Database Users

galaxy sII Backtrack5 and Usb Host

Hi I've been working on adding support for usb host support in backtrack 5 running on a chroot session.
The ultimate goal is to be able to use a usb wifi adapter for pentesting, as the interal wifi doesnt support layer-2 or packet injection.
i created the usb host cable,by jumping pin 4 to 5, and was able to power my device by splicing in DC power to the cable.
i'm having issues with busybox in the chroot session. i have ver 1.9 running on the android OS but it seems like there are missing modules in backtrack. NO LSUSB!! grr
i just cant get it to give me any output what so ever
#lsusb
#
. But i know the chroot session reads the host device (OTG). running dmesg (full output attached):
[ 3881.112070] max8997_muic_usb_cb: usb mode=3
[ 3881.112087] otg_power_cb: otg power = 1
--
[ 3881.114323] usb usb cable = 3
[ 3881.114348] usb Enable usb LDO.
[ 3881.114396] max8997-charger max8997-charger: max8997_disable_charging: disable charging
[ 3881.114536] usb check ldo vcc_d(192)
[ 3881.114704] usb check ldo vcc_a(192)
[ 3881.114889] otg_dbg: in s5pc110_otg_drv_probe()::00075
[ 3881.114900] => s3c_otg_drv_probe
[ 3881.115115] otg_host_phy_int : USBPHYCTL=0x1,PHYPWR=0xa40,PHYCLK=0x7,PHYTUNE=0x819b3,USBCFG=0x0
[ 3881.266334] s3c_otghcd s3c_otghcd: S3C OTGHCD
[ 3881.266406] s3c_otghcd s3c_otghcd: new USB bus registered, assigned bus number 2
[ 3881.266463] s3c_otghcd s3c_otghcd: irq 135, io mem 0x12480000
[ 3881.268360] max8922-charger max8922-charger: max8922_enable_charging: disable charging,TA
[ 3881.496575] hub 2-0:1.0: USB hub found
[ 3881.496598] hub 2-0:1.0: 1 port detected
[ 3881.496618] otg_dbg: in root_hub_feature()::00477
[ 3881.496625] => case SetPortFeature -USB_PORT_FEAT_POWER
[ 3881.497347] otg_dbg: in s5pc110_otg_drv_probe()::00175
[ 3881.497358] => OTG HCD Initialized HCD, bus=C110 OTG Controller, usbbus=2
[ 3881.498518] usb otg host : registered
[ 3881.498530] host_notify: ndev name=usb_otg: from state=0 -> to state=1
[ 3881.499742] usb change mode ret=0
--
[ 3883.372113] otg_dbg: in root_hub_feature()::00483
[ 3883.372126] => case SetPortFeature -USB_PORT_FEAT_RESET
[ 3883.432171] otg_dbg: in otg_handle_interrupt()::00087
[ 3883.432182] => Port Interrupt
[ 3883.432192] otg_dbg: in process_port_intr()::00271
[ 3883.432203] => port enable/disable changed
[ 3883.502695] usb 2-1: new high speed USB device using s3c_otghcd and address 2
[ 3883.522370] svn usbdev_open, skip usb_autoresume_device
[ 3883.522488] svn usbdev_open, skip usb_autosuspend_device
[ 3883.524055] hub 2-1:1.0: USB hub found
[ 3883.524407] hub 2-1:1.0: 4 ports detected
[ 3883.534375] max8922-charger max8922-charger: max8922_is_charging: charging state = 0x1
[ 3883.762482] usb 2-1.1: new high speed USB device using s3c_otghcd and address 3
[ 3883.784996] usb 2-1.1: device v0bda p8187 is not supported
[ 3883.785068] host_notify: ndev name=s3c_otghcd: from state=0 -> to state=5
[ 3883.805674] hub 2-1:1.0: unable to enumerate USB device on port 1
--
[ 3932.353319] usb_port_resume = 1283, 4
--
[ 5492.343091] usbsvn_request_resume:run time resume
[ 5492.343107] Host USB : Resume
[ 5492.422261] usb_port_resume = 1283, 4
[ 5492.422906] usb 1-2: svn L0 p.s=1
i have the driver for the device (alfa network ,AWUS036h) and it is supported in linux.
i was able to build the driver in the chroot session, but since it is an ARM distro, will the driver even work.
any help would be awesome.

Some success!
I finally got lsusb to recognize the devices. after many many recompilation of busybox,turns out it was a binding problem between the android and the chroot session.
i ran in terminal emulator: ($mnt = the chroot mount point)
#mkdir -p $mnt/dev/bus/usb
#mount -o bind /dev/bus/usb /$mnt/dev/bus/usb
and now in the chroot session:
[email protected]:/#lsusb
Bus 002 Device 002: ID 05e3:0608 Genesys Logic, inc USB-2.0 4-port HUB
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 002: ID 1519:0020
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
as you can see i plugged in a usb hub to power the device, just to test.
i'm going to be working on compiling the driver.
hopefully beaple to use the aircrack suite soon on my phone.

Two cheers for you mate. Hope you bring in something soon.
Sent from my GT-I9100 using XDA Premium App

Driver
I'm trying to compile the RTL8187 driver for the ARM architecture . I've never done this sort of thing, so any advice on kernel modules would be greatly appreciated.
i'm using the ARM toolchain from :
http://www.codesourcery.com/sgpp/lite/arm/portal/[email protected]=lite
compiling with the i19100 kernel source compiled by XDA members (not the tar files from samsung).
If anyone has any experience with Cross compiling, any help would be awesome.

Holy crap i hope u get this running.
I would love to have bt4 on my phone
I hope u make a full how to guide once u r done
Great work

Boom! Awesome stuff

Zionator said:
Holy crap i hope u get this running.
I would love to have bt4 on my phone
I hope u make a full how to guide once u r done
Great work
Click to expand...
Click to collapse
bt5 is already avalible for i9100
http://forum.xda-developers.com/showthread.php?t=1162662

more good stuff
i've finally got the driver compiled for ARM without it spewing Piles of errors.
now i've actually got to test them.
2 modules:
ieee80211.ko
rtl8187.ko
these would either be loaded in android OS with "insmod" in the init.rc file, so it's loaded on boot. Or in the backtrack 5 chroot session.
now i've got LSUSB working and displaying Some connected devices, however devices such as usb keyboards and My Wifi card are not displayed (the Usb host port is displayyed though)
From the reading i've done i'm pretty sure this is due to a vendor permissions issue.
in a file simmilar to this:
/etc/udev/rules.d/50-android.rules
now i havnt been able to find this file on my phone. or simmilar.
this file allows the types of vendors allowed to connect.
an example command to be added:
Code:
SUBSYSTEM=="usb_device", SYSFS{idVendor}=="0bb4", MODE="0666", NAME=="android"
When i run lsusb on my ubuntu virtual machine, with the card plugged in i get:
Bus 002 Device 002: ID 0bda:8187 Realtek Semiconductor Corp. RTL8187 Wireless Adapter
so i'd have to add a line like this :
Code:
SUBSYSTEM=="usb_device", SYSFS{idVendor}=="0bda", MODE="0666", NAME=="Realtek"
so in short, If ANYBODY knows where a vendors permission file resides, please post something.
sweet thanks

HUGE!
O MAN i had no IDEA i'd get this far, i've never even used linux that much untill i got this phone!
so as it turns out the permission issue with pretty well ALL devices is very prevalent
you have to allow android OS to connect to specific vendors, i've tested it woth sevral keyboards.
the vendor codes can be found here
HTML:
http://developer.android.com/guide/developing/device.html
but here they are
Code:
Company USB Vendor ID
Acer 0502
ASUS 0b05
Dell 413c
Foxconn 0489
Garmin-Asus 091E
Google 18d1
HTC 0bb4
Huawei 12d1
K-Touch 24e3
KT Tech 2116
Kyocera 0482
Lenevo 17EF
LG 1004
Motorola 22b8
NEC 0409
Nook 2080
Nvidia 0955
OTGV 2257
Pantech 10A9
Philips 0471
PMC-Sierra 04da
Qualcomm 05c6
SK Telesys 1f53
Samsung 04e8
Sharp 04dd
Sony Ericsson 0fce
Toshiba 0930
ZTE 19D2
so an example of this.
i have a lenovo usb keyboard that i want to use.
so log in as root, create file /etc/udev/rules.d/51-android.rules, and add these line:
SUBSYSTEM=="usb_device", SYSFS{idVendor}=="17EF", MODE "0666", NAME=="lenovo"
so in bash:
Code:
su
mount -o remount,rw system /system
mkdir -p /etc/udev/rules.d/
cd /etc/udev/rules.d/
echo SUBSYSTEM=="usb_device", SYSFS{idVendor}=="17EF", MODE "0666", NAME=="lenovo" > 51-android.rules
THIS can be applied to any usb device, so far as i;ve tested. if you cant find the vendor codes in the table, you can get them by plugging the device into a linux box and running lsusb and it's the first set of digits so
bus ### dev ###: ID <this one>:blah "some company"
i'll put together a full tutorial up since NO ONE HAS PUT ONE UP AS FAR AS I"VE SEEN. this would add support for pretty well android devices with OTG host mode!!

Any news on this ?

So ****tiest week ever
my galaxy s2 stopped working, put it in to charge and it wont turn on. no lights no nothing.
i've tried a usb jig.
no dice.
i phoned samsung to get it repaired to replaced.
i sent it in a week ago and i just got it Rushed back from them saying that since it's not a canadian phone; they cant service it.
turns out it was bought in chile.
i have a 700$ paperweight. isnt that awesome
JDouce said he managed to compile a driver successfully

Damn, that's worst news I heard all day. Any ideas how it happened?

Sorry to hear that ... there must be a way to fix your phone without sending it to Chile

Td8f4, huge thanks for posting your findings.
I compiled kernel modules for my ralink3070, which is the . I even had them loaded with insmod. But it didn't work. dmesg says "this device is not supported".

Any news on this, is this manual written some place?
I tried writing this udev rule, but with no effect so far. I am also running on Galaxy S2, with Lite'ning ROM 6.1 (Android 2.3.4, Kernel 2.6.35-11 ninphetamine 2.0.5+).
Edit: I did not see page 2 of this thread... sorry for your phone Td8f4... but then trying to get the warranty when you re-flashed it... and overclocked it, you have little chances. Good luck anyway.
If anyone get the USB device to actually appear in lsusb, give me a sign, I only get flashdrives and hubs to appear, a serial2usb won't.

I now figured out that the problem was due to CONFIG_SEC_WHITELIST and driver/usb/core/sec_whitelist.h One or the other has to be modified, both have been tested to be working. With the default falues, devices other than a few defined one (HID, cameras, mass storage, hub) won't be connected at all and will not appear in lsusb or dmesg.
The next step once they appear in lsusb and dmesg with a line "usb 2-1: device v0403 p6001 is not supported" is to find which driver is needed and either compile it within the kernel, or compile it as a module and insmod it manually. You have succeeded that step when you get a new line in dmesg from your device driver.
The next step again is to find an application using the driven device (I am at that step now, for a usbserial device)

Hi,
I am currently trying to get the usbserial-module working on Siyah-kernel.
In fact, usbserial and ftdi_sio both load (the same device works fine with those modules on a desktop. Yes, I have compiled them for ARM agains Siyah-Kernel and not just copied them from desktop ;-) ), but s3c_otghcd 'snatches' away the device before I can get a hold of it.
Have a look at my post here:
http://forum.xda-developers.com/showpost.php?p=18299539&postcount=3712
If you can give me any further leads (should "CONFIG_SEC_WHITELIST=n" be enough, and does it break other things, like mouse / hub support?), that would be very much appreciated .
EDIT: Got it working with an external DIGITIZER, I can now watch analog signals with 5 GS/s on my phone... oscilloscope to go!
So "CONFIG_SEC_WHITELIST=n" breaks nothing (thumbdrives still work), but enables a whole world of possibilities.
EDIT2: A nice picture can be seen here:
http://forum.xda-developers.com/showpost.php?p=18328481&postcount=4032

watching this thread with great interest, if the OP has a donate link to go towards a new phone i'm sure plenty of people might contribute

Td8f4 said:
So ****tiest week ever
my galaxy s2 stopped working, put it in to charge and it wont turn on. no lights no nothing.
i've tried a usb jig.
no dice.
i phoned samsung to get it repaired to replaced.
i sent it in a week ago and i just got it Rushed back from them saying that since it's not a canadian phone; they cant service it.
turns out it was bought in chile.
i have a 700$ paperweight. isnt that awesome
JDouce said he managed to compile a driver successfully
Click to expand...
Click to collapse
Depending on how far you want to go to repair it, you can always unbrick your phone. Search for Jtag repair. You can reflash through the built in testing ports.

some new?? galaxy S2 LIVE???

Accessing uart on Galaxy Nexus i9250

I'm going to do some low-level software development on Samsung Galaxy Nexus (replacing kernel with custom one doing stuff that are not Android-related). To do so I'll require accessing uart output of bootloaders and Linux.
I'm looking for an information how to connect to i9250's uart serial port and possibly other stuff.
Currently the best what I've found is The all-in-one Galaxy S2 Hack Pack (http://forum.xda-developers.com/showthread.php?t=1316501), but obviously this is not entirely what I'm looking for. The i9250 service manual maybe some help too. If anyone has any information regarding this matter, please post.

dpc.ucore.info said:
I'm looking for an information how to connect to i9250's uart serial port and possibly other stuff.
Click to expand...
Click to collapse
To get access to your kernel's, bootloader's logs through UART you need UART jack(dont know this word in english, I think I guess 'jack') on your board, in your case i9250's.
If developers of board didn't add that jack to pcb design, your attempts to view logs will be unsuccessful.
If you find UART pins of your SoC, connect it to UART-USB converter and plug to your PC.
In bootloader sources you will find to which UART port debug messages will go, if your SoC has more than one controller.
In linux's kernel case debug port you could assign through startup string, like bootargs in uboot, or through menuconfig.
But all this stuff depends on have you got UART pins on board or not.

dpc.ucore.info said:
I'm looking for an information how to connect to i9250's uart serial port and possibly other stuff.
Click to expand...
Click to collapse
First you have to tell us what hardware you have! Find some links to "tear-aparts / tear-downs" etc. Also make sure, what you find, corresponds to your device. Samsung is going wild when it comes to making (incompatible) product variations. When we know the hardware we can start to find out the rest... In your case the most important is to find out about the application processor (AP), baseband processor (P) and the micro-USB mux.

Its the Galaxy Nexus GSM/HSPA version. It has an OMAP4460. The processor found on the pandaboard.

This device should have external UART.
Have you tried 619Kohms on the USB port yet? Most samsung device, including this one, have a FSA chip. This is the first way to tell if UART is properly connected.
If it is, than you can probe deeper to find the internal UART which will show more. The Internal UART connection will show UART before the FSA chip is initialized giving you even more to work with.
It's likely that because this is an OMAP chip, it should have the following characteristics:
192600 or 115200 bps
8 bits per word
1 stop bit
No parity
No flow control
1.8V high, Open drain
I'm not sure if the FSA chip will increase that level to 3V or not.

To briefly clarify (and confirm) what Adam says.
There is already built in UART-USB functionality controlled by the FSA (MUX). Thus you can just connect an external microUSB connector with appropriate resistor values, to get a serial connection. (Just google "I9x00 USB JIG"). But if you decide to use internal UART pins on the PCB, then you get earlier access to everything and you can start reading already at the IBL (Initial Boot Loader) stage, which are the absolute first characters coming out of phone after a reboot.

I can confirm the 619Kohm trick works on Galaxy Nexus. I used a 3.3V USB/UART breakout card. Serial output:
�����[sbl_board_charger_init_post] : Succeed set model data : 0x78!!!!!
====== VCELL : 368500, SOC : 23, nType : 4 ======
[Charger] nScaledVCELL : 368500000, nDesriedSOC, : 23, nMaxSOC : 43, nMinSOC : 3
[ omap_power_get_reset_source :47] PRM_RSTST : 0x1
[ __omap_usbacc_test_donwload_by_musb :280] nDeviceType : 0x4
[ omap_usbacc_get_reboot_reason :333] nJigStatus = 0x00000001
[ __sbl_board_hw_init_late :719] final reboot mode in cable = 0x20000
[ __sbl_board_hw_init_late :730] Wake up by TA / USB / JIG
* FB base addr = 0xbea70000!
* PANEL_S6E8AA0_ID_READ : 0x12, 0x8e, 0x9f.
[ omap_power_get_reset_source :47] PRM_RSTST : 0x1
message.command =
message.status =
message.recovery =
Starting kernel at 0x81808000...
<hit enter twice to activate fiq debugger>
AST_POWERON

This is what comes prior to the above, in case anyone is interested.
-- OMAP 00004460 (version 04460e11) PPA release 1.6.1 Hash 30639809--
Device type: HS, DEBUG OFF
CPFROM HAL API support integrated
THERMAL support integrated: Run Time + Boot time
HDCP support integrated
-- PROD PPA RC3.2.3 --
Reset reason = 00037ba2
PRM_RSTST = 00000002
PPA freed 2992 bytes
Texas Instruments X-Loader 1.41 (Nov 16 2011 - 16:28:45)
Starting OS Bootloader from MMC/SD1 ...
EXCEPTION : CM_CLKMODE_DPLL_ABE = 0x7
EXCEPTION : CM_IDLEST_DPLL_ABE = 0x1
EXCEPTION : CM_CLKSEL_DPLL_ABE = 0x804018
EXCEPTION : CM_CLKMODE_DPLL_CORE = 0xf
EXCEPTION : CM_IDLEST_DPLL_CORE = 0x1
EXCEPTION : CM_CLKSEL_DPLL_CORE = 0x7d05
EXCEPTION : CM_CLKMODE_DPLL_PER = 0x107
EXCEPTION : CM_IDLEST_DPLL_PER = 0x1
EXCEPTION : CM_CLKSEL_DPLL_PER = 0x1400
EXCEPTION : CM_CLKMODE_DPLL_MPU = 0x117
EXCEPTION : CM_IDLEST_DPLL_MPU = 0x1
EXCEPTION : CM_CLKSEL_DPLL_MPU = 0x807d07
CFG_LOADADDR = 0xa0208000
1st instruct = 0xEA000007
[ __omap_twl6030_init_vbat_cfg :49] SA_PHOENIX_START_CONDITION = 0x8
[ __omap_twl6030_init_vbat_cfg :54] SA_PH_CFG_VBATLOWV = 0x80
[ __omap_twl6030_init_vbat_cfg :63] SA_PH_CFG_VBATLOWV = 0x80
[ __omap_twl6030_init_vbat_cfg :86] SA_BBSPOR_CFG = 0x78

Now, could we have the English translation (of all that above) please?
[And if debug is OFF, how can we turn it ON?]
I seem to be able to count 4 bootloaders there, how many damn boot loaders are there!?

USB - UART 619Kohm cable
Would anyone build a custom 619Kohm mini-USB to UART cable and ship it in the U.S. or India? We need it.
Is there any supplier of this in the U.S.?
Thanks,
Bahadir

I've attached a circuit diagram. You will need to modify your cable. You will need a UART device like the FTDIFriend or Bus Pirate. I specified the communications settings above.
Here is the cable modifications and where to hook up on the MicroUSB port.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Power is disconnected
Data- and Data+ are your signal lines.
Pin X (aka Pin4) is connected to ground via 619Kohm resistor
Ground is used as a reference.
Just tear up a MicroUSB cable and modify it as above.

I managed to get the UART cable done and also some output from there. Now my questions is has anyone managed to get kernel boot log out of the UART as well? Atm. I get only the bootloader things:
Code:
[sbl_board_charger_init_post] : Succeed set model data : 0x78!!!!!
====== VCELL : 380250, SOC : 57, nType : 4 ======
[Charger] nScaledVCELL : 380250000, nDesriedSOC, : 60, nMaxSOC : 80, nMinSOC : 40
[ omap_power_get_reset_source :47] PRM_RSTST : 0x1
[ __omap_usbacc_test_donwload_by_musb :280] nDeviceType : 0x4
[ omap_usbacc_get_reboot_reason :333] nJigStatus = 0x00000001
[ __sbl_board_hw_init_late :719] final reboot mode in cable = 0x20000
[ __sbl_board_hw_init_late :730] Wake up by TA / USB / JIG
* FB base addr = 0xbea70000!
* PANEL_S6E8AA0_ID_READ : 0x12, 0x8e, 0x9d.
[ omap_power_get_reset_source :47] PRM_RSTST : 0x1
message.command =
message.status =
message.recovery =
Starting kernel at 0x81808000...
So does anyone know what kernel configs and cmdline I need in order to get the kernel messages out from the UART?
Thanks in advance.

Where is the actual resistor values determined? I know it has something to do with the USB MUX, but are the actual values determined by code or by hardware? Or is the Nexus MUX different? I'm wondering because according to this thread (for the GT-I9100) the resistor value should be R = 523 K.
---------- Post added at 11:58 AM ---------- Previous post was at 11:55 AM ----------
iamsage2 said:
So does anyone know what kernel configs and cmdline I need in order to get the kernel messages out from the UART?
Click to expand...
Click to collapse
Check the link above...
...and let us know how it goes.
[EDIT] I've just answered my own questions, plus a resistor reference table over here.

I managed to get the kernel output out with the 619K resistor. Just had to enable some kernel options of FIQ_DEBUGGER
Code:
CONFIG_FIQ_DEBUGGER=y
CONFIG_FIQ_DEBUGGER_NO_SLEEP=y
# CONFIG_FIQ_DEBUGGER_WAKEUP_IRQ_ALWAYS_ON is not set
CONFIG_FIQ_DEBUGGER_CONSOLE=y
CONFIG_FIQ_DEBUGGER_CONSOLE_DEFAULT_ENABLE=y
And have the console=ttyFIQ0 on cmdline. Thanks for the nice thread

Hey guys... I just got a Galaxy Nexus. I'm going to be doing some work. I used UART for the first time last night.
This works differently than standard UART with SBL or U-BOOT. How do you access the command line parmeters for the kernel, or do you need to take a kernel, un-boot.img it and then add new parmeters?

AdamOutler said:
...How do you access the command line parmeters for the kernel, or do you need to take a kernel, un-boot.img it and then add new parmeters?
Click to expand...
Click to collapse
Probably you don't remember this and this. But basically you can use the sblParam tool, to look at and set your command line on the fly. (Do backup and check that the output of that program is the same, as it was originally developed for a different phone.) You can check with:
# hexdump -C /mnt/.lfs/param.blk
BTW. Do you know what the voltage levels are for Tx/Rx (D+/D-), when using the various resistor values, for USB/UART?
In particular the values:
150K UART Cable
255K Factory Mode Boot OFF-USB
301K Factory Mode Boot ON-USB
523K Factory Mode Boot OFF-UART
619K Factory Mode Boot ON-UART
I'd also like to know if the voltages changes when switching USB/UART mode when using:
a) The PhoneUtil menu: *#7284#
b) The ServiceMode menu : *#197328640#
Code:
==> MAIN MENU --> COMMON --> DIAG CONFIG
[1] LOG VIA USB *
[2] LOG VIA UART
Why?
1) It may be possible that there are already level-shifters built in to the MUX, and thus we may no longer need to build level shifter UART cables.
(Your PC should automatically recognize a new serial device, using one of the ~7 drivers included in the Samsung CDC, when connecting disconnecting via USB and using some (?) of the resistors above.)
2) I have the FTDI FT232R-3V3 cable and need to check if its TTL 5V or CMOS 3.3V levels on the output..
This is all hypothetical, so it may be that I'm on a wild goose chase... But I'm still waiting for my μUSB breakout connector and cable...and then found out I may have the wrong levels for my cable.

Thanks.
Its supposed to be 3v3. 5v works fine thanks to the fsa chip

Those menus dont exist on my stock device.

AdamOutler said:
Those menus don't exist on my stock device.
Click to expand...
Click to collapse
Really!? I don't believe it. They must have changed the code(s) to something else. Sometimes you also need to write the "*#" parts twice before or after the number, for reasons unknown, but probably some lame attempts to further hide these menus from curious users. Did you try *#0011#? (Or any other of the hundreds of "hidden" function codes?) No worry, we can find them by looking in the baseband or the available Apps on the phone...
[EDIT] Ah, I just remembered, the various codes are pointers to the various sub-menus in the servicemode app, so if they have updated this app, which they surely have if you're on ICS and Nexus, the sub-entry codes have likely changed as well. (Remember that this app is just a wrapper for the real/native code running on BP which is different for different platforms (phones). However, most main entry codes should always be the same. Like 0011 and 06 etc etc.
Also try:
Code:
# find / -iname "*service*"
If indeed none of these menus are available, they must have done some interesting kernel mods to extend the auto-detection and for tweaking functionality elsewhere. You're on ICS 404, right?

E:V:A said:
Really!? I don't believe it. They must have changed the code(s) to something else. Sometimes you also need to write the "*#" parts twice before or after the number, for reasons unknown, but probably some lame attempts to further hide these menus from curious users. Did you try *#0011#? (Or any other of the hundreds of "hidden" function codes?) No worry, we can find them by looking in the baseband or the available Apps on the phone...
[EDIT] Ah, I just remembered, the various codes are pointers to the various sub-menus in the servicemode app, so if they have updated this app, which they surely have if you're on ICS and Nexus, the sub-entry codes have likely changed as well. (Remember that this app is just a wrapper for the real/native code running on BP which is different for different platforms (phones). However, most main entry codes should always be the same. Like 0011 and 06 etc etc.
Also try:
Code:
# find / -iname "*service*"
If indeed none of these menus are available, they must have done some interesting kernel mods to extend the auto-detection and for tweaking functionality elsewhere. You're on ICS 404, right?
Click to expand...
Click to collapse
I dont have find or hexdump yet. I have decided that any modifications i do to this device will be CASUAL implementations. I am running stock 4.0.2 ICL53F.i9250XWKL2.
I believe there is a root exploit out there i can port into CASUAL. Its a matter of getting time to do it.

[Q] Need help/info. Bricked G2 and Linux Fix method.

OK I really need some help and info here. Ive done some searching around on here and other sites, and found what seems to be the only method to fix my phone ... http://forum.xda-developers.com/showthread.php?t=2582142 ... I feel fairly confident that I can accomplish this method. Although im not running ubuntu but rather kali.
My device had the vzw-vs980-27a.kdz and rooted by stumproot.apk. and the other morning verizon pushed the lollipop ota and now my phone is stuck in the secure boot error fastboot. It fits all the signs as described in the fix it post.
Questions:
1. Since i was on 27A and the files provided in the link only go up to 24A, I was wondering if I could use the 24A image files or will they further break my phone?
2. I was able to find a 27A bootstack zip via https://www.androidfilehost.com/?fid=95916177934539347... the only thing is the bootstack files in the zip are .bin files and the instructions call for .img files.
are these two interchangeable? if not can i use the 24A to fix my phone or can some one direct me to a link where i can find the 27A .img files.
Any and all help and input are greatly appreciated.

REALLY NEED HELP!
I cant get my linux system to recognize the phone but when i plug it into a windows system it recognizes it as a unkown device. but i cant upate the driver to a adb driver or fastboot driver
and i cant even turn the phone on or off no matter what button config i try

anyone?

a.perkins89 said:
Although im not running ubuntu but rather kali.
Click to expand...
Click to collapse
It shouldn't matter that you're running Kali instead of Ubuntu. As long as you have the required files: /bin/ls, /sbin/gdisk and /bin/dd you're good to go. You can confirm the location of the binary commands by running the whereis command followed by ls, gdisk, and dd respectively.
If you're having trouble mounting your device or getting it recognized, consider using a more user friendly environment like Ubuntu. Kali is great for forensics and pen-testing but using it to communicate with your phone probably isn't the best choice, it may have missing dependencies.
a.perkins89 said:
I was able to find a 27A bootstack zip via https://www.androidfilehost.com/?fid=95916177934539347... the only thing is the bootstack files in the zip are .bin files and the instructions call for .img files. Are these two interchangeable?
Click to expand...
Click to collapse
Yes they are. Rename all the .bin files to .img and continue from there.
Good luck!

a.perkins89 said:
REALLY NEED HELP!
I cant get my linux system to recognize the phone but when i plug it into a windows system it recognizes it as a unkown device. but i cant upate the driver to a adb driver or fastboot driver
and i cant even turn the phone on or off no matter what button config i try
Click to expand...
Click to collapse
Plug your phone in and type "dmesg" in linux. Paste the output on pastebin.com and link it here.
I'm suspecting you are in a QH USB 9008 error. First of all - dont panic. I have successfully recovered from a 9008 error - but it is a longer process (and it may involve you paying someone 30$).
But first, let us confirm.

I have this problem too, my PC wont recognize that its a phone connected it reads "Unknown Device" on WINdows but when i plug it in the computer with Ubuntu it reads nothing. no 9008 error nothing at all. What do i do? do i have to replace the usb port? cant i just use someone elses same exact usb rig and flash and put my old one back? my current one only works if i clean it with alchohal wait 10 minutes to dry then i plug it into my pc and it detects and if i dont then my pc wont see that theirs something connected to it.

d00lz said:
It shouldn't matter that you're running Kali instead of Ubuntu. As long as you have the required files: /bin/ls, /sbin/gdisk and /bin/dd you're good to go. You can confirm the location of the binary commands by running the whereis command followed by ls, gdisk, and dd respectively.
If you're having trouble mounting your device or getting it recognized, consider using a more user friendly environment like Ubuntu. Kali is great for forensics and pen-testing but using it to communicate with your phone probably isn't the best choice, it may have missing dependencies.
Yes they are. Rename all the .bin files to .img and continue from there.
Good luck!
Click to expand...
Click to collapse
Thank you, I was kind of thinking they were interchangeable, just didn't want to assume and possibly screw the device up some more.
sandys1 said:
Plug your phone in and type "dmesg" in linux. Paste the output on pastebin.com and link it here.
I'm suspecting you are in a QH USB 9008 error. First of all - dont panic. I have successfully recovered from a 9008 error - but it is a longer process (and it may involve you paying someone 30$).
But first, let us confirm.
Click to expand...
Click to collapse
Ok, here it is.. pastebin.com/CH6HqSCT.. Once again thank you for any help you can offer.. This really couldn't have happened to me at a more inconvenient time... I literally just had to get on the search for a new job and dropped my resume' at like 20 places within the few days before my phone dying.

a.perkins89 said:
Thank you, I was kind of thinking they were interchangeable, just didn't want to assume and possibly screw the device up some more.
Ok, here it is.. pastebin.com/CH6HqSCT.. Once again thank you for any help you can offer.. This really couldn't have happened to me at a more inconvenient time... I literally just had to get on the search for a new job and dropped my resume' at like 20 places within the few days before my phone dying.
Click to expand...
Click to collapse
Please plug your device into the USB slot and type the following,
Code:
lsusb
Please reply with the output.

d00lz said:
Please plug your device into the USB slot and type the following,
Code:
lsusb
Please reply with the output.
Click to expand...
Click to collapse
Bus 003 Device 006: ID 0cf3:3005 Atheros Communications, Inc. AR3011 Bluetooth
Bus 003 Device 004: ID 04f2:b230 Chicony Electronics Co., Ltd Integrated HP HD Webcam
Bus 003 Device 003: ID 0781:5530 SanDisk Corp. Cruzer
Bus 003 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub
Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 004 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 002 Device 097: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 003: ID 138a:003c Validity Sensors, Inc. VFS471 Fingerprint Reader
Bus 001 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

a.perkins89 said:
Bus 003 Device 006: ID 0cf3:3005 Atheros Communications, Inc. AR3011 Bluetooth
Bus 003 Device 004: ID 04f2:b230 Chicony Electronics Co., Ltd Integrated HP HD Webcam
Bus 003 Device 003: ID 0781:5530 SanDisk Corp. Cruzer
Bus 003 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub
Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 004 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 002 Device 097: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 003: ID 138a:003c Validity Sensors, Inc. VFS471 Fingerprint Reader
Bus 001 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Click to expand...
Click to collapse
Looks like your device is getting detected at least.
Code:
Bus 002 Device 097: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)
Please confirm this by unplugging your device and running lsusb again and comparing the output.
I urge you to stop using Kali for this and try Ubuntu btw .

yes, when i unplug the phone from the machine and run the command again. Qualcomm no longer shows up, and of course, comes back upon re-attaching

a.perkins89 said:
Thank you, I was kind of thinking they were interchangeable, just didn't want to assume and possibly screw the device up some more.
Ok, here it is.. pastebin.com/CH6HqSCT.. Once again thank you for any help you can offer.. This really couldn't have happened to me at a more inconvenient time... I literally just had to get on the search for a new job and dropped my resume' at like 20 places within the few days before my phone dying.
Click to expand...
Click to collapse
Code:
[ 173.880606] usb 2-1: New USB device found, idVendor=05c6, [B]idProduct=9008[/B]
[ 173.880619] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 173.880625] usb 2-1: Product: QHSUSB__BULK
[ 173.880629] usb 2-1: Manufacturer: Qualcomm CDMA Technologies MSM
[ 173.881813] qcserial 2-1:1.0: Qualcomm USB modem converter detected
[ 173.882151] usb 2-1: Qualcomm USB modem converter now attached to ttyUSB0
Unfortunately, you are in QH USB 9008 mode . so now you are in a more complicated way to recover. I suggest you first read this http://www.reddit.com/r/Android/comments/2p8ju4/xpost_rlgg2_the_lg_g2_is_unbrickable_a_story_of/
Then I suggest you download the TOT files and KDZ files for your phone - please be VERY careful in choosing your TOT and KDZ.
Then I also suggest to download the KDZ extractor in python form . Then extract the image files from the KDZ by running
Code:
python KDZFileTools.py -f ../D80110A_00.kdz -x
python DZFileTools.py -f kdzextracted/D80110a_00.dz -x
So now, you have 3 things - TOT file, KDZ file and extracted image files. Also you need to open the back cover of your phone and figure out how to disconnect the battery (it is a small button like thing). Very easy stuff. All of this is a pre-requisite to unbricking your phone.
Now you have two choices - pay someone to connect to a Windows computer (search for tungkick on this forum) or to use this. I would say, use the second one first ... and then decide to pay or not. FYI - when I unbricked, I didnt have access to the second tool so I had to pay Tungkick.
Hope this helps.

sandys1 said:
Code:
[ 173.880606] usb 2-1: New USB device found, idVendor=05c6, [B]idProduct=9008[/B]
[ 173.880619] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 173.880625] usb 2-1: Product: QHSUSB__BULK
[ 173.880629] usb 2-1: Manufacturer: Qualcomm CDMA Technologies MSM
[ 173.881813] qcserial 2-1:1.0: Qualcomm USB modem converter detected
[ 173.882151] usb 2-1: Qualcomm USB modem converter now attached to ttyUSB0
Unfortunately, you are in QH USB 9008 mode . so now you are in a more complicated way to recover. I suggest you first read this http://www.reddit.com/r/Android/comments/2p8ju4/xpost_rlgg2_the_lg_g2_is_unbrickable_a_story_of/
Then I suggest you download the TOT files and KDZ files for your phone - please be VERY careful in choosing your TOT and KDZ.
Then I also suggest to download the KDZ extractor in python form . Then extract the image files from the KDZ by running
Code:
python KDZFileTools.py -f ../D80110A_00.kdz -x
python DZFileTools.py -f kdzextracted/D80110a_00.dz -x
So now, you have 3 things - TOT file, KDZ file and extracted image files. Also you need to open the back cover of your phone and figure out how to disconnect the battery (it is a small button like thing). Very easy stuff. All of this is a pre-requisite to unbricking your phone.
Now you have two choices - pay someone to connect to a Windows computer (search for tungkick on this forum) or to use this. I would say, use the second one first ... and then decide to pay or not. FYI - when I unbricked, I didnt have access to the second tool so I had to pay Tungkick.
Hope this helps.
Click to expand...
Click to collapse
I can't seem to get the tool to work. Iv downloaded a . tot file from storagecow.eu/index.php?dir=Xda%2FLG+G2%2FStock%2FVerizon%2FTOT+Method%2F.. and when trying to run the first step the tool program stops responding

ok i got that figured out, now im stuck on the second step.. when i try to test ap and emmc i get a serial port open message... dont know wgat to do, and i cant really understand the steps in the second image of the guide

a.perkins89 said:
ok i got that figured out, now im stuck on the second step.. when i try to test ap and emmc i get a serial port open message... dont know wgat to do, and i cant really understand the steps in the second image of the guide
Click to expand...
Click to collapse
I suggest you ask on http://forum.xda-developers.com/lg-g2/general/tool-unbrick-lg-g2-qualcomm-9008-board-t3072073 - I'm not really sure what is the way to use this software.

My Lumia 520 is ded.

Hi everyone!
So, I flashed Android severals days ago.
Then, I booted into dload mode, took backup and went back to WP.
I unlocked bootloader and booted into mass storage mode to restore Android, but HDD Raw Copy reported an error "Can't write to device, aborting"
Then I rebooted, phone vibrated and then black screen.
What can I do?

mattschwantes said:
Please clarify what you are trying to do. The backup that you made was the backup of the phone while it was running WP8 or running Android? Which OS do you want on your phone now, WP8 or Android
---------- Post added at 04:44 AM ---------- Previous post was at 04:43 AM ----------
Also, what does Device Manager show in Windows when you plug in the phone now?
Click to expand...
Click to collapse
I did backup of Android. Device Manager showed device like Unknown USB Device (Device Descriptor Request Failed) with code 43.

mattschwantes said:
Afraid I haven't seen that error 43 issue before. My second L521 does the "Black Screen - Vibrate only" but it shows up as "USB HID Input Device", and I wasn't able to fix it.
WinDiskImage may only work for backup/restore of the WP8 partitions.
Click to expand...
Click to collapse
I checked again, and my phone also shows as "HID-compliant vendor-defined device" and "USB Input Device"}
Hardware Ids is: HID\VID_05C6&PID_F006; USB\VID_093A&PID_2510&REV_0100

feherneoh said:
PID_F006 HID usually means battery is empty.
Try connecting the phone to USB with battery removed. If it shows up as PID_9008, then bootloaders are dead, otherwise it's something different.
If in 9008 mode, you should try WPInternals' Unlock Bootloader option.
Click to expand...
Click to collapse
Without battery, it doesn't work at all.
I also got second battery, which is charged, and it also doesn't show up with that battery.
It seems that only with dead battery phone shows in Device Manager

So, I booted into ubuntu and connected device.
dmesg shows:
Code:
[ 82.671947] usb 1-1.1: new high-speed USB device number 5 using ehci-pci
[ 82.793682] usb 1-1.1: New USB device found, idVendor=05c6, idProduct=f006
[ 82.793696] usb 1-1.1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 82.806265] hid-generic 0003:05C6:F006.0003: hiddev0,hidraw2: USB HID v1.11 Device [HID 05c6:f006] on usb-0000:00:1a.0-1.1/input0
lsusb shows:
Code:
Bus 002 Device 003: ID 046d:c534 Logitech, Inc. Unifying Receiver
Bus 002 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 004: ID 5986:0292 Acer, Inc
Bus 001 Device 003: ID 0a5c:21d7 Broadcom Corp. BCM43142 Bluetooth 4.0
Bus 001 Device 005: ID 05c6:f006 Qualcomm, Inc.
Bus 001 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
View attachment dmesg.txt Here's full dmesg output.

Dead Lumia 1020 while bootloader unlock WPinternals 2.3
feherneoh said:
PID_F006 HID usually means battery is empty.
Try connecting the phone to USB with battery removed. If it shows up as PID_9008, then bootloaders are dead, otherwise it's something different.
If in 9008 mode, you should try WPInternals' Unlock Bootloader option.
Click to expand...
Click to collapse
Dear in case bootloaders are dead, the only solution would be JTAG right? Just to confirm

feherneoh said:
Did you even read the reply you quoted?
Click to expand...
Click to collapse
Yes i did. Did i miss something?

Kernel Source for Nook Glowlight 2013 (BNRV500)

EDIT: The files have now reappeared on B&N's servers. For safety and convenience I've attached the Nook-1.3.0 and Nook-1.3.1 Delta files here in one Zip file. Hope this helps someone else. I'm off to try patching this kernel.
Hi all!
Does anyone have a copy of the source code for the 2013 Glowlight? The links on B&N's site aren't working. I've tried hunting around on XDA, but it doesn't seem as though anyone has ever uploaded them here.
Nook OS version on my GL 2013 is 1.3.2, but I'm guessing 1.3.0 and 1.3.1 aren't that different and would be better than nothing.
Thank you!
Alex

Found them! B&N must have fixed their site, because the links are working again. I've attached them here in one Zip file just in case they go missing again. I've also popped them on the Wayback Machine.

I've managed to build the kernel using the Sourcery G++ Lite 2010q1-202 toolchain. There was a tiny tweak needed to get it to work with newer versions of Perl, but otherwise it's compiled without a problem. I've tried with a couple of later Linaro toolchain builds, but they failed.
Patch-wise I'm trying to get features as close to the NST modded kernels as possible. The kernel on my old NST has the smartassv2 CPU governor and the SIO scheduler, so I've found patches for those and added them.
I have a few other patches, but no success so far. FastMode needs quite a few tweaks for the patch to work. USB Host Mode compiles fine but does nothing, with no chipset shown in Renate's USB Mode Utility. Finally, I can't work out how to overclock to 1000 MHz.
I'm sure a lot of these issues are solved somewhere in this forum, or there are at least clues (the "Hacking the New Nook Glowlight" thread has certainly helped). I haven't found the answers yet. It's not an urgent project - my NST is still hanging on for dear life - so I'm just working on it when I have a few minutes or feel inspired to do so.
I'll post updates here as I work things out. If anyone has any tips or can offer any help, please do reply to this thread.

albrow said:
USB Host Mode compiles fine but does nothing, with no chipset shown in Renate's USB Mode Utility.
Click to expand...
Click to collapse
The old driver(s) exposed:
Code:
/sys/devices/platform/musb_hdrc/mode
/sys/devices/platform/musb_hdrc/vbus
/sys/devices/platform/i2c_omap.1/i2c-adapter/i2c-1/1-0048/twl4030_usb/vbus
/sys/devices/virtual/sec/switch/adc
/sys/devices/platform/bq24073/regulator/regulator.5/state
/sys/devices/platform/bq24073/force_current

I've uploaded what I've done so far to GitHub.
GitHub - PocketNerdIO/nook-kernel-1.3.1: Kernel for the Nook Glowlight 1 (BNRV500), based on B&N's stock kernel (nook-1.3.1, Android 2.1, Linux 2.6.29-omap1) with some extra patches.
Kernel for the Nook Glowlight 1 (BNRV500), based on B&N's stock kernel (nook-1.3.1, Android 2.1, Linux 2.6.29-omap1) with some extra patches. - GitHub - PocketNerdIO/nook-kernel-1.3.1: Kern...
github.com
Currently the only changes from stock are adding SIO and smartassv2. I've attached the uImage and .config files, should you want to give them a go yourself.
I don't know how many NG1 users are still out there, but hopefully someone will find this useful.
Sidenote: I'm a Linux user. If you run ADB in Linux first, Renate's ADBGRAB runs perfectly in Wine. See the screenshot below.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

I'll try look into it.

I thought I should add that I've already adjusted the partition table. My NG1 currently has a uRamdIsk that mounts /sdcard as a simlink, but some apps really don't like this. I think I'm going to repurpose "reserve" as /sdcard instead.
Code:
NAME FSTYPE FSVER LABEL SIZE
sdb
├─sdb1 vfat FAT32 boot 76M
├─sdb2 vfat FAT32 rom 16M
├─sdb3 ext2 1.0 factory 190M
├─sdb4
├─sdb5 ext2 1.0 288M
├─sdb6 vfat FAT32 NOOK 2.5G
├─sdb7 ext3 1.0 cache 239M
├─sdb8 ext3 1.0 reserve 15M
└─sdb9 ext3 1.0 userdata 300M

albrow said:
Renate's ADBGRAB runs perfectly in Wine.
Click to expand...
Click to collapse
Gosh! Glad to hear it.
Don't forget that for a simple grab give it a filename:
Code:
adbgrab grab.png /o90
Rotate works on this (but not Scale /s)
For interactive:
Code:
adbgrab /s.5
Rotate & Scale work.
Mouse clicks and most keys work on this (but slowly due to Android "input" command which does it in Java).

Renate NST said:
Don't forget that for a simple grab give it a filename:
Code:
adbgrab grab.png /o90
Rotate works on this (but not Scale /s)
For interactive:
Code:
adbgrab /s.5
Rotate & Scale work.
Mouse clicks and most keys work on this (but slowly due to Android "input" command which does it in Java).
Click to expand...
Click to collapse
Thank you! I'm going to try running a few more of your tools with Wine in the next few days. I'm especially interested in patching the Reader using MergeSmali, as well as swapping versions (seeing if the one in 1.2.1/1.2.2 is better than the one in 1.3.1).
I added some compilation tweaks to the code so that it aimed at Cortex-8 rather than a generic ARMv7 build. The changes are on Github and will be part of the next binary I release.
I've been wondering if it's worth trying to find some other patches for this old kernel to give it a speed boost, or maybe more battery savings. I'm guessing it's not worth trying to get it running with a newer kernel (2.6.32/35/36). To be honest I don't know much about kernel hacking beyond some beginner-level C and adding patches. For now I'd like to get things like multitouch and FastMode running, which shouldn't be too tough.

With a quick tweak to the code, the kernel now compiles and boots with Linaro 2012-08 (gcc 4.7.2). I'll push the change to Github later.
I was also able to compile it with Linaro's gcc 4.9.4, but unfortunately the NG1 wouldn't boot. I probably need to work out how to look at u-boot and kernel logs to see if it's fixable, but it's not as important as getting the other patches working.

I'm slowly going through Guevor's old patch file (v4) for the NST. I've added the option for Veno TCP congestion control to the kernel. The change is up on Github. Plus, here's my latest kernel compiled with Linaro gcc 4.7.2, along with the config. To recap, here's the changelog from the stock Nook 1.3.1 kernel (2.6.29):
Compiles (and boots) with Linaro gcc 4.7.2
Fixed to compile with modern versions of Perl
Use SIO I/O Scheduler as default
Use smartassv2 as default
Add Veno TCP congestion and set as default
Not a huge number of changes from stock, but hopefully still some improvements. Next up are FastMode, Multitouch and USB Host. There are also the overclocking settings, but I'm less sure about whether they're all that worthwhile.
EDIT: Realised that I'd uploaded a kernel compiled with the Sourcery toolchain, so I've just uploaded one compiled with Sourcery and one with Linaro gcc 4.7.2. Feel free to test both.
In other news (cc @Renate NST), the stock Reader on my device really doesn't like files loaded using the Temblast Library, which is a massive shame as it's my preferred library app. It takes a long time to load the file, and then has no indexing whatsoever: "Content" does nothing, "go to" shows "Page 3 of 0", and highlighting a word crashes the reader. It's not the end of the world as I can use the stock Library, although I don't know if it's going to read the files in /sdcard. Further research required.
Also, this version of the stock reader REALLY dislikes Button Savior drawing over the top of it. This is most noticeable when the trigger fades out. It will try to refresh the screen at every gradient of change, sometimes making the device unresponsive for up to 30 seconds. I thought there was a way of turning off the fade-out, but I can't find it. One workaround is to close the Button Savior panel, press home, wait for the button to fade, then go back to the reader. It's times like this when I actually miss the "n" button bar on the NST. I can live without physical buttons if the virtual ones do the job well enough.
Think my next task will be to rearrange the partitions so that there's a proper /sdcard rather than a symlink.

albrow said:
The stock Reader on my device really doesn't like files loaded using the Temblast Library...
Click to expand...
Click to collapse
That's very strange. If it opens the intended book then it should be ok from there.
In my world the reader gets the last reading point by itself.
Maybe your reader is expecting something extra in the intent and it isn't handling the lack gracefully?
Does it always go to page 1 even if you've read further?
albrow said:
Also, this version of the stock reader REALLY dislikes Button Savior...
Click to expand...
Click to collapse
Mmm, I dislike those things too.
I was looking at the Onyx Boox Poke 3. It has only a power button, no home, no anything.
It has this arc of icons that follows your finger, a bit like Button Savior.
It's great hardware but I'd have to do a bunch of work to make it clean.

Renate NST said:
Maybe your reader is expecting something extra in the intent and it isn't handling the lack gracefully?
Click to expand...
Click to collapse
I'm certain you're right on this, but I have no idea how to monitor that.
Renate NST said:
Does it always go to page 1 even if you've read further?
Click to expand...
Click to collapse
Yes, unless you're re-opening the same book that is currently open (i.e. Reader is already running in the background with that book.
I've just noticed something with this Reader. It NEVER does a refresh on a page turn, nor when the bottom menu appears or disappears. It sometimes does a refresh when it first loads a book, but not always. But if something tries to draw over the top of it (Button Savior, the Android volume HUD), it refreshes on every change to the screen.
I have a theory on this. When trying to apply the FastMode patches, I noticed that the nook 1.3.1 kernel has more functionality than the one from 1.2.x. I've attached them both here, along with a diff of the two files. Could it be that this newer Reader uses a "new" (given the device is 8 years old) screen drawing method that the NG1 is switching in and out of when something draws over the top of Reader?
I might compile another kernel with the old kernel driver to see what it does.
Renate NST said:
I was looking at the Onyx Boox Poke 3. It has only a power button, no home, no anything.
It has this arc of icons that follows your finger, a bit like Button Savior.
It's great hardware but I'd have to do a bunch of work to make it clean.
Click to expand...
Click to collapse
Oh, don't tempt me! Hacking around with Android 2.1 does feel futile in 2021, but I'm not sure if I want to spend $189 on an ereader right now.

So, a quick update. I've managed to get the OTG patch on and enable the right kernel options (thanks to guevor's old NST .config file). It can now see devices!
Unfortunately, even though I've enabled block devices and SCSI, no new devices are showing in /dev. I'm sure I'm just missing some kernel options.
I found a later version of Linaro's gcc, specifically 4.7.3 from April 2013, which creates a bootable kernel. I think this is the latest version of gcc that will work properly with this code - any later and I just get a freeze at boot, not even a bootloop. It would've been nice (for me) to run a 64 bit compiler, but this works for now so I'll stick with it.
Latest amendments are on Github. I'm not at my laptop at the moment so I don't have a copy of the uImage or .config, but I'll add them when I'm next about.
Finally, I was wondering how easy it would be to "backport" this kernel to work on the NST or NST/G. It might just require an old .config file such as guevor's one. I don't know how useful that would be for anyone, especially as it doesn't have multitouch or FastMode, but it might provide some better screen writing code. I guess it could be a good experiment.

Hmm, it's interesting that it's not showing any interfaces or endpoints.
Are you using UsbMode-2.2.apk?
What does dmesg say when you plug it in?
Does a keyboard or something else work fine?

I think I've only got 2.1 on there actually - an old copy from when I was setting up my NST many years ago. I'll download 2.2 and get the dmesg log tonight. I don't have the USB stick or an OTG cable with me.
Do I need usbhostd as well, or is that only for the KitKat Nooks?

albrow said:
Do I need usbhostd as well, or is that only for the KitKat Nooks?
Click to expand...
Click to collapse
No, that's only for Glow2/3/4

I couldn't get UsbMode 2.2 to install on the NST or the NG1, but 2.1 runs fine on both. I've tried my Microsoft Ergonomic Keyboard on the NG1. It's showing in UsbMode, but dmesg comes up with this:
Code:
<6>[ 283.243438] usb 1-1: new low speed USB device using musb_hdrc and address 7
<3>[ 283.445098] usb 1-1: device v045e p00db is not supported
<6>[ 283.452697] usb 1-1: configuration #1 chosen from 1 choice
For the Sandisk OTG memory stick I get the following (of course, this could just be the stick asking for too much current):
Code:
<6>[ 589.997344] usb 1-1: new high speed USB device using musb_hdrc and address 9
<3>[ 590.163635] usb 1-1: device v0bda p0109 is not supported
<6>[ 590.171295] usb 1-1: rejected 1 configuration due to insufficient available bus power
<4>[ 590.179595] usb 1-1: no configuration chosen from 1 choice
Here's an Apple Mighty Mouse:
Code:
<6>[ 666.583343] usb 1-1: new low speed USB device using musb_hdrc and address 10
<3>[ 666.771850] usb 1-1: device v05ac p0304 is not supported
<6>[ 666.779510] usb 1-1: configuration #1 chosen from 1 choice
And for a laugh I thought I'd plug my NST into the NG1:
Code:
<6>[ 1193.856811] usb 1-1: new high speed USB device using musb_hdrc and address 21
<3>[ 1194.021789] usb 1-1: device v2080 p0003 is not supported
<6>[ 1194.029296] usb 1-1: rejected 1 configuration due to insufficient available bus power
<4>[ 1194.037597] usb 1-1: no configuration chosen from 1 choice
I'm sure I've just not enabled something in the kernel, but right now I'm not sure what.

OK, here's an interesting thing.
I thought I'd try plugging in an unpowered USB 2.0 Hub, which was recognised:
Code:
<6>[ 1858.059326] usb 1-1: new high speed USB device using musb_hdrc and address 25
<6>[ 1858.222869] usb 1-1: configuration #1 chosen from 1 choice
<6>[ 1858.229644] hub 1-1:1.0: USB hub found
<6>[ 1858.233978] hub 1-1:1.0: 4 ports detected
And then I plugged in the USB stick into the hub... which also worked and created /dev/block/sda and sda1!
Code:
<6>[ 2031.161499] usb 1-1: reset high speed USB device using musb_hdrc and address 25
<6>[ 2031.968811] usb 1-1.3: new high speed USB device using musb_hdrc and address 26
<3>[ 2032.104217] usb 1-1.3: device v0bda p0109 is not supported
<6>[ 2032.111999] usb 1-1.3: configuration #1 chosen from 1 choice
<6>[ 2032.130249] scsi0 : SCSI emulation for USB Mass Storage devices
<7>[ 2032.139739] usb-storage: device found at 26
<7>[ 2032.144134] usb-storage: waiting for device to settle before scanning
<5>[ 2037.149627] scsi 0:0:0:0: Direct-Access Generic- SD/MMC 1.00 PQ: 0 ANSI: 0 CCS
<6>[ 2037.273895] usb 1-1.3: reset high speed USB device using musb_hdrc and address 26
Unfortunately the Apple Mighty Mouse did what it did before, although it showed as being plugged in to the hub.
Code:
<6>[ 79.115997] usb 1-1.2: new low speed USB device using musb_hdrc and address 3
<3>[ 79.238891] usb 1-1.2: device v05ac p0304 is not supported
<6>[ 79.246276] usb 1-1.2: configuration #1 chosen from 1 choice

albrow said:
I couldn't get UsbMode 2.2 to install on the NST or the NG1.
Click to expand...
Click to collapse
Well, it looks like someone has to do some regression testing.
Edit: @albrow 2.2 works fine on my NST. I don't have a BNRV500.
If the logcat tells you something could you post it?
albrow said:
Code:
<6>[ 590.171295] usb 1-1: rejected 1 configuration due to insufficient available bus power
You should always test questionable USB OTG things using a powered hub.
After you get it working you can try flying solo.
Click to expand...
Click to collapse