Database Users

[GUIDE][HOW-TO]Extracting A 'boot.img' From An FTF

This is compatible with a wide variety of Xperia Devices​
A guide bought to you by matt4321 and DaRk-L0rD​
Here I am going to show you how to get the boot.img (kernel) out of an FTF! This procedure is most useful for Locked Bootloaders as it means we can upgrade without the need for FlashTool!
This guide assumes that you have FlashTool installed on your PC
#############################​
Step 1:
You need a file extractor such as WinRar or 7zip.
Once this is done you want to open the whole FTF in the extractor. You will see a lot of .sin files!
The one we want is 'kernel.sin', not 'fotakernel.sin'.
Extract that file to somewhere appropriate on your computer, like the desktop!
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
#############################​
Step 2:
Now you need to open FlashTool,
At the top you will see a tab that says 'Tools', click on that and select 'SIN Editor'. You will see a button that has 3 dots in the top right. This is the browse button, click on it and locate where your SIN file is.
One that is done, you need to click on 'Dump Data'.
This will dump the 'kernel.elf' to the same location of where your 'kernel.sin' is.
#############################​
Step 3:
The next part is simple,
All you need to do is rename your 'kernel.elf' to 'boot.img' and put it in a flashable zip, to make the flashable zip follow the instructions by @DaRk-L0rD in the 2nd post!
Keep in mind that the kernel should be 20mb.
#############################​
Step 4:
Enjoy! The kernel can be flashed via PhilZ for Locked Bootloaders and will work on both Locked and Unlocked bootloaders, since it is an official kernel it is signed by the Sony key so will be fine for Locked Bootloaders.

If you want to make a kernel's flashable zip
What you need:
1. winrar
2. Notepad++
3. The attachment: View attachment META-INF.rar
4. boot.img or kernel.elf
Procedure:
1. Extract the META-INF folder from the rar archive previously downloaded.
2. Open it and go META-INF -> google -> android and using Notepad++ edit the updater-script (right click on it and choose open with Notepad++).
3. Now you can see that the updater-script looks like this:
4. The line package_extract_file("boot.img", "/dev/block/mmcblkXXX"); should be edited ONLY for 2 reasons.
In case you have a kernel.elf (custom kernels) instead of a boot.img
To edit the mmcblkXXX partition since it's different for each device
5. At the end of this post you will find a list of the /mmcblkXXX . For each device are different to choose wisely!!
In my case is the /mmcblk0p4, so will look like this:
6. ui_print(""); , inside the " " you can add the text what you want. Remember that all the users will use this zip will be able to see what you wrote, so please be polite
For example:
ui_print("Installing the kernel");
ui_print("matt4321");
ui_print("DaRk-L0rD");
ui_print("");
package_extract_file("boot.img", "/dev/block/mmcblk0p4");
ui_print("Enjoy");
ui_print("Hit the thanks button");
Click to expand...
Click to collapse
----------------In case the kernel's format is kernel.elf, you can change the line and make it look like this: ----------------
package_extract_file("kernel.elf", "/dev/block/mmcblk0p4"); (as i said you before, the partition is my case is mmcblk0p4)
Also, make sure that you leave an empty line at the end of the commands (as you can see the line number 8 is empty).
6. Now select the META-INF folder and the boot.img or the kernel.elf file, right click on them and select Add to archive.
7. Make sure that the Archive format is ZIP and the Compression method is Store
8. Now your flashable zip is ready!
9. Enjoy
List of /mmcblkXXX
Each device has different partition for the kernel. Here is a list of those we found so far:
Xperia SP ---- /dev/block/mmcblk0p4
Xperia T---- /dev/block/mmcblk0p4
Xperia V---- /dev/block/mmcblk0p4
Xperia TX---- /dev/block/mmcblk0p4
Xperia Z1---- /dev/block/mmcblk0p14
Xperia E---- /dev/block/mmcblk0p3
Xperia Tipo---- /dev/block/mmcblk0p3
Xperia S---- /dev/block/mmcblk0p3
Xperia Ion---- /dev/block/mmcblk0p3
Since we don't know all devices' partition, you should give us a hand.
Here is what you have to do:
Procedure:
via adb shell
ls -l /dev/block/platform/
Click to expand...
Click to collapse
then pick the top one (in my case is msm_sdcc.1), so
ls -l /dev/block/platform/msm_sdcc.1/by-name
Click to expand...
Click to collapse
Then which ever says 'kernel' is the one we want.

On portal
Congrats you 2

Took much of wrong/incorrect/partial info in this thread...

DooMLoRD said:
Took much of wrong/incorrect/partial info in this thread...
Click to expand...
Click to collapse
Could you give us a hand with the right/correct/total mate?
We tested all this in different Xperia devices and never had issues and that's why we made the tutorial.

DooMLoRD said:
Took much of wrong/incorrect/partial info in this thread...
Click to expand...
Click to collapse
Reiterating what DaRk-L0rD said, what can we change/how can we make it better?
Sent from my LT30p using Tapatalk

DaRk-L0rD said:
Could you give us a hand with the right/correct/total mate?
We tested all this in different Xperia devices and never had issues and that's why we made the tutorial.
Click to expand...
Click to collapse
matt4321 said:
Reiterating what DaRk-L0rD said, what can we change/how can we make it better?
Sent from my LT30p using Tapatalk
Click to expand...
Click to collapse
btw you can still use with this script :
Code:
package_extract_file("kernel.elf", "/dev/block/platform/msm_sdcc.1/by-name/Kernel");
Code:
package_extract_file("boot.img", "/dev/block/platform/msm_sdcc.1/by-name/Kernel");
you don't need to change compressed zip to store, normal is work

For a long time since Xperia X10, I think we can't flash kernel using an update package to flash in CWM?

This guide is very simple and very interesting, especially for locked bootloader users, but with just "rename" it would not cause a very high risk? ...
sorry with my question (just want to make sure ), because I know about kernel on Xperia devices that are quite complicated (unlike the Galaxy device)
btw, thank for the very simple guide, this is very useful, especially for my rom

ibanez7 said:
This guide is very simple and very interesting, especially for locked bootloader users, but with just "rename" it would not cause a very high risk? ...
sorry with my question (just want to make sure ), because I know about kernel on Xperia devices that are quite complicated (unlike the Galaxy device)
btw, thank for the very simple guide, this is very useful, especially for my rom
Click to expand...
Click to collapse
It's the method I have used for countless firmwares on the T, have done it for the V and TX as well. renaming it isn't totally necessary afaik, people are just more comfortable with the thought of a boot.img rather than a kernel.elf

New possibilities
Will this open up the possibility of upgrading android beyond 4.1.2 on locked bootloader on Xperia S and Ion?

osamaanjum said:
Will this open up the possibility of upgrading android beyond 4.1.2 on locked bootloader on Xperia S and Ion?
Click to expand...
Click to collapse
I don't think so, as it's just a method of flashing a stock kernel via recovery instead of using Flashtool. It will not allow modified/custom kernels to run on a device with a locked bootloader.
Sent from my C6603 using Tapatalk

osamaanjum said:
Will this open up the possibility of upgrading android beyond 4.1.2 on locked bootloader on Xperia S and Ion?
Click to expand...
Click to collapse
It just allows locked bootloaders to flash a kernel via a locked bootloader recovery. It helps for people to update without the need for flashtool
Sent from my LT30p using Tapatalk

When you update kernel, I think you have to update rpm too.
rpm is proprietary firmware file to be added to the kernel.
Code:
package_extract_file("rpm.elf", "/dev/block/platform/msm_sdcc.1/by-name/rpm");

Can you tell me what is the partition layout of 2011 device such as xperia mini. /dev/block/mmcblk???

no /dev/block/platform folder (xperia z)
where gonna help a bit by finding info fo SGP321 (xperia tablet z) but as title says I could not find the listed folder
Edit:
I found it but this is what I get
[email protected]:/dev/block/platform/msm_sdcc.1 $ ls -l /dev/block/platform/msm_sdcc
.1/by-name
/platform/msm_sdcc.1/by-name <
lrwxrwxrwx root root 2014-06-08 20:48 B2B -> /dev/block/mmcblk0p26
lrwxrwxrwx root root 2014-06-08 20:48 FOTAKernel -> /dev/block/mmcblk0p23
lrwxrwxrwx root root 2014-06-08 20:48 LTALabel -> /dev/block/mmcblk0p16
lrwxrwxrwx root root 2014-06-08 20:48 TA -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 2014-06-08 20:48 aboot -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 2014-06-08 20:48 alt_aboot -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 2014-06-08 20:48 alt_rpm -> /dev/block/mmcblk0p15
lrwxrwxrwx root root 2014-06-08 20:48 alt_s1sbl2 -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 2014-06-08 20:48 alt_sbl1 -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 2014-06-08 20:48 alt_sbl2 -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 2014-06-08 20:48 alt_sbl3 -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 2014-06-08 20:48 alt_tz -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 2014-06-08 20:48 apps_log -> /dev/block/mmcblk0p22
lrwxrwxrwx root root 2014-06-08 20:48 boot -> /dev/block/mmcblk0p17
lrwxrwxrwx root root 2014-06-08 20:48 cache -> /dev/block/mmcblk0p25
lrwxrwxrwx root root 2014-06-08 20:48 m9kefs1 -> /dev/block/mmcblk0p18
lrwxrwxrwx root root 2014-06-08 20:48 m9kefs2 -> /dev/block/mmcblk0p19
lrwxrwxrwx root root 2014-06-08 20:48 m9kefs3 -> /dev/block/mmcblk0p20
lrwxrwxrwx root root 2014-06-08 20:48 ramdump -> /dev/block/mmcblk0p21
lrwxrwxrwx root root 2014-06-08 20:48 rpm -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 2014-06-08 20:48 s1sbl2 -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 2014-06-08 20:48 sbl1 -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 2014-06-08 20:48 sbl2 -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 2014-06-08 20:48 sbl3 -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 2014-06-08 20:48 system -> /dev/block/mmcblk0p24
lrwxrwxrwx root root 2014-06-08 20:48 tz -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 2014-06-08 20:48 userdata -> /dev/block/mmcblk0p27

i extracted the kernel.sin from Sony xperia z 4.4.4 ftf and using flashtool to dum data and renamed .elf to Boot.img but its only 7.86 mb ??????? while trying to cook a rom with Android kitchen , Android kitchen gives me an error that android magic header not found at start of boot.img and then a warning Android header not found in boot.img ( Unsupported format ) any idea what is going on ?
---------- Post added at 06:38 AM ---------- Previous post was at 06:04 AM ----------
Fota kernel is the kernel that you mentioned in ?? if no than i do not see any kernel listed here in adb shell.
if yes then here you can it add in the op.
Sony Xperia Z (C6603)
FOTAKernel -> /dev/block/mmcb1k0p23
ls -l /dev/block/platform/
then pick the top one (in my case is msm_sdcc.1), so
Quote:
ls -l /dev/block/platform/msm_sdcc.1/by-name
Then which ever says 'kernel' is the one we want. ???

In recent Xperia devices, kernel partition is called boot.

For android 4.4+ boot.img should b below 9 mb and its the correct one..So if u don't get a 20 mb sized boot.img means don't afraid. Just go ahead.

Epic guide man! You just saved some time for me with this guide!
That's me when I was searching for elf2img software on google and then I found your thread. xD

Moto e us lte / boot.img / mounts

Im not really a dev but i know my way around android. I figured this could help kickstart development for us. I have pulled my boot.img and attached it below.
Here are the mount points for building a rom. May differ from the different varients. My model is XT1527 US LTE.
HTML:
ls -al /dev/block/platform/soc.0/by-name
lrwxrwxrwx root root 1970-01-23 12:12 DDR -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 1970-01-23 12:12 aboot -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 1970-01-23 12:12 abootBackup -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 1970-01-23 12:12 boot -> /dev/block/mmcblk0p33
lrwxrwxrwx root root 1970-01-23 12:12 cache -> /dev/block/mmcblk0p43
lrwxrwxrwx root root 1970-01-23 12:12 carrier -> /dev/block/mmcblk0p41
lrwxrwxrwx root root 1970-01-23 12:12 cid -> /dev/block/mmcblk0p28
lrwxrwxrwx root root 1970-01-23 12:12 clogo -> /dev/block/mmcblk0p30
lrwxrwxrwx root root 1970-01-23 12:12 dhob -> /dev/block/mmcblk0p24
lrwxrwxrwx root root 1970-01-23 12:12 factorytune1 -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 1970-01-23 12:12 factorytune2 -> /dev/block/mmcblk0p35
lrwxrwxrwx root root 1970-01-23 12:12 frp -> /dev/block/mmcblk0p20
lrwxrwxrwx root root 1970-01-23 12:12 fsc -> /dev/block/mmcblk0p26
lrwxrwxrwx root root 1970-01-23 12:12 fsg -> /dev/block/mmcblk0p25
lrwxrwxrwx root root 1970-01-23 12:12 hob -> /dev/block/mmcblk0p23
lrwxrwxrwx root root 1970-01-23 12:12 hyp -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 1970-01-23 12:12 hypBackup -> /dev/block/mmcblk0p18
lrwxrwxrwx root root 1970-01-23 12:12 keystore -> /dev/block/mmcblk0p39
lrwxrwxrwx root root 1970-01-23 12:12 kpan -> /dev/block/mmcblk0p36
lrwxrwxrwx root root 1970-01-23 12:12 logo -> /dev/block/mmcblk0p29
lrwxrwxrwx root root 1970-01-23 12:12 logs -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 1970-01-23 12:12 metadata -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 1970-01-23 12:12 misc -> /dev/block/mmcblk0p32
lrwxrwxrwx root root 1970-01-23 12:12 modem -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 1970-01-23 12:12 modemst1 -> /dev/block/mmcblk0p21
lrwxrwxrwx root root 1970-01-23 12:12 modemst2 -> /dev/block/mmcblk0p22
lrwxrwxrwx root root 1970-01-23 12:12 oem -> /dev/block/mmcblk0p40
lrwxrwxrwx root root 1970-01-23 12:12 padA -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 1970-01-23 12:12 padB -> /dev/block/mmcblk0p19
lrwxrwxrwx root root 1970-01-23 12:12 padC -> /dev/block/mmcblk0p37
lrwxrwxrwx root root 1970-01-23 12:12 persist -> /dev/block/mmcblk0p31
lrwxrwxrwx root root 1970-01-23 12:12 recovery -> /dev/block/mmcblk0p34
lrwxrwxrwx root root 1970-01-23 12:12 rpm -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 1970-01-23 12:12 rpmBackup -> /dev/block/mmcblk0p15
lrwxrwxrwx root root 1970-01-23 12:12 sbl1 -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 1970-01-23 12:12 sec -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 1970-01-23 12:12 sp -> /dev/block/mmcblk0p38
lrwxrwxrwx root root 1970-01-23 12:12 ssd -> /dev/block/mmcblk0p27
lrwxrwxrwx root root 1970-01-23 12:12 system -> /dev/block/mmcblk0p42
lrwxrwxrwx root root 1970-01-23 12:12 tz -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 1970-01-23 12:12 tzBackup -> /dev/block/mmcblk0p16
lrwxrwxrwx root root 1970-01-23 12:12 userdata -> /dev/block/mmcblk0p44
lrwxrwxrwx root root 1970-01-23 12:12 utags -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 1970-01-23 12:12 utagsBackup -> /dev/block/mmcblk0p17

Excellent.... Thank u....I will try to release a ROM within a week

Shawn5162 said:
Excellent.... Thank u....I will try to release a ROM within a week
Click to expand...
Click to collapse
good news, good luck for your build

Shawn5162 said:
Excellent.... Thank u....I will try to release a ROM within a week
Click to expand...
Click to collapse
awesome, if you need a tester, please pm.

Shawn5162 said:
Excellent.... Thank u....I will try to release a ROM within a week
Click to expand...
Click to collapse
Shawn, you got a Moto E 2015? :laugh:
I find myself fortunate getting MotoG 2015 n Moto E 2015, both being worked upon by you! Thanks man!

If anybody who us good at linux knows how to add these mount points to cwm or philz touch im trying to port a build for us pm me.

WIFI tethering
I just picked this phone up today and cricket has ripped out the WIFI tethering. If anyone has a stock rooted rom please send me a link.

Mounting points are different on my cmda moto e2 will try to upload them later

bzo22 said:
Mounting points are different on my cmda moto e2 will try to upload them later
Click to expand...
Click to collapse
yup the cdma models and the 3g only models will probably have different mounts.

cmda xt1526 boostmobile surina
s -al /dev/block/platform/soc.0/by-name <
/dev/block/platform/soc.0/by-name: Permission denied
1|[email protected]_cdma:/ $ su
s -al /dev/block/platform/soc.0/by-name <
lrwxrwxrwx root root 1970-01-31 14:18 DDR -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 1970-01-31 14:18 aboot -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 1970-01-31 14:18 abootBackup -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 1970-01-31 14:18 boot -> /dev/block/mmcblk0p33
lrwxrwxrwx root root 1970-01-31 14:18 cache -> /dev/block/mmcblk0p42
lrwxrwxrwx root root 1970-01-31 14:18 carrier -> /dev/block/mmcblk0p40
lrwxrwxrwx root root 1970-01-31 14:18 cid -> /dev/block/mmcblk0p28
lrwxrwxrwx root root 1970-01-31 14:18 clogo -> /dev/block/mmcblk0p30
lrwxrwxrwx root root 1970-01-31 14:18 dhob -> /dev/block/mmcblk0p24
lrwxrwxrwx root root 1970-01-31 14:18 factorytune1 -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 1970-01-31 14:18 factorytune2 -> /dev/block/mmcblk0p35
lrwxrwxrwx root root 1970-01-31 14:18 frp -> /dev/block/mmcblk0p20
lrwxrwxrwx root root 1970-01-31 14:18 fsc -> /dev/block/mmcblk0p26
lrwxrwxrwx root root 1970-01-31 14:18 fsg -> /dev/block/mmcblk0p25
lrwxrwxrwx root root 1970-01-31 14:18 hob -> /dev/block/mmcblk0p23
lrwxrwxrwx root root 1970-01-31 14:18 hyp -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 1970-01-31 14:18 hypBackup -> /dev/block/mmcblk0p18
lrwxrwxrwx root root 1970-01-31 14:18 keystore -> /dev/block/mmcblk0p39
lrwxrwxrwx root root 1970-01-31 14:18 kpan -> /dev/block/mmcblk0p36
lrwxrwxrwx root root 1970-01-31 14:18 logo -> /dev/block/mmcblk0p29
lrwxrwxrwx root root 1970-01-31 14:18 logs -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 1970-01-31 14:18 metadata -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 1970-01-31 14:18 misc -> /dev/block/mmcblk0p32
lrwxrwxrwx root root 1970-01-31 14:18 modem -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 1970-01-31 14:18 modemst1 -> /dev/block/mmcblk0p21
lrwxrwxrwx root root 1970-01-31 14:18 modemst2 -> /dev/block/mmcblk0p22
lrwxrwxrwx root root 1970-01-31 14:18 padA -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 1970-01-31 14:18 padB -> /dev/block/mmcblk0p19
lrwxrwxrwx root root 1970-01-31 14:18 padC -> /dev/block/mmcblk0p37
lrwxrwxrwx root root 1970-01-31 14:18 persist -> /dev/block/mmcblk0p31
lrwxrwxrwx root root 1970-01-31 14:18 recovery -> /dev/block/mmcblk0p34
lrwxrwxrwx root root 1970-01-31 14:18 rpm -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 1970-01-31 14:18 rpmBackup -> /dev/block/mmcblk0p15
lrwxrwxrwx root root 1970-01-31 14:18 sbl1 -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 1970-01-31 14:18 sec -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 1970-01-31 14:18 sp -> /dev/block/mmcblk0p38
lrwxrwxrwx root root 1970-01-31 14:18 ssd -> /dev/block/mmcblk0p27
lrwxrwxrwx root root 1970-01-31 14:18 system -> /dev/block/mmcblk0p41
lrwxrwxrwx root root 1970-01-31 14:18 tz -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 1970-01-31 14:18 tzBackup -> /dev/block/mmcblk0p16
lrwxrwxrwx root root 1970-01-31 14:18 userdata -> /dev/block/mmcblk0p43
lrwxrwxrwx root root 1970-01-31 14:18 utags -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 1970-01-31 14:18 utagsBackup -> /dev/block/mmcblk0p17
[email protected]_cdma:/ #

bzo22 said:
s -al /dev/block/platform/soc.0/by-name <
<SNIP>
[email protected]_cdma:/ #
Click to expand...
Click to collapse
How did you get root on the xt1526 boost phone bzo22? Any chance you could post the stock boot loader img file or direct me to a working copy of a bootloader for it?

phliptrip said:
How did you get root on the xt1526 boost phone bzo22? Any chance you could post the stock boot loader img file or direct me to a working copy of a bootloader for it?
Click to expand...
Click to collapse
I used twrp to flash super user the recovery works for our device too...but do not flash it just boot it from fastboot. Which partition is boot loader stored . is it aboot or boot section

aboot.img
bzo22 said:
I used twrp to flash super user the recovery works for our device too...but do not flash it just boot it from fastboot. Which partition is boot loader stored . is it aboot or boot section
Click to expand...
Click to collapse
Here u go the aboot.img

Rooted this Phone
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
phliptrip said:
How did you get root on the xt1526 boost phone bzo22? Any chance you could post the stock boot loader img file or direct me to a working copy of a bootloader for it?
Click to expand...
Click to collapse
---------- Post added at 08:32 PM ---------- Previous post was at 08:29 PM ----------
i have root on this phone look and see.
http://imgur.com/tll9LYH,TeVRm5I,4dBA7v5,TdZJI1m,vJyFZEa
---------- Post added at 08:35 PM ---------- Previous post was at 08:32 PM ----------
here are some more pictures of my phone.
http://imgur.com/tll9LYH,TeVRm5I,4dBA7v5,TdZJI1m,vJyFZEa#1
http://imgur.com/tll9LYH,TeVRm5I,4dBA7v5,TdZJI1m,vJyFZEa#2
http://imgur.com/tll9LYH,TeVRm5I,4dBA7v5,TdZJI1m,vJyFZEa#3
http://imgur.com/tll9LYH,TeVRm5I,4dBA7v5,TdZJI1m,vJyFZEa#4.
there you go. im not giving you the files.because i can

fix-this! said:
Im not really a dev but i know my way around android. I figured this could help kickstart development for us. I have pulled my boot.img and attached it below.
Here are the mount points for building a rom. May differ from the different varients. My model is XT1527 US LTE.
HTML:
ls -al /dev/block/platform/soc.0/by-name
lrwxrwxrwx root root 1970-01-23 12:12 DDR -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 1970-01-23 12:12 aboot -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 1970-01-23 12:12 abootBackup -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 1970-01-23 12:12 boot -> /dev/block/mmcblk0p33
lrwxrwxrwx root root 1970-01-23 12:12 cache -> /dev/block/mmcblk0p43
lrwxrwxrwx root root 1970-01-23 12:12 carrier -> /dev/block/mmcblk0p41
lrwxrwxrwx root root 1970-01-23 12:12 cid -> /dev/block/mmcblk0p28
lrwxrwxrwx root root 1970-01-23 12:12 clogo -> /dev/block/mmcblk0p30
lrwxrwxrwx root root 1970-01-23 12:12 dhob -> /dev/block/mmcblk0p24
lrwxrwxrwx root root 1970-01-23 12:12 factorytune1 -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 1970-01-23 12:12 factorytune2 -> /dev/block/mmcblk0p35
lrwxrwxrwx root root 1970-01-23 12:12 frp -> /dev/block/mmcblk0p20
lrwxrwxrwx root root 1970-01-23 12:12 fsc -> /dev/block/mmcblk0p26
lrwxrwxrwx root root 1970-01-23 12:12 fsg -> /dev/block/mmcblk0p25
lrwxrwxrwx root root 1970-01-23 12:12 hob -> /dev/block/mmcblk0p23
lrwxrwxrwx root root 1970-01-23 12:12 hyp -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 1970-01-23 12:12 hypBackup -> /dev/block/mmcblk0p18
lrwxrwxrwx root root 1970-01-23 12:12 keystore -> /dev/block/mmcblk0p39
lrwxrwxrwx root root 1970-01-23 12:12 kpan -> /dev/block/mmcblk0p36
lrwxrwxrwx root root 1970-01-23 12:12 logo -> /dev/block/mmcblk0p29
lrwxrwxrwx root root 1970-01-23 12:12 logs -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 1970-01-23 12:12 metadata -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 1970-01-23 12:12 misc -> /dev/block/mmcblk0p32
lrwxrwxrwx root root 1970-01-23 12:12 modem -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 1970-01-23 12:12 modemst1 -> /dev/block/mmcblk0p21
lrwxrwxrwx root root 1970-01-23 12:12 modemst2 -> /dev/block/mmcblk0p22
lrwxrwxrwx root root 1970-01-23 12:12 oem -> /dev/block/mmcblk0p40
lrwxrwxrwx root root 1970-01-23 12:12 padA -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 1970-01-23 12:12 padB -> /dev/block/mmcblk0p19
lrwxrwxrwx root root 1970-01-23 12:12 padC -> /dev/block/mmcblk0p37
lrwxrwxrwx root root 1970-01-23 12:12 persist -> /dev/block/mmcblk0p31
lrwxrwxrwx root root 1970-01-23 12:12 recovery -> /dev/block/mmcblk0p34
lrwxrwxrwx root root 1970-01-23 12:12 rpm -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 1970-01-23 12:12 rpmBackup -> /dev/block/mmcblk0p15
lrwxrwxrwx root root 1970-01-23 12:12 sbl1 -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 1970-01-23 12:12 sec -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 1970-01-23 12:12 sp -> /dev/block/mmcblk0p38
lrwxrwxrwx root root 1970-01-23 12:12 ssd -> /dev/block/mmcblk0p27
lrwxrwxrwx root root 1970-01-23 12:12 system -> /dev/block/mmcblk0p42
lrwxrwxrwx root root 1970-01-23 12:12 tz -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 1970-01-23 12:12 tzBackup -> /dev/block/mmcblk0p16
lrwxrwxrwx root root 1970-01-23 12:12 userdata -> /dev/block/mmcblk0p44
lrwxrwxrwx root root 1970-01-23 12:12 utags -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 1970-01-23 12:12 utagsBackup -> /dev/block/mmcblk0p17
Click to expand...
Click to collapse
hey bro i needed some help. first can this boot image be used for 3g version.
If not then please can you tell me how to extract the boot.img of moto e 3g version

I've got the XT1527 for cricket and I'm willing to test. I'm no dev but ive been flashing roms constantly on all sorts of devices for a few years and id like to get involved and learn more if possible. This is my daily driver though so I might be a little cautious until there's a working twrp or something for the US version but this is a good phone so I'm very eager to see what ends up being made for this phone. Normally I'll look a phone up before buying it to make sure there's plenty of stuff available to keep me busy with it but when I saw this one had very little I actually got excited since Im sure this one will wind up with some good stuff and for the first time I won't be starting with a phone months after the forum died down lol

hakr4life said:
I've got the XT1527 for cricket and I'm willing to test. I'm no dev but ive been flashing roms constantly on all sorts of devices for a few years and id like to get involved and learn more if possible. This is my daily driver though so I might be a little cautious until there's a working twrp or something for the US version but this is a good phone so I'm very eager to see what ends up being made for this phone. Normally I'll look a phone up before buying it to make sure there's plenty of stuff available to keep me busy with it but when I saw this one had very little I actually got excited since Im sure this one will wind up with some good stuff and for the first time I won't be starting with a phone months after the forum died down lol
Click to expand...
Click to collapse
Same here keep me in the loop. I'm eager to brick my new phone
Sent from my MotoE2(4G-LTE) using XDA Free mobile app

+1 for at%t/aio/cricket users on the XT1527 model. there has got to be a workaround for the unlock on this. @mdewii23 @hakr4life

Can someone provide stock recovery?

I've scoured the internet over and over and come up with nothing yet
Sent from my Nexus 4 using XDA Free mobile app

Droid Turbo Think Tank.

Droid Turbo Think Tank
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
The main purpose of this thread is to discuss possible ideas for development and exploitation of the Motorola Droid Turbo. Topics can range from ideas on how to accomplish certain mods as we are trying to bake them into images to ways to flash different files to unlocking the BL. I am by no means an expert and I have some ideas I'd like to share with others on various topics. There is alot of hostility on this board, lets build some community!
__________________________________________________________________________________________________________
I do not however have total knowledge so I lack some skills to know if what I am saying is even possible. I am simply an android enthusiast, technologically inclined individual, and engineering student.
I will start us off: Since we have root permissions would it be possible to just dd a replacement recovery to the recovery partition, or even a modified bootloader. Or is that something R/W would prohibit/ not keep after a reboot? Would we be able to nandroid and restore/ install if we even could get a replacement recovery without the unlocked B/L?
Recovery Image DD:
Code:
dd if=/sdcard/recoveryfile.img of=/dev/block/mmcblk0p36
Here is a list of the partitions along with their name
Code:
[email protected]:/dev/block/platform/msm_sdcc.1 $ ls -al /dev/block/platform/msm_sdcc
.1/by-name
/platform/msm_sdcc.1/by-name <
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="Blue"]aboot[/COLOR] -> /dev/block/mmcbl
k0p6
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]abootBackup[/COLOR] -> /dev/block
/mmcblk0p13
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]boot [/COLOR]-> /dev/block/mmcblk
0p35
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]cache[/COLOR] -> /dev/block/mmcbl
k0p38
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]cid[/COLOR] -> /dev/block/mmcblk0
p25
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]clogo[/COLOR] -> /dev/block/mmcbl
k0p28
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]ddr[/COLOR] -> /dev/block/mmcblk0
p5
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]factorytune1 [/COLOR]-> /dev/bloc
k/mmcblk0p10
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]factorytune2 [/COLOR]-> /dev/bloc
k/mmcblk0p37
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]kpan [/COLOR]-> /dev/block/mmcblk
0p34
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]logo [/COLOR]-> /dev/block/mmcblk
0p27
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]logs [/COLOR]-> /dev/block/mmcblk
0p20
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]mdm1dhob [/COLOR]-> /dev/block/mm
cblk0p23
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]mdm1hob [/COLOR]-> /dev/block/mmc
blk0p22
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]mdm1m9kefs1 [/COLOR]-> /dev/block
/mmcblk0p17
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]mdm1m9kefs2 [/COLOR]-> /dev/block
/mmcblk0p18
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]mdm1m9kefs3 [/COLOR]-> /dev/block
/mmcblk0p31
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]mdm1m9kefsc [/COLOR]-> /dev/block
/mmcblk0p32
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]misc [/COLOR]-> /dev/block/mmcblk
0p29
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]modem [/COLOR]-> /dev/block/mmcbl
k0p1
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]padA [/COLOR]-> /dev/block/mmcblk
0p11
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]padB [/COLOR]-> /dev/block/mmcblk
0p19
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]padC [/COLOR]-> /dev/block/mmcblk
0p30
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]pds [/COLOR]-> /dev/block/mmcblk0
p26
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]persist [/COLOR]-> /dev/block/mmc
blk0p21
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]recovery [/COLOR]-> /dev/block/mm
cblk0p36
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]rpm [/COLOR]-> /dev/block/mmcblk0
p7
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]rpmBackup [/COLOR]-> /dev/block/m
mcblk0p14
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]sbl1 [/COLOR]-> /dev/block/mmcblk
0p2
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]sbl1bak [/COLOR]-> /dev/block/mmc
blk0p12
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]sdi [/COLOR]-> /dev/block/mmcblk0
p3
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]sec [/COLOR]-> /dev/block/mmcblk0
p4
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]sp [/COLOR]-> /dev/block/mmcblk0p
24
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]ssd [/COLOR]-> /dev/block/mmcblk0
p33
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]system [/COLOR]-> /dev/block/mmcb
lk0p39
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]tz [/COLOR]-> /dev/block/mmcblk0p
9
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]tzBackup [/COLOR]-> /dev/block/mm
cblk0p16
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]userdata [/COLOR]-> /dev/block/mm
cblk0p40
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]utags [/COLOR]-> /dev/block/mmcbl
k0p8
lrwxrwxrwx root root 1969-12-31 19:00 [COLOR="blue"]utagsBackup [/COLOR]-> /dev/block
/mmcblk0p15
[email protected]:/dev/block/platform/msm_sdcc.1 $
If a more knowledgeable user would comment on this I'd appreciate it!

Which are the imei blocks?

cascade128 said:
Which are the imei blocks?
Click to expand...
Click to collapse
The IMEI is in the utags partition.
Code:
su
dd if="/dev/block/platform/msm_sdcc.1/by-name/utags" of="/sdcard/utags.bin"
Then pull utags.bin off of the internal storage of the device and open it in a hex editor (you need root to copy it to the internal storage)

What about 2nd init? This seems to have been a good solution in the past. I believe this is how Safestrap worked. It used an exploit in a log file to launch 2nd init from the data partition. In this case the system would boot from data and we would presumably have full access. I don't know if the exploit would still work in 4.4.4. This would be the key, but the exploit could be added to a system image and flashed. Safestrap would be awesome, but even a simple 2nd init could work to start. I am just throwing this out there for discussion. This is way outside of my means, but someone else might be able to help.

Harry44 said:
Would we be able to nandroid and restore/ install if we even could get a replacement recovery without the unlocked B/L?
Click to expand...
Click to collapse
To answer your first question, no, dd'ing a new recovery in place wouldn't work. I think wp(write protect) would stop it and even if it doesn't, booting it would fail, as it verifies the signature of the partition it's booting from unless the device is unlocked or an engineering model. For your second question, yes, if you could miraculously perform the act of getting a recovery in there and it boots (emphasis on "and it boots") you *should* be able to backup/restore/install stuff.

r3pwn said:
The IMEI is in the utags partition.
Code:
su
dd if="/dev/block/platform/msm_sdcc.1/by-name/utags" of="/sdcard/utags.bin"
Then pull utags.bin off of the internal storage of the device and open it in a hex editor (you need root to copy it to the internal storage)
Click to expand...
Click to collapse
Thx.
What is utagsBackup.bin? Do i need to change it?

cascade128 said:
Thx.
What is utagsBackup.bin? Do i need to change it?
Click to expand...
Click to collapse
Not sure what your local laws are but check before modifying IMEI.

cascade128 said:
Thx.
What is utagsBackup.bin? Do i need to change it?
Click to expand...
Click to collapse
Erh, I wasn't aware that you wanted to CHANGE your IMEI. I am afraid that I am unable to assist you with that (well, I'm able, I just don't want to because it's illegal).

Harry44 said:
Not sure what your local laws are but check before modifying IMEI.
Click to expand...
Click to collapse
r3pwn said:
Erh, I wasn't aware that you wanted to CHANGE your IMEI. I am afraid that I am unable to assist you with that (well, I'm able, I just don't want to because it's illegal).
Click to expand...
Click to collapse
In our country, you have to register to use the mobile phone brought a passport outside the country due to a ridiculous law. Also you invest 50$ before the bank for this purpose.
That's not all. The passport to be registered abroad in the last 2 months need to be logged in our country. In addition, within the last 2 years it is supposed to be saved to another mobile phone passport...
This transaction is being processed on the IMEI number...
We were so old that we bring to mobile phones from abroad, used condition but in our country we are writing the IMEI number of the phone is registered. However we have to...

Any way we could boot back up an IRC for people who want to throw ideas off eachother a bit quicker, or just a general DT Discuss?

Sareniah said:
Any way we could boot back up an IRC for people who want to throw ideas off eachother a bit quicker, or just a general DT Discuss?
Click to expand...
Click to collapse
This would actually be a good idea. Anyone willing to set it up?

If someone have moto maxx and check files whats changes in unlocking bootloader and try change in droid turbo too.

I have some ideas for bootloader unlock. They're probably really stupid, but bear with me. Like OP, I'm no developer, just an Android enthusiast with basic knowledge of the inner workings.
So the Moto Maxx US (XT1250) and Droid Turbo (XT1254) are essentially the same device, right? They essentially have the same specs, same hardware, software, and they both work on CDMA carriers like Verizon. The only difference is that the Maxx's bootloader is not locked by Verizon. So here are a few ideas pertaining to that.
***NOTE: It has to be the XT1250 variant
Idea A:
1. XT1250 Maxx user uses "fastboot oem get_unlock_data" or goes through WinDroid to get the unlock key
2. Key is given to a Turbo user
3. Turbo user uses "fastboot oem unlock <maxx_key>
4. Profit
Idea B (risky):
1. Turbo user downloads XT1250 system .img
2. User flashes to Turbo using RSDlite or MOFO (not sure which would work better, if at all)
3. Use WinDroid to unlock BL, root, and install a custom recovery
4. Profit
Yes, yes, I know...they are probably bad ideas, but we must consider every possibility!

jake7405 said:
I have some ideas for bootloader unlock. They're probably really stupid, but bear with me. Like OP, I'm no developer, just an Android enthusiast with basic knowledge of the inner workings.
Click to expand...
Click to collapse
These wouldn't work. Good start on ideas, though.

Thanks!
Just a quick n00b question, why wouldnt flashing the xt1250 img work?
Sent from my XT1254

Thank you.

jake7405 said:
Thanks!
Just a quick n00b question, why wouldnt flashing the xt1250 img work?
Sent from my XT1254
Click to expand...
Click to collapse
The phone data itself (IMEI and stuff) is still the same, so the unlock data generated would still be the same, meaning Motorola would still reject it.

Was shown this as potential ways to head towards bl unlock. Leaving it here for greater minds to dissect.
http://manualwire.com/view/19580/

JakeDHS07 said:
Was shown this as potential ways to head towards bl unlock. Leaving it here for greater minds to dissect.
http://manualwire.com/view/19580/
Click to expand...
Click to collapse
Unless I'm mistaken, that would only help with a bootloader bypass. Trust me. Unlocks are better than bypasses.

r3pwn said:
The phone data itself (IMEI and stuff) is still the same, so the unlock data generated would still be the same, meaning Motorola would still reject it.
Click to expand...
Click to collapse
Any way to modify or change it? Also, would this probably end up hard bricking me if I tried?

How can I backup everything on my rooted N4? (Every single thing)

This might seem like a newbie question but this isn't the case.
I already know Titanium backup exists and I have been using it for years. However a few months back I suffered from the ''infamous brick'' seen everywhere on this thread caused by the unofficial CM13 ROM.
This brick corrupted everything on my phone (EFS Partition, etc) and the ONLY thing i could ever boot into was the recovery.
2 months and $150 later in repairs (literally everyone failed to fix it software-side) I learned my lesson
I need to back up my entire phone incase something like this happens again. What app should I use, and what should I back up?
Thanks

Do a nandroid backup from the recovery

Nortabun said:
This might seem like a newbie question but this isn't the case.
I already know Titanium backup exists and I have been using it for years. However a few months back I suffered from the ''infamous brick'' seen everywhere on this thread caused by the unofficial CM13 ROM.
This brick corrupted everything on my phone (EFS Partition, etc) and the ONLY thing i could ever boot into was the recovery.
2 months and $150 later in repairs (literally everyone failed to fix it software-side) I learned my lesson
I need to back up my entire phone incase something like this happens again. What app should I use, and what should I back up?
Thanks
Click to expand...
Click to collapse
Here is a snapshot of everything on the entire phone.
[email protected]:/dev/block/platform/15540000.dwmmc0/by-name # ls -la
ls -la
lrwxrwxrwx root root 2015-12-31 13:08 BOOT -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 2015-12-31 13:08 BOTA0 -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 2015-12-31 13:08 BOTA1 -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 2015-12-31 13:08 CACHE -> /dev/block/mmcblk0p19
lrwxrwxrwx root root 2015-12-31 13:08 CARRIER -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 2015-12-31 13:08 CDMA-RADIO -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 2015-12-31 13:08 DNT -> /dev/block/mmcblk0p15
lrwxrwxrwx root root 2015-12-31 13:08 EFS -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 2015-12-31 13:08 HIDDEN -> /dev/block/mmcblk0p20
lrwxrwxrwx root root 2015-12-31 13:08 OTA -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 2015-12-31 13:08 PARAM -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 2015-12-31 13:08 PERSDATA -> /dev/block/mmcblk0p16
lrwxrwxrwx root root 2015-12-31 13:08 RADIO -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 2015-12-31 13:08 RECOVERY -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 2015-12-31 13:08 RESERVED2 -> /dev/block/mmcblk0p17
lrwxrwxrwx root root 2015-12-31 13:08 SYSTEM -> /dev/block/mmcblk0p18
lrwxrwxrwx root root 2015-12-31 13:08 TOMBSTONES -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 2015-12-31 13:08 USERDATA -> /dev/block/mmcblk0p21
lrwxrwxrwx root root 2015-12-31 13:08 m9kefs1 -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 2015-12-31 13:08 m9kefs2 -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 2015-12-31 13:08 m9kefs3 -> /dev/block/mmcblk0p6
Option 1 Command line:
Quick and easy way to backup /system
dd if=/dev/block/mmcblk0p18 of=/sdcard/system.img bs=4096
Quick and easy way to backup the kernel
dd if=/dev/block/mmcblk0p9 of=/sdcard/boot.img bs=4096
Quick and easy way to back up EFS
dd if=/dev/block/mmcblk0p3 of=/sdcard/efs.img bs=4096
Quick and easy way to back up Radio
dd if=/dev/block/mmcblk0p13 of=/sdcard/radio.img bs=4096
Quick and easy way to back up Recovery
dd if=/dev/block/mmcblk0p10 of=/sdcard/recovery.img bs=4096
Create a directory on your machine. C:\Phonerecovery
Copy all those files from /sdcard to that directory.
With those images you can build a ODIN flash file
Using Cygwin or a Linux machine: tar -H ustar -c boot.img kernel.img recovery.img system.img > Unf*ckMyNote4.tar
Using ODIN to restore stock firmware usually will unf*ck a CM flashed phone. Keeping one handy from a provider of stock Samsung Note 4 firmware is also a good thing.
Option 2:
Custom recovery like CWM / TWRP installed on your phone
Since you were able to reboot into recovery having a TWRP backup probably would have saved you.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

Guide backup recovery stock Meizu M2 Mini

Step :
Install adb driver
Root devices
Open adb type :
adb shell
su
ls -al /dev/block/platform/mtk-msdc.0/by-name (see from update-script file stockrom)
lrwxrwxrwx root root 2015-12-14 15:21 boot -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 2015-12-14 15:21 cache -> /dev/block/mmcblk0p22
lrwxrwxrwx root root 2015-12-14 15:21 custom -> /dev/block/mmcblk0p17
lrwxrwxrwx root root 2015-12-14 15:21 expdb -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 2015-12-14 15:21 flashinfo -> /dev/block/mmcblk0p24
lrwxrwxrwx root root 2015-12-14 15:21 frp -> /dev/block/mmcblk0p18
lrwxrwxrwx root root 2015-12-14 15:21 keystore -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 2015-12-14 15:21 lk -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 2015-12-14 15:21 logo -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 2015-12-14 15:21 metadata -> /dev/block/mmcblk0p20
lrwxrwxrwx root root 2015-12-14 15:21 nvdata -> /dev/block/mmcblk0p19
lrwxrwxrwx root root 2015-12-14 15:21 nvram -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 2015-12-14 15:21 oemkeystore -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 2015-12-14 15:21 para -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 2015-12-14 15:21 proinfo -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 2015-12-14 15:21 protect1 -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 2015-12-14 15:21 protect2 -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 2015-12-14 15:21 recovery -> /dev/block/mmcblk0p8 <<=========<<<
lrwxrwxrwx root root 2015-12-14 15:21 seccfg -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 2015-12-14 15:21 secro -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 2015-12-14 15:21 system -> /dev/block/mmcblk0p21
lrwxrwxrwx root root 2015-12-14 15:21 tee1 -> /dev/block/mmcblk0p15
lrwxrwxrwx root root 2015-12-14 15:21 tee2 -> /dev/block/mmcblk0p16
lrwxrwxrwx root root 2015-12-14 15:21 userdata -> /dev/block/mmcblk0p23
dd if=/dev/block/mmcblk0p8 of=/sdcard/recovery.img
(reference of @broadways on post http://forum.xda-developers.com/showpost.php?p=64312955&postcount=125 )​
Take backup recovery.img from sdcard and save in folder ImgExtractor_32-64Bit
Open folder and click menu - Run as administrator
Select 3 - unpack process
Select 4 - repack process
Rename recovery-new.img to recovery.img
Flash recovery.img with Flashify-premium-1.8.3.apk / fastboot or etc,
Open Rebootmanager.apk - reboot to recovery
Finished
___
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
___
___
___
Files :
ImgExtractor_32-64Bit source from boycracked
Flashify-premium-1.8.3.apk
recovery-stock-M2-flyme-4.5.4iglobal
recovery-stock-M2-flyme-5.1.6.0global
recovery-stock-M2-flyme-5.1.8.0global
recovery-stock-M2-flyme-5.1.9.0global
recovery-stock-M2-flyme-5.1.10.0global
recovery-stock-M2-flyme-5.1.11.0global
recovery-stock-M2-flyme-5.1.12.0global

and the possibility of this method can be used for other android,

Great..it very useful