Database Users

Possible malicious program?

I just got a text message from T-mobile: "Free T-Mobile Msg: Your data usage in this billing cycle has exceeded 10 GB;Data throughput for the remainder of the cycle may be reduced to 50 kbps or less"
I heavily use the internet capabilities on this phone, but I've never exceeded 1.5 GB in the months were I've looked at my usage, so I guessed that something was going on that I didn't know about.
The first thing I did was check data usage on T-Mobile's website. Stretching as far back as the usage history goes (7/28), I'm seeing fairly large chunks of data usage, even in the middle of the night when I'm certainly not using the phone. ex:
07/28/09 05:21 AM 8.6367
07/28/09 05:16 AM 29.3007
07/28/09 05:12 AM 9.7666
07/28/09 03:12 AM 8.6728
07/28/09 03:01 AM 39.0654
07/28/09 01:01 AM 8.6533
07/28/09 12:53 AM 39.0654
Something is either malicious or has a serious bug.
I'm not quite sure how to debug this. I've switched it over to my wifi network. I think I can install tcpdump on my router and at least see what the phone is sending and where.
Has anyone had a similar problem? Check your data usage on T-mobile's website. I don't know how long this has been going on before it managed to trip their 10 GB threshold.
Here is a list of the installed programs on my system. If anyone can check their usage and tell me that they have x program and definitely aren't having any problems, that would be helpful.
JF ADP 1.5 ROM as the base
/data/app:
android.game.doom.apk
com.akproduction.notepad.apk
com.alex.PodcastManager.apk
com.alfray.bearing.apk
com.amazon.mp3.apk
com.android.BetterBookmarks.apk
com.android.wallpapersetandsave.apk
com.androidemu.snes.apk
com.ap.DroidFtp.apk
com.app.webcamwidgetca.apk
com.appdroid.anycut.apk
com.appdroid.videoplayer.apk
com.aws.android.apk
com.bg.smsbk.apk
com.bigtincan.android.adfree.apk
com.billnapier.android.livebookmarks.apk
com.compareeverywhere.apk
com.cooolmagic.android.toggle5.apk
com.deafcode.android.Cinema.apk
com.deafcode.android.Orienteer.apk
com.eclipsim.gpsstatus2.apk
com.eri.widget.binaryclock.apk
com.estrongs.android.pop.apk
com.farproc.wifi.analyzer.apk
com.flashcup.apk
com.g3.android.widgets.sdcardm.apk
com.google.android.apps.maps.apk
com.google.android.maps.mytracks.apk
com.htc.pdfreader.apk
com.isaacwaller.youtubedownloader.apk
com.lindaandny.lindamanager.apk
com.mibollma.wakemeR1.apk
com.nextmobileweb.quickpedia.apk
com.paxmodept.palringo.android.main.apk
com.roundedlabs.widgets.Brightness.apk
com.roundedlabs.widgets.Ringer.apk
com.roundedlabs.widgets.Wifi.apk
com.roundedlabs.widgets.bluetooth.apk
com.schwimmer.android.mmsextract.apk
com.schwimmer.android.togglebluetooth.apk
com.schwimmer.android.togglebright.apk
com.schwimmer.android.togglegps.apk
com.schwimmer.android.togglewifi.apk
com.shazam.android.apk
com.streamfurious.android.free.apk
com.taskManager.rootTaskManager.apk
com.tmobile.selfhelp.apk
com.tni.TasKiller.apk
de.android_telefonie.appmanager.apk
droidsans.android.DroidSansTweakToolsLite.apk
fm.last.android.apk
info.marcelp.android.locmark.apk
jp.co.taosoftware.android.widget.calendar.apk
jp.co.webimpact.ty.darairc.apk
lysesoft.andexplorer.apk
net.androidcomics.acv.apk
net.ser1.timetracker.apk
nl.jsource.retroclock.android.apk
nl.rogro.GScript.apk
nl.rogro.GScriptLite.apk
org.connectbot.apk
org.microemu.android.Browser.apk
org.rabold.android.wifibuddy.apk
rip.android.GlImageView.apk
tw.mawa.jasoncheng.aNetShare.apk
/data/app-private:
com.agilesoftresource.apk
com.ap.SnapPhoto_Pro.apk
I would also guess that with this being the first month to trip 10 GB that it is something that got installed last month (and possibly updated at some point), so I'm a little more suspicious of those. Here are the programs with modify dates from July and August:
Jul 28 23:39 com.akproduction.notepad.apk
Jul 26 13:47 com.alfray.bearing.apk
Jul 22 20:48 com.app.webcamwidgetca.apk
Jul 15 00:03 com.billnapier.android.livebookmarks.apk
Jul 22 20:44 com.google.android.apps.maps.apk
Jul 18 15:12 com.google.android.maps.mytracks.apk
Jul 3 13:05 com.shazam.android.apk
Jul 10 19:26 jp.co.taosoftware.android.widget.calendar.apk
Jul 17 00:12 net.androidcomics.acv.apk
Jul 1 00:00 org.connectbot.apk
Aug 1 16:56 com.androidemu.snes.apk
Aug 14 01:21 com.ap.SnapPhoto_Pro.zip
Aug 5 17:50 com.bg.smsbk.apk
Aug 14 11:58 com.bigtincan.android.adfree.apk
Aug 14 11:58 com.estrongs.android.pop.apk
Aug 14 01:20 com.farproc.wifi.analyzer.apk
Aug 5 04:00 com.streamfurious.android.free.apk
Aug 14 01:23 com.tmobile.selfhelp.apk
Aug 5 17:49 com.tni.TasKiller.apk
Aug 12 01:15 de.android_telefonie.appmanager.apk
Aug 5 13:44 fm.last.android.apk
Aug 5 22:23 jp.co.webimpact.ty.darairc.apk
Aug 6 03:41 lysesoft.andexplorer.apk
Aug 9 20:03 org.rabold.android.wifibuddy.apk

Why dont you try using the spare parts app and seeing what in network is using up the most battery? that could probably tell you whats using the most data. Also try installing droid wall and setting it to use only apps that you want to access data

Ahh, I hadn't really looked at spare parts beyond turning on the maps compass.
Battery History / Network usage shows Media as a major hog with 1,451,82,439 bytes received since last boot. Last boot time was mid-day last Friday.
"Packages sharing this UID:
Camera
DRM Protected Content Storage
Download Manager
Media Storage"
Hmm, all of those sound like Google packages. Not sure what to think here.

Download manager is probably the one.
Are you sure you are using JFADP1.5 and not JFtmobile1.5? The latter will continuously try to download OTA updates and repeatedly fail, which would account for the data usage.
tiberiumx said:
Ahh, I hadn't really looked at spare parts beyond turning on the maps compass.
Battery History / Network usage shows Media as a major hog with 1,451,82,439 bytes received since last boot. Last boot time was mid-day last Friday.
"Packages sharing this UID:
Camera
DRM Protected Content Storage
Download Manager
Media Storage"
Hmm, all of those sound like Google packages. Not sure what to think here.
Click to expand...
Click to collapse

Settings->About Phone shows Model number as "Android Dev Phone 1", and I install JF1.5 as soon as it was available (I think the t-mobile one came later).
How does the JF rom avoid downloading the updates?
I have the adblock program, which modifies /etc/hosts. Maybe JF was intended to block this function via the hosts file but that got overwritten?
Did T-Mobile release an update last month?

Okay, so I found a tcpdump binary for Android and ran it on my phone last night.
Looks like all of the traffic is due to the downloading of an update.
I see several HTTP GETs to android.clients.google.com:
"GET /updates/signed-kila-ota-150275.53dde318.zip HTTP/1.1\r\n
Host: android.clients.google.com\r\n
User-Agent: AndroidDownloadManager\r\n"
I checked out the JF1.5 update.zip and saw an empty hosts file, so this isn't how it avoids updating. This also wouldn't be a good idea -- and cannot be the solution to my problem -- because it also appears to sync email/etc from this server (I see fairly frequent SSL connections opened to this host).
How would it normally refrain from downloading the update with JF1.5?
Any ideas on how to fix this?
The update downloads to /cache/update.zip, correct? Perhaps I could just create a root-owned read-only update.zip in /cache and it would fail with a "cannot open file" error when it tried to write.

There is a trick to this...
not finding it right now but I know there's something fairly easy you can do to keep this issue from occurring. I'll dig deeper.

tiberiumx said:
Settings->About Phone shows Model number as "Android Dev Phone 1", and I install JF1.5 as soon as it was available (I think the t-mobile one came later).
Click to expand...
Click to collapse
That doesn't mean anything.

tiberiumx said:
Okay, so I found a tcpdump binary for Android and ran it on my phone last night.
Looks like all of the traffic is due to the downloading of an update.
I see several HTTP GETs to android.clients.google.com:
"GET /updates/signed-kila-ota-150275.53dde318.zip HTTP/1.1\r\n
Host: android.clients.google.com\r\n
User-Agent: AndroidDownloadManager\r\n"
I checked out the JF1.5 update.zip and saw an empty hosts file, so this isn't how it avoids updating. This also wouldn't be a good idea -- and cannot be the solution to my problem -- because it also appears to sync email/etc from this server (I see fairly frequent SSL connections opened to this host).
How would it normally refrain from downloading the update with JF1.5?
Any ideas on how to fix this?
The update downloads to /cache/update.zip, correct? Perhaps I could just create a root-owned read-only update.zip in /cache and it would fail with a "cannot open file" error when it tried to write.
Click to expand...
Click to collapse
As I said before, you have tmobile software installed and it is continually downloading updates.

tiberiumx,
This is a known issue with some JF 1.5 ROMs. Here are some fixes from JF's android blog at http://jf.andblogs.net/:
1. delete the otacerts.zip file manually. The file is at /system/etc/security/otacerts.zip But keep in mind if you use this method your phone will continuously re-down the OTA and try to verify it, which is bad on your bandwidth usage and your battery life
2. Replace /system/build.prop on your phone with the one from the ADP1 version of JFv1.51
3. chmod 000 the OTA file in /cache (unconfirmed solution, but is likely to work)

tiberiumx said:
Okay, so I found a tcpdump binary for Android and ran it on my phone last night.
Click to expand...
Click to collapse
Hi,
I'm looking for a tcpdump for android: can you tell me where you have found it?
Thanks
Louis

[GUIDE] My Bell Canada flashing/rooting procedure

Update: I upgraded my phone with XXKI3 2.3.5 firmware, from XXKH3.
The lag is gone, definitely a big improvement compared to XXKH3 version. The phone is very responsive and fast. Quadrant shows 4200+, pretty impressive:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
The bootloader was updated, you cannot reset anymore your phone with a download jig. However, Intratech uploaded the old bootloader:
Intratech said:
If you've already flashed a full package from elsewhere and cannot reset your binary counter using the Jig just flash this package in the PDA or Bootloader (Yes both will work) section of Odin to replace the bootloaders and then you can reset the counter: http://www.multiupload.com/LQQBRQVJUD
Click to expand...
Click to collapse
Personally, I flashed the file with Odin (PDA).
The phone ring is set to silent, instead of default "Over the horizon" ringtone. Make sure you change it, your phone is not broken. See the complete list of changes, related to previous ROM.
Guide
I'm posting this procedure in a separate thread, as is easier to be linked into different forum posts. My Bell Canada phone came originally with the UGKG2 firmware, so everything listed below is based on my own experience with this version, I do not know or confirm it will work with other firmware. I currently run the official (?) XXKI3 Gingerbread 2.3.5 firmware, downloaded from samfirmware.com site (see details below). This is a wipe device release.
Personally, I read that other people flashed their phones with a different firmware... but I did not wanted to do it on my phone. I sticked with the same family XXKGx, just to be safe. Please read Electroz's explanation below.
There are 3 types of release builds: leaked, Frankenstein (compiled and tested by devs, based on demand) and official (Kies updates).
The procedure is simple (I presume you are familiar with Odin, Download Mode &Co.):
1) Get yourself the stock firmware and kernel (thank you Intratech)
2) Setup your drivers properly, avoid the Kies insanity (see below)
3) Flash the new firmware (my flash procedure, you can/should skip Re-Partition/PIT as Intratech explained)
4) Flash phone with CF-Root (I used the CF-Root-SGS2_XX_OXA_KI3-v4.1-CWM4.zip file)
5) Wipe (cache + factory reset)
6) Uninstall all Samsung crap and install additional system apps (i.e. Car Home)
7) Flash back the stock KI3 kernel (thank you Intratech, password: [email protected])
8) Wipe (cache + factory reset)
9) Connect your device to a download jig, to reset the flash counter (old bootloader needed)
Phone & Modem Drivers Setup
Note: This procedure was tested with Windows 7 Ultimate 64bits. If you already installed Kies, uninstall all related software/drivers and clean your registry. Or do a clean Windows install just to be safe.
1) With your anti-virus off, put your phone in Download mode and connect the USB cable. Windows Update will start to download right away the modem and USB drivers. Make sure you select the Windows Update option, when asked into driver install window.
2) Once the modem drivers installed, disconnect the cable, reboot the phone in normal mode and reconnect the cable again. A new set of drivers will be installed for the rest of USB interface.
Important: You need do it in the SPECIFIC order mentioned above, or else the modem drivers will not be installed and you will not be able to use properly Odin. I know this because I tried the other way around.
Initial Phone Setup
Once the phone rebooted, you will be welcomed to the Android Setup.
1) First, set the language from English UK to whatever you like.
A Network warning related to Date and Time will pop, tap on Cancel.
2) Tap the Android robot and setup your phone.
There is NO need to change any other settings, the phone will automatically detect the Bell network.
If for some reason it does not, once you completed your basic setup go to:
Settings > Wireless and Network > Mobile networks > Network operators
It will start the scanning and pop 3 Bell networks, pick the first one. Again, this is in case your phone does not work with calls, voicemail or SMS.
Notes
You should uninstall the CWM app once you flashed back the stock kernel, is half useless. I tested the new Superuser app from Android Market, it will properly upgrade to latest version and also upgrade the su binary on XXKI3 firmware. If you plan to poke around your phone with the Terminal, you will lose all the fancy Linux commands. (grep etc.)
Personally, I purchased ChainsDD's Superuser Elite key. It will allow you to pin protect your rooted device, among other useful things that are planned to be added (built-in terminal). I upgraded Superuser to version 3 and everything works properly.
Battery Power Savings
I always leave my phone with all default options, including screen auto-adjust. The only options I turn off are:
Settings > About phone > Software update > Auto update Disabled
Settings > Applications > Samsung Apps > Off
Personally, I have no idea who started the battery calibration myth in S2. It is useless to "overcharge" the battery, as the software has a check to stop automatically the charge once the battery is 100% while the battery itself has a build-in controller that can't be wiped.
Example of battery stats with the phone in idle mode for approx. 18hrs (86%) and 109hrs (2%):
Running Services
I use Wifi N with a Cisco E4200 DD-WRT (phone at 20"), these are my running services:
Code:
PID USER VSZ STAT COMMAND
1 root 508 S /init
2 root 0 SW [kthreadd]
3 root 0 SW [ksoftirqd/0]
4 root 0 SW [migration/0]
5 root 0 SW [watchdog/0]
9 root 0 SW [events/0]
11 root 0 SW [khelper]
15 root 0 SW [async/mgr]
16 root 0 SW [pm]
19 root 0 SW [suspend]
20 root 0 SW [sync_system_wor]
151 root 0 SW [s5p-tmu]
337 root 0 SW [sync_supers]
339 root 0 SW [bdi-default]
341 root 0 SW [kblockd/0]
356 root 0 SW [khubd]
359 root 0 SW [kseriod]
394 root 0 SW [irq/331-max8997]
434 root 0 SW [kmmcd]
527 root 0 SW [kondemand/0]
540 root 0 SW [pet_watchdog/0]
549 root 0 SW [khungtaskd]
550 root 0 SW [kswapd0]
599 root 0 SW [aio/0]
612 root 0 SW [crypto/0]
1237 root 0 SW [sec_jack_wq]
1240 root 0 SW [irq/350-sec_hea]
1245 root 0 SW [spi_gpio.3]
1262 root 0 SW [svnet_txq]
1274 root 0 SW [file-storage]
1300 root 0 SW [irq/328-mxt224_]
1306 root 0 SW [irq/325-k3g]
1312 root 0 SW [irq/326-proximi]
1315 root 0 SW [cm3663_light_wq]
1316 root 0 SW [cm3663_prox_wq]
1366 root 0 SW [mali_dvfs]
1369 root 0 SW [mali-pmm-wq]
1378 root 0 SW [sii9234_wq]
1379 root 0 SW [irq/481-mhl_int]
1380 root 0 SW [irq/496-mhl_wak]
1383 root 0 SW [irq/343-max1704]
1394 root 0 SW [kstriped]
1396 root 0 SW [kmpathd/0]
1398 root 0 SW [kmpath_handlerd]
1399 root 0 SW [ksnapd]
1400 root 0 SW [kconservative/0]
1414 root 0 SW [ktflash_requlat]
1429 root 0 SW [usbhid_resumer]
1432 root 0 SW [binder]
1441 root 0 SW [irq/333-IPC_HOS]
1452 root 0 SW [mmcqd]
1481 root 0 SW [l2cap]
1482 root 0 SW< [krfcommd]
1488 root 0 SW [dynamic hotplug]
1501 root 0 SW [melfas_touchkey]
1506 root 0 SW [fimc0_iqr_wq_na]
1509 root 0 SW [fimc1_iqr_wq_na]
1512 root 0 SW [fimc2_iqr_wq_na]
1515 root 0 SW [fimc3_iqr_wq_na]
1518 root 0 SW [hdcp work]
1529 root 0 SW [tvout resume wo]
1535 root 0 SW [sec-battery]
1538 root 384 S /sbin/ueventd
1761 root 0 SW [Si4709_wq]
1782 root 0 SW [jbd2/mmcblk0p9-]
1784 root 0 SW [ext4-dio-unwrit]
2563 root 0 SW [jbd2/mmcblk0p7-]
2564 root 0 SW [ext4-dio-unwrit]
2566 root 0 SW [jbd2/mmcblk0p1-]
2567 root 0 SW [ext4-dio-unwrit]
2570 root 0 SW [jbd2/mmcblk0p10]
2571 root 0 SW [ext4-dio-unwrit]
2579 system 868 S /system/bin/servicemanager
2580 root 6616 S /system/bin/vold
2581 system 1972 S /system/bin/notified_event
2583 root 732 S /system/bin/debuggerd
2584 radio 9512 S /system/bin/rild
2585 system 4624 S /system/bin/npsmobex
2586 system 8476 S /system/bin/drexe
2590 bluetoot 1372 S /system/bin/dbus-daemon --system --nofork
2591 root 932 S /system/bin/installd
2592 keystore 1804 S /system/bin/keystore /data/misc/keystore
2594 system 14192 S /system/bin/tvoutserver
2595 shell 800 S /system/bin/sh /system/bin/rtc_log.sh
2612 shell 780 S /system/bin/immvibed
2907 wifi 2644 S /system/bin/wpa_supplicant -Dwext -ieth0 -c/data/wifi/bcm_su
3374 media 56536 S < /system/bin/mediaserver
3375 root 15472 S /system/bin/netd
3376 root 126m S zygote /bin/app_process -Xzygote /system/bin --zygote --star
3391 system 276m S system_server
3496 root 0 SW [iscan_sysioc]
3497 root 0 SW [dhd_watchdog]
3498 root 0 SW [dhd_dpc]
3499 root 0 SW [dhd_sysioc]
3502 system 152m S com.android.systemui
3511 app_99 168m S com.sec.android.inputmethod.axt9
3521 radio 155m S com.android.phone
3522 app_66 148m S android.process.media
3528 app_53 134m S com.sec.pcw.device
3532 system 134m S com.samsung.bt.avrcp
3536 bluetoot 134m S com.broadcom.bt.app.system
3544 app_12 176m S com.sec.android.app.twlauncher
3604 app_54 173m S com.google.process.gapps
3631 app_12 148m S android.process.acore
3688 app_84 135m S com.sec.android.app.FileTransferManager
3777 app_36 137m S com.sec.android.widgetapp.weatherclock
3927 app_38 136m S com.sec.android.widgetapp.apnews
4193 app_91 137m S com.sec.android.app.clockpackage
4220 app_16 137m S com.android.providers.calendar
4234 app_100 134m S com.sec.android.daemonapp.accuweather
4255 app_78 159m S com.google.android.gm
4333 app_81 174m S com.cooliris.media
4366 app_119 144m S com.google.android.apps.reader
4376 app_103 170m S com.levelup.beautifulwidgets
4435 app_37 138m S com.sec.android.widgetapp.stockclock
4453 app_16 138m S com.android.calendar
4476 system 156m S com.android.settings
4486 app_112 177m S com.google.android.music
4633 app_82 137m S com.sec.android.app.fm
4752 app_40 135m S com.sec.android.app.samsungapps.una
6623 app_68 185m S < com.google.android.apps.maps
9014 dhcp 916 S /system/bin/dhcpcd -ABK eth0
10732 graphics 139m S com.sec.android.app.screencapture
11958 system 138m S com.wssyncmldm
11989 system 135m S com.sec.android.providers.drm
11997 app_1 139m S com.smlds
12037 app_102 139m S com.skype.raider
13094 app_5 141m S jackpal.androidterm
13136 app_115 135m S com.noshufou.android.su
13170 app_68 149m S com.google.android.apps.maps:NetworkLocationService
13180 app_68 144m S com.google.android.apps.maps:FriendService
13503 app_83 141m S com.sec.android.app.FileTransferServer
13579 root 0 SW [flush-179:0]
13646 shell 1684 S /sbin/ext/busybox sh /sbin/sleep 3600
13651 shell 1676 S /sbin/ext/busybox /sbin/sleep 3600
13707 app_68 154m S com.google.android.apps.maps:HotpotService
13788 system 135m S com.android.MtpApplication
13825 app_5 796 S /system/bin/sh -
13858 root 796 S sh -
13966 root 1684 S /sbin/ext/busybox sh /sbin/ps
13971 root 1716 R /sbin/ext/busybox /sbin/ps
CSC (Cell Site Controller)
The default CSC setting in XXKI3 is KOR. You can check it with: *#272*{IMEI}#
where the {IMEI} value represents the 15 digits of your IMEI (International Mobile Equipment Identity).
I personally used the default option (KOR) and the phone works perfect, with great reception:
There are some people who wonder if they should change the CSC. I will quote Intratech on this matter as he answered perfectly to my question:
Intratech said:
Some people do and some just use the CSC packaged with whichever firmware they flash. As long as your APN and SMS/MMS settings are ok there is no need to flash another CSC package.
Click to expand...
Click to collapse
Fast Dormancy
Some people noticed that their network idle on 3G, instead of HSPA+. That is absolutely normal, because of the "fast dormancy" feature. If enabled, HSPA+ will rapidly disconnect from the network once the information is sent or received. That will penalize the actual network you are on, unless the carrier network and your phone talk to each other in a way that takes battery life as well as network congestion into consideration. For this to work, both networks and smartphones have to implement a standardized version of the fast dormancy feature. Bell Canada supports this feature and by default Fast Dormancy is enabled into XXKI3 firmware.
You can check it with: *#9900#
You should call your carrier to see if they have it implemented. Probably your tech support will look like you are speaking Chinese and escalate it to a more knowledgeable guy. This is the average download speed I get on XXKI3 (network is switching automatically on HSPA+):
There are some reports where people confirmed that the UGKG2 build allowed you to reach faster download speeds (up to 9MB). Personally I think 6MB over a cell network is already more than perfect for tethering, not to mention that there are many factors to be taken into consideration when you deal with a wireless transmission. (location, tower antenna, weather, etc.)
Random Restart
The screen needs minimum 500Mhz to get out of Sleep Mode. Some custom ROM's use a low voltage or "underclock" feature that reduces the power consumption but also the number of CPU steps. That is what makes your phone crash and reboot randomly. If you use an external sdcard, do a sd wipe just to be safe. It should take several hours, so do it over the night. Personally, I did not experienced any random reboots using neither the XXKH3 or XXKI3 firmware.
Some people might have bad battery contacts on their S2. Basically, the phone shuts down while in your pocket. Clean the battery terminals with some audio head tape cleaner and cotton swabs, than make sure the contacts are proper.
You could also have a RAM (hardware) issue. Bad memory degrades fast so you will see your random reboots pop at a faster frequency. If you did all the above and still experience random reboots, run adb logcat to see what is going on at that specific moment. If you get error codes like:
Code:
code 1 (SEGV_MAPERR), fault addr 00000000
you are dealing with bad memory unfortunately and need to service your phone.
Manage system apps with Terminal
Personally, I decided to stick with a terminal for now, I feel more comfortable to see what is going on with my own eyes in my phone. A good alternative to Terminal would be the SystemApp Remover, is faster and more robust compared to Titanium Backup as it does only one task (backup/remove system apps).
I did an output list of all the packages:
Code:
$ pm list packages -f >> /sdcard/packages 2>&1
so I know now where each package is located and what is the associated name.
All I have to do is run:
Code:
$ su
# rm -f /system/app/package.{apk,odex}
# pm clear PACKAGE
# pm uninstall PACKAGE
Running "mount | grep system" tells me right away where and how /system is mounted:
Code:
/dev/block/mmcblk0p9 on /system type ext4 (ro,relatime,barrier=1,data=ordered)
so all I have to do is change the mount perms to write, instead of read:
Code:
# mount -o remount,rw /dev/block/mmcblk0p9 /system
Package Manager commands:
Code:
# pm
usage: pm [list|path|install|uninstall]
pm list packages [-f] [-d] [-e] [-u] [FILTER]
pm list permission-groups
pm list permissions [-g] [-f] [-d] [-u] [GROUP]
pm list instrumentation [-f] [TARGET-PACKAGE]
pm list features
pm list libraries
pm path PACKAGE
pm install [-l] [-r] [-t] [-i INSTALLER_PACKAGE_NAME] [-s] [-f] PATH
pm uninstall [-k] PACKAGE
pm clear PACKAGE
pm enable PACKAGE_OR_COMPONENT
pm disable PACKAGE_OR_COMPONENT
pm setInstallLocation [0/auto] [1/internal] [2/external]
The list packages command prints all packages, optionally only
those whose package name contains the text in FILTER. Options:
-f: see their associated file.
-d: filter to include disbled packages.
-e: filter to include enabled packages.
-u: also include uninstalled packages.
The list permission-groups command prints all known
permission groups.
The list permissions command prints all known
permissions, optionally only those in GROUP. Options:
-g: organize by group.
-f: print all information.
-s: short summary.
-d: only list dangerous permissions.
-u: list only the permissions users will see.
The list instrumentation command prints all instrumentations,
or only those that target a specified package. Options:
-f: see their associated file.
The list features command prints all features of the system.
The path command prints the path to the .apk of a package.
The install command installs a package to the system. Options:
-l: install the package with FORWARD_LOCK.
-r: reinstall an exisiting app, keeping its data.
-t: allow test .apks to be installed.
-i: specify the installer package name.
-s: install package on sdcard.
-f: install package on internal flash.
The uninstall command removes a package from the system. Options:
-k: keep the data and cache directories around.
after the package removal.
The clear command deletes all data associated with a package.
The enable and disable commands change the enabled state of
a given package or component (written as "package/class").
The getInstallLocation command gets the current install location
0 [auto]: Let system decide the best location
1 [internal]: Install on internal device storage
2 [external]: Install on external media
The setInstallLocation command changes the default install location
0 [auto]: Let system decide the best location
1 [internal]: Install on internal device storage
2 [external]: Install on external media
Removed System Apps
This is the list of /system apps I removed from XXKI3 firmware:
BuddiesNow.apk
Days.apk
DigitalClock.apk (I use Beautiful Widgets instead)
Email.apk (I use Gmail only)
EmailWidget.apk
GameHub.apk
GenieWidget.apk
install_flash_player.apk
Kies.apk
KiesAir.apk
kieswifi.apk
Kobo.apk
MiniDiary.apk
MusicHub_U1.apk
MusicPlayer.apk (I use Google Music instead)
PolarisOffice.apk
PressReader.apk
ReadersHub.apk
SamsungApps.apk
SamsungAppsUNA3.apk
SamsungIM.apk
SecretWallpaper1.apk
SecretWallpaper2.apk
SevenEngine.apk
ShareApp.apk
SnsAccountFb.apk
SnsAccountLi.apk
SnsAccountMy.apk
SnsAccountTw.apk
SnsDisclaimer.apk
SnsImageCache.apk
SnsProvider.apk
SocialHub.apk
VoiceToGo.apk (I use Car Home instead)
Zinio.apk
Apps ported to Galaxy S2
Some of my favorite apps, not available into Market and ported to Galaxy S2:
Google Car Home
Market Access
Google+ 2.0 (works with a Google Apps account)
Terms
ROM - software stored into read-only memory. ROM retains its contents even when the phone is turned off. ROM is referred to as being nonvolatile, whereas RAM is volatile.
Kernel - portion of the OS that handles drivers, hardware control and access for the rest of the OS.
Modem - handles the communication with your carrier.
Root - superuser privileges in any Linux OS.

yqed said:
I'm posting this procedure in a separate thread, as is easier to be linked into different forum posts. My Bell Canada phone came originally with the UGKG2 firmware, so everything listed below is based on my own experience with this version, I do not know or confirm it will work with other firmware. I currently run the official (?) XXKG3 Gingerbread 2.3.4 firmware, downloaded from samfirmware.com site (see details below).
Personally, I read that other people flashed their phones with a different firmware... but I did not wanted to do it on my phone. I sticked with the same family XXKGx, just to be safe.
Click to expand...
Click to collapse
This is wrong. I'm not sure where you got that XXKG3 is remotely the same as UGKG2, but here's an explanation of the firmware version numbers:
This is standard across most Samsung Phones.
I9000 = Model #
UG = Carrier/Area code. For example, XX = Europe, UG = Bell Mobility Canada.
K = Year = 2011
G = Month = July (H = August, I = September)
2 = Revisions that month for the specific region (aka. UG, XX, XW).
A lot of people on here think the last 3 digits are important and that if you have 2 KG3 firmware that they are the same. However, this is not the case.
You need to go by all 5 letters due to the fact that each firmware is customized by different groups at Samsung. And to prove this, just look at KG2. There are 2.3.3 KG2's and there are 2.3.4 KG2's.
It's actually possible that one area's KG2 could have been newer than another area's KG4. The best way to check, is to look at the build date in the Build.prop for each firmware.
But your assuming that KGx means they're the same is wrong. All that those numbers mean is what month/revision the firmware is. Samsung has several different teams producing firmware independently of each other for different regions. The only letters that mean the firmwares are similar are the country/carrier code (ie. UG, XX, XW).
Also, your idea of what Official firmware is, is flawed. Just because it's on samfirmware, DOES NOT make it official. Most of their firmwares are leaked test builds. If it's not released on Kies, it's not official.

Thanks for the great explanation, much appreciated. It should help many people understand better how the versioning works. About the "official" part, that's the reason why I mark it with a (?). As you said very well, it is official once is released by Samsung through updates.
The thread is related to my own experiences with the Europe MULTI firmware, based on the fact that a Bell phone specs are identical to the Europe model.
Edit: I upgraded to XXKH3 firmware successfully just now, everything works great.

I currently have a Bell branded SGSII with baseband version UGKG2.
I originally flashed it with CF-Root-SGS2_ZS_OZS_KG2-v4.1-CWM4.zip and then I re-flashed it with the original UGKG2 Stock Kernel from Bell.
Now my phone is rooted and stock.
Any positive/negative feedback from users running XXKH3 firmware (2.3.4) would be very much appreciated.

thvpham said:
I currently have a Bell branded SGSII with baseband version UGKG2.
I originally flashed it with CF-Root-SGS2_ZS_OZS_KG2-v4.1-CWM4.zip and then I re-flashed it with the original UGKG2 Stock Kernel from Bell.
Now my phone is rooted and stock.
Any positive/negative feedback from users running XXKH3 firmware (2.3.4) would be very much appreciated.
Click to expand...
Click to collapse
I ran the KH3 firmware briefly with no issues. The only annoying this was when using the program monitor widget I would experience some lag or choppiness when switching homescreens(same on KG6/KH4). On the positive side the gps accuracy and lock time was greatly improved.

Aha, I had no idea as I don't use that widget... thanks for the tip.
I usually hold the Home button until the Task Manager pops, to see the running apps. But I got used already to press the Back key every time I deal with an app... that automatically closes it.
About the GPS, the accuracy is greatly improved indeed. It takes me 1-3secs max to get a lock (with wireless networks disabled) and the accuracy is always 5meters.
Edit: There is a new Digital Clock service running now... I have no idea what makes it start, please let me know. I use Beautiful Widgets on my home screen.

The digital clock service should be part of the digital clock widget. You can try to end the process under running services and see if it stops it.

I downloaded the XXKH3 firmware but I'm not sure which files I should be using with Odin (Bootloader, PDA, Phone & CSC).

KayvinM said:
The digital clock service should be part of the digital clock widget. You can try to end the process under running services and see if it stops it.
Click to expand...
Click to collapse
I use Beautiful Widgets, so DigitalClock.apk should not be starting... Weird.
I just uninstalled the system app, no more running services. It was wasting my battery for nothing.
thvpham said:
I downloaded the XXKH3 firmware but I'm not sure which files I should be using with Odin (Bootloader, PDA, Phone & CSC).
Click to expand...
Click to collapse
See step 3 and skip the PIT file (re-partition unchecked). Also see the Update note into OP.

thvpham said:
I downloaded the XXKH3 firmware but I'm not sure which files I should be using with Odin (Bootloader, PDA, Phone & CSC).
Click to expand...
Click to collapse
I ended up re-downloading the XXKH3 from Intratech's thread and it was much easier flashing the one PDA file.
Now do I need to flash the XXKH3 stock kernel or my default stock Bell kernel?

You need the XXKH3 stock kernel, Intratech has it linked below the actual firmware link.

does it matter if CSC changes?
right now, (before root + update firmware), I still have BMC....
but once it's changed, would that create problems? If yes, what kind of problems. If no, then why do we care about CSC?

Personally, I used the samfirmware files and the phone works great. The pda.bell.ca info is present into ASN also.

Thanks for the responses everyone.
I ended flashing the stock XXKH3 kernel with the firmware. So far the upgrade has been good to me, I noticed improved battery life for the first 18 hours of usage. I will continue to use this build until I find something that is more stable and efficient then this.

A BIG THANK YOU!!!! I finally rooted and unlocked.
Originally: UGKF6
Now: XXKG5
Thanks for the guide!!!
Just 1 question though, do I HAVE TO do a factory after root? Any problem if I don't?

One thing is sure, the battery life degraded compared to XXKG3 firmware.
XXKG3 | XXKH3 (about 4hrs lost)
When I took the screenshot on KG3, I was using the phone for about 2 hours to read a book (notice the sudden drops because of the white screen), while the KH3 was always in sleep mode. So ya, there is a significant change in battery life with a tradeoff for the GPS gains.
I updated the OP.
clb09 said:
A BIG THANK YOU!!!! I finally rooted and unlocked.
Originally: UGKF6
Now: XXKG5
Thanks for the guide!!!
Just 1 question though, do I HAVE TO do a factory after root? Any problem if I don't?
Click to expand...
Click to collapse
Just curious, why you did not used the KH3 to take advantage of amazing GPS? The battery life should be a bit better also, compared to KG5. What do you mean by "do a factory"? You will lose root only if you flash back the firmware, flashing the kernel will not delete the su binary. You want to keep your phone rooted.
I strongly recommend you to spend $1 and get ChainsDD's Superuser Elite key, it will allow you to pin protect your rooted device. I upgraded to 3.0 Beta4 and everything works properly. Worth the dollar in so many ways, not just for securing the su access.

What you use to remove system app.
Thanks

Fizwiz said:
What you use to remove system app.
Thanks
Click to expand...
Click to collapse
I use Titanium Backup PRO. It allows me to backup, freeze and uninstall the unwanted apps.

One thing i have see with the XXKH3. With the KG2 im stable on H+, now im switching between 3G and H+.
Anyone else?

See Fast Dormancy info in OP. Is normal and the intended way to save you battery and bandwidth congestion.

Root+Xposed+Busybox for Bootloader Locked Moto X ATT/VZW

Only fresh flashed bootloader locked XT1058 AT&T - ROM LPAS23.12-21.7-1, and XT1060 VZW - ROM LPAS23.12-39.7-1 are supported!
See archive content for instructions. Time to install ~20 min. If you experience problems after Android boot, like not working buttons or quick settings, wipe cache + data partitions. Don't update SuperSU (disable auto updates), it won't work. Later I'll post complete debloated ROMs with fresh SuperSU version, and simplify instructions. Be informed also, that this method doesn't give you read-write rights like unlocked bootloader. You may read and write having root-rights, but only till a restart or shutdown occurs, and every change will be undo by the Qualcomm protection (like HTC' s=on).
At the moment patch includes:
SuperSU 2.65 Free
Xposed Framework v86 (installer, modules)
Busybox 1.25.0.YDS, path /system/xbin/busybox
Download
P.S. Install only on indicated above ROM versions, and it's obvious that you must have enough theory knowledge and practical experience to make use of 9008 patch, so I'm not responsible for any consequences, etc. Greets go to: CrashXXL (method inventor), Sabissimo (our former OP), and serg_gangubas (ROM guru).
==============================================================================================
31.07.2017 - Full ROM Patch for Bootloader Locked Moto X ATT/VZW/etc
Based on the same principle, and not depend on system partition content, so it suits any bootloader locked Moto X Gen1 ATT/VZW (possibly any model, besides 1049 RepW / 1055 US Cell), but takes about 4 hours to be done - prepare for that, 100% battery level only!
This full ROM patch includes:
SuperSU 2.82 Free
Xposed Framework v87 (installer, modules)
Busybox 1.26.2, path /system/xbin/busybox
ViperFX 2.5.0.5 - sorry needs polishing, removed now (
Gallery and Camera not depend on Moto services
Gboard instead AOSP Keyboard. If it eats too much RAM, see Simple Keyboard
GAPPSes updated. Use command like adb shell pm uninstall --user 0 com.blahblah.blah to block any unwanted app or service
ES File Explorer Free Edition (a clone, you can disable and install yours )
"Jedy" gesture
AdBlock support (effect lasts till the 1st reboot yet, I'll think about make it constant). Please, choose /data/hosts instead of /system/etc/hosts
ROM debloated, but not deodexed.
Download
Instruction
Be careful, phone will be WIPED then flashed in 9008 "brick" mode (CrashXXL idea). Before you start install Moto drivers, latest RSD Lite, and fully charge the battery.
1) Download and unpack zip on С: (or any), open Python27, launch RUN_path.bat (needs to be launched only single time), install driver QHSUSB_driver.exe, and launch file _Moto.X.BootLocked.*.exe (where * - is desired ROM).
2) Go into fastboot mode, execute RUN_blbroke.bat. Screen gets black, Device Manager in Windows finds "QHSUSB_DLOAD", and installs it as "Qualcomm HS-USB QDLoader 9008 (COM*)". If it doesn't install, google for Windows driver digital signature disable.
3) Now launch RUN_root.bat, and see that patching process took start.
4) A small patch *SPEAKERS.BOOST.exe (if exists) boosts both speakers' volume.
P.S. Please, don't flash anything extra into the phone. In case of trouble, all you need is inside this folder. Just make it work.
To make "Battery OK" in fastboot use fastboot_cyclecharge.bat
Completely drained out battery causing "USB input device" needs disassembly of the phone to charge externally.
In case Titanium Backup shows error "Batch backup interrupted: insufficient free storage space", delete default backup folder, and make a new:
Titanium Backup > Menu > Preferences > Backup folder location > Storage Provider > DocumentProvider storage > Show Internal Storage > Internal Storage > Select Internal Storage > Create the folder > Use the current folder. Done!
Notes for myself: Viper, force wipe, readme.txt, volume patch, Adblock, advanced debloat

Debloated, rooted, lightweight ROM - soon! )
PUBLISHED. Sorry, took long time.

As soon as I can actually get 5.1 flashed I'll try this.
Though I'm afraid I'll have to try to go to stock and use sunshine first, still have a locked BL.
But this is great, I didn't expect root so soon.

DownTheCross said:
As soon as I can actually get 5.1 flashed I'll try this.
Though I'm afraid I'll have to try to go to stock and use sunshine first, still have a locked BL.
But this is great, I didn't expect root so soon.
Click to expand...
Click to collapse
This method is working on locked BL.

DownTheCross said:
As soon as I can actually get 5.1 flashed I'll try this.
Though I'm afraid I'll have to try to go to stock and use sunshine first, still have a locked BL.
But this is great, I didn't expect root so soon.
Click to expand...
Click to collapse
Wait wait... If you can have now possibility to unlock bootloader - go for it immediately! You will have normal FULL root-rights (SuperSU 2.49). Don't install 5.1, if you plan to unlock, because Sunshine app (25$) works only on 4.4.2 Android.
This topic is to help those AT&T users that are boot locked forever (who missed out possibility to unlock on 4.4.2 by proceed to 5.1) to give them READ-ONLY root. Yes, it's limited, but anything at least.

s5610 said:
If you can have now possibility to unlock bootloader...
Click to expand...
Click to collapse
I guess anyone on 4.4.4 today. There is no possibility to use Sunshine anymore.
Anyway spasibo za method

Ahh, if I don't have to be BL unlocked that's great lol.
I haven't read too much into the 5.1 updates or sunshine for that matter.
I've been on krypton 1.4.1 since it was released, and I haven't been able to successfully upgrade to any 5.1 roms yet.

Works great!
Works great for me on Windows 10 RTM 64-bit! Thanks a ton, I was waiting for a post like this.
I only had 3 minor hiccups:
1. RSD Lite gave me an error about "getvar", so I had to go into flashfile.xml in the ROM zip and remove the line that said getvar
2. I had to reboot to disable driver signature enforcement twice for some reason because Windows Update
3. The run-root.bat got stuck on "Executing..." because I installed the wrong driver (the correct file is qcusb.inf when installed from device manager -> browse my computer for driver software -> let me pick from a list -> all devices -> have disk)
Otherwise, everything runs just as well as KitKat, including Xposed.

Hehe got to love step 9

System Write
How can we help in getting the system write to zero using the same method,because I have xt1058 model bootloader unlocked and I provide any file needed to disable the pesky system write...

How can we help in getting the system write to zero using the same method,because I have xt1058 model bootloader unlocked and I provide any file needed to disable the pesky system write...
Click to expand...
Click to collapse
First, never quote op. It takes way to much space and is redundant.
Second, to get write off we would need to some how either start a custom kernel some magical way or disable it via a kernel mod like htc guys did. Another way, which was done before was to burn the efuse but kernel has been patched since then.

Need some help, I did all steps until step 9. I installed the QHSUSB_DLOAD driver manually, and I can see 'Qualcomm HS-USB QDLoader 9008 (COM4)' showed in my Device Manager, but when I run 'RUN_Root.bat', I got this
c:\Python27>python qdloadRoot.py MPRG8960.bin -ptf root/partitions.txt
QDLoad utility version 1.2 (c) VBlack 2014
Found TTY port: com4
Sending MAGIC ...
QCOM fast download protocol targ:
Version: 7
Compatible version 2
Maximum block size 1024 (0x00000400)
Base address of Flash 0x00000000
Flash: eMMC
Window size: 30
Number of sectors: 128
First sector size: 2097152 (0x00200000)
Feature bits: 09
Sending SBL Reset...
Done
c:\Python27>pause
Press any key to continue . . .
Then I tried to run 'RUN_Root.bat' again, then I got
c:\Python27>python qdloadRoot.py MPRG8960.bin -ptf root/partitions.txt
QDLoad utility version 1.2 (c) VBlack 2014
Found TTY port: com4
Requesting Params...
Params:
Version: 8
Min version: 1
Max write size: 1536 (0x00000600)
Model: 144
Device size: Invalid or unrecognized Flash device, or Flash device progr
amming not supported by this implementation
Device type: Intel 28F400BX-TL or Intel 28F400BV-TL
Requesting SoftwareVersion...
Version: PBL_DloadVER2.0
Requesting SerialNumber...
Serial number: 00,00,48,03
Requesting HW Id...
HW Id: 00,00,48,03,e1,10,7e,00
Requesting PublicKey...
PublicKey: 39,c4,ee,3e,b5,be,eb,87,8e,2f,e3,b8,53,4d,14,6f,91,ca,fd,bb,94,2a,0d
,aa,d0,1e,b0,87,62,d4,b9,b8
Uploading file 'MPRG8960.bin' to addr 0x2a000000...
Executing...
Could not find Qualcomm device in Emergency download mode
Done, with errors!!!
c:\Python27>pause
Press any key to continue . . .
any suggestions? Thanks

jahrule said:
First, never quote op. It takes way to much space and is redundant.
Second, to get write off we would need to some how either start a custom kernel some magical way or disable it via a kernel mod like htc guys did. Another way, which was done before was to burn the efuse but kernel has been patched since then.
Click to expand...
Click to collapse
Ill put the files here

Fantastic!!! I was looking this. All the last week I was sleeping about 3 hours per day trying to root my phone.
----
I scream "Victory" before the process finish.
Damn! My phone reboot and stay in the android doll fallen screen.

DejanPet said:
Ill put the files here
Click to expand...
Click to collapse
What to do with these files?

Those files are needed by Jahrule

Sabissimo
Hello.
I did everything as instructed, but eventually got the screen "no command".
The only thing I did not flash rom - a month ago updated by an OTA to 5.1, thought it was not necessary.
Factory reset does not help.
Advise something.
In the end, everything worked, thank you))

It works
It works great! Thank you very much! ATT xt1058.

eze_cba17 said:
Damn! My phone reboot and stay in the android doll fallen screen.
Click to expand...
Click to collapse
Follow the OP instruction EXACTLY, no exceptions!
If you got your current 5.1 through AT&T OTA, it's not enough for root patching procedure. A full RSD 5.1 official SBF flash over is required.

Could someone please do a video on this. I'm having a little trouble.

Internal-formatted SD card not recognized

My friend got Moto X Play and after update to Marshmallow he formatted his SD card as internal storage. However, without any apparent reason, phone stopped to recognize the card as internal-formatted: after inserting it, in Storage and USB settings section "Checking..." is displayed and followed with "Not inserted". After clicking the card entry it gives option of forgetting encryption key, which I don't want to do - my goal is to recover data from the card which was encrypted by the phone.
I wanted to follow guide below to recover encryption key and decrypt card on the computer, but there is significant problem about it - phone is not rooted and bootloader is locked. I can't unlock the bootloader, cause encryption key would be wiped with the whole data partition.
http://nelenkov.blogspot.com/2015/06/decrypting-android-m-adopted-storage.html
Cause I know C and basics of POSIX programming, I've tried to use Dirty Cow exploit (https://github.com/timwr/CVE-2016-5195) to replace run-as binary with my own, that included low-level POSIX C instructions of copying content of /data/misc/vold to temporary partition from which I could do adb pull to the computer. And indeed, exploit succeeded in replacing binary and after running it from adb shell, run-as process outputs UID 0, which means it's run by root user. However, SELinux is set to enforcing, which apparently doesn't allow me to access /data/misc/vold even by a process with elevated privileges - any attempts of opening the directory in C end with file I/O functions returning error codes.
My question is - is there any method available to our X Play with Marshmallow that allows for at least temporary root so that I can copy encryption keys to the computer? I tried to find another exploit root based on Dirty Cow, but all I found is just proof of concept stuff. I've tried rooting apps like KingRoot or Kingoroot, but they don't manage to get root.
Phone system specifications:
Android version: 6.0.1
Android security patch level: March 2016 - thanks to it it's vulnerable to Dirty Cow, which was fixed in December 2016
System version: 24.61.52.lux_reteu.reteu.en.EU reteu
Build number: MPD24.107-52

Project Treble GSI images on Smart Tab M10 (TB-X605F/L) and P10 (TB-X705F/L)

This thread is for sharing your experiences with Project Treble GSI images on the Lenovo Smart Tabs M10 (TB-X605F/L) & P10 (TB-X705F/L). I'll update this post as more things are discovered.
You can load Android 10 and 11 GSI ROMs on top of Lenovo's stock Pie ROMs.
You can also load Android 10 and 11 GSI ROMs on top of Lenovo's stock Oreo ROMs. There are some graphics glitches when you use the stock Oreo ROMs.
WARNING 1: this procedure will wipe your whole device (including data). So do a backup first.
WARNING 2: this is experimental. If you don't know what you're doing, then you could brick your device. The risk is all yours.
Loading over stock Pie
unlock the bootloader (if not already unlocked)
download Disable_Dm-Verity_ForceEncrypt.zip (created by @Zackptg5). If you want your data partition encrypted, then rename the zip file to Disable_Dm-Verity_enfec.zip. We'll use this to disable dm-verity on boot.
download modify_phh_gsi.sh to your SDcard or OTG device. I wrote this script to by-pass phhusson's read-write mount of /system during boot, which freezes our tablets. The script also runs resize2fs to make the /system filesystem take up the whole /system partition. Don't forget to make this script executable with chmod.
copy those files to your SDCard or OTG device:
Code:
adb push modify_phh_gsi.sh /external_sd/
adb shell chmod a+x /external_sd/modify_phh_gsi.sh
adb push Disable_Dm-Verity_ForceEncrypt.zip /external_sd/
[B]only if you want an encrypted data partition[/B]: adb shell mv /external_sd/Disable_Dm-Verity_ForceEncrypt.zip /external_sd/Disable_Dm-Verity_enfec.zip
load the stock Pie ROM using LMSA rescue mode or QComDLoader
boot the device into fastboot (Power+VolDown)
flash the GSI image: fastboot flash system your_gsi.img (you can install the GSI image in twrp, if you prefer)
flash TWRP (for Pie): fastboot flash recovery pie_twrp.img
boot into twrp (pwr+VolUp+VolDown)
format Data partition
install Disable_Dm-Verity_enfec.zip or Disable_Dm-Verity_ForceEncrypt.zip
run modify_phh_gsi.sh and boot the GSI:
Code:
adb shell /external_sd/modify_phh_gsi.sh
adb reboot
(optional) if your GSI doesn't include Google Apps, then download and install a gapps zip (ARM64) in TWRP. I use "pico", but choose the one that suits you. Do this after running modify_phh_gsi.sh - to avoid running out of space.
reboot to system
Loading over stock Oreo
unlock the bootloader (if not already unlocked)
download and unzip the stock Oreo ROM
load the stock Oreo ROM using QComDLoader, and your device in EDL mode. When it's finished, do not boot into the system. QComDLoader configuration settings:
Code:
Download Mode: Upgrade
Chipset: 8953
eMMC Programmer: prog_emmc_firehose_8953_ddr.mbn
Raw program: rawprogram_unsparse_upgrade.xml
patch0: patch0.xml
boot the device into fastboot (Power+VolDown)
flash the GSI image: fastboot flash system your_gsi.img (you can install the GSI image in twrp, if you prefer)
flash TWRP (for Oreo): fastboot flash recovery oreo_twrp.img
boot into twrp (pwr+VolUp+VolDown)
(optional) if your GSI doesn't include Google Apps, then download and install a gapps zip (ARM64) in TWRP. I use "pico", but choose the one that suits you. OpenGApps isn't officially available for Android 11 yet.
(optional) to get the right pixel density, add "ro.sf.lcd_density=240" to vendor/build.prop. I wrote gsi4tablet.sh to do this for you. Run it in twrp adb shell. Make sure the script is executable (using chmod).
reboot to system
Here are some links to Lenovo's stock Oreo ROMs:
TB-X605F: TB-X605F_USER_S000022_20181026_Q00020_ROW_Bundle
TB-X605L: TB-X605L_USER_S000020_20180921_Q00020_ROW
TB-X705F: TB-X705F_USER_S000017_20180831_Q00020_ROW
TB-X705L: TB-X705L_USER_S000023_20180921_Q00020_ROW
Choosing a GSI image
@phhusson keeps a full list of Project Treble GSI images.
Our devices are all ARM64 A-only. This means that you should only get ARM64 and A-only GSI images. Anything else will not work.
If there is an ARM64 A-only "vndklite" GSI, you can use that.
But do not use AB (or AB vndklite) GSIs, because this tablet is non-System-As-Root (nonSAR).
Note for A11: there is no A-only GSI with vndklite. So just use the A-only GSI.
"This device is not Certified by Google"
If you get this message when you boot the GSI, use ADB and follow instructions under "How to bypass certified device after first boot?".
If you can't find sqlite3 in adb, then install the Device ID app from this XDA article to get the GSF number on your tablet.
"Insufficient storage space available in System partition"
If you get this error message when trying to install GApps, read this post.
What about Android 12 ?
There are no non-SAR A12 GSIs for these tablets, because of the vndk-lite implementation.
If you want to try Android 12, visit this thread about converting the tablet to system-as-root (SAR). It is also experimental.
How do I repartition my tablet?
You might want to do this to increase the size of the system partition. Google it, if you like. But there are no instructions on this thread. No one wants to support noobs who trash their partition tables.
Where do I find... ?
QComDLoader is downloaded during an LMSA rescue. You'll find it in C:\ProgramData\LMSA\Download\ToolFiles\QcomDLoader_1.3.2\QcomDLoader_1.3.2. Alternatively, @Chaser42 has a link and some instructions at the bottom of the first post in this thread.
EDL mode: the easiest ways to enter EDL mode are: adb reboot edl or in TWRP: Reboot->EDL Mode. Alternatively, from a powered-off device: insert USB cable while holding VolUp
TWRP for Oreo for TB-X605F/L.
TWRP for Oreo for TB-X705F/L.
Magisk (for phhusson-based GSI ROMs) lives here.
GApps lives here.
Disable_Dm-Verity lives here.
Last modified: 2 September 2022 (add note about A11 and vndklite)

Since you mentioned me, I've taken a brief look - can you boot ARM64 AB on Pie? On many devices, updating to Pie changes the arch to AB. Note that "A/AB" in GSI is not the same thing as physical partition layout.

AndyYan said:
Since you mentioned me, I've taken a brief look - can you boot ARM64 AB on Pie? On many devices, updating to Pie changes the arch to AB. Note that "A/AB" in GSI is not the same thing as physical partition layout.
Click to expand...
Click to collapse
On stock Pie, Hackintosh5's app reports it's an A-only device supported by VNDK 28 Lite. System properties confirm that.
I just tried to load an AB GSI ROM over Pie. The device boots to qcom diagnostic 900E mode.
So looks like it's definitely A-only on stock Pie. There's just something unusual about the treble implementation on stock Pie.
Loading an A-only GSI over stock Pie just hangs on reboot. It never gets to the boot animation. I've unsuccessfully tried different combinations of permissiver, disable_dm-verity and magisk. No luck.
(There is no vbmeta partition, by the way.)
But thanks for the suggestion about trying AB. It was worth a try.

Yahoo Mike said:
I have successfully loaded @phhusson 's AOSP 10.0 ("Quack") and @AndyYan 's LineageOS 17.x on my TB-X605F.
Click to expand...
Click to collapse
Hi Yahoo Mike,
is the LOS 17 fully functionnal on TB-X605F?
Thanks

Success and Failure
I went through the process above and this worked great. I do have one small problem......
Twrp loads with a black screen and is unusable from the tablet screen in recovery mode. Fortunately this isn't a big deal if you use adb from your pc to control twrp.
2. FLASHING GAPPS
Put the tablet into recovery from adb or through hardbuttons.
open cmd:
adb shell
twrp wipe cache
twrp wipe dalvik
twrp sideload
adb sideload <location_of_your_GApps.zip>, e.g. adb sideload C:\GApps.zip

kmh5147 said:
I went through the process above and this worked great. I do have one big problem and another not so big.
The not so big problem; twrp loads with a black screen and is unusable from the tablet screen in recovery mode. Fortunately this isn't a big deal if you use adb from your pc to control twrp.
The big problem; after loading linos 17 and also ASOP 10, I am unable to run the gapp suite. After installing the gapp suite using twrp on linos 17, linos almost becomes unusable. After installing ASOP with the integrated Gapps, it's also almost not usable upon startup. The problem is with certification of the device, I get millions of messages upon startup after installing the gapp suite or installing a rom with the gapp suite. The message effectively is "This device is not Certified by google"
Click to expand...
Click to collapse
TWRP for Oreo (8.1)
Here's a version of TWRP for Oreo (8.1) for TB-X605F/L. It doesn't mount the data partition, but everything else works. I'll try to fix the data partition next week.
Does anyone have a TWRP for Oreo for TB-X705F/L ?
This device is not Certified by Google
This seems to be a common problem with GSI images.
Use ADB and follow instructions under "How to bypass certified device after first boot?".
Note that the GSF can change whenever you do a factory reset. If it changes, you need to register the new GSF.

Monpseud0 said:
Hi Yahoo Mike,
is the LOS 17 fully functionnal on TB-X605F?
Thanks
Click to expand...
Click to collapse
I don't know if LOS is "fully" functional. I loaded it, but didn't thoroughly test it. Wifi worked.
I've been using Quack and it's stable. Wifi, camera, bluetooth, audio all work. NovaLauncher works fine. Some graphics flicker until they load. I haven't found the right settings under "Phh Treble Settings" to stop that.

kmh5147 said:
I went through the process above and this worked great. I do have one small problem......
Twrp loads with a black screen and is unusable from the tablet screen in recovery mode. Fortunately this isn't a big deal if you use adb from your pc to control twrp.
2. FLASHING GAPPS
Put the tablet into recovery from adb or through hardbuttons.
open cmd:
adb shell
twrp wipe cache
twrp wipe dalvik
twrp sideload
adb sideload <location_of_your_GApps.zip>, e.g. adb sideload C:\GApps.zip
Click to expand...
Click to collapse
I would recommend going with lineage os based on my testing so far. Some apps are a little buggy with flickering, and random minor issues hear and there. I'm thinking we need an updated bootloader, is a newer bootloader available???

Lineage OS 17
I just wanted to give an update with lineage 17, I was able to get passed the issues with the gapps by registering the google services id through their webpage.
Everything thing seems to work very well...... wifi, audio, and both front and rear camera work perfectly. The only problem I am still dealing with is flickering in overlay situations, and nothing I've tried from a developer settings perspective fixes the issue. If the flickering can be fixed, I think we'll have a really good option here.
One other thing I wish I could get working in this lineage OS is the google assistant ambient mode. I can't get the option to show up in the assistant settings. Have ambient mode on this tablet would be perfect with the original alex cradle.

kmh5147 said:
I'm thinking we need an updated bootloader, is a newer bootloader available???
Click to expand...
Click to collapse
I think we're stuck with this bootloader until we can work out how to load GSI over stock Pie.
kmh5147 said:
The only problem I am still dealing with is flickering in overlay situations, and nothing I've tried from a developer settings perspective fixes the issue. If the flickering can be fixed, I think we'll have a really good option here.
Click to expand...
Click to collapse
I'll have a look at the overlays on the weekend. Maybe that will fix our problems.
Which device do you have? They might all need slightly different overlays.

I tried HavocOS (2020-07-09) with GApps. It booted and was pretty smooth, but I couldn't enable root or adb. Might need to wait for the next release.
It also insisted on face unlock, which was annoying.

Here's a guide on how to fix the "Insufficient storage space available in System partition" when you try to install GApps.
solution
In TWRP:
press "Mount"
untick "Mount system partition read-only", then tick "System".
go back to main menu and select "Wipe". Don't panic. We're not going to delete any files from the system.
select "Advanced Wipe"
tick "System" and select "Repair or Change File System"
select "Resize File System". If that button is not there, then you mounted the system partition as read-only. Go back and untick that.
confirm that TWRP is asking "Resize System?" and then swipe to resize
now you can go back to main menu and install GApps
why does this happen?
The system partition is roughly 3GB in these devices. However, after flashing a GSI image, the filesystem size can be considerably less.
For example:
Code:
X605F:/ # df -H
Filesystem Size Used Avail Use% Mounted on
rootfs 1.3G 26M 1.3G 2% /
tmpfs 1.4G 188k 1.4G 1% /dev
tmpfs 1.4G 25k 1.4G 1% /tmp
/dev/block/mmcblk0p26 260M 172k 260M 1% /cache
/dev/block/mmcblk0p52 25G 46M 25G 1% /data
/dev/block/mmcblk1p1 128G 24G 104G 19% /external_sd
/dev/block/mmcblk0p24 1.9G 1.8G 60M 97% /system
X605F:/ # blockdev --getsize64 /dev/block/mmcblk0p24
3221225472
In this example, the partition size of /system is about 3.2GB (3221225472), but the filesystem size is 1.9GB with only 60M free. Because there's only 60M free, GApps fails with the message "Insufficient storage space available in System partition".
The solution is to resize the filesystem to include the unused 1.3GB on the partition. That's what TWRP does in the solution above.
Here's our example filesystem after following the steps above:
Code:
X605F:/ # df -H
Filesystem Size Used Avail Use% Mounted on
rootfs 1.3G 26M 1.3G 2% /
tmpfs 1.4G 188k 1.4G 1% /dev
tmpfs 1.4G 45k 1.4G 1% /tmp
/dev/block/mmcblk0p52 25G 46M 25G 1% /data
/dev/block/mmcblk1p1 128G 24G 104G 19% /external_sd
/dev/block/mmcblk0p24 3.2G 1.8G 1.3G 59% /system
There's now 1.3GB free on the filesystem because it's been resized to fill up the whole partition. TWRP saves the day (again) ... and GApps is happy!

Yahoo Mike said:
I think we're stuck with this bootloader until we can work out how to load GSI over stock Pie.
I'll have a look at the overlays on the weekend. Maybe that will fix our problems.
Which device do you have? They might all need slightly different overlays.
Click to expand...
Click to collapse
Hi Mike, I have the TB-X605F and its hardware version is 60.
Thank you for all of the effort in making this thing work!

I was also able to install AOSP 10.0 Quack on my TB-X705F using your guide. Thanks so much! Didn't install TWRP yet as I don't know if it supports Oreo. With regard to that, i'm assuming it refers to the vendor rather than the rom we're running, correct?
I did encounter a little bit of flickering for some graphics. It's very intermittent. Seems like it affects dark grays more than anything. Most everything works fine. Will try some others and report back.

Yahoo Mike said:
I tried HavocOS (2020-07-09) with GApps. It booted and was pretty smooth, but I couldn't enable root or adb. Might need to wait for the next release.
It also insisted on face unlock, which was annoying.
Click to expand...
Click to collapse
What 'smallest width' are you putting in the developer option. The standard DPI settings are for a phone i'm assuming because everything is huge lol. So far I feel like 600 & 790 are good settings depending on how large you want things.
---------- Post added at 07:29 PM ---------- Previous post was at 06:59 PM ----------
Running the July Build of Descendant X and so far its pretty awesome. I've noticed that the flickering seems to be limited to Google Applications. For instance if you scroll through the Play Store.

Mr. Jedge said:
...Didn't install TWRP yet as I don't know if it supports Oreo. With regard to that, i'm assuming it refers to the vendor rather than the rom we're running, correct?
Click to expand...
Click to collapse
That's correct. TWRP needs to be compiled with a kernel from a stock Oreo boot.img.
The TWRP for Pie seems to be incompatible with the stock Oreo vendor/firmware/bootloader we have to load before flashing a GSI. TWRP is functional, but the screen is blank. That's fixed by compiling TWRP for 8.1 with the stock Oreo kernel.
But you might want to try the X705 TWRP (for Pie). You might get lucky and it works.

Yahoo Mike said:
I think we're stuck with this bootloader until we can work out how to load GSI over stock Pie.
I'll have a look at the overlays on the weekend. Maybe that will fix our problems.
Which device do you have? They might all need slightly different overlays.
Click to expand...
Click to collapse
Do you think the flickering is an overlay issue, or an issue with the vendor? I was going to try flashing a different Oreo build to check, but it looks like there are no full images other than the original; only OTAs.

Mr. Jedge said:
Do you think the flickering is an overlay issue, or an issue with the vendor?
Click to expand...
Click to collapse
I built and installed a vendor overlay, but it didn't fix the flickering. I'm not really sure it did anything.
I started playing with the "smallest width" parameter you found. On stock Oreo it's set to 800dp. When I used 800dp on the GSI, most (but not all) of the flickering stopped. At 600dp, the flickering started again.
The "smallest width" also seems to affect calculations for the keyboard display. For some dp settings, the input dialog box is not drawn. It's there, but it's just not rendered. You can test it with the "smallest width" option. When you change the dp, just tap the option again. With some dp settings (like 700dp), the input text box is "invisible". You can use the keyboard to change the dp, but your input is not displayed while you are typing. Set it back to 800dp, tap on the option again and the input box is there.
While 800dp stops most of the flickering in PlayStore, the drawer (swipe from the left) writes over the whole screen.
843dp fixes the drawer problem, but does weird things to the soft buttons (back/home/recent).
840dp fixes soft buttons but the drawer problem returns.
And to make it even more complicated, portrait mode seems to prefer different dps. 721dp worked ok in portrait, but not in landscape.
It's going to be a matter of finding the sweet spot. Or perhaps there's a second setting that also needs to be changed at the same time ???
Anyway, give it a try.

New discovery. I downloaded a DPI changer to use instead if the smallest width option. Changing the DPI didn't yeild any difference in reference to flickering, but changing the resolution did. Default resolution is 1200 x 1920 which matches Lenovos specs. However I lowered it to 1180 x 1900 and the flickering has gone away completely....at least in the play store. Haven't noticed it anywhere else. The drawer blanks out the rest of the store however which is weird but acceptable. I'll keep playing around, but it's time to go-to bed.

Mr. Jedge said:
New discovery. I downloaded a DPI changer to use instead if the smallest width option. Changing the DPI didn't yeild any difference in reference to flickering, but changing the resolution did. Default resolution is 1200 x 1920 which matches Lenovos specs. However I lowered it to 1180 x 1900 and the flickering has gone away completely....at least in the play store. Haven't noticed it anywhere else. The drawer blanks out the rest of the store however which is weird but acceptable. I'll keep playing around, but it's time to go-to bed.
Click to expand...
Click to collapse
Interesting.
Only thing I can add is that if you add the following to /vendor/build.prop you don't get that big font during configuration when you install a GSI.
Code:
ro.sf.lcd_density=240
In stock that is set in /system/build.prop.
Most of the GSI images assume lcd_density of 480 (xxhdpi) for mobiles, but our tablets are 240 (hdpi).