to solve?

Look at my post with the manual instructions.

don't need to, its on my evo that I tether from and I see no ads on the nook or my pc

Fix Permisions
I ran "Fix Permissions" from TWRP touch recovery and that did the trick for me.

How to Run(Chroot) Linux(Ubuntu/Debian,etc.) in your Milestone 2

Chrooting Linux on Android is a very popular topic, and you can find many tutorials online. I am not going to post a detailed how to here.. but, I will explain the generalized steps for the process! If anyone have any questions or need help, feel free to ask!
Get Root Access on your phone
There are many ways to get root access; Easiest will be using z4root or SuperOneClick ! Rooting is mandatory because: You need to install Busybox; Need to mount file system, etc..​
Install SuperUser App from the Market
This application allows you to grant Root access to other applications (when needed). Depending on how you rooted your phone, superuser.apk may be already installed on your phone.​
Install Busybox App from the Market
Depending on how you rooted your phone, Busybox may be already installed on your phone. In any case install this app from the market and update your busybox to the latest version. Busybox is a set of commonly used linux commands, which are not available in android by default. Eg: cp, chroot, etc.​
Install Connectbot from Android market
Connect bot is a terminal client application for android. There are other alternatives but, I recommend Connectbot! Also Connectbot has SSH support, so if you are installing an SSH server on your Ubuntu, you can connect to it using connectbot and you may totally skip the VNC for GUI. Anyway, note that you need a terminal app to start the chroot daemon!​
Install AndroidVNCViewer from Android market
With androidVNCViewer we can get GUI access to our ubuntu! This App works so fine in my Milestone 2 with Ubuntu; It even supports mouse pointer!​
Download/build a Linux rootfs for your flavour of linux
Now, you need the Ubuntu/Debian/Other linux file system for your Phone's processor. Like most of the Android phones, Milestone 2 uses an ARM processor. And Ubuntu offers full support for ARM processors. It is so easy to build ubuntu for ARM(OMAP) platform using rootstock/bootstrap method. I used rootstock method for Ubuntu as explained here.
PS: For your first time, make sure you build, "Ubuntu Lucid" (just use the --seed/-s parameter of rootstock command. I was not able to use 11.04(Natty). Once you get Lucid to work, you can surely try yourself for the other versions! )​
Create a mountable .img file with a size suited for you
From rootstock, you will get a .tgz file! You will need to convert this to a mountable .img file.
In order to create an empty ubuntu.img file, use the followed command in your ubuntu-desktop's terminal; the last arguement (2048) specifies size of the Ubuntu rootfs (If you need much disk space when you are in ubuntu, use a large value here. Normally 2GB will be sufficient for you; even with GUI/VNC).
Code:
dd if=/dev/zero of=ubuntu.img bs=1MB count=0 seek=2048
Next, format our empty ubuntu.img with a suitable ext2/ext3/ext4 file system!
For Milestone 2, you should use ext3 (I think it does not support ext2). ext4 is supported only in Gingerbird+. So, you should use the appropriate command based on your mobile
Code:
mkfs.ext2 -F ubuntu.img
mkfs.ext3 -F ubuntu.img
mkfs.ext4 -F ubuntu.img
You can find out the suitable file system by opening Connectbot in your mobile and entering the followed command. In the output, look for words ext2/ext3/ext4!
Code:
su
mount
Once you format ubuntu.img with appropriate file system. We should temporarily mount the ubuntu.img in a somewhere and we should extract the armel-rootfs-xx.tgz to it. You can use these commands
Code:
sudo mount -o loop ubuntu.img /mnt
sudo tar -C /mnt -zxf armel-rootfs--xx.tgz
sudo umount /mnt
Download(and modify) or create a Shell script for automatically mounting your Chroot image
This is the most important part, we have to run a set of commands in our android shell to get into the ubuntu. To make things easier, we will write these command-sequence in a shell script, and whenever we need we simple call this script. Cool isn't it?. Basically this is what this script should do:
Code:
1. Check if there exists an ubuntu.img file as we specify in command line
2. Create a loop device with the ubuntu.img - ie. Make android(linux) believe that ubuntu.img is a mountable device.
3. Mount the newly created loop device to a folder. My script mounts the image to /data/local/chrootos
4. Set some environment variables in the shell
5. Mount the [I]devpts, proc, sysfs[/I] for the ubuntu!
6. Run the Chroot command. This command actually changes the root of file system to a new directory we specify. ie. we fake [B]/data/local/chrootos[/B] as the rootfs![B]/[/B]
Create a folder in your Phone's SD Card and copy one or more(If you want to choose between: Debian/Ubuntu/Puppy/etc) .img files and your shell script for booting linux into it.
Create a folder named .chroot in your SD Card. If you have a "." as the first character, this folder will be hidden in the Android File Browser. And will avoid you accidentally modifying these files.​
Get into your Phone's Shell through ConnectBot / USB-ADB / Terminal Emulator
Enter su in the terminal to get root access
Remount your Android filesystem to get write access to your phones
By default, the android file system is read only. So in order to write to the files sytem, we have to remount it with the following command.
Code:
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
Copy your bootscript to /system/bin so that you can easily start your LinuxIf you have downloaded my bootscript, the file name will be bl - short for boot linux. So, once you copied you will have your shell script at /system/bin/bl. Once we copy the shell script to the bin directory, it will work as a shell command.​
Start your linux and customize it
If you have done everything correctly so far, you can now boot into your ubuntu.img with the following command. Note that you do not need to specify the full file name "ubuntu.img".
Code:
bl ubuntu
Start your linux and customize it
If Chroot was a success, you will see the ubuntu shell prompt. And then you can start installing more stuff, etc. [email protected]:​
Downloads & Screenshots
Screenshots: http://goo.gl/PzVI0
My Shell Script for starting linux: http://goo.gl/il3nJ
My ubuntu.img: Coming Soon​Password
Code:
arunraj.in
Common Errors
The most common error will be when we are dealing with the "loop device". Because, according to the apps installed in your device, there may not be a free loop device available. If you are facing errors, feel free to ask me and I will try and help!​

Thanks, man! When I have time I'm gonna try it out.
Sent from my Milestone 2 XDA App

thanks for tutorial. will try this soon

Script didn't work :/

Gongui20 said:
Script didn't work :/
Click to expand...
Click to collapse
Do you get any error message?

Thanks !
It's very interesting.I will try it when I have some free time.

echo "Linux Chrooter: Chroot!"
chroot $mnt /bin/bash
Click to expand...
Click to collapse
/bin/bash didnt exist or something like that.

Gongui20 said:
/bin/bash didnt exist or something like that.
Click to expand...
Click to collapse
I think there was no free loop device available for mounting the image.
could run these commands as root and send me the output(the txt files created)?
Code:
mount > mount-list.txt
losetup -f > losetup1.txt
losetup /dev/block/loop1 /sdcard/.chroot/ubuntu.img > losetup2.txt

losetup1.txt
/dev/loop0
Click to expand...
Click to collapse
mount-list.txt
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/mmcblk1p21 /system ext3 ro,noatime,nodiratime,barrier=1,data=ordered 0 0
/dev/block/userdata /data ext3 rw,nosuid,nodev,noatime,nodiratime,errors=continue,barrier=1,data=ordered 0 0
/dev/block/cache /cache ext3 rw,nosuid,nodev,noatime,nodiratime,errors=continue,barrier=1,data=ordered 0 0
tmpfs /tmp tmpfs rw,relatime,size=2048k 0 0
/dev/block/pds /pds ext3 rw,nosuid,nodev,noatime,nodiratime,barrier=1,data=ordered 0 0
/dev/block/preinstall /preinstall ext3 rw,nosuid,nodev,noatime,nodiratime,barrier=1,data=ordered 0 0
/dev/block/vold/179:1 /mnt/sdcard vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/block/vold/179:1 /mnt/secure/asec vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
tmpfs /mnt/sdcard/.android_secure tmpfs ro,relatime,size=0k,mode=000 0 0
/dev/block/dm-0 /mnt/asec/com.rovio.angrybirdsrio-1 vfat ro,dirsync,nosuid,nodev,noexec,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/block/dm-1 /mnt/asec/com.rovio.angrybirds-1 vfat ro,dirsync,nosuid,nodev,noexec,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/block/dm-2 /mnt/asec/org.xbmc.android.remote-2 vfat ro,dirsync,nosuid,nodev,noexec,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
Click to expand...
Click to collapse
losetup2.txt is empty.

Yeap, I faced the same error when I was doing it. If you notice the mount-list.txt, you can see that AngryBirds application is using /dev/block/dm-0 and /dev/block/dm-1. /dev/block/dm-2 is also in use.
You could try this:
Edit the script bl and replace /dev/block/loop1 in the script with /dev/block/dm-3. It might just do the trick.

Hey check this out:
http://androlinux.com/android-ubuntu-development/how-to-install-ubuntu-on-android/

Works on Asus TF101
Hi
Thanks for the guide. I got it running on my Asus TF101. I had to modify your script slightly :
The /system filesystem is mounted as ext4 (not yaffs)
The /system fs is mounted from /dev/block/mmcblk0p1
/dev/block/mmcblk0p1 /system ext4 rw,relatime,barrier=1,data=ordered 0 0
Click to expand...
Click to collapse
Apart from that no other changes were necessary.

Need Help!!!!
hi ~ I just put the img file in /sdcard/.chroot/.linux/ ,named ubuntu.img and edited the Script
but when I run the script ,there is a problem in line:
mount -t ext3 /dev/block/loop1 $mnt
it said:
Device or resourc busy
I have tried thousand ways and cost 5 days,but I can't solve it.....
can you help me?
sorry for my poor english...
losetup1.txt
/dev/loop0
I also replace /dev/block/loop1 in the script with /dev/block/dm-5,but I need use command :"mknod /dev/block/dm-5 b 7 0" first.

the error Screenshots and mount

echoeye said:
the error Screenshots and mount
Click to expand...
Click to collapse
Hi,
Which is your Mobile ?
Also -- Did you see reply #7, #8 on page 1 of this thread ?

There is another way to mount it without using the option -oloop
If you look into /dev/block you are going to find 8 loop devices, from loop0 to loop7. As android doesn't use that many loop devices it should be enough. You can mount it like this:
Code:
losetup /dev/block/loop7 /sdcard/ubuntu/ubuntu.img
mount -t ext3 /dev/block/loop7 /mnt/ubuntu
If your phone doesn't have a free loop device, you can create a new one, like this:
Code:
mknod /dev/block/loop99 b 7 99
losetup /dev/block/loop99 /sdcard/ubuntu/ubuntu.img
mount -t ext3 /dev/block/loop99 /mnt/ubuntu

The problem is you have apps installed to the sd card (and getting mount points busy), when it happens here I just open Titanium Backup and move External apps to internal.
No matter what I tried here, this script wouldn't work... So I used DebOnDroid app from defy forum, and when updated to GB. The app stopped working also, so I moved the ubuntu.img to /data/local/ and mounted from there, works like a charm!
This is the script I'm using /system/bin/buntu:
Code:
export mnt=/data/local/debian
export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin
export TERM=linux
export HOME=/root
export USER=root
echo "Linux Chrooter: Setup Networking"
sysctl -w net.ipv4.ip_forward=1
#necessary mount points
busybox mount -o loop $mnt/../debian.img $mnt
busybox mount -t devpts devpts $mnt/dev/pts
busybox mount -t sysfs sysfs $mnt/sys
busybox mount -t proc proc $mnt/proc
#extra mount points
busybox mount -o rw /system $mnt/mnt/s
busybox mount /data $mnt/mnt/d
busybox mount /sdcard $mnt/mnt/sd
echo "Linux Chrooter: Chroot!"
chroot $mnt /bin/bash
umount $mnt/sys
umount $mnt/proc
umount $mnt/dev/pts
umount $mnt/mnt/*
#somehow the commented lines didn't work...
#umount $mnt/mnt/d
#umount $mnt/mnt/s
umount $mnt
PS: when I copy a binary from ubuntu to /system/bin and chmod, it won't exec, why?
Sent from my Milestone 2 XDA App

r2beta0 said:
There is another way to mount it without using the option -oloop
If you look into /dev/block you are going to find 8 loop devices, from loop0 to loop7. As android doesn't use that many loop devices it should be enough. You can mount it like this:
Code:
losetup /dev/block/loop7 /sdcard/ubuntu/ubuntu.img
mount -t ext3 /dev/block/loop7 /mnt/ubuntu
If your phone doesn't have a free loop device, you can create a new one, like this:
Code:
mknod /dev/block/loop99 b 7 99
losetup /dev/block/loop99 /sdcard/ubuntu/ubuntu.img
mount -t ext3 /dev/block/loop99 /mnt/ubuntu
Click to expand...
Click to collapse
thank you very very very very very very very very very very very very very very very much!!!!
I made it!!!
oh yeah!~~~~

How is this different from using an app like linuxinstaller? Well, apart from doing it manually and the nerdy way of course?
Is it safer? I am intrigued by the possibility of having a working ubuntu in my pocket, but am wondering if I should go this way or try the app.
great guide though... i think this is the push i needed to finally try this.

Nice job! but i got this..
Nice job!
I got this
#bl ubuntu
bl: permission denied
#
;/

[Guide] [Root required] Allow Apps write access to SD card and USB Drive (Fire TV 2)

So, I ran in to some difficulty allowing apps saving to external storage.
As it turns out Google changed the default permissions to external storage in Android 4.4 (API 19)
I found a guide that solved this problem for me so thought it would be good to share on here
(All credits go to Android Revolution for the guide)
Procedure
Note: root required!
Start up your device normally and wait for the system to be fully loaded.
Open any files manager of your choice (Root Explorer, ES File Explorer, Total Commander) and make sure it runs with superuser permissions.
Mount your system partition as R/W (Read/Write) to perform any changes.
Navigate to the /system/etc/permissions/ folder and look for the platform.xml.
Copy and make a backup of the platform.xml file naming it platform.xml.bak
Open the original platform.xml file with any text editor on your device and search for the following line:
<permission name="android.permission.WRITE_EXTERNAL_STORAGE">
It should look like this:
<permission name="android.permission.WRITE_EXTERNAL_STORAGE" >
<group gid="sdcard_r" />
<group gid="sdcard_rw" />
</permission>
Now you need to add a 3rd GID (Group ID): <group gid="media_rw" /> and you need to make it looks exactly like this:
<permission name="android.permission.WRITE_EXTERNAL_STORAGE" >
<group gid="sdcard_r" />
<group gid="sdcard_rw" />
<group gid="media_rw" />
</permission>
Using ES File Explorer or any other Files Manager of your choice make sure that the platform.xml file has proper permissions:
Owner R-W | Group R | Others R (0644 rw-r--r--).
You can also use adb shell to set permissions with a chmod 0644 /system/etc/permissions/platform.xml command.
Reboot your device and enjoy!
In case of problems with OTA update just remove modified platform.xml and rename platform.xml.bak to its original name.
For those who just want my already modified, file click to download here
Confirm this works great on FTV2 and fixed my apps write problems

What apps need this? It's good info to have out there just looking for an example of what situations need it.

Ludacrisvp said:
What apps need this? It's good info to have out there just looking for an example of what situations need it.
Click to expand...
Click to collapse
As examples,
Some emulators that save game saves to external storage (If configured that way)
UAE4ALL2 (Amiga Emulator) when using WHDLoad setup (Dos error if no write access to WHDLoad folder)
Titanium Backup to save backups to external storage location.
No doubt there are lots of other scenarios.

Hi,
just tried it but i'm not able to remount rw the system part.
I test it with ES File Explorer, RB, and over adb shell
mount -o remount,rw /system
Error: invalid argument
The root partition just works fine
What was your trick?
Regards

Fruchttiger00x0 said:
Hi,
just tried it but i'm not able to remount rw the system part.
I test it with ES File Explorer, RB, and over adb shell
mount -o remount,rw /system
Error: invalid argument
The root partition just works fine
What was your trick?
Regards
Click to expand...
Click to collapse
You need root, obviously.
Open ES File Explorer.
Scroll down to tools and select Root Explorer.
Grant SU permissions.
Now make /system R/W access
You can then amend / replace the file platform.xml file

Device is rooted
And yes, tried exact what you say but it did not work. The ES FE didn't even show up an error message. Any ideas?

Fruchttiger00x0 said:
Device is rooted
And yes, tried exact what you say but it did not work. The ES FE didn't even show up an error message. Any ideas?
Click to expand...
Click to collapse
Are you using ES File Explorer from Amazon Market?
No idea why it would not work.
Are you getting the Super User request when you click on Root Explorer in the tools menu?

If you can't remount system as rw just reboot and try again. When I used abdFire to install system tools I was unable to remount system until reboot.

Yes, i did recieved the request for su but as i already tried other root apps or commands during the last days, I'm almost sure that root works as design.
For ES FE the same, tried the Amazon Version and 2-3 apks which I deployed via sideload. Could you maybe post the output of that after a /system remount:
cat /proc/mounts
Would be helpful
@Ludacrisvp
Hm, actualy I rebootet several times but the reason for failing could be something which is coming up again in the background. I'll take a look in that

Ludacrisvp said:
If you can't remount system as rw just reboot and try again. When I used abdFire to install system tools I was unable to remount system until reboot.
Click to expand...
Click to collapse
Good advise.
As a rule of thumb, I always do a clean reboot before I start to mess with stuff.

That's right. But in my case it makes no difference. I just reboot und connect to adb shell as soon as the device was recognize. No way
su
mount -o remount, rw /system
mount: invalid argument
What the...
Have you something installed after rooting? Toolkit, busybox for example?

Fruchttiger00x0 said:
That's right. But in my case it makes no difference. I just reboot und connect to adb shell as soon as the device was recognize. No way
su
mount -o remount, rw /system
mount: invalid argument
What the...
Have you something installed after rooting? Toolkit, busybox for example?
Click to expand...
Click to collapse
I do have busybox pro sideloaded, but don't know if that makes a difference

Installed to ../xbin ?

Fruchttiger00x0 said:
Installed to ../xbin ?
Click to expand...
Click to collapse
yes

Installation was ok but the error is persistent
Maybe it was already too late. Busybox should be the first to install :silly:
OK,i guess i should reset, what do you think?

Does busybox add its own mount command?
Maybe try calling out the full path:
# /system/bin/mount -o remount,rw /system

damn, doesn't work
tried it also with the 2 argument method but same story
here's some output, maybe i'm blind and others can see it
did it via ssh to get a root shell. "adb root" comes up with no root in production system.
[email protected]:/mnt/sdcard # mount -o remount,rw /system
mount: Invalid argument
255|[email protected]:/mnt/sdcard # mount -o remount,ro /system
[email protected]:/mnt/sdcard #
[email protected]:/mnt/sdcard # which mount
/system/bin/mount
[email protected]:/mnt/sdcard # cat /proc/mounts
rootfs / rootfs ro,seclabel 0 0
tmpfs /dev tmpfs rw,seclabel,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,seclabel,relatime,mode=600 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,seclabel,relatime 0 0
selinuxfs /sys/fs/selinux selinuxfs rw,relatime 0 0
none /sys/fs/cgroup tmpfs rw,seclabel,relatime,mode=750,gid=1000 0 0
none /sys/kernel/debug debugfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt/asec tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
/dev/block/dm-3 /mnt/asec/berserker.android.apps.sshdroid-1 ext4 ro,dirsync,seclabel,nosuid,nodev,noatime 0 0
/dev/block/dm-2 /mnt/asec/com.estrongs.android.pop-1 ext4 ro,dirsync,seclabel,nosuid,nodev,noatime 0 0
tmpfs /mnt/obb tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
/dev/block/platform/mtk-msdc.0/by-name/system /system ext4 ro,seclabel,noatime,commit=1,data=ordered 0 0
/dev/block/platform/mtk-msdc.0/by-name/userdata /data ext4 rw,seclabel,noatime,commit=1,data=ordered 0 0
/dev/block/platform/mtk-msdc.0/by-name/cache /cache ext4 rw,seclabel,noatime,commit=1,data=ordered 0 0
/dev/block/loop0 /mnt/sqfs squashfs ro,context=ubject_r:squashfs_file:s0,relatime 0 0
/dev/fuse /mnt/shell/emulated fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
tmpfs /storage/emulated tmpfs rw,seclabel,nosuid,nodev,relatime,mode=050,gid=1028 0 0
/dev/block/vold/179:129 /mnt/media_rw/sdcard1 vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1023,gid=1023,fmask=0007,dmask=0007,allow_utime=0020,codepage=437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/block/vold/179:129 /mnt/secure/asec vfat rw,dirsync,nosuid,nodev,noexec,relatime,uid=1023,gid=1023,fmask=0007,dmask=0007,allow_utime=0020,codepage=437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/fuse /storage/sdcard1 fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
/dev/fuse /storage/emulated/0 fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
/dev/fuse /storage/emulated/0/Android/obb fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
/dev/fuse /storage/emulated/legacy fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
/dev/fuse /storage/emulated/legacy/Android/obb fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0

Thanks for share
Gửi từ SM-N910C của tôi bằng cách sử dụng Tapatalk

Ludacrisvp said:
Does busybox add its own mount command?
Maybe try calling out the full path:
# /system/bin/mount -o remount,rw /system
Click to expand...
Click to collapse
Not sure why @Fruchttiger00x0 is having so much trouble with it.
I just used ES File Explorer (root explorer) to mount r/w no issues.
Another option for you to try is via adbfire.
It has a simple 1 click button to make /system r/w
Other than that, maybe your root is not complete for some reason

I ran into the same problem mounting /system as rw. Banged my head for quite some time. I had rooted using the video tutorial by ultimate spy binns. So I rooted it again the same exact way and that solved the mount issue. So I was able to set platform.xml to fix the permissions but alas, my apps still cant write to external hdd.

Soldering Method: How do I disable SE Linux restrictions?

**UPDATE**
Here is my collection of scripts for rooting, blocking updates, and all kinds of stuff for ALL fire tv:
https://github.com/pwntrik/firetv/
Here's the video (2 parts) on howto root Fire TV 1st gen using soldering:
https://youtu.be/yhwYfudGiM8
https://youtu.be/Kn7zmXf08bk
**/UPDATE**
Greetings, AFTV hackers!
I have successfully soldered an emmc reader to the Fire TV 1st Gen, and I have complete r/w access. However, the tutorial for rooting appears to be a bit dated as the hacker (@maximus64) at the time was able to just copy the su binary to /system/xbin, modify the permissions, and run it.
Since FireOS 5.2.0.0, however, SELinux now prevents the binary from being executed:
(At this point, I have already copied su binary, chmod 6755 it, chown 0:0 it)
Code:
[email protected]:/ $ ls -la /system/xbin/su
ls -la /system/xbin/su
/system/xbin/su: Permission denied
1|[email protected]:/ $ su
su
/system/bin/sh: su: not found
127|[email protected]:/ $ ls -ld /system/xbin
ls -ld /system/xbin
drwxr-xr-x root shell 2017-01-05 01:35 xbin
[email protected]:/ $ ls -l /system/xbin/
ls -l /system/xbin/
-rwxr-xr-x root shell 63880 2016-05-27 17:00 dexdump
-rwxr-xr-x root shell 49816 2016-05-27 17:00 sqlite3
lstat '/system/xbin//su' failed: Permission denied
-rwxr-xr-x root shell 813248 2016-05-27 17:00 tcpdump
-rwxr-xr-x root shell 9384 2016-05-27 17:00 trapz
-rwxr-xr-x root shell 46456 2016-05-27 17:00 vitals_collection_agent
And just to make sure I did everything correctly, I hooked it up again then checked the binary:
Code:
[email protected]:/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b1/xbin# ls -la
total 1092
drwxr-xr-x. 2 root 2000 4096 Jan 5 04:35 .
drwxr-xr-x. 16 root root 4096 Jan 6 17:07 ..
-rwxr-xr-x. 1 root 2000 63880 May 27 2016 dexdump
-rwxr-xr-x. 1 root 2000 49816 May 27 2016 sqlite3
-rwsr-sr-x 1 root root 112576 Jan 5 04:31 su
-rwxr-xr-x. 1 root 2000 813248 May 27 2016 tcpdump
-rwxr-xr-x. 1 root 2000 9384 May 27 2016 trapz
-rwxr-xr-x. 1 root 2000 46456 May 27 2016 vitals_collection_agent
So at this point, I did some research and it seems that SELinux prevents this from being run. Does anyone have a workaround or could tell me how to give this binary permission? I have zero experience with SELinux, and even if anyone can point me to a similar thread for rooting when you have full r/w access, that'd be excellent..
Thanks!

cancelyourcable said:
Greetings, AFTV hackers!
I have successfully soldered an emmc reader to the Fire TV 1st Gen, and I have complete r/w access. However, the tutorial for rooting appears to be a bit dated as the hacker (@maximus64) at the time was able to just copy the su binary to /system/xbin, modify the permissions, and run it.
Since FireOS 5.2.0.0, however, SELinux now prevents the binary from being executed:
(At this point, I have already copied su binary, chmod 6755 it, chown 0:0 it)
Code:
[email protected]:/ $ ls -la /system/xbin/su
ls -la /system/xbin/su
/system/xbin/su: Permission denied
1|[email protected]:/ $ su
su
/system/bin/sh: su: not found
127|[email protected]:/ $ ls -ld /system/xbin
ls -ld /system/xbin
drwxr-xr-x root shell 2017-01-05 01:35 xbin
[email protected]:/ $ ls -l /system/xbin/
ls -l /system/xbin/
-rwxr-xr-x root shell 63880 2016-05-27 17:00 dexdump
-rwxr-xr-x root shell 49816 2016-05-27 17:00 sqlite3
lstat '/system/xbin//su' failed: Permission denied
-rwxr-xr-x root shell 813248 2016-05-27 17:00 tcpdump
-rwxr-xr-x root shell 9384 2016-05-27 17:00 trapz
-rwxr-xr-x root shell 46456 2016-05-27 17:00 vitals_collection_agent
And just to make sure I did everything correctly, I hooked it up again then checked the binary:
Code:
[email protected]:/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b1/xbin# ls -la
total 1092
drwxr-xr-x. 2 root 2000 4096 Jan 5 04:35 .
drwxr-xr-x. 16 root root 4096 Jan 6 17:07 ..
-rwxr-xr-x. 1 root 2000 63880 May 27 2016 dexdump
-rwxr-xr-x. 1 root 2000 49816 May 27 2016 sqlite3
-rwsr-sr-x 1 root root 112576 Jan 5 04:31 su
-rwxr-xr-x. 1 root 2000 813248 May 27 2016 tcpdump
-rwxr-xr-x. 1 root 2000 9384 May 27 2016 trapz
-rwxr-xr-x. 1 root 2000 46456 May 27 2016 vitals_collection_agent
So at this point, I did some research and it seems that SELinux prevents this from being run. Does anyone have a workaround or could tell me how to give this binary permission? I have zero experience with SELinux, and even if anyone can point me to a similar thread for rooting when you have full r/w access, that'd be excellent..
Thanks!
Click to expand...
Click to collapse
bueller_recovery_v2.zip begins with a shell script. If you open it in a text editor, you can see it. mkdir /system/recovery, unzip the contents of that zip to /system/recovery, and do the mv and ln commands. Make sure the selinux contexts of /system/recovery and it's contents match the other contents of /systems.
And also make sure the contents are chmod 755.

rbox said:
bueller_recovery_v2.zip begins with a shell script. If you open it in a text editor, you can see it. mkdir /system/recovery, unzip the contents of that zip to /system/recovery, and do the mv and ln commands. Make sure the selinux contexts of /system/recovery and it's contents match the other contents of /systems.
And also make sure the contents are chmod 755.
Click to expand...
Click to collapse
Thanks, rbox! I've managed to rewrite the script to do all that, but how do I make sure the SELinux contexts match? Sorry, not familiar with SELinux.
Is this the ACTUAL partition table, or is this the way the eMMC reader loads it?
Code:
[email protected]:/media/root# ls 5*
57f8f4bc-abf4-655f-bf67-946fc0f9f25b:
adb backup hostapd property system?
anr bugreports key_provisioning prReset time
app connectivity local radio tombstones
app-asec dalvik-cache logd resource-cache user
app_ext data lost+found securedStorageLocation vitals
app-lib debug_service media securestop webcrypto
app_ms dontpanic mediadrm security wiper
app-private dpm misc shared wpstiles
audio drm playready ssh
autotrace fota proffline system
57f8f4bc-abf4-655f-bf67-946fc0f9f25b1:
data lost+found usf
57f8f4bc-abf4-655f-bf67-946fc0f9f25b2:
com.amazon.avod.apk lost+found
com.amazon.venezia.apk recovery
com.amazon.vizzini-550901810.apk signed_com.amazon.kso.blackbird-1550000810.apk
dalvik-cache signed_CSAppFireTV-fireOs-release_v112.apk
57f8f4bc-abf4-655f-bf67-946fc0f9f25b3:
data lost+found usf
57f8f4bc-abf4-655f-bf67-946fc0f9f25b4:
app etc lib priv-app sqfs vendor
bin fonts lost+found recovery-from-boot.p tts xbin
build.prop framework media security usr
I ask because /system/bin is actually on a completely separate partition using this method. Is it possible to copy the actual init2stub in place of e2fsck instead of symlinking it? (in case the symlink doesn't work)
Here's my modified version of your script:
Code:
# Put your `recovery' folder in here, unzipped
SHARED="/media/sf_Shared"
# This is the directory created by the MMC reader
LABEL="/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b"
SYSTEM="${LABEL}/system"
BIN="${LABEL}4/bin"
echo "Copying recovery..."
cp -rf $SHARED/recovery $SYSTEM
echo "Chmodding..."
chmod -R 755 $SYSTEM/recovery
echo "Backup the old e2fsck..."
mv $BIN/e2fsck $BIN/e2fsck.real
echo "Symlink e2fsck to 2ndinitstub..."
# If symlink doesn't work, can I copy 2ndinitstub completely?
ln -sf ../recovery/2ndinitstub $BIN/e2fsck
echo "Done."
Thanks for your help otherwise I'd be so SCREWED! :laugh:

cancelyourcable said:
Thanks, rbox! I've managed to rewrite the script to do all that, but how do I make sure the SELinux contexts match? Sorry, not familiar with SELinux.
Is this the ACTUAL partition table, or is this the way the eMMC reader loads it?
Code:
[email protected]:/media/root# ls 5*
57f8f4bc-abf4-655f-bf67-946fc0f9f25b:
adb backup hostapd property system?
anr bugreports key_provisioning prReset time
app connectivity local radio tombstones
app-asec dalvik-cache logd resource-cache user
app_ext data lost+found securedStorageLocation vitals
app-lib debug_service media securestop webcrypto
app_ms dontpanic mediadrm security wiper
app-private dpm misc shared wpstiles
audio drm playready ssh
autotrace fota proffline system
57f8f4bc-abf4-655f-bf67-946fc0f9f25b1:
data lost+found usf
57f8f4bc-abf4-655f-bf67-946fc0f9f25b2:
com.amazon.avod.apk lost+found
com.amazon.venezia.apk recovery
com.amazon.vizzini-550901810.apk signed_com.amazon.kso.blackbird-1550000810.apk
dalvik-cache signed_CSAppFireTV-fireOs-release_v112.apk
57f8f4bc-abf4-655f-bf67-946fc0f9f25b3:
data lost+found usf
57f8f4bc-abf4-655f-bf67-946fc0f9f25b4:
app etc lib priv-app sqfs vendor
bin fonts lost+found recovery-from-boot.p tts xbin
build.prop framework media security usr
I ask because /system/bin is actually on a completely separate partition using this method. Is it possible to copy the actual init2stub in place of e2fsck instead of symlinking it? (in case the symlink doesn't work)
Here's my modified version of your script:
Code:
# Put your `recovery' folder in here, unzipped
SHARED="/media/sf_Shared"
# This is the directory created by the MMC reader
LABEL="/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b"
SYSTEM="${LABEL}/system"
BIN="${LABEL}4/bin"
echo "Copying recovery..."
cp -rf $SHARED/recovery $SYSTEM
echo "Chmodding..."
chmod -R 755 $SYSTEM/recovery
echo "Backup the old e2fsck..."
mv $BIN/e2fsck $BIN/e2fsck.real
echo "Symlink e2fsck to 2ndinitstub..."
# If symlink doesn't work, can I copy 2ndinitstub completely?
ln -sf ../recovery/2ndinitstub $BIN/e2fsck
echo "Done."
Thanks for your help otherwise I'd be so SCREWED! :laugh:
Click to expand...
Click to collapse
That is /data. Not /system. ls -lZ will show you contexts.

rbox said:
That is /data. Not /system. ls -lZ will show you contexts.
Click to expand...
Click to collapse
Well, not sure exactly what happened but I booted it back up and /system/recovery doesn't exist. Even if that's normal behavior, it didn't run TWRP.
The shell script I pasted above, it runs chcon and chmod, but perhaps chcon has no effect since it's being run on a host system (linux), instead of the actual android system (I kinda expected that.)
Code:
[email protected]:/system/bin $ ls -Z e2*
ls -Z e2*
e2fsck: Permission denied
e2fsck.real: Permission denied
Is there an init file I can edit to run chcon or completely disable selinux? Seems like that's probably preventing it. I can't see log files as user, but I feel like that might be part of it.
Thanks

cancelyourcable said:
Well, not sure exactly what happened but I booted it back up and /system/recovery doesn't exist. Even if that's normal behavior, it didn't run TWRP.
The shell script I pasted above, it runs chcon and chmod, but perhaps chcon has no effect since it's being run on a host system (linux), instead of the actual android system (I kinda expected that.)
Code:
[email protected]:/system/bin $ ls -Z e2*
ls -Z e2*
e2fsck: Permission denied
e2fsck.real: Permission denied
Is there an init file I can edit to run chcon or completely disable selinux? Seems like that's probably preventing it. I can't see log files as user, but I feel like that might be part of it.
Thanks
Click to expand...
Click to collapse
Did you properly unmount the filesystem after you were done changing it? That's really the only way the changes wouldn't stick and recovery wouldn't be there. You definitely need to verify all the permissions and contexts manually before booting back in. Don't just assume a script worked. Also, I think chcon isn't going to work, now that I think about it. I remember when I was messing around with this stuff with the Fire TV 2 I wound up having to use extended attributes manually. This page: http://unix.stackexchange.com/quest...on-mounted-ext4-image-from-non-selinux-system explains how to do. As for disabling selinux... that's half the whole point of 2ndinit

rbox said:
Did you properly unmount the filesystem after you were done changing it? That's really the only way the changes wouldn't stick and recovery wouldn't be there. You definitely need to verify all the permissions and contexts manually before booting back in. Don't just assume a script worked. Also, I think chcon isn't going to work, now that I think about it. I remember when I was messing around with this stuff with the Fire TV 2 I wound up having to use extended attributes manually. This page: http://unix.stackexchange.com/quest...on-mounted-ext4-image-from-non-selinux-system explains how to do. As for disabling selinux... that's half the whole point of 2ndinit
Click to expand...
Click to collapse
Ya, definitely unmounted it. I'm like 99% sure it's because of this selinux thing. Ideally if I can get these extended attributes to work and run either `su' or get the recovery to load, that'd be best.
But /system and /recovery are on two separate partitions. When I look at the layout from linux when I mount it using the soldering method, it looks like this:
Code:
# /dev/sdb1 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b3 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb19 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b2 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb2 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b1 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb20 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb18 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
And from the firetv using adb shell, here's all the mounts:
Code:
[email protected]:/ $ mount
mount
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,seclabel,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,seclabel,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,seclabel,relatime 0 0
selinuxfs /sys/fs/selinux selinuxfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
none /sys/fs/cgroup tmpfs rw,seclabel,relatime,mode=750,gid=1000 0 0
tmpfs /mnt/asec tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/platform/msm_sdcc.1/by-name/system /system ext4 ro,seclabel,relatime,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/cache /cache ext4 rw,seclabel,nosuid,nodev,noatime,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/userdata /data ext4 rw,seclabel,nosuid,nodev,noatime,nomblk_io_submit,nobarrier,commit=20,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/modem /firmware vfat ro,context=u:object_r:firmware_file:s0,relatime,uid=1000,gid=1000,fmask=0337,dmask=0227,codepage=cp437,iocharset=iso8859-1,shortname=lower,errors=remount-ro 0 0
/dev/block/loop0 /mnt/sqfs squashfs ro,context=u:object_r:squashfs_file:s0,relatime 0 0
/dev/block/platform/msm_sdcc.1/by-name/persist /persist ext4 rw,context=u:object_r:persist_file:s0,nosuid,nodev,noatime,data=ordered 0 0
/dev/fuse /mnt/shell/emulated fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
/dev/fuse /mnt/shell/emulated/0 fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
It looks very different. Like the /bin that appears in /system on the fire tv is actually on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4, yet /system appears on a completely separate partition /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b it's weird. Copying e2fsck did make it appear there, yet adding /system/recovery did nothing:
Code:
[email protected]:/ $ cd /system/recovery
cd /system/recovery
/system/bin/sh: cd: /system/recovery: No such file or directory
Not sure whether this is the firetv or the emmc reader which is displaying it oddly.
I'll wire it back up tomorrow and see if I can get extended permissions as well as try to figure out why the recovery dir is not showing up at all.
Thanks!

cancelyourcable said:
Ya, definitely unmounted it. I'm like 99% sure it's because of this selinux thing. Ideally if I can get these extended attributes to work and run either `su' or get the recovery to load, that'd be best.
But /system and /recovery are on two separate partitions. When I look at the layout from linux when I mount it using the soldering method, it looks like this:
Code:
# /dev/sdb1 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b3 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb19 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b2 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb2 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b1 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb20 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
# /dev/sdb18 on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4 type ext4 (rw,nosuid,nodev,relatime,data=ordered,uhelper=udisks2)
And from the firetv using adb shell, here's all the mounts:
Code:
[email protected]:/ $ mount
mount
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,seclabel,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,seclabel,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,seclabel,relatime 0 0
selinuxfs /sys/fs/selinux selinuxfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
none /sys/fs/cgroup tmpfs rw,seclabel,relatime,mode=750,gid=1000 0 0
tmpfs /mnt/asec tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,seclabel,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/platform/msm_sdcc.1/by-name/system /system ext4 ro,seclabel,relatime,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/cache /cache ext4 rw,seclabel,nosuid,nodev,noatime,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/userdata /data ext4 rw,seclabel,nosuid,nodev,noatime,nomblk_io_submit,nobarrier,commit=20,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/modem /firmware vfat ro,context=u:object_r:firmware_file:s0,relatime,uid=1000,gid=1000,fmask=0337,dmask=0227,codepage=cp437,iocharset=iso8859-1,shortname=lower,errors=remount-ro 0 0
/dev/block/loop0 /mnt/sqfs squashfs ro,context=u:object_r:squashfs_file:s0,relatime 0 0
/dev/block/platform/msm_sdcc.1/by-name/persist /persist ext4 rw,context=u:object_r:persist_file:s0,nosuid,nodev,noatime,data=ordered 0 0
/dev/fuse /mnt/shell/emulated fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
/dev/fuse /mnt/shell/emulated/0 fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
It looks very different. Like the /bin that appears in /system on the fire tv is actually on /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4, yet /system appears on a completely separate partition /media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b it's weird. Copying e2fsck did make it appear there, yet adding /system/recovery did nothing:
Code:
[email protected]:/ $ cd /system/recovery
cd /system/recovery
/system/bin/sh: cd: /system/recovery: No such file or directory
Not sure whether this is the firetv or the emmc reader which is displaying it oddly.
I'll wire it back up tomorrow and see if I can get extended permissions as well as try to figure out why the recovery dir is not showing up at all.
Thanks!
Click to expand...
Click to collapse
You're not looking for a partition with a directory called system in it. The partition IS /system. So the partition with 'bin' and 'xbin' is the /system partition. That other one is /data.

rbox said:
You're not looking for a partition with a directory called system in it. The partition IS /system. So the partition with 'bin' and 'xbin' is the /system partition. That other one is /data.
Click to expand...
Click to collapse
Alright, so I made some big progress
Here's my script which successfully installed your TWRP zip:
Code:
# Put your `recovery' folder in here, unzipped
SHARED="/media/sf_Shared"
# This is the directory created by the MMC reader
LABEL="/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b"
# WARNING: this CHANGED from 4 to 3. Always CHECK FIRST
SYSTEM="${LABEL}3"
if [ ! -e "${SYSTEM}/xbin" ]; then
echo "ERROR: couldn't find /system/xbin - is the mount point correct?"
exit 1
fi
echo "Copying recovery..."
cp -rf $SHARED/recovery $SYSTEM
echo "Backup the old e2fsck..."
cp -i $SYSTEM/bin/e2fsck $SHARED/e2fsck.real
mv -i $SYSTEM/bin/e2fsck $SYSTEM/bin/e2fsck.real
echo "Chmodding and chconing RECOVERY..."
chown -R 0:2000 $SYSTEM/recovery
chmod -R 755 $SYSTEM/recovery
chcon -R --reference=$SYSTEM/bin $SYSTEM/recovery
echo "Copying, chmodding and chconing SU (in case recovery doesn't work out)..."
cp $SHARED/su $SYSTEM/xbin/
chown 0:2000 $SYSTEM/xbin/su
chmod 6755 $SYSTEM/xbin/su
chcon --reference=$SYSTEM/xbin/trapz $SYSTEM/xbin/su
echo "Symlink e2fsck to 2ndinitstub..."
ln -sf ../recovery/2ndinitstub $SYSTEM/bin/e2fsck
echo "Done."
Then I booted into TWRP successfully.
However, when I tried to install your bueller-5.2.1.1-rooted_r1 I got this:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
After a long time it was clearly hung, so I rebooted and now it's bricked. But I did do a `dd if=/dev/sdb123 of=system.img` so i have that.
Would it be possible to just overwrite that partition with your system prerooted image while I have it connected to the emmc reader?
Thanks again for all the help!

cancelyourcable said:
Alright, so I made some big progress
Here's my script which successfully installed your TWRP zip:
Code:
# Put your `recovery' folder in here, unzipped
SHARED="/media/sf_Shared"
# This is the directory created by the MMC reader
LABEL="/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b"
# WARNING: this CHANGED from 4 to 3. Always CHECK FIRST
SYSTEM="${LABEL}3"
if [ ! -e "${SYSTEM}/xbin" ]; then
echo "ERROR: couldn't find /system/xbin - is the mount point correct?"
exit 1
fi
echo "Copying recovery..."
cp -rf $SHARED/recovery $SYSTEM
echo "Backup the old e2fsck..."
cp -i $SYSTEM/bin/e2fsck $SHARED/e2fsck.real
mv -i $SYSTEM/bin/e2fsck $SYSTEM/bin/e2fsck.real
echo "Chmodding and chconing RECOVERY..."
chown -R 0:2000 $SYSTEM/recovery
chmod -R 755 $SYSTEM/recovery
chcon -R --reference=$SYSTEM/bin $SYSTEM/recovery
echo "Copying, chmodding and chconing SU (in case recovery doesn't work out)..."
cp $SHARED/su $SYSTEM/xbin/
chown 0:2000 $SYSTEM/xbin/su
chmod 6755 $SYSTEM/xbin/su
chcon --reference=$SYSTEM/xbin/trapz $SYSTEM/xbin/su
echo "Symlink e2fsck to 2ndinitstub..."
ln -sf ../recovery/2ndinitstub $SYSTEM/bin/e2fsck
echo "Done."
Then I booted into TWRP successfully.
However, when I tried to install your bueller-5.2.1.1-rooted_r1 I got this:
View attachment 3996750
After a long time it was clearly hung, so I rebooted and now it's bricked. But I did do a `dd if=/dev/sdb123 of=system.img` so i have that.
Would it be possible to just overwrite that partition with your system prerooted image while I have it connected to the emmc reader?
Thanks again for all the help!
Click to expand...
Click to collapse
UPDATE...
I flashed my original system.img and brought it back to a working state. After that, I set up recovery again then tried to install bueller-5.2.1.1-rooted_r1.zip. Same as before, it froze, but this time at 80%:
Here's the only "log" I could find:
Code:
[email protected]:/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4/recovery# cat log
Installing new recovery image: failed
So now I have the emmc reader connected again, and I'm *hoping* I can just flash the image in your bueller-5.2.1.1-rooted_r1.zip directly to the mmc using `dd if=system.new.dat of=/dev/sdb19`
But I thought I'd run it by your first before I brick it again :laugh:
Thanks again, @rbox

cancelyourcable said:
UPDATE...
I flashed my original system.img and brought it back to a working state. After that, I set up recovery again then tried to install bueller-5.2.1.1-rooted_r1.zip. Same as before, it froze, but this time at 80%:
View attachment 3997946
Here's the only "log" I could find:
Code:
[email protected]:/media/root/57f8f4bc-abf4-655f-bf67-946fc0f9f25b4/recovery# cat log
Installing new recovery image: failed
So now I have the emmc reader connected again, and I'm *hoping* I can just flash the image in your bueller-5.2.1.1-rooted_r1.zip directly to the mmc using `dd if=system.new.dat of=/dev/sdb19`
But I thought I'd run it by your first before I brick it again :laugh:
Thanks again, @rbox
Click to expand...
Click to collapse
The thread for TWRP talks about what to do if it hangs. You can use adb. You'll need to check the log while it's running. /tmp/recovery.log. The image in the rom is sparse, so you'll have to run sdat2img.py on it. And then you'll have to do all the steps listed in the updater-script. The image itself is 100% pure stock.

rbox said:
The thread for TWRP talks about what to do if it hangs. You can use adb. You'll need to check the log while it's running. /tmp/recovery.log. The image in the rom is sparse, so you'll have to run sdat2img.py on it. And then you'll have to do all the steps listed in the updater-script. The image itself is 100% pure stock.
Click to expand...
Click to collapse
I discovered your "updater-script" so I understand the process a lot better now (wish I had found this earlier)
How do I know which image to use for boot: boot.img or boot_unlocked.img? I'm running from a host system so I can't check the value of ro.boot.unlocked_kernel from within linux.
Thanks!
P.S. Almost finished a bash script others can use to flash your image from an emmc reader - I will post a guide on here!

cancelyourcable said:
I discovered your "updater-script" so I understand the process a lot better now (wish I had found this earlier)
How do I know which image to use for boot: boot.img or boot_unlocked.img? I'm running from a host system so I can't check the value of ro.boot.unlocked_kernel from within linux.
Thanks!
P.S. Almost finished a bash script others can use to flash your image from an emmc reader - I will post a guide on here!
Click to expand...
Click to collapse
Since it's running OS5, you have to use the regular boot.img, since your bootloader isn't unlocked.

cancelyourcable said:
P.S. Almost finished a bash script others can use to flash your image from an emmc reader - I will post a guide on here!
Click to expand...
Click to collapse
I would really appreciate this.

zexma said:
I would really appreciate this.
Click to expand...
Click to collapse
It's almost done! Will post very soon

cancelyourcable said:
It's almost done! Will post very soon
Click to expand...
Click to collapse
Don't want to bother, you
Is there any progress to expect, cause I'm stuck at the very same point, SELinux prevents loading su
(/system/xbin//su' failed: Permission denied)
Thanks in advance.

pwntrik said:
It's almost done! Will post very soon
Click to expand...
Click to collapse
Any progress on this?

zexma said:
Any progress on this?
Click to expand...
Click to collapse
Yes, it works 100%. Literally just ordered an overhead camera tripod for recording a video of the whole process. Sit tight -- I promise it's coming soon!

@pwntrik : any tricks to have your Linux (Ubuntu) box recognizing the FireTV in fastboot mode?
I can get it to connect in fastboot with Win7 on the same machine, but in Ubuntu 16.04 I'm not able to.
I did add ATTR{idVendor}== "1949" and ATTR{idProduct}=="0401" to /etc/udev/51-android.rules and rebooted, but no luck...
My FireTV (1st gen, last firmware was 5.0.5, rooted) is currently , after unsuccessful flash of "rooted-5.0.5_r1" ROM in TWRP stuck at this screen:
.
I know it's a longshot to recover it, but I have patience....
Sent from space

kozmo2k4 said:
@pwntrik : any tricks to have your Linux (Ubuntu) box recognizing the FireTV in fastboot mode?
I can get it to connect in fastboot with Win7 on the same machine, but in Ubuntu 16.04 I'm not able to.
I did add ATTR{idVendor}== "1949" and ATTR{idProduct}=="0401" to /etc/udev/51-android.rules and rebooted, but no luck...
My FireTV (1st gen, last firmware was 5.0.5, rooted) is currently , after unsuccessful flash of "rooted-5.0.5_r1" ROM in TWRP stuck at this screen:
.
I know it's a longshot to recover it, but I have patience....
Sent from space
Click to expand...
Click to collapse
I've been using Win10 for that. I only use Linux for writing the images.