Related
I found a way to write arbritary data to local.prop
Right now my local.prop (after reboot) looks like this
Code:
ro.sys.atvc_allow_netmon_usb=0
ro.sys.atvc_allow_netmon_usb=0
ro.sys.atvc_allow_netmon_ih=0
ro.sys.atvc_allow_res_core=0
ro.sys.atvc_allow_res_panic=0
ro.sys.atvc_allow_all_adb=0
ro.sys.atvc_allow_all_core=0
ro.sys.atvc_allow_efem=0
ro.sys.atvc_allow_bp_log=0
ro.sys.atvc_allow_ap_mot_log=0
ro.sys.atvc_allow_gki_log=0
#: comparing /system/preinstall/md5/#.md5 and /data/preinstall_md5/#.md5
#: install skipped, file unchanged
#: comparing /system/preinstall/md5/#.md5 and /data/preinstall_md5/#.md5
#: install skipped, file unchanged
ro.sys.atvc_allow_all_adb=1#: comparing /system/preinstall/md5/ro.sys.atvc_allow_all_adb=1#.md5 and /data/preinstall_md5/ro.sys.atvc_allow_all_adb=1#.md5
ro.sys.atvc_allow_all_adb=1#: install attempt 1 of 5 failed
ro.sys.atvc_allow_all_adb=1#: install attempt 2 of 5 failed
ro.sys.atvc_allow_all_adb=1#: install attempt 3 of 5 failed
ro.sys.atvc_allow_all_adb=1#: install attempt 4 of 5 failed
ro.sys.atvc_allow_all_adb=1#: install attempt 5 of 5 failed
preinstall finished, setting preinstall.done to 1
preinstall exiting...
I've tried a few variants, but adb keeps droping its root privileges. "adb root" and "adb remount" don't work either.
I'm guessing that either the local.prop gets parsed before the script runs, or that the garbage at the end prevents it from loading.
My knowledge of android died there, so if someone has any idea what can be tried, i'll give it a go.
How did i get there (in case someone wants to do the same):
I found out that on boot a script is run by the root user (/system/bin/installpreloads.sh) that writes /data/preinstall_md5/log.txt
/data/preinstall is world-writable, so i just deleted log.txt, and replaced it with a (soft) symbolic link to /data/local.prop.
Rebooted the phone and checked local.prop, and there was the output of the script.
Now, what it was writing at that point was no good (it was checking whether adobe flash app was installed), but there was a sign of hope:
The lines started with the app name (com.adobe.flashplayer, or something like that)
I took a look at the script and it checks for the apps in /preload (which is only readable by system so no chance to change that) and writes to the log file the names of the files it finds there.
A couple of days later, i realized (toying with sbf_flash) that the preinstall partition, isn't signed.
So i can change whatever i want on it, flash it with sbf_flash, and get the data i want into local.prop.
So i downloaded the Personal GB sbf and extracted it with the motorola depacker.
Luckily the preinstall patition is ext3, so i just mounted it changed the adobe package for one called "ro.sys.atvc_allow_all_adb=1#", unmounted it, flashed it and on next boot, my local.prop looked like that.
Please, anyone?
I know most of milestones 2 around the world are running rootable ROM's, but here in Argentina and Brasil, we are stuck with an unrootable 2.3.6 ROM.
I'd just like a tip on what to try next, or at least know whether it's not posible.
I feel I'm just a tweak away of rooting this ROMs, but I don't know what to do next.
Anything, any idea is welcomed.
Please...
Try to PM the devs e.g. tezet, sfc3001, --UFO--, Endless7, r2beta0 etc. Or may be even someone from Defy Devs like Quarkx n Epsylon3
Has there been any more progress with this?
Error -bad way
ADB shell write: permission denied!!!!! = ro.sys.atvc_allow_netmon_usb=0
nicofff said:
I found a way to write arbritary data to local.prop
Right now my local.prop (after reboot) looks like this
Code:
ro.sys.atvc_allow_netmon_usb=0
ro.sys.atvc_allow_netmon_usb=0
ro.sys.atvc_allow_netmon_ih=0
ro.sys.atvc_allow_res_core=0
ro.sys.atvc_allow_res_panic=0
ro.sys.atvc_allow_all_adb=0
ro.sys.atvc_allow_all_core=0
ro.sys.atvc_allow_efem=0
ro.sys.atvc_allow_bp_log=0
ro.sys.atvc_allow_ap_mot_log=0
ro.sys.atvc_allow_gki_log=0
#: comparing /system/preinstall/md5/#.md5 and /data/preinstall_md5/#.md5
#: install skipped, file unchanged
#: comparing /system/preinstall/md5/#.md5 and /data/preinstall_md5/#.md5
#: install skipped, file unchanged
ro.sys.atvc_allow_all_adb=1#: comparing /system/preinstall/md5/ro.sys.atvc_allow_all_adb=1#.md5 and /data/preinstall_md5/ro.sys.atvc_allow_all_adb=1#.md5
ro.sys.atvc_allow_all_adb=1#: install attempt 1 of 5 failed
ro.sys.atvc_allow_all_adb=1#: install attempt 2 of 5 failed
ro.sys.atvc_allow_all_adb=1#: install attempt 3 of 5 failed
ro.sys.atvc_allow_all_adb=1#: install attempt 4 of 5 failed
ro.sys.atvc_allow_all_adb=1#: install attempt 5 of 5 failed
preinstall finished, setting preinstall.done to 1
preinstall exiting...
I've tried a few variants, but adb keeps droping its root privileges. "adb root" and "adb remount" don't work either.
I'm guessing that either the local.prop gets parsed before the script runs, or that the garbage at the end prevents it from loading.
My knowledge of android died there, so if someone has any idea what can be tried, i'll give it a go.
How did i get there (in case someone wants to do the same):
I found out that on boot a script is run by the root user (/system/bin/installpreloads.sh) that writes /data/preinstall_md5/log.txt
/data/preinstall is world-writable, so i just deleted log.txt, and replaced it with a (soft) symbolic link to /data/local.prop.
Rebooted the phone and checked local.prop, and there was the output of the script.
Now, what it was writing at that point was no good (it was checking whether adobe flash app was installed), but there was a sign of hope:
The lines started with the app name (com.adobe.flashplayer, or something like that)
I took a look at the script and it checks for the apps in /preload (which is only readable by system so no chance to change that) and writes to the log file the names of the files it finds there.
A couple of days later, i realized (toying with sbf_flash) that the preinstall partition, isn't signed.
So i can change whatever i want on it, flash it with sbf_flash, and get the data i want into local.prop.
So i downloaded the Personal GB sbf and extracted it with the motorola depacker.
Luckily the preinstall patition is ext3, so i just mounted it changed the adobe package for one called "ro.sys.atvc_allow_all_adb=1#", unmounted it, flashed it and on next boot, my local.prop looked like that.
Click to expand...
Click to collapse
I cant flash any ROM after wiped "system" I always get this error on log
Installing '/external_sd/Cyanogenmod-12.1-Zenfone-5-TWRP.zip'...
Checking for MD5 File...
Skipping MD5 check: no MD5 file found
This package is for device: a500cg,a501cg,cm_a500cg,cm_a501cg,ASUS_T00F,ASUS_T00j,a600cg,cm_a600cg,ASUS_T00G; this device is .
E : Error executing updater binary in zip '/external_sd/Cyanogenmod-12.1-Zenfone-5-TWRP.zip'
Error flashing zip '/external_sd/Cyanogenmod-12.1-Zenfone-5-TWRP.zip'
Updating partition details...
...done
what should i do now?
WInEns said:
I cant flash any ROM after wiped "system" I always get this error on log
Installing '/external_sd/Cyanogenmod-12.1-Zenfone-5-TWRP.zip'...
Checking for MD5 File...
Skipping MD5 check: no MD5 file found
This package is for device: a500cg,a501cg,cm_a500cg,cm_a501cg,ASUS_T00F,ASUS_T00j,a600cg,cm_a600cg,ASUS_T00G; this device is .
E : Error executing updater binary in zip '/external_sd/Cyanogenmod-12.1-Zenfone-5-TWRP.zip'
Error flashing zip '/external_sd/Cyanogenmod-12.1-Zenfone-5-TWRP.zip'
Updating partition details...
...done
what should i do now?
Click to expand...
Click to collapse
try this rr remix 569 http://forum.xda-developers.com/zenfone-5/development/rom-resurrection-remix-mm-5-6-7-t3357331
WInEns said:
I cant flash any ROM after wiped "system" I always get this error on log
Installing '/external_sd/Cyanogenmod-12.1-Zenfone-5-TWRP.zip'...
Checking for MD5 File...
Skipping MD5 check: no MD5 file found
This package is for device: a500cg,a501cg,cm_a500cg,cm_a501cg,ASUS_T00F,ASUS_T00j,a600cg,cm_a600cg,ASUS_T00G; this device is .
E : Error executing updater binary in zip '/external_sd/Cyanogenmod-12.1-Zenfone-5-TWRP.zip'
Error flashing zip '/external_sd/Cyanogenmod-12.1-Zenfone-5-TWRP.zip'
Updating partition details...
...done
what should i do now?
Click to expand...
Click to collapse
Go the 'Reboot' section in Recovery mode and reboot your recovery. Try flashing again after rebooting your recovery. Hope it helps!
ingeniousretard said:
Go the 'Reboot' section in Recovery mode and reboot your recovery. Try flashing again after rebooting your recovery. Hope it helps!
Click to expand...
Click to collapse
I tried this, and still no luck.
paktepu said:
try this rr remix 569 http://forum.xda-developers.com/zenfone-5/development/rom-resurrection-remix-mm-5-6-7-t3357331
Click to expand...
Click to collapse
Thanks for the suggestion. I haven't download it yet but i tried to flash resurrection remix v5.5.8 and still failed. This is the log:
E: Unknown File System: 'osip'
E: Unknown File System: 'osip'
E: Unknown File System: 'osip'
E: Unable to find partition size for '/misc'
E: Unable to find partition size for '/splashscreen'
Updating partition details...
...done
Full SElinux support is present.
E; Unable to set bootloader message
MTP Enabled
Installing '/external_sd/Resurrection-Remix-LP-v5.5.8-20151113-a500cg.zip'...
Checking for MD5 file...
Skipping MD5 check: no MD5 file found
This package is for device: a500cg, a501cg, cm_a500cg, cm_501cg, ASUS_T00F, ASUS_T00J, a600cg, cm_a600cg, ASUS_T00G; this device is .
E: Error executing updater binary in zip '/external_sd/Resurrection-Remix-LP-v5.5.8-20151113-a500cg.zip
Error flashing zip 'external_sd/Resurrection-Remix-LP-v5.5.8-20151113-a500cg.zip'
Updating partition details...
...done
WInEns said:
Thanks for the suggestion. I haven't download it yet but i tried to flash resurrection remix v5.5.8 and still failed. This is the log:
E: Unknown File System: 'osip'
E: Unknown File System: 'osip'
E: Unknown File System: 'osip'
E: Unable to find partition size for '/misc'
E: Unable to find partition size for '/splashscreen'
Updating partition details...
...done
Full SElinux support is present.
E; Unable to set bootloader message
MTP Enabled
Installing '/external_sd/Resurrection-Remix-LP-v5.5.8-20151113-a500cg.zip'...
Checking for MD5 file...
Skipping MD5 check: no MD5 file found
This package is for device: a500cg, a501cg, cm_a500cg, cm_501cg, ASUS_T00F, ASUS_T00J, a600cg, cm_a600cg, ASUS_T00G; this device is .
E: Error executing updater binary in zip '/external_sd/Resurrection-Remix-LP-v5.5.8-20151113-a500cg.zip
Error flashing zip 'external_sd/Resurrection-Remix-LP-v5.5.8-20151113-a500cg.zip'
Updating partition details...
...done
Click to expand...
Click to collapse
For that rr, use twrp 3.0
http://forum.xda-developers.com/showthread.php?t=3355749
Sent from my ASUS_T00F using XDA-Developers mobile app
WInEns said:
I cant flash any ROM after wiped "system" I always get this error on log
Installing '/external_sd/Cyanogenmod-12.1-Zenfone-5-TWRP.zip'...
Checking for MD5 File...
Skipping MD5 check: no MD5 file found
This package is for device: a500cg,a501cg,cm_a500cg,cm_a501cg,ASUS_T00F,ASUS_T00j,a600cg,cm_a600cg,ASUS_T00G; this device is .
E : Error executing updater binary in zip '/external_sd/Cyanogenmod-12.1-Zenfone-5-TWRP.zip'
Error flashing zip '/external_sd/Cyanogenmod-12.1-Zenfone-5-TWRP.zip'
Updating partition details...
...done
what should i do now?
Click to expand...
Click to collapse
Flash the latest custom recovery and give a try (3.0 by xanwar)
Boomshiva said:
Flash the latest custom recovery and give a try (3.0 by xanwar)
Click to expand...
Click to collapse
try flashing latest twrp 3.0.4, its more stable and did'nt experience random shut during rom flash..tq
azackforum said:
try flashing latest twrp 3.0.4, its more stable and did'nt experience random shut during rom flash..tq
Click to expand...
Click to collapse
Thanks bro . But I don't have any issues with recovery every great here .
WInEns said:
I cant flash any ROM after wiped "system" I always get this error on log
Installing '/external_sd/Cyanogenmod-12.1-Zenfone-5-TWRP.zip'...
Checking for MD5 File...
Skipping MD5 check: no MD5 file found
This package is for device: a500cg,a501cg,cm_a500cg,cm_a501cg,ASUS_T00F,ASUS_T00j,a600cg,cm_a600cg,ASUS_T00G; this device is .
E : Error executing updater binary in zip '/external_sd/Cyanogenmod-12.1-Zenfone-5-TWRP.zip'
Error flashing zip '/external_sd/Cyanogenmod-12.1-Zenfone-5-TWRP.zip'
Updating partition details...
...done
what should i do now?
Click to expand...
Click to collapse
Ur trouble isn't due vy any TWRP version but by yourself.
Bcuz u wiped system parttition, then certainly file build.prop's gone too. So, when TWRP want to get name of device, it can't, then it will cancel flash process. To fix, i suggest u some method:
1. Set "ro.product.device" manually
- Use terminal builtin of TWRP, type follow:
Code:
setprop ro.product.device a500cg
setprop ro.build.product a500cg
- Or, if use adb shell from ur PC:
Code:
adb shell
then type 2 lines as above
After that, choice & flash rom as normaln
2. Edit updater-script
- Open Rom zip via Winrar/7z (Windows) or file roller...(Linux)
- Goto META-INF/com/google/android, u'll see 2 files: update-binary & updater-script.
- Open file "updater-script" via any editor program u have (For Windows, use Notepad++ ONLY), find and delete any line contains "assert" word. On stock, first 10 lines, while custom rom just 1, or 2 lines, in generally.
- When done, save your file, choose "Yes" when a popup promt u want to update your zip.
- Push your new zip to device then choice it to flash
3. Find then flash any "system.img" for your device first via fastboot, then reboot to recovery, then u know what have to do, right :laugh:
4. Use Asus Flash tool & "raw" file. But this's a longest & hardest way, so avoid it anyway.
Hope can help u. Goodluck
quanganh2627 said:
Ur trouble isn't due vy any TWRP version but by yourself.
Bcuz u wiped system parttition, then certainly file build.prop's gone too. So, when TWRP want to get name of device, it can't, then it will cancel flash process. To fix, i suggest u some method:
1. Set "ro.product.device" manually
- Use terminal builtin of TWRP, type follow:
Code:
setprop ro.product.device a500cg
setprop ro.build.product a500cg
- Or, if use adb shell from ur PC:
Code:
adb shell
then type 2 lines as above
After that, choice & flash rom as normaln
2. Edit updater-script
- Open Rom zip via Winrar/7z (Windows) or file roller...(Linux)
- Goto META-INF/com/google/android, u'll see 2 files: update-binary & updater-script.
- Open file "updater-script" via any editor program u have (For Windows, use Notepad++ ONLY), find and delete any line contains "assert" word. On stock, first 10 lines, while custom rom just 1, or 2 lines, in generally.
- When done, save your file, choose "Yes" when a popup promt u want to update your zip.
- Push your new zip to device then choice it to flash
3. Find then flash any "system.img" for your device first via fastboot, then reboot to recovery, then u know what have to do, right :laugh:
4. Use Asus Flash tool & "raw" file. But this's a longest & hardest way, so avoid it anyway.
Hope can help u. Goodluck
Click to expand...
Click to collapse
After many failed attempts , I finally decided to go back to the original stock ROM . Maybe I'll try again when there was a bugless custom ROM .
Thanks anyway for all your efforts , it will definitely be useful in the future.
quanganh2627 said:
Ur trouble isn't due vy any TWRP version but by yourself.
Bcuz u wiped system parttition, then certainly file build.prop's gone too. So, when TWRP want to get name of device, it can't, then it will cancel flash process. To fix, i suggest u some method:
1. Set "ro.product.device" manually
- Use terminal builtin of TWRP, type follow:
Code:
setprop ro.product.device a500cg
setprop ro.build.product a500cg
- Or, if use adb shell from ur PC:
Code:
adb shell
then type 2 lines as above
After that, choice & flash rom as normaln
2. Edit updater-script
- Open Rom zip via Winrar/7z (Windows) or file roller...(Linux)
- Goto META-INF/com/google/android, u'll see 2 files: update-binary & updater-script.
- Open file "updater-script" via any editor program u have (For Windows, use Notepad++ ONLY), find and delete any line contains "assert" word. On stock, first 10 lines, while custom rom just 1, or 2 lines, in generally.
- When done, save your file, choose "Yes" when a popup promt u want to update your zip.
- Push your new zip to device then choice it to flash
3. Find then flash any "system.img" for your device first via fastboot, then reboot to recovery, then u know what have to do, right :laugh:
4. Use Asus Flash tool & "raw" file. But this's a longest & hardest way, so avoid it anyway.
Hope can help u. Goodluck
Click to expand...
Click to collapse
Thank you bro.... I used your first option step and flashing rom successful.:good::good:
WInEns said:
After many failed attempts , I finally decided to go back to the original stock ROM . Maybe I'll try again when there was a bugless custom ROM .
Thanks anyway for all your efforts , it will definitely be useful in the future.
Click to expand...
Click to collapse
Hello. Actually I am having the very same problem. Could you please guide me how to install the stock rom. Thank you
Thanks man ... you are a legend ...just fixed my phone i erased my os and no backup was available .. thanks a lot
Flashing system.img should help too, but you alredy fixed it.
Try to full wipe and reboot recovery mode
WInEns said:
I cant flash any ROM after wiped "system" I always get this error on log
Installing '/external_sd/Cyanogenmod-12.1-Zenfone-5-TWRP.zip'...
Checking for MD5 File...
Skipping MD5 check: no MD5 file found
This package is for device: a500cg,a501cg,cm_a500cg,cm_a501cg,ASUS_T00F,ASUS_T00j,a600cg,cm_a600cg,ASUS_T00G; this device is .
E : Error executing updater binary in zip '/external_sd/Cyanogenmod-12.1-Zenfone-5-TWRP.zip'
Error flashing zip '/external_sd/Cyanogenmod-12.1-Zenfone-5-TWRP.zip'
Updating partition details...
...done
what should i do now?
Click to expand...
Click to collapse
Try.
1. Full wipe.
2. *Important* Reboot Recovery Mode (select menu in twrp).
3. Install > ROM > Gapps > Supersu .
4. Reboot system.
it worked
ShOgYzzz said:
Try.
1. Full wipe.
2. *Important* Reboot Recovery Mode (select menu in twrp).
3. Install > ROM > Gapps > Supersu .
4. Reboot system.
Click to expand...
Click to collapse
Thanks dude you saved me
So in this guide or tutorial i'll show you how to patch boot.img so it doesn't fails to boot.
what you'll need
Python (We're using a python script to unpack/repack)
This python script https://github.com/liudongmiao/bootimg
Text editor (notepad++) for windows is a good thing
Patience
Now if you have python installed navigate to the folder where your bootimg.py & boot.img exist
now open cmd or terminal depending on what system you're using. and enter:
python bootimg.py --extract-bootimg
python bootimh.py --extract-ramdisk
Now we need to disable dm-verity and such
To disable system check change: ro,barrier=1 wait,verify > ro,barrier=1 wait
it is recommended to do this to all partitions u want to be able to modify later.
now you can also remove dm-verity executable and is not needed and it most likely will cause your boot.img to fail.
There's probably need to patch se policy file as well so you could use phh zip to do this.
And thats it. Post 2 is to add superuser access but it'll be later
How to swap from phh to chainfire supersu
Open init.environ.rc and add
export PATH /su/bin:/sbin:/vendor/bin:/system/sbin:/system/bin:/su/xbin:/system/xbin
Above bootlogo
Now download the two zips and extract su folder to root of ramdisk
And the sbin to sbin folder but don't remove any files!
Now if u have trouble with remount system as rw you need to edit the fstab and remove the verify on its partition. Now just repack ramdisk and then repack boot and you should be done
LastStandingDroid said:
So in this guide or tutorial i'll show you how to patch boot.img so it doesn't fails to boot.
what you'll need
Python (We're using a python script to unpack/repack)
This python script https://github.com/liudongmiao/bootimg
Text editor (notepad++) for windows is a good thing
Patience
Now if you have python installed navigate to the folder where your bootimg.py & boot.img exist
now open cmd or terminal depending on what system you're using. and enter:
python bootimg.py --extract-bootimg
python bootimh.py --extract-ramdisk
Now we need to disable dm-verity and such
To disable system check change: ro,barrier=1 wait,verify > ro,barrier=1 wait
it is recommended to do this to all partitions u want to be able to modify later.
now you can also remove dm-verity executable and is not needed and it most likely will cause your boot.img to fail.
There's probably need to patch se policy file as well so you could use phh zip to do this.
And thats it. Post 2 is to add superuser access but it'll be later
Click to expand...
Click to collapse
Sorry, which tool do you use in order to extract boot img from UPDATE.APP?
And after unpack and repack ramdisk and boot is it normale that the new boot.img is smaller than the "original" boot.img?
Thanks, I'm trying to patch honor 5c boot image in order to root it.
Huawei Firmware Extractor will unpack the UPDATE.APP.
LastStandingDroid said:
So in this guide or tutorial i'll show you how to patch boot.img so it doesn't fails to boot.
what you'll need
Python (We're using a python script to unpack/repack)
This python script https://github.com/liudongmiao/bootimg
Text editor (notepad++) for windows is a good thing
Patience
Now if you have python installed navigate to the folder where your bootimg.py & boot.img exist
now open cmd or terminal depending on what system you're using. and enter:
python bootimg.py --extract-bootimg
python bootimh.py --extract-ramdisk
Now we need to disable dm-verity and such
To disable system check change: ro,barrier=1 wait,verify > ro,barrier=1 wait
it is recommended to do this to all partitions u want to be able to modify later.
now you can also remove dm-verity executable and is not needed and it most likely will cause your boot.img to fail.
There's probably need to patch se policy file as well so you could use phh zip to do this.
And thats it. Post 2 is to add superuser access but it'll be later
Click to expand...
Click to collapse
In which file we have to edit this line "ro,barrier=1 wait,verify > ro,barrier=1 wait". I have infinix smart 5 x657b. I extracted the boot file and from some instructions on google, I opened fstab file. But there is nothing like that line.
hassansuriya said:
In which file we have to edit this line "ro,barrier=1 wait,verify > ro,barrier=1 wait". I have infinix smart 5 x657b. I extracted the boot file and from some instructions on google, I opened fstab file. But there is nothing like that line.
Click to expand...
Click to collapse
There is a way to remove dm-verity and forceencrypt by just flashing a file in twrp.
[Deprecated] Universal DM-Verity, ForceEncrypt, Disk Quota Disabler [11/2/2020]
Hi all! For the past couple of months, I've been looking into making a more universal solution to disable dm-verity and forceencrypt. Needing to take different zips, modify them for different devices, and then cross your fingers when you switch...
forum.xda-developers.com
CHECK_123 said:
There is a way to remove dm-verity and forceencrypt by just flashing a file in twrp.
[Deprecated] Universal DM-Verity, ForceEncrypt, Disk Quota Disabler [11/2/2020]
Hi all! For the past couple of months, I've been looking into making a more universal solution to disable dm-verity and forceencrypt. Needing to take different zips, modify them for different devices, and then cross your fingers when you switch...
forum.xda-developers.com
Click to expand...
Click to collapse
but there is not any version of twrp recovery for my device. From where should I download it?
hassansuriya said:
but there is not any version of twrp recovery for my device. From where should I download it?
Click to expand...
Click to collapse
I found this "auto twrp recovery porter"
Mediatek (MTK) Auto TWRP recovery porter by Team Hovatek
If you wish to root your Mediatek Android phone, we'd dropped a guide on rooting using Magisk and stock boot.img at https://www.hovatek.com/forum/thread-21427.html , no custom recovery is required. Se
forum.hovatek.com
I dont know if it would work, you should try
You may have to sign up to get the andorid 9 and 10 version of the tool
Hello,
Please and thanks in advance for any assistance!
I've successfully rooted my HD8 7th gen fire tablet, thanks to the many helpful posts here. However during some of my failed attempts while using Magisk, TWRP App, etc, I've somehow managed to wipe out my stock Recovery partition/files. I can do normal booting fine and I'm sure that I have root, as confirmed by the # at ADB shell and the Root Checker apps available.
I've tried the following:
-Entered Fastboot mode and tried several commands there: always resulting in a 'the command you input is restricted on locked hw' (So, obviously, my bootloader is locked (but I've overwritten it somehow, so it makes me think that at some point I was able to unlock it and overwrite it?)
-Flashfire, TWRP, Magisk and Flashify apps - successful messages every time I try, but no joy when trying to enter recovery mode (it's possible I'm trying to flash the wrong recovery.img file? - does anyone have it and what is it's size? i searched my tablet for the file and found two: one 17mb and the other 8mb - both "flashed" successfully, but no joy when trying to boot into them)
-adb su commands
-Giving up and doing a full Factory Restore via the GUI - it just tries to reboot to the recovery mode, which doesn't exist, so i can't do anything.
-Giving up and doing a full Factory Restore via Fastboot mode - 'the command you input is restricted on locked hw'
I was so happy I was able to obtain root, but if something gets wonky or I decide to try the much raved about resurrection image, i need to have the recovery boot available if/when everything goes wrong.
Please and thanks again for any advice.
Daveychan said:
Please and thanks again for any advice.
Click to expand...
Click to collapse
It's fairly simple but cumbersome to recreate recovery with root. You need to locate the original install-recovery script for your Rom. You may search in /etc or /system/etc . Most likely though your SuperSu deleted it.
So you download your particular Rom version from amazon, unpack it into a system image via mtk-extractor, mount that system image, and find the files.
You can mount this extracted system.bin either on Linux, or directly on your tablet. Just push it to /sdcard, and do this: https://stackoverflow.com/questions/36448234/how-to-mount-a-loop-device-in-android
Then you run the full install-recovery script which will patch your boot.img into recovery partition.
Alternatively, you can beg someone here to dump their HD8 2017 recovery, and upload the image here. So you can dd it in using root into the appropriate partition.
See, I told you - it's all very simple !
Edit: @dondraper23 - can you help a fellow XDA-er? Just dd your HD8 2017 recovery, and post it here.
Code:
dd if=/dev/block/platform/soc/by-name/recovery of=/sdcard/recovery.img
Then zip it, and post it here.
Thank you very much for the fast reply. Much appreciated!
I’ll give this a try ASAP and post back.
If anyone has the recovery.img for the HD8 Gen7, please do post it.
Thank you again!
Okay, i've spent several hours on this and I need to ask for more help.
I managed to get the system.img file from the Amazon .bin as you described. (I used the MTK Extractor for that. It's 1.57 GB by the way.) Next, I moved the system.img file to my Fire's SD card, then I connected the Fire to my Linux, and mounted the system.img file in Linux so I can see the file directory.
I can now see the install-recovery.sh file, located in the /bin folder of the mounted image, but it's read-only. Even by opening to that path via terminal with SU and trying to chmod 777 the file, it's still locked as read-only.
So, I don't know what to do next. I can't copy the file, and I don't see how to run the file via Fire anyway. (Was I supposed to somehow mount the system.img file via ADB commands and then run it that way? If so, I don't know how to do that.)
Sorry if I've asked something obvious or silly. As before, I appreciate the assistance!
Please and Thanks!
Daveychan said:
Okay, i've spent several hours on this and I need to ask for more help.
I managed to get the system.img file from the Amazon .bin as you described. (I used the MTK Extractor for that. It's 1.57 GB by the way.) Next, I moved the system.img file to my Fire's SD card, then I connected the Fire to my Linux, and mounted the system.img file in Linux so I can see the file directory.
I can now see the install-recovery.sh file, located in the /bin folder of the mounted image, but it's read-only. Even by opening to that path via terminal with SU and trying to chmod 777 the file, it's still locked as read-only.
So, I don't know what to do next. I can't copy the file, and I don't see how to run the file via Fire anyway. (Was I supposed to somehow mount the system.img file via ADB commands and then run it that way? If so, I don't know how to do that.)
Sorry if I've asked something obvious or silly. As before, I appreciate the assistance!
Please and Thanks!
Click to expand...
Click to collapse
Sure, just copy that install-recovery.sh file to your tablet, into /data/local/tmp. There is also another file you will need, it's /system/recovery-from-boot.p . Copy this one to /data/local/tmp as well. Then edit your install recovery script, to point to this /data/local/tmp/recovery-from-boot.p . Then just su, chmod 777 your install recovery script, and run it. It should take your boot, and patch it into recovery using recovery-from-boot.p patch file.
Thank you for the fast reply. But because that sh file its read-only, I can't open it or copy it.
Error when running the script
Hello again,
I managed to get around the read-only problem (opening everything as Superuser in Linux was the trick to making that work, for other noobs who may be following along with my pain here.)
I grabbed those two files as you indicated and followed the instructions. Unfortunately I was met with a ton of error messages. Here they are:
=====================
[email protected]:/data/local/tmp # /data/local/tmp/install-recovery.sh
contents of partition "/dev/block/platform/mtk-msdc.0/by-name/recovery" didn't match EMMC:/dev/block/platform/mtk-msdc.0/by-name/recovery:7022592:38eeb844c578f6bbfb6edf8ddf7ba1112200a25c
file "EMMC:/dev/block/platform/mtk-msdc.0/by-name/recovery:7022592:38eeb844c578f6bbfb6edf8ddf7ba1112200a25c" doesn't have any of expected sha1 sums; checking cache
failed to stat "/cache/saved.file": No such file or directory
failed to load cache file
patch EMMC:/dev/block/platform/mtk-msdc.0/by-name/boot:4720640:9dc6d0ebab0b237a7b2f31ae0fabe026da83cda5: LoadPartitionContents called with bad filename (EMMC:/dev/block/platform/mtk-msdc.0/by-name/recovery)
contents of partition "/dev/block/platform/mtk-msdc.0/by-name/recovery" didn't match EMMC:/dev/block/platform/mtk-msdc.0/by-name/recovery
contents of partition "/dev/block/platform/mtk-msdc.0/by-name/boot" didn't match EMMC:/dev/block/platform/mtk-msdc.0/by-name/boot:4720640:9dc6d0ebab0b237a7b2f31ae0fabe026da83cda5
source file is bad; trying copy
failed to stat "/cache/saved.file": No such file or directory
failed to read copy file
=====================
I'm attaching the two files i pulled from the system.img file - as converted from the .bin file downloaded from Amazon (as above), in case you are still willing to help out and can take a look. (I edited the install-recovery.sh file to the correct path already, so it's not the original anymore.)
MUCH APPRECIATED!
Thank you!
Daveychan said:
Hello,
Please and thanks in advance for any assistance!
I've successfully rooted my HD8 7th gen fire tablet, thanks to the many helpful posts here. However during some of my failed attempts while using Magisk, TWRP App, etc, I've somehow managed to wipe out my stock Recovery partition/files. I can do normal booting fine and I'm sure that I have root, as confirmed by the # at ADB shell and the Root Checker apps available.
I've tried the following:
-Entered Fastboot mode and tried several commands there: always resulting in a 'the command you input is restricted on locked hw' (So, obviously, my bootloader is locked (but I've overwritten it somehow, so it makes me think that at some point I was able to unlock it and overwrite it?)
-Flashfire, TWRP, Magisk and Flashify apps - successful messages every time I try, but no joy when trying to enter recovery mode (it's possible I'm trying to flash the wrong recovery.img file? - does anyone have it and what is it's size? i searched my tablet for the file and found two: one 17mb and the other 8mb - both "flashed" successfully, but no joy when trying to boot into them)
-adb su commands
-Giving up and doing a full Factory Restore via the GUI - it just tries to reboot to the recovery mode, which doesn't exist, so i can't do anything.
-Giving up and doing a full Factory Restore via Fastboot mode - 'the command you input is restricted on locked hw'
I was so happy I was able to obtain root, but if something gets wonky or I decide to try the much raved about resurrection image, i need to have the recovery boot available if/when everything goes wrong.
Please and thanks again for any advice.
Click to expand...
Click to collapse
You shuld try:
-Extract an ota update in a folder
-Run from the folder with the extracted files
Code:
fastboot flash boot boot.img
the recovery is in boot.img, doing this helped me on a similar situation
Thanks to @bibikalka for pointing me to this thread
On the 7th gen fire hd8 TWRP doesn't work yet
t0x1cSH said:
You shuld try:
-Extract an ota update in a folder
-Run from the folder with the extracted files
Code:
fastboot flash boot boot.img
the recovery is in boot.img, doing this helped me on a similar situation
Thanks to @bibikalka for pointing me to this thread
On the 7th gen fire hd8 TWRP doesn't work yet
Click to expand...
Click to collapse
It's not enough to reflash boot.img ! Recovery is created on boot by patching boot.img, but the OP's fire has messed up recovery creation scripts due to SuperSu. So he needs to either re-run the recovery creation script manually - which seems to produce errors, or simply flash a full recovery image - hence my request to extract it from a fire with working recovery.
Hey, I'll pull the recovery off mine tomorrow
NFSP G35 said:
Hey, I'll pull the recovery off mine tomorrow
Click to expand...
Click to collapse
That would be fantastic! Thank you much!
Here you go
Daveychan said:
That would be fantastic! Thank you much!
Click to expand...
Click to collapse
Just FYI, to flash this image file into recovery (assuming you have the recovery image sitting in /sdcard/recovery.img):
Code:
dd if=/sdcard/recovery.img of=/dev/block/platform/mtk-msdc.0/by-name/recovery
bibikalka said:
It's not enough to reflash boot.img ! Recovery is created on boot by patching boot.img, but the OP's fire has messed up recovery creation scripts due to SuperSu. So he needs to either re-run the recovery creation script manually - which seems to produce errors, or simply flash a full recovery image - hence my request to extract it from a fire with working recovery.
Click to expand...
Click to collapse
this is the recovery partition straight from my hd8 2017
but i am very curious about a thing, if you look at booth the boot.img and the recovery partition they contains exactly the same data, in the same structure so why cant he simply flash boot.img?
t0x1cSH said:
this is the recovery partition straight from my hd8 2017
but i am very curious about a thing, if you look at booth the boot.img and the recovery partition they contains exactly the same data, in the same structure so why cant he simply flash boot.img?
Click to expand...
Click to collapse
They do have a lot of similarities, that's why recovery is created by patching boot via a relatively small patch file. But, they are still different! That recovery menu is contained entirely within the recovery image, while the boot image does not do that.
Just to add to this, you don't need to flash the boot.img to use install-recovery.sh.
You can also modify the script to read boot from an img file.
k4y0z said:
Just to add to this, you don't need to flash the boot.img to use install-recovery.sh.
You can also modify the script to read boot from an img file.
Click to expand...
Click to collapse
Do you care to post a script that does that, and writes into a recovery image file? The syntax of that patch command is a bit messy, so I would not mind having a debugged working script
Hello again,
My apologies for the delay, work was busy this week, and I couldn't find the time to check the solution until now.
I'm so VERY HAPPY to report that all worked well, and the recovery.img and the command line you provided worked perfectly. (WOW! Thank you!)
For those who want the details, the message after the command in the terminal was:
==
#dd if=/sdcard/recovery.img of=/dev/block/platform/mtk-msdc.0/by-name/recovery
----
34816+0 records in
34816+0 records out
17825792 bytes transferred in 1.159 secs (15380320 bytes/sec)
==
I then did a full power down, and then a started it up again while holding the top-left Volume key and the Power key, and look at that! I'm sitting at the Amazon system recovery screen again! <insert YAY! here>
I'm not sure if it matters, but I thought I'd mention it. At the bottom of the screen in orange letters, it says:
===
E:Error in /cache/recovery/last_kmsg
(No space left on device)
===
So, after a little bit of searching, I selected "wipe cache partition", rebooted again into recovery, and the error is gone now.
Another normal reboot started the "Optimizing apps..." thingy, but it finished quickly and I can confirm that all my stuff is still there. Just to be sure, I did another reboot to recovery, no error messages this time, and then another regular reboot, with no optimizing.
It appears that everything in my world is good again!
My sincerest gratitude and appreciation to all who helped contribute and support this solution.
THANK YOU VERY MUCH!
Daveychan said:
the much raved about resurrection image .
Click to expand...
Click to collapse
Out of curiosity, what is this? There is an image, other than stock, for the 7th Gen HD8?
Resurrection-remix
xnatex21 said:
Out of curiosity, what is this? There is an image, other than stock, for the 7th Gen HD8?
Click to expand...
Click to collapse
It's a WIP for the HD8 I've read. My friend has this on his HD7 and swears it's twice as fast as the regular.
Here's some info:
https://forum.xda-developers.com/kindle-fire-hd/7-development/rom-resurrection-remix-5-1-x-t3234535
and here:
https://forum.xda-developers.com/le-pro3/development/9-0-resurrection-remix-v7-0-t3894663
Hi,
I am trying to install the latest Lineage version on my Samsung Nexus 10 via twrp, but so far it always immediately fails with
Error E1001: Failed to update system image.
Updater process ended with ERROR: 7
Error installing zip file '/sdcard/lineage-17.1-20220318-UNOFFICIAL-manta.zip'
I tried wiping the entire system, cache and all and I tried both the adb push method and sideloading adb and they all produce the exact same error.
This is my first time doing this type of thing, so any help would be greatly appreciated.
P.S. I am currently running Windows 10, but could boot into a Linux Live Medium if that would be useful.
Edit: I was following this tutorial for the setup.
I'm facing exactly the same issue here with the installation of `lineage-17.1-20220919-UNOFFICIAL-manta.zip` file.
I'm currently on the latest original Google Android ROM flashed with `image-mantaray-lmy49j.zip` and want to update the system to the lineage OS as above.
I'm using TWRP v3.6.2_9.
What I did:
- uploaded `lineage-17.1-20220919-UNOFFICIAL-manta.zip` to `/sdcard` location;
- wiped out `dalvik-cache` and `cache` partitions;
- tried to install `lineage-17.1-20220919-UNOFFICIAL-manta.zip` as a single installation file;
Got this error. Here is an output from recovery.log:
Code:
Installing zip file '/sdcard/lineage-17.1-20220919-UNOFFICIAL-manta.zip'
Unmounting System...
I:Update binary zip
I:Extracting updater binary 'META-INF/com/google/android/update-binary'
I:Zip does not contain SELinux file_contexts file in its root.
I:Legacy property environment not used in updater.
No path given to file labeling backend
selinux_android_file_context: Error getting file context handle (No such file or directory)
Warning: No file_contextsTarget: google/mantaray/manta:5.1.1/LMY49J/2640980:user/release-keysTarget: google/mantaray/manta:5.1.1/LMY49J/2640980:user/release-keys
Extracted file "/tmp/install/bin/backuptool.functions"
Extracted file "/tmp/install/bin/backuptool.sh"
Extracted 2 file(s)
about to run program [/tmp/install/bin/backuptool.sh] with 4 args
Backup/restore is not possible. Partition is probably empty
Patching system image unconditionally...
performing update
blockimg version is 4
maximum stash entries 0
creating stash /cache/recovery/4dd6bf24fbba9cc76c352f5c4cfaed0074be0244
535756800 bytes free on /cache (0 needed)
/cache/recovery/last_command doesn't exist.
erasing 3367 blocks
BLKDISCARD ioctl failed: Invalid argument
failed to execute command [erase 4,225950,228864,229947,230400]
new data receiver is still available after executing all commands.
Patching system image unconditionally...script aborted: E1001: Failed to update system image.
E1001: Failed to update system image.error: 1001
Updater process ended with ERROR: 7
I:Install took 0 second(s).
Error installing zip file '/sdcard/lineage-17.1-20220919-UNOFFICIAL-manta.zip'
Does anyone have any clue on what could be wrong here and why it fails?
unpack zip remove lines, then pack zip and try again. voilla
or utube eroor 7
I'd the same problem with twrp but does did successfully for version 16 installation. I tried the above listed way but failed again. Same thing happened even I unchecked the system in twrp before flashing again. Need expert to help fix the issue. Appreciate in advanced!
Cpluo said:
I'd the same problem with twrp but does did successfully for version 16 installation. I tried the above listed way but failed again. Same thing happened even I unchecked the system in twrp before flashing again. Need expert to help fix the issue. Appreciate in advanced!
Click to expand...
Click to collapse
Not enough space on /system. Resize the partition. After 17.1 is running for me. https://www.hovatek.com/forum/thread-32750.html
Thanks a lot Daniel! I will try your way.